From 442c0a9a00c2154f0b1d7a3d1c9143964c3cb569 Mon Sep 17 00:00:00 2001 From: Felix Hamann Date: Sun, 8 Jul 2018 18:37:57 +0200 Subject: [PATCH 01/12] show-hide-settings now persistant --- templates/standalone/showHide.julius | 50 ++++++++++++++++++---------- templates/widgets/asidenav.hamlet | 2 +- 2 files changed, 34 insertions(+), 18 deletions(-) diff --git a/templates/standalone/showHide.julius b/templates/standalone/showHide.julius index 40ae6b711..09b3c3e2e 100644 --- a/templates/standalone/showHide.julius +++ b/templates/standalone/showHide.julius @@ -8,29 +8,45 @@ document.addEventListener('DOMContentLoaded', function() { - var elements = Array.from(document.querySelectorAll('.js-show-hide__toggle')), - toggles = []; + var LSNAME = 'SHOW_HIDE'; function addEventHandler(el) { el.addEventListener('click', function elClickListener() { - var toggle = toggles[el.dataset.index]; - toggle.collapsed = !toggle.collapsed; - toggle.parent.classList.toggle('js-show-hide--collapsed', toggle.collapsed); + var newState = el.parentElement.classList.toggle('js-show-hide--collapsed'); + updateLSState(el.dataset.shIndex || null, newState); }); } - elements.forEach(function(el, i) { - el.dataset.index = i; - var coll = el.dataset.collapsed === 'true'; - if (coll) { - el.parentElement.classList.add('js-show-hide--collapsed') + function updateLSState(index, state) { + if (!index) { + return false; } - Array.from(el.parentElement.children).forEach(function(el) { - if (!el.classList.contains('js-show-hide__toggle')) { - el.classList.add('js-show-hide__target'); - } - }); - toggles.push({index: i, collapsed: coll, parent: el.parentElement}); - addEventHandler(el); + var lsData = fromLocalStorage(); + lsData[index] = state; + window.localStorage.setItem(LSNAME, JSON.stringify(lsData)); + } + + function collapsedStateInLocalStorage(index) { + return fromLocalStorage()[index] || null; + } + + function fromLocalStorage() { + return JSON.parse(window.localStorage.getItem(LSNAME)) || {}; + } + + Array + .from(document.querySelectorAll('.js-show-hide__toggle')) + .forEach(function(el) { + var index = el.dataset.shIndex || null; + el.parentElement.classList.toggle( + 'js-show-hide--collapsed', + collapsedStateInLocalStorage(index) || el.dataset.collapsed === 'true' + ); + Array.from(el.parentElement.children).forEach(function(el) { + if (!el.classList.contains('js-show-hide__toggle')) { + el.classList.add('js-show-hide__target'); + } + }); + addEventHandler(el); }); }); diff --git a/templates/widgets/asidenav.hamlet b/templates/widgets/asidenav.hamlet index 0f4fff888..69ab002b3 100644 --- a/templates/widgets/asidenav.hamlet +++ b/templates/widgets/asidenav.hamlet @@ -3,7 +3,7 @@ $newline never
$forall tid@TermIdentifier{..} <- favouriteTerms
-

+

$case season $of Winter _{MsgWinterTermShort year} From a02e2cdc98807d019b40556e9450ca6551c00bc4 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sun, 8 Jul 2018 20:12:07 +0200 Subject: [PATCH 02/12] Prevent admins elevating rights to more schools by session-hijacking --- models | 1 + src/Handler/Users.hs | 11 ++++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/models b/models index 90b554663..909a72610 100644 --- a/models +++ b/models @@ -12,6 +12,7 @@ User json UserAdmin user UserId school SchoolId + UniqueUserAdmin user school UserLecturer user UserId school SchoolId diff --git a/src/Handler/Users.hs b/src/Handler/Users.hs index ba2ad0022..48010f33c 100644 --- a/src/Handler/Users.hs +++ b/src/Handler/Users.hs @@ -13,6 +13,7 @@ import Import import Handler.Utils import qualified Data.Map as Map +import qualified Data.Set as Set import qualified Database.Esqueleto as E @@ -95,7 +96,15 @@ postAdminHijackUserR cID = do case hijackRes of FormSuccess uid' | uid' == uid -> do - User{..} <- runDB $ get404 uid + myUid <- requireAuthId + User{..} <- runDB $ do + otherSchoolsAdmin <- Set.fromList . map (userAdminSchool . entityVal) <$> selectList [UserAdminUser ==. uid] [] + otherSchoolsLecturer <- Set.fromList . map (userLecturerSchool . entityVal) <$> selectList [UserLecturerUser ==. uid] [] + mySchools <- Set.fromList . map (userAdminSchool . entityVal) <$> selectList [UserAdminUser ==. myUid] [] + when (not $ (otherSchoolsAdmin `Set.union` otherSchoolsLecturer) `Set.isSubsetOf` mySchools) $ + permissionDenied "Cannot escalate admin status to additional schools" + + get404 uid setCredsRedirect $ Creds "dummy" (userPlugin <> ":" <> userIdent) [] | otherwise -> error "This should be impossible by definition of `hijackUserForm`" FormFailure errs -> toTypedContent <$> mapM_ (addMessage "error" . toHtml) errs From 61404a4c0c52c15ff06534b145f6bd702bb2f3ad Mon Sep 17 00:00:00 2001 From: Felix Hamann Date: Sun, 8 Jul 2018 20:29:36 +0200 Subject: [PATCH 03/12] asidenav-cleanup and show-hide-classes --- templates/adminTest.hamlet | 4 ++-- templates/widgets/asidenav.hamlet | 4 ++-- templates/widgets/asidenav.julius | 9 --------- 3 files changed, 4 insertions(+), 13 deletions(-) diff --git a/templates/adminTest.hamlet b/templates/adminTest.hamlet index 394729cd0..6afe2d43d 100644 --- a/templates/adminTest.hamlet +++ b/templates/adminTest.hamlet @@ -8,10 +8,10 @@ Der Handler sollte jeweils aktuelle Beispiele für alle möglichen Funktionalitäten enthalten, so dass man immer weiß, wo man nachschlagen kann. -
+

Teilweise funktionierende Abschnitte -