Changeset 470

Timestamp:

10/03/09 14:40:52 (15 years ago)

Author:

nanardon

Message:

• think to check groups in acl tracking

File:

• LATMOS-Accounts/lib/LATMOS/Accounts/Bases.pm (modified) (2 diffs)

LATMOS-Accounts/lib/LATMOS/Accounts/Bases.pm

@@ -449 +449 @@
     if ($auth) {
         $self->{_user} = $username;
+        la_log(LA_DEBUG, "Connect as $username");
     }
     return $auth;
@@ -456 +457 @@
     my ($self, $obj, $attr, $perm) = @_;
     if ($self->{_acls}) {
-        my $who = $self->{_users} || '';
-        my $groups;
-        return $self->{_acls}->check($obj, $attr, $perm, $who, $groups);
+        my ($who, $groups) = ($self->{_user} || '');
+        if ($who && (my $uo = $self->get_object('user', $who))) {
+            $groups = [ $uo->_get_attributes('memberOf') ];
+        } else {
+            $who = '';
+        }
+        my $res = $self->{_acls}->check($obj, $attr, $perm, $who, $groups);
+        $self->log(LA_NOTICE, 'permission denied for "%s" to get %s.%s for %s',
+           $who, $obj, $attr, $perm) if (!$res);
+        return $res;
     } else {
         # No acls, woot