Changeset 413 for trunk/packages/sipb-xen-www/code/getafsgroups.py

Timestamp:

Apr 14, 2008, 12:44:00 AM (16 years ago)

Author:

ecprice

Message:

Resolve #69, by checking that administrators are either users or
groups in the athena cell.

File:

• trunk/packages/sipb-xen-www/code/getafsgroups.py (modified) (4 diffs)

trunk/packages/sipb-xen-www/code/getafsgroups.py

@@ -29 +29 @@
 
 def getAfsGroupMembers(group, cell):
-    p = subprocess.Popen(["pts", "membership", group, '-c', cell], 
+    p = subprocess.Popen(["pts", "membership", "-noauth", group, '-c', cell], 
                          stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    if p.wait():
-        return []
+    err = p.stderr.read()
+    if err: #Error code doesn't reveal missing groups, but stderr does
+        raise AfsProcessError(err)
     return [line.strip() for line in p.stdout.readlines()[1:]]
 
@@ -39 +40 @@
         raise AfsProcessError("Locker '%s' is invalid." % locker)
     return '/mit/' + locker
-
-def checkAfsGroup(user, group, cell):
-    """
-    checkAfsGroup(user, group) returns True if and only if user is in AFS group group in cell cell
-    """
-    return user in getAfsGroupMembers(group, cell)
 
 def getCell(locker):
@@ -82 +77 @@
 
     for entry in values:
-        if entry == user or (entry[0:6] == "system" and 
-                                checkAfsGroup(user, entry, cell)):
+        if entry == user or (entry[0:6] == "system" and
+                                user in getAfsGroupMembers(entry, cell)):
             return False
     return "You don't have admin bits on " + getLockerPath(locker)
@@ -90 +85 @@
 if __name__ == "__main__":
 #    print list(getldapgroups("tabbott"))
-    print checkAfsGroup("tabbott", "system:debathena", 'athena.mit.edu')
-    print checkAfsGroup("tabbott", "system:debathena", 'sipb.mit.edu')
-    print checkAfsGroup("tabbott", "system:debathena-root", 'athena.mit.edu')
-    print checkAfsGroup("tabbott", "system:hmmt-request", 'athena.mit.edu')
+    print "tabbott" in getAfsGroupMembers("system:debathena", 'athena.mit.edu')
+    print "tabbott" in getAfsGroupMembers("system:debathena", 'sipb.mit.edu')
+    print "tabbott" in getAfsGroupMembers("system:debathena-root", 'athena.mit.edu')
+    print "tabbott" in getAfsGroupMembers("system:hmmt-request", 'athena.mit.edu')
     print notLockerOwner("tabbott", "tabbott")
     print notLockerOwner("tabbott", "debathena")