wisest owl (wisest_owl) wrote in changelog,
wisest owl
wisest_owl
changelog

[livejournal] r17965: LJSUP-7649. Remove all call "LJ::can_man...

Committer: gprochaev
LJSUP-7649. Remove all call "LJ::can_manage"

U   trunk/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm
U   trunk/cgi-bin/Apache/LiveJournal/Interface/S2.pm
U   trunk/cgi-bin/LJ/Comment.pm
U   trunk/cgi-bin/LJ/Console/Command/BanList.pm
U   trunk/cgi-bin/LJ/Console/Command/BanSet.pm
U   trunk/cgi-bin/LJ/Console/Command/BanUnset.pm
U   trunk/cgi-bin/LJ/Console/Command/Community.pm
U   trunk/cgi-bin/LJ/Console/Command/Set.pm
U   trunk/cgi-bin/LJ/Console/Command/Shared.pm
U   trunk/cgi-bin/LJ/Console/Command/TagDisplay.pm
U   trunk/cgi-bin/LJ/Console/Command/TagPermissions.pm
U   trunk/cgi-bin/LJ/Entry.pm
U   trunk/cgi-bin/LJ/Event/JournalNewComment.pm
U   trunk/cgi-bin/LJ/S2/DayPage.pm
U   trunk/cgi-bin/LJ/S2/EntryPage.pm
U   trunk/cgi-bin/LJ/S2/FriendsPage.pm
U   trunk/cgi-bin/LJ/S2/MonthPage.pm
U   trunk/cgi-bin/LJ/S2/RecentPage.pm
U   trunk/cgi-bin/LJ/S2.pm
U   trunk/cgi-bin/LJ/Talk.pm
U   trunk/cgi-bin/LJ/User.pm
U   trunk/cgi-bin/ljlib.pl
U   trunk/cgi-bin/ljtodo.pl
U   trunk/cgi-bin/ljviews.pl
U   trunk/cgi-bin/taglib.pl
U   trunk/htdocs/allpics.bml
U   trunk/htdocs/community/create.bml
U   trunk/htdocs/community/pending.bml
U   trunk/htdocs/customize/advanced/layerbrowse.bml
U   trunk/htdocs/customize/advanced/layeredit.bml
U   trunk/htdocs/customize/advanced/layersource.bml
U   trunk/htdocs/delcomment.bml
U   trunk/htdocs/manage/subscriptions/user.bml
U   trunk/htdocs/styles/browse/links.bml
U   trunk/htdocs/styles/browse/styleinfo.bml
U   trunk/htdocs/talkread.bml
U   trunk/htdocs/tools/endpoints/get_thread.bml
Modified: trunk/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm
===================================================================
--- trunk/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -650,7 +650,7 @@
     # we've authenticated successfully and remote is set. But can remote
     # manage the requested account?
     my $remote = LJ::get_remote();
-    unless (LJ::can_manage($remote, $u)) {
+    unless ($remote && $remote->can_manage($u)) {
         return respond(403, "User <b>$remote->{'user'}</b> has no administrative access to account <b>$u->{user}</b>.");
     }
 

Modified: trunk/cgi-bin/Apache/LiveJournal/Interface/S2.pm
===================================================================
--- trunk/cgi-bin/Apache/LiveJournal/Interface/S2.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/Apache/LiveJournal/Interface/S2.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -46,7 +46,7 @@
     if ($meth eq 'GET') {
 
         return error(403, "Forbidden", "You are not authorized to retrieve this layer")
-            unless $lu->{'user'} eq 'system' || LJ::can_manage($u, $lu);
+            unless $lu->{'user'} eq 'system' || ($u && $u->can_manage($lu));
 
         my $layerinfo = {};
         LJ::S2::load_layer_info($layerinfo, [ $id ]);
@@ -66,7 +66,7 @@
     elsif ($meth eq 'PUT') {
 
         return error(403, "Forbidden", "You are not authorized to edit this layer")
-            unless LJ::can_manage($u, $lu);
+            unless $u && $u->can_manage($lu);
 
         return error(403, "Forbidden", "Your account type is not allowed to edit layers")
             unless LJ::get_cap($u, "s2styles");

Modified: trunk/cgi-bin/LJ/Comment.pm
===================================================================
--- trunk/cgi-bin/LJ/Comment.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Comment.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -873,7 +873,7 @@
 
     # screened comment
     return 0 if $self->is_screened &&
-                !( LJ::can_manage($u, $self->journal)           # owns the journal
+                !( ($u && $u->can_manage($self->journal))           # owns the journal
                    || LJ::u_equals($u, $self->poster)           # posted the comment
                    || LJ::u_equals($u, $self->entry->poster )); # posted the entry
 
@@ -1040,7 +1040,7 @@
     my $remote = LJ::get_remote() or return;
 
     my %LJ_cmtinfo;
-    $LJ_cmtinfo{'canAdmin'} = LJ::can_manage($remote, $self->journal);
+    $LJ_cmtinfo{'canAdmin'} = $remote->can_manage($self->journal);
     $LJ_cmtinfo{'journal'} = $self->journal->{user};
     $LJ_cmtinfo{'remote'} = $remote->{user};
 

Modified: trunk/cgi-bin/LJ/Console/Command/BanList.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/BanList.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/BanList.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -35,7 +35,7 @@
             unless $journal;
 
         return $self->error("You are not a maintainer of this account")
-            unless LJ::can_manage($remote, $journal) || LJ::check_priv($remote, "finduser");
+            unless ($remote && $remote->can_manage($journal)) || LJ::check_priv($remote, "finduser");
     }
 
     my $banids = LJ::load_rel_user($journal, 'B') || [];

Modified: trunk/cgi-bin/LJ/Console/Command/BanSet.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/BanSet.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/BanSet.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -35,7 +35,7 @@
             unless $journal;
 
         return $self->error("You are not a maintainer of this account")
-            unless LJ::can_manage($remote, $journal);
+            unless $remote && $remote->can_manage($journal);
     }
 
     my $banuser = LJ::load_user($user);

Modified: trunk/cgi-bin/LJ/Console/Command/BanUnset.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/BanUnset.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/BanUnset.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -35,7 +35,7 @@
             unless $journal;
 
         return $self->error("You are not a maintainer of this account")
-            unless LJ::can_manage($remote, $journal);
+            unless $remote && $remote->can_manage($journal);
     }
 
     my $banuser = LJ::load_user($user);

Modified: trunk/cgi-bin/LJ/Console/Command/Community.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/Community.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/Community.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -40,7 +40,7 @@
     return $self->error("Unknown user: $user")
         unless $target;
 
-    my $can_add = LJ::can_manage($remote, $comm) || LJ::check_priv($remote, "sharedjournal", "*");
+    my $can_add = ($remote && $remote->can_manage($comm)) || LJ::check_priv($remote, "sharedjournal", "*");
     my $can_remove = $can_add || LJ::u_equals($remote, $target);
 
     return $self->error("You cannot add users to this community.")

Modified: trunk/cgi-bin/LJ/Console/Command/Set.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/Set.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/Set.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -39,7 +39,7 @@
         return $self->error("Invalid account: $name")
             unless $journal;
         return $self->error("You are not permitted to change this journal's settings.")
-            unless LJ::can_manage($remote, $journal) || LJ::check_priv($remote, "siteadmin", "propedit");
+            unless ($remote && $remote->can_manage($journal)) || LJ::check_priv($remote, "siteadmin", "propedit");
     }
 
     my ($key, $value) = @args;

Modified: trunk/cgi-bin/LJ/Console/Command/Shared.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/Shared.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/Shared.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -35,7 +35,7 @@
 
     my $remote = LJ::get_remote();
     return $self->error("You don't have access to manage this shared journal.")
-        unless LJ::can_manage($remote, $shared) || LJ::check_priv($remote, "sharedjournal", "*");
+        unless ($remote && $remote->can_manage($shared)) || LJ::check_priv($remote, "sharedjournal", "*");
 
     if ($action eq "add") {
         return $self->error("User $target_user already has posting access to this shared journal.")

Modified: trunk/cgi-bin/LJ/Console/Command/TagDisplay.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/TagDisplay.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/TagDisplay.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -40,7 +40,7 @@
             unless $foru;
 
         return $self->error("You cannot change tag display settings for $args[1]")
-            unless LJ::can_manage($remote, $foru);
+            unless $remote && $remote->can_manage($foru);
 
         ($tag, $val) = ($args[2], $args[3]);
     } else {

Modified: trunk/cgi-bin/LJ/Console/Command/TagPermissions.pm
===================================================================
--- trunk/cgi-bin/LJ/Console/Command/TagPermissions.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Console/Command/TagPermissions.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -40,7 +40,7 @@
             unless $foru;
 
         return $self->error("You cannot change tag permission settings for $args[1]")
-            unless LJ::can_manage($remote, $foru);
+            unless $remote && $remote->can_manage($foru);
 
         ($add, $control) = ($args[2], $args[3]);
     } else {

Modified: trunk/cgi-bin/LJ/Entry.pm
===================================================================
--- trunk/cgi-bin/LJ/Entry.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Entry.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -868,7 +868,7 @@
     return
         $remote->{userid} == $u->{userid} ||
         $remote->{userid} == $self->posterid ||
-        LJ::can_manage($remote, $u);
+        $remote->can_manage($u);
 }
 
 # instance method:  returns bool, if remote user can view this entry

Modified: trunk/cgi-bin/LJ/Event/JournalNewComment.pm
===================================================================
--- trunk/cgi-bin/LJ/Event/JournalNewComment.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Event/JournalNewComment.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -621,7 +621,7 @@
 
     # user can track all comments to their community journal, provided
     # that the community is paid
-    if (LJ::can_manage($u, $journal)) {
+    if ($u && $u->can_manage($journal)) {
         return $journal->get_cap('maintainer_track_comments') ? 1 : 0;
     }
 

Modified: trunk/cgi-bin/LJ/S2/DayPage.pm
===================================================================
--- trunk/cgi-bin/LJ/S2/DayPage.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2/DayPage.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -177,7 +177,7 @@
             'enabled' => $entry_obj->comments_shown,
             'locked' => !$entry_obj->posting_comments_allowed,
             'screened' => ($logprops{$itemid}->{'hasscreened'} && $remote &&
-                           ($remote->{'user'} eq $u->{'user'} || LJ::can_manage($remote, $u))) ? 1 : 0,
+                           ($remote->{'user'} eq $u->{'user'} || $remote->can_manage($u))) ? 1 : 0,
         });
         $comments->{show_postlink} = $entry_obj->posting_comments_allowed;
         $comments->{show_readlink} = $entry_obj->comments_shown && ($replycount || $comments->{'screened'});

Modified: trunk/cgi-bin/LJ/S2/EntryPage.pm
===================================================================
--- trunk/cgi-bin/LJ/S2/EntryPage.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2/EntryPage.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -270,7 +270,7 @@
             $s2com->{'metadata'}->{'poster_ip'} = $com->{'props'}->{'poster_ip'} if
                 ($com->{'props'}->{'poster_ip'} && $remote &&
                  ($remote->{'userid'} == $entry->posterid ||
-                  LJ::can_manage($remote, $u) || $viewall));
+                  ($remote && $remote->can_manage($u)) || $viewall));
 
             push @$destlist, $s2com;
 
@@ -293,7 +293,7 @@
 
     # print comment info
     {
-        my $canAdmin = LJ::can_manage($remote, $u) ? 1 : 0;
+        my $canAdmin = ($remote && $remote->can_manage($u)) ? 1 : 0;
         my $formauth = LJ::ejs(LJ::eurl(LJ::form_auth(1)));
 
         my $cmtinfo = {
@@ -466,7 +466,7 @@
         'enabled' => $entry->comments_shown,
         'locked' => !$entry->posting_comments_allowed,
         'screened' => ($entry->prop("hasscreened") && $remote &&
-                       ($remote->{'user'} eq $u->{'user'} || LJ::can_manage($remote, $u))) ? 1 : 0,
+                       ($remote->{'user'} eq $u->{'user'} || $remote->can_manage($u))) ? 1 : 0,
     });
     $comments->{show_postlink} = $entry->posting_comments_allowed;
     $comments->{show_readlink} = $entry->comments_shown && ($replycount || $comments->{'screened'});

Modified: trunk/cgi-bin/LJ/S2/FriendsPage.pm
===================================================================
--- trunk/cgi-bin/LJ/S2/FriendsPage.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2/FriendsPage.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -314,7 +314,7 @@
             'enabled' => $eobj->comments_shown,
             'locked' => !$eobj->posting_comments_allowed,
             'screened' => ($logprops{$datakey}->{'hasscreened'} && $remote &&
-                           ($remote->{'user'} eq $fr->{'user'} || LJ::can_manage($remote, $fr))) ? 1 : 0,
+                           ($remote->{'user'} eq $fr->{'user'} || $remote->can_manage($fr))) ? 1 : 0,
         });
         $comments->{show_postlink} = $eobj->posting_comments_allowed;
         $comments->{show_readlink} = $eobj->comments_shown && ($replycount || $comments->{'screened'});

Modified: trunk/cgi-bin/LJ/S2/MonthPage.pm
===================================================================
--- trunk/cgi-bin/LJ/S2/MonthPage.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2/MonthPage.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -151,7 +151,7 @@
             'enabled' => $entry_obj->comments_shown,
             'locked' => !$entry_obj->posting_comments_allowed,
             'screened' => ($logprops{$itemid}->{'hasscreened'} && $remote &&
-                           ($remote->{'user'} eq $u->{'user'} || LJ::can_manage($remote, $u))) ? 1 : 0,
+                           ($remote->{'user'} eq $u->{'user'} || $remote->can_manage($u))) ? 1 : 0,
         });
 
         my $userlite_poster = $userlite_journal;

Modified: trunk/cgi-bin/LJ/S2/RecentPage.pm
===================================================================
--- trunk/cgi-bin/LJ/S2/RecentPage.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2/RecentPage.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -208,7 +208,7 @@
         $readurl .= "?$nc" if $nc;
         my $posturl = $permalink . "?mode=reply";
 
-        my $has_screened = ($logprops{$itemid}->{'hasscreened'} && LJ::can_manage($remote, $u)) ? 1 : 0;
+        my $has_screened = ($logprops{$itemid}->{'hasscreened'} && $remote && $remote->can_manage($u)) ? 1 : 0;
 
         my $comments = CommentInfo({
             'read_url' => $readurl,

Modified: trunk/cgi-bin/LJ/S2.pm
===================================================================
--- trunk/cgi-bin/LJ/S2.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/S2.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -3634,9 +3634,11 @@
     my $entry = LJ::Entry->new($journalu, ditemid => $this->{itemid});
 
     if ($key eq "edit_entry") {
-        return $null_link unless $remote && ($remote->{'user'} eq $journal ||
-                                        $remote->{'user'} eq $poster ||
-                                        LJ::can_manage($remote, LJ::load_user($journal)));
+        return $null_link unless $remote && 
+                                    ($remote->{'user'} eq $journal ||
+                                     $remote->{'user'} eq $poster ||
+                                     $remote->can_manage(LJ::load_user($journal))
+                                    );
         return LJ::S2::Link("$LJ::SITEROOT/editjournal.bml?journal=$journal&amp;itemid=$this->{'itemid'}",
                             $ctx->[S2::PROPS]->{"text_edit_entry"},
                             LJ::S2::Image("$LJ::IMGPREFIX/btn_edit.gif", 24, 24));

Modified: trunk/cgi-bin/LJ/Talk.pm
===================================================================
--- trunk/cgi-bin/LJ/Talk.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/Talk.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -133,7 +133,7 @@
     # edit entry - if we have a remote, and that person can manage
     # the account in question, OR, they posted the entry, and have
     # access to the community in question
-    if (defined $remote && (LJ::can_manage($remote, $u) ||
+    if (defined $remote && ($remote && $remote->can_manage($u) ||
                             (LJ::u_equals($remote, $up) && LJ::can_use_journal($up->{userid}, $u->{user}, {}))))
     {
         push @linkele, $mlink->("$LJ::SITEROOT/editjournal.bml?${jargent}itemid=$itemid", "editentry");
@@ -339,7 +339,7 @@
     return 1 if $remote->{'user'} eq $userpost ||
                 $remote->{'user'} eq (ref $u ? $u->{'user'} : $u) ||
                 $remote->{'user'} eq (ref $up ? $up->{'user'} : $up) ||
-                LJ::can_manage($remote, $u);
+                $remote->can_manage($u);
     return 0;
 }
 
@@ -348,7 +348,7 @@
     return 0 unless $remote;
     return 1 if $remote->{'user'} eq $u->{'user'} ||
                 $remote->{'user'} eq (ref $up ? $up->{'user'} : $up) ||
-                LJ::can_manage($remote, $u);
+                $remote->can_manage($u);
     return 0;
 }
 
@@ -1135,7 +1135,7 @@
                     $post->{'state'} eq "S" && ! ($remote && ($remote->{'userid'} == $u->{'userid'} ||
                                                               $remote->{'userid'} == $uposterid ||
                                                               $remote->{'userid'} == $post->{'posterid'} ||
-                                                              LJ::can_manage($remote, $u) ));
+                                                              $remote->can_manage($u) ));
             }
             $post->{'_show'} = $should_show;
             $post_count += $should_show;
@@ -2369,7 +2369,7 @@
                 $text .= "<br />$user\n";
                 $text .= "<br /><font size='-1'>$datepost</font>\n";
                 if ($post->{'props'}->{'poster_ip'} &&
-                    $remote && ($remote->{'user'} eq $up->{'user'} || LJ::can_manage($remote, $u) || $viewall))
+                    $remote && ($remote->{'user'} eq $up->{'user'} || $remote->can_manage($u) || $viewall))
                 {
                     $text .= BML::ml('.fromip', { 'ip' => $post->{'props'}->{'poster_ip'} });
                 }

Modified: trunk/cgi-bin/LJ/User.pm
===================================================================
--- trunk/cgi-bin/LJ/User.pm	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/LJ/User.pm	2010-12-17 10:11:19 UTC (rev 17965)
@@ -5166,9 +5166,31 @@
     return $u->show_graphic_previews eq "on" ? 1 : 0;
 }
 
+# name: can_manage
+# des: Given a target user and determines that the user is an admin for the taget  user
+# returns: bool: true if authorized, otherwise fail
+# args: u
+# des-u: user object or userid of target user
 sub can_manage {
-    my ($u, $target) = @_;
-    return LJ::can_manage($u, $target);
+    my $remote  = shift;
+    my $u       = LJ::want_user(shift);
+
+    return undef unless $remote && $u;
+
+    # is same user?
+    return 1 if LJ::u_equals($u, $remote);
+
+    # do not allow suspended users manage other accounts
+    return 0 if $remote->is_suspended;
+
+    # people/syn/rename accounts can only be managed by the one account
+    return undef if $u->{journaltype} =~ /^[PYR]$/;
+
+    # check for admin access
+    return undef unless LJ::check_rel($u, $remote, 'A');
+
+    # passed checks, return true
+    return 1;
 }
 
 sub hide_adult_content {
@@ -5884,6 +5906,7 @@
 # args: u, opts?
 # des-opts: Optional hashref.  keys are:
 #           - type: 'P' to only return users of journaltype 'P'.
+#                   'S' return users of Supermaintainer type instead Maintainer type.
 #           - cap:  cap to filter users on.
 # </LJFUNC>
 sub get_authas_list {
@@ -5893,9 +5916,9 @@
     $opts = { 'type' => $opts } unless ref $opts;
 
     # Two valid types, Personal or Community
-    $opts->{'type'} = undef unless $opts->{'type'} =~ m/^(P|C)$/;
+    $opts->{'type'} = undef unless $opts->{'type'} =~ m/^(P|C|S)$/;
 
-    my $ids = LJ::load_rel_target($u, 'A');
+    my $ids = LJ::load_rel_target($u, $opts->{'type'} eq 'S' ? 'S' : 'A');
     return undef unless $ids;
 
     # load_userids_multiple
@@ -5904,7 +5927,7 @@
 
     return map { $_->{'user'} }
                grep { ! $opts->{'cap'} || LJ::get_cap($_, $opts->{'cap'}) }
-               grep { ! $opts->{'type'} || $opts->{'type'} eq $_->{'journaltype'} }
+               grep { ! ($opts->{'type'} && $opts->{'type'} ne 'S') || $opts->{'type'} eq $_->{'journaltype'} }
 
                # unless overridden, hide non-visible/non-read-only journals. always display the user's acct
                grep { $opts->{'showall'} || $_->is_visible || $_->is_readonly || LJ::u_equals($_, $u) }
@@ -9569,36 +9592,6 @@
 }
 
 # <LJFUNC>
-# name: LJ::can_manage
-# des: Given a user and a target user, will determine if the first user is an
-#      admin for the target user.
-# returns: bool: true if authorized, otherwise fail
-# args: remote, u
-# des-remote: user object or userid of user to try and authenticate
-# des-u: user object or userid of target user
-# </LJFUNC>
-sub can_manage {
-    my $remote = LJ::want_user(shift);
-    my $u = LJ::want_user(shift);
-    return undef unless $remote && $u;
-
-    # is same user?
-    return 1 if LJ::u_equals($u, $remote);
-
-    # do not allow suspended users manage other accounts
-    return 0 if $remote->is_suspended;
-
-    # people/syn/rename accounts can only be managed by the one account
-    return undef if $u->{journaltype} =~ /^[PYR]$/;
-
-    # check for admin access
-    return undef unless LJ::check_rel($u, $remote, 'A');
-
-    # passed checks, return true
-    return 1;
-}
-
-# <LJFUNC>
 # name: LJ::can_manage_other
 # des: Given a user and a target user, will determine if the first user is an
 #      admin for the target user, but not if the two are the same.
@@ -9610,11 +9603,14 @@
 sub can_manage_other {
     my ($remote, $u) = @_;
     return 0 if LJ::want_userid($remote) == LJ::want_userid($u);
-    return LJ::can_manage($remote, $u);
+    $remote = LJ::want_user($remote);
+    return $remote && $remote->can_manage($u);
 }
 
 sub can_delete_journal_item {
-    return LJ::can_manage(@_);
+    my ($remote, $u) = @_;
+    $remote = LJ::want_user($remote);
+    return $remote && $remote->can_manage($u);
 }
 
 

Modified: trunk/cgi-bin/ljlib.pl
===================================================================
--- trunk/cgi-bin/ljlib.pl	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/ljlib.pl	2010-12-17 10:11:19 UTC (rev 17965)
@@ -1367,7 +1367,7 @@
     return undef unless $u->{clusterid};
 
     # does $u have admin access?
-    return undef unless LJ::can_manage($remote, $u);
+    return undef unless $remote->can_manage($u);
 
     # passed all checks, return $u
     return $u;
@@ -2530,7 +2530,8 @@
     }
 
     # is the poster an admin for this community?
-    return 1 if LJ::can_manage($posterid, $uowner);
+    my $poster = LJ::want_user($posterid);
+    return 1 if $poster && $poster->can_manage($uowner);
 
     $res->{'errmsg'} = "You do not have access to post to this journal.";
     return 0;

Modified: trunk/cgi-bin/ljtodo.pl
===================================================================
--- trunk/cgi-bin/ljtodo.pl	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/ljtodo.pl	2010-12-17 10:11:19 UTC (rev 17965)
@@ -21,7 +21,7 @@
         my $quser = $dbh->quote($u->{'user'});
         
         ## check if you're an admin of that journal 
-        my $is_manager = LJ::can_manage($remote, $u);
+        my $is_manager = $remote ? $remote->can_manage($u) : undef;
         if ($is_manager) {
             $perm->{'add'} = 1;
             $perm->{'delete'} = 1;

Modified: trunk/cgi-bin/ljviews.pl
===================================================================
--- trunk/cgi-bin/ljviews.pl	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/ljviews.pl	2010-12-17 10:11:19 UTC (rev 17965)
@@ -1358,7 +1358,7 @@
             my $readurl = LJ::Talk::talkargs($permalink, $nc);
 
             my $dispreadlink = $replycount ||
-                ($logprops{$itemid}->{'hasscreened'} && LJ::can_manage($remote, $u));
+                ($logprops{$itemid}->{'hasscreened'} && $remote && $remote->can_manage($u));
 
             $lastn_event{'talklinks'} = LJ::fill_var_props($vars, 'LASTN_TALK_LINKS', {
                 'itemid' => $ditemid,
@@ -1919,7 +1919,7 @@
         if ($entry_obj->comments_shown)
         {
             my $dispreadlink = $replycount ||
-                ($logprops{$datakey}->{'hasscreened'} && LJ::can_manage($remote, $friendid));
+                ($logprops{$datakey}->{'hasscreened'} && $remote && $remote->can_manage($friendid));
 
             my $nc = "";
             $nc .= "nc=$replycount" if $replycount && $remote && $remote->{'opt_nctalklinks'};
@@ -2603,7 +2603,7 @@
             my $readurl = LJ::Talk::talkargs($permalink, $nc);
 
             my $dispreadlink = $replycount ||
-                ($logprops{$itemid}->{'hasscreened'} && LJ::can_manage($remote, $u));
+                ($logprops{$itemid}->{'hasscreened'} && $remote && $remote->can_manage($u));
             $day_event{'talklinks'} = LJ::fill_var_props($vars, 'DAY_TALK_LINKS', {
                 'itemid' => $ditemid,
                 'itemargs' => $itemargs,

Modified: trunk/cgi-bin/taglib.pl
===================================================================
--- trunk/cgi-bin/taglib.pl	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/cgi-bin/taglib.pl	2010-12-17 10:11:19 UTC (rev 17965)
@@ -281,7 +281,8 @@
     # remote may be undef so we have to check exists
     if (exists $opts->{remote}) {
         # never going to cull anything if you control it, so just return
-        return $res if LJ::can_manage($opts->{remote}, $u);
+        my $remote = $opts->{remote};
+        return $res if $remote && $remote->can_manage($u);
 
         # setup helper variables from u to remote
         my ($is_friend, $grpmask) = (0, 0);
@@ -497,7 +498,7 @@
     my $perms = LJ::Tags::get_permission_levels($journal);
     if ($perms->{add} eq 'author_moder'){
         return 1 if $remote==$entry->poster; # check author
-        return LJ::can_manage($remote, $entry->journal);  # check moder
+        return $remote->can_manage($entry->journal);  # check moder
     }
     
     ## generic case: if $remote can add tags to the entire journal of the entry
@@ -537,7 +538,7 @@
     return undef unless $u && $remote && $perm;
 
     # allow if they can manage it (own, or 'A' edge)
-    return 1 if LJ::can_manage($remote, $u);
+    return 1 if $remote->can_manage($u);
 
     # permission checks
     if ($perm eq 'public') {
@@ -547,9 +548,9 @@
     } elsif ($perm eq 'friends') {
         return LJ::is_friend($u, $remote);
     } elsif ($perm eq 'private') {
-        return LJ::can_manage($remote, $u);
+        return $remote->can_manage($u);
     } elsif ($perm eq 'author_moder'){
-        return (LJ::can_manage($remote, $u) || LJ::is_friend($u, $remote));
+        return ($remote->can_manage($u) || LJ::is_friend($u, $remote));
     } elsif ($perm =~ /^group:(\d+)$/) {
         my $grpid = $1+0;
         return undef unless $grpid >= 1 && $grpid <= 30;

Modified: trunk/htdocs/allpics.bml
===================================================================
--- trunk/htdocs/allpics.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/allpics.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -64,7 +64,7 @@
 
     my ($can_manage, $getextra);
     if ($remote) {
-        $can_manage = LJ::can_manage($remote, $u->{'userid'});
+        $can_manage = $remote->can_manage($u->{'userid'});
         $getextra = $can_manage && $remote->{'user'} ne $u->{'user'} ? "?authas=$u->{'user'}" : '';
     }
 

Modified: trunk/htdocs/community/create.bml
===================================================================
--- trunk/htdocs/community/create.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/community/create.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -78,7 +78,7 @@
             # community was created in the last 10 minutes?
             my $recent_create = ($u->timecreate > (time() - (10*60))) ? 1 : 0;
             $second_submit = ($u->is_community && $recent_create
-                                 && LJ::can_manage($remote, $u)) ? 1 : 0;
+                                 && $remote && $remote->can_manage($u)) ? 1 : 0;
 
             $error = "$ML{'.error.username.inuse'}" if (!$second_submit);
         }

Modified: trunk/htdocs/community/pending.bml
===================================================================
--- trunk/htdocs/community/pending.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/community/pending.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -35,7 +35,7 @@
     my $cid = $c->{'userid'};
 
     # is $remote an admin?
-    unless (LJ::can_manage($remote, $c)) {
+    unless ($remote && $remote->can_manage($c)) {
         $ret .= "<?h1 $ML{'Error'} h1?><?p ";
         $ret .= BML::ml('/community/members.bml.error.noaccess', 
                         { comm => LJ::ljuser($cname, { type => 'C' }) });

Modified: trunk/htdocs/customize/advanced/layerbrowse.bml
===================================================================
--- trunk/htdocs/customize/advanced/layerbrowse.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/customize/advanced/layerbrowse.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -122,7 +122,7 @@
                    LJ::check_priv($remote, 'canview', '*'));       # in case they're private styles
     return $err->($ML{'.error.cantviewlayer'})
         unless defined $pub->{$id} || $srcview == 1 ||
-               LJ::can_manage($remote, $layer->{'userid'}) ||
+               ($remote && $remote->can_manage($layer->{'userid'})) ||
                $isadmin;
 
     LJ::S2::load_layers($id);
@@ -157,7 +157,7 @@
     }
     if (defined $pub->{$id} && (! defined $srcview || $srcview != 0) ||
             $srcview == 1 ||
-            LJ::can_manage($remote, $layer->{'userid'}) ||
+            ($remote && $remote->can_manage($layer->{'userid'})) ||
             $isadmin) {
 
         $body .= BML::ml('Actionlink', { 'link' => "$ML{'.nav.viewsource'} <a href=\"$LJ::SITEROOT/customize/advanced/layersource.bml?id=$id\">$ML{'.nav.viewsource.raw'}</a> | <a href=\"$LJ::SITEROOT/customize/advanced/layersource.bml?id=$id&fmt=html\">$ML{'.nav.viewsource.highlighted'}</a>" }) . "\n";

Modified: trunk/htdocs/customize/advanced/layeredit.bml
===================================================================
--- trunk/htdocs/customize/advanced/layeredit.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/customize/advanced/layeredit.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -37,7 +37,7 @@
 
     # is authorized admin for this layer?
     return $err->('You are not authorized to edit this layer.')
-        unless LJ::can_manage($remote, $lay->{'userid'});
+        unless $remote && $remote->can_manage($lay->{'userid'});
 
     # get u of user they are acting as
     my $u = $lay->{'userid'} == $remote->{'userid'} ? $remote : LJ::load_userid($lay->{'userid'});

Modified: trunk/htdocs/customize/advanced/layersource.bml
===================================================================
--- trunk/htdocs/customize/advanced/layersource.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/customize/advanced/layersource.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -32,7 +32,7 @@
     return $err->($ML{'/customize/advanced/layerbrowse.bml.error.cantviewlayer'})
         unless defined $pub->{$id} && (! defined $srcview || $srcview != 0) ||
                $srcview == 1 ||
-               LJ::can_manage($remote, $lay->{'userid'}) ||
+               ($remote && $remote->can_manage($lay->{'userid'})) ||
                $isadmin;
 
     my $s2code = LJ::S2::load_layer_source($id);

Modified: trunk/htdocs/delcomment.bml
===================================================================
--- trunk/htdocs/delcomment.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/delcomment.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -91,7 +91,7 @@
         return $error->($err);
     }
 
-    my $can_manage = LJ::can_manage($remote, $u);
+    my $can_manage = $remote->can_manage($u);
 
     # can ban if can manage and the comment is by someone else and not anon
     my $can_ban = $can_manage && $tp->{'posterid'}

Modified: trunk/htdocs/manage/subscriptions/user.bml
===================================================================
--- trunk/htdocs/manage/subscriptions/user.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/manage/subscriptions/user.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -115,13 +115,13 @@
     ];
 
     push @$groups, { event => "JournalNewComment", 'journalid' => $journal->id }
-        if LJ::can_manage($u, $journal);
+        if $u && $u->can_manage($journal);
 
     push @$groups, { event => "UserExpunged", 'journalid' => $journal->id }
         unless LJ::User->is_protected_username($journal->user);
 
     push @$groups, { event => "CommunityJoinReject", 'journalid' => $journal->id }
-        if LJ::can_manage($u, $journal); 
+        if $u && $u->can_manage($journal); 
 
     $ret .= $widget->render({
         'title' => BML::ml('subscribe_interface.category.this-journal', { 'journal' => $journal->ljuser_display }),

Modified: trunk/htdocs/styles/browse/links.bml
===================================================================
--- trunk/htdocs/styles/browse/links.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/styles/browse/links.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -33,10 +33,10 @@
     foreach my $sty (sort { $a->{'type'} cmp $b->{'type'} || $a->{'styledes'} cmp $b->{'styledes'} }
                      values %$styles) {
 
-        next STY unless $sty->{is_public} eq 'Y' ||      # public is always visible
-                        LJ::u_equals($remote, $styu) ||  # yours are visible to you
-                        LJ::can_manage($remote, $styu) ||# you can view things you manage
-                        $admin;                          # you have appropriate canview
+        next STY unless $sty->{is_public} eq 'Y'                ||  # public is always visible
+                        LJ::u_equals($remote, $styu)            ||  # yours are visible to you
+                        ($remote && $remote->can_manage($styu)) ||  # you can view things you manage
+                        $admin;                                     # you have appropriate canview
 
         if ($last ne $LJ::viewinfo{$sty->{'type'}}->{'des'}) {
             $last = $LJ::viewinfo{$sty->{'type'}}->{'des'};

Modified: trunk/htdocs/styles/browse/styleinfo.bml
===================================================================
--- trunk/htdocs/styles/browse/styleinfo.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/styles/browse/styleinfo.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -7,11 +7,11 @@
  my $styu = $sty ? LJ::load_user($sty->{user}) : undef; # if $sty so we don't auto-vivify!
  return "Style $styleid does not exist or is not public."
     unless $sty && 
-          ($sty->{is_public} eq 'Y' ||       # straight up public
-           LJ::u_equals($remote, $styu) ||   # is this your account?
-           LJ::can_manage($remote, $styu) || # how about your community?
-           LJ::check_priv($remote, 'canview', 'styles') || # can you see private styles?
-           LJ::check_priv($remote, 'canview', '*'));       # or maybe you can see everything
+          ($sty->{is_public} eq 'Y'                     ||  # straight up public
+           LJ::u_equals($remote, $styu)                 ||  # is this your account?
+           ($remote && $remote->can_manage($styu))      ||  # how about your community?
+           LJ::check_priv($remote, 'canview', 'styles') ||  # can you see private styles?
+           LJ::check_priv($remote, 'canview', '*'));        # or maybe you can see everything
 
  my $ret = "";
  $ret .= "<H1>Style Info</H1>\n";

Modified: trunk/htdocs/talkread.bml
===================================================================
--- trunk/htdocs/talkread.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/talkread.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -226,7 +226,7 @@
     my $showmultiform = $remote &&
                         ($remote->{'user'} eq $u->{'user'} ||
                          $remote->{'user'} eq $up->{'user'} ||
-                         LJ::can_manage($remote, $u));
+                         $remote->can_manage($u));
 
     my $multiform_selects = 0;  # are there select boxes?  don't show form if not.
 
@@ -462,7 +462,7 @@
     my $LJ_cmtinfo = {  # data structure to give to javascript for commentmanage
         form_auth => LJ::form_auth(1),
         journal   => $u->{user},
-        canAdmin  => LJ::can_manage($remote, $u) ? 1 : 0,
+        canAdmin  => ($remote && $remote->can_manage($u)) ? 1 : 0,
         remote    => $remote ? $remote->{user} : "",
         is_s1     => 1,
     };

Modified: trunk/htdocs/tools/endpoints/get_thread.bml
===================================================================
--- trunk/htdocs/tools/endpoints/get_thread.bml	2010-12-17 09:36:01 UTC (rev 17964)
+++ trunk/htdocs/tools/endpoints/get_thread.bml	2010-12-17 10:11:19 UTC (rev 17965)
@@ -127,7 +127,7 @@
     my $showmultiform = $remote &&
                         ($remote->{'user'} eq $u->{'user'} ||
                          $remote->{'user'} eq $up->{'user'} ||
-                         LJ::can_manage($remote, $u));
+                         $remote->can_manage($u));
 
     my $multiform_selects = 0;  # are there select boxes?  don't show form if not.
 
@@ -136,7 +136,7 @@
     my $LJ_cmtinfo = {  # data structure to give to javascript for commentmanage
         form_auth => LJ::form_auth(1),
         journal   => $u->{user},
-        canAdmin  => LJ::can_manage($remote, $u) ? 1 : 0,
+        canAdmin  => ($remote && $remote->can_manage($u)) ? 1 : 0,
         remote    => $remote ? $remote->{user} : "",
     };
 

Tags: bml, livejournal, pl, pm, wisest-owl
Subscribe
  • Post a new comment

    Error

    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened

    Your IP address will be recorded 

  • 0 comments