mozilla
/
mozilla-history
зеркало из https://github.com/mozilla/mozilla-history.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

adding functionality to security

This commit is contained in:
arielb%netscape.com 1999-08-08 22:29:02 +00:00
Родитель d92799422f
Коммит 3ab0ae3afa
4 изменённых файлов: 89 добавлений и 137 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

57
caps/src/nsCCapsManager.cpp
Просмотреть файл

@ -22,11 +22,10 @@
#include "nsPrincipalArray.h"
#include "nsCaps.h"
#include "nsICapsSecurityCallbacks.h"
//#include "nsLoadZig.h"
#include "secnav.h"
#ifdef MOZ_SECURITY
#include "navhook.h"
#include "jarutil.h"
#include "navhook.h"
#include "jarutil.h"
#endif /* MOZ_SECURITY */
#define ALL_JAVA_PERMISSION "AllJavaPermission"
@ -73,7 +72,7 @@ nsCCapsManager::CreateCertificatePrincipal(const unsigned char **certChain, PRUi
return nsPrincipalManager::GetPrincipalManager()->CreateCertificatePrincipal(certChain,certChainLengths,noOfCerts,prin);
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::GetPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRInt16 * privilegeState)
{
* privilegeState = nsIPrivilege::PrivilegeState_Blank;
@ -88,7 +87,7 @@ nsCCapsManager::GetPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRI
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::SetPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRInt16 privilegeState)
{
nsITarget * target = nsTarget::FindTarget(ALL_JAVA_PERMISSION);
@ -101,7 +100,7 @@ nsCCapsManager::SetPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRI
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::AskPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRInt16 * privilegeState)
{
nsITarget * target = nsTarget::FindTarget(ALL_JAVA_PERMISSION);
@ -125,24 +124,22 @@ nsCCapsManager::AskPermission(nsIPrincipal * prin, nsITarget * ignoreTarget, PRI
*
* @param result - is true if principal was successfully registered with the system
*/
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::Initialize(PRBool * result)
{
// * result = nsCapsInitialize();
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::InitializeFrameWalker(nsICapsSecurityCallbacks* aInterface)
{
//XXX write me
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::RegisterPrincipal(nsIPrincipal * prin)
{
// if (principalManager != NULL) privilegeManager->RegisterPrincipal(prin);
return NS_OK;
}
@ -157,7 +154,7 @@ nsCCapsManager::RegisterPrincipal(nsIPrincipal * prin)
* @param ret_val - is true if user has given permission for the given principal and
* target
*/
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::EnablePrivilege(nsIScriptContext * context, const char* targetName, PRInt32 callerDepth, PRBool * ret_val)
{
nsITarget *target = nsTarget::FindTarget((char*)targetName);
@ -171,18 +168,7 @@ nsCCapsManager::EnablePrivilege(nsIScriptContext * context, const char* targetNa
return NS_OK;
}
/**
* Returns if the user granted permission for the principal located at the given
* stack depth for the given target.
*
* @param context - is the parameter JS needs to determinte the principal
* @param targetName - is the name of the target.
* @param callerDepth - is the depth of JS stack frame, which JS uses to determinte the
* principal
* @param ret_val - is true if user has given permission for the given principal and
* target
*/
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::IsPrivilegeEnabled(nsIScriptContext * context, const char* targetName, PRInt32 callerDepth, PRBool *ret_val)
{
nsITarget *target = nsTarget::FindTarget((char*)targetName);
@ -195,7 +181,7 @@ nsCCapsManager::IsPrivilegeEnabled(nsIScriptContext * context, const char* targe
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::RevertPrivilege(nsIScriptContext * context, const char* targetName, PRInt32 callerDepth, PRBool *ret_val)
{
nsITarget *target = nsTarget::FindTarget((char*)targetName);
@ -207,7 +193,7 @@ nsCCapsManager::RevertPrivilege(nsIScriptContext * context, const char* targetNa
return NS_OK;
}
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::DisablePrivilege(nsIScriptContext * context, const char* targetName, PRInt32 callerDepth, PRBool *ret_val)
{
nsITarget *target = nsTarget::FindTarget((char*)targetName);
@ -219,23 +205,6 @@ nsCCapsManager::DisablePrivilege(nsIScriptContext * context, const char* targetN
return NS_OK;
}
/* interfaces for nsIPrincipal object, may be we should move some of them to nsIprincipal */
/**************
//Principals must be created by type, the nsPrincipal data member is deprecated
NS_METHOD
nsCCapsManager::NewPrincipal(PRInt16 *principalType, void* key, PRUint32 key_len, void *zig, nsIPrincipal** ret_val)
{
nsIPrincipal* pNSIPrincipal;
nsPrincipal *pNSPrincipal = new nsPrincipal(type, key, key_len, zig);
if (pNSPrincipal->isCodebase()) {
pNSIPrincipal = (nsIPrincipal*)new nsCodebasePrincipal(pNSPrincipal);
} else {
pNSIPrincipal = (nsIPrincipal*)new nsCertificatePrincipal(pNSPrincipal);
}
*ret_val = pNSIPrincipal;
return NS_OK;
}
*********************/
//XXX: todo: This method is covered by to nsIPrincipal object, should not be part of caps
//XXX: nsPrincipal struct if deprecated, access as nsIPrincipal
//do not use IsCodebaseExact, Tostring, or any other of the principal specific objects from here
@ -299,7 +268,7 @@ nsCCapsManager::CreateMixedPrincipalArray(void *aZig, const char * name, const c
* nsCapsGetPermission(struct nsPrivilege *privilege)
* nsCapsGetPrivilege(struct nsPrivilegeTable *annotation, struct nsITarget *target)
*/
NS_METHOD
NS_IMETHODIMP
nsCCapsManager::IsAllowed(void *annotation, const char * targetName, PRBool * ret_val)
{
nsITarget *target = nsTarget::FindTarget((char *)targetName);

3
caps/src/nsPrincipalManager.cpp
Просмотреть файл

@ -358,8 +358,7 @@ nsPrincipalManager *
nsPrincipalManager::GetPrincipalManager()
{
static nsPrincipalManager * prinMan = NULL;
if(!prinMan)
prinMan = new nsPrincipalManager();
if(!prinMan) prinMan = new nsPrincipalManager();
return prinMan;
}

162
caps/src/nsPrivilegeManager.cpp
Просмотреть файл

@ -309,15 +309,16 @@ nsPrivilegeManager::EnablePrincipalPrivilegeHelper(nsIScriptContext * context, n
callerPrinArray->GetPrincipalArraySize(& i);
while (i-- > 0) {
callerPrinArray->GetPrincipalArrayElement(i, & callerPrin);
PRBool result;
callerPrin->Equals(preferredPrin, & result);
if (result
//XXX ARIEL: update this code soon
// &&
// ((callerPrin->isCert() ||
// callerPrin->isCertFingerprint()))
PRBool prinEq;
PRInt16 prinType;
callerPrin->Equals(preferredPrin, & prinEq);
callerPrin->GetType(& prinType);
if (prinEq &&
((prinType == nsIPrincipal::PrincipalType_Certificate) ||
(prinType == nsIPrincipal::PrincipalType_CertificateFingerPrint) ||
(prinType == nsIPrincipal::PrincipalType_CertificateKey) ||
(prinType == nsIPrincipal::PrincipalType_CertificateChain))
) {
useThisPrin = callerPrin;
break;
}
@ -362,106 +363,89 @@ nsPrivilegeManager::EnablePrincipalPrivilegeHelper(nsIScriptContext * context, n
nsPrivilegeTable *
nsPrivilegeManager::EnableScopePrivilegeHelper(nsITarget *target, PRInt32 callerDepth, void *data, PRBool helpingSetScopePrivilege,
nsIPrincipal *prefPrin)
nsPrivilegeManager::EnableScopePrivilegeHelper(nsITarget * target, PRInt32 callerDepth, void * data, PRBool helpingSetScopePrivilege, nsIPrincipal * prefPrin)
{
return this->EnableScopePrivilegeHelper(NULL, target, callerDepth, data,
helpingSetScopePrivilege, prefPrin);
return this->EnableScopePrivilegeHelper(NULL, target, callerDepth, data, helpingSetScopePrivilege, prefPrin);
}
nsPrivilegeTable *
nsPrivilegeManager::EnableScopePrivilegeHelper(nsIScriptContext * context, nsITarget *target, PRInt32 callerDepth,
void *data, PRBool helpingSetScopePrivilege, nsIPrincipal * prefPrin)
nsPrivilegeManager::EnableScopePrivilegeHelper(nsIScriptContext * context, nsITarget * target, PRInt32 callerDepth,
void * data, PRBool helpingSetScopePrivilege, nsIPrincipal * prefPrin)
{
nsPrivilegeTable *privTable;
nsIPrivilege * allowedScope;
PRBool res;
nsITarget * targ = nsTarget::FindTarget(target);
if (targ != target) return NULL;
//throw new ForbiddenTargetException(target + " is not a registered target");
(prefPrin != NULL) ?
res = this->CheckPrivilegeGranted(target, prefPrin, data) :
nsPrivilegeTable * privTable;
nsIPrivilege * allowedScope;
PRBool res;
nsITarget * targ = nsTarget::FindTarget(target);
if (targ != target) return NULL;
//throw new ForbiddenTargetException(target + " is not a registered target");
(prefPrin != NULL) ? res = this->CheckPrivilegeGranted(target, prefPrin, data) :
this->CheckPrivilegeGranted(context, target, callerDepth, data,& res);
if (res == PR_FALSE) return NULL;
privTable = this->GetPrivilegeTableFromStack(context, callerDepth,
(helpingSetScopePrivilege ? PR_FALSE : PR_TRUE));
if (helpingSetScopePrivilege) {
if (privTable == NULL) privTable = new nsPrivilegeTable();
}
allowedScope = nsPrivilegeManager::FindPrivilege(nsIPrivilege::PrivilegeState_Allowed, nsIPrivilege::PrivilegeDuration_Scope);
this->UpdatePrivilegeTable(target, privTable, allowedScope);
return privTable;
if (res == PR_FALSE) return NULL;
privTable = this->GetPrivilegeTableFromStack(context, callerDepth, (helpingSetScopePrivilege ? PR_FALSE : PR_TRUE));
if (helpingSetScopePrivilege && privTable == NULL) privTable = new nsPrivilegeTable();
allowedScope = nsPrivilegeManager::FindPrivilege(nsIPrivilege::PrivilegeState_Allowed, nsIPrivilege::PrivilegeDuration_Scope);
this->UpdatePrivilegeTable(target, privTable, allowedScope);
return privTable;
}
NS_IMETHODIMP
nsPrivilegeManager::AskPermission(nsIPrincipal * useThisPrin, nsITarget * target, void * data, PRBool * result)
{
/*
PRBool ret_val = PR_FALSE;
nsPrivilege* newPrivilege = NULL;
// Get the Lock to display the dialog
nsCaps_lock();
nsIPrincipalArray* callerPrinArray = new nsIPrincipalArray();
callerPrinArray->Add(useThisPrin);
if (PR_TRUE == this->IsPermissionGranted(target, callerPrinArray, data)) {
ret_val = PR_TRUE;
goto done;
}
// Do a user dialog
newPrivilege = target->EnablePrivilege(useThisPrin, data);
// Forbidden for session is equivelent to decide later.
// If the privilege is DECIDE_LATER then throw exception.
// That is user should be prompted again when this applet
// performs the same privileged operation
//
if ((!newPrivilege->IsAllowed()) &&
(newPrivilege->GetDuration() == nsIPrivilege::PrivilegeDuration_Session)) {
// "User didn't grant the " + target->getName() + " privilege.";
ret_val = PR_FALSE;
goto done;
}
this->SetPermission(useThisPrin, target, newPrivilege);
// if newPrivilege is FORBIDDEN then throw an exception
if (newPrivilege->IsForbidden()) {
// "User didn't grant the " + target->getName() + " privilege.";
ret_val = PR_FALSE;
goto done;
}
ret_val = PR_TRUE;
* result = PR_FALSE;
PRBool privAllowed = PR_FALSE, privForbidden = PR_FALSE;
PRInt16 privDuration;
nsIPrivilege * newPrivilege = NULL;
// Get the Lock to display the dialog
nsCaps_lock();
nsIPrincipalArray * callerPrinArray = (nsIPrincipalArray *)new nsPrincipalArray();
callerPrinArray->AddPrincipalArrayElement(useThisPrin);
if (this->IsPermissionGranted(target, callerPrinArray, data)) {
* result = PR_TRUE;
goto done;
}
// Do a user dialog
target->EnablePrivilege(useThisPrin, data,& newPrivilege);
// Forbidden for session is equivelent to decide later.
// If the privilege is DECIDE_LATER then throw exception.
// That is user should be prompted again when this applet
// performs the same privileged operation
newPrivilege->IsAllowed(& privAllowed);
newPrivilege->GetDuration(& privDuration);
if (!privAllowed && (privDuration == nsIPrivilege::PrivilegeDuration_Session)) {
// "User didn't grant the " + target->getName() + " privilege.";
* result = PR_FALSE;
goto done;
}
this->SetPermission(useThisPrin, target, newPrivilege);
// if newPrivilege is FORBIDDEN then throw an exception
newPrivilege->IsForbidden(& privForbidden);
if (privForbidden) {
// "User didn't grant the " + target->getName() + " privilege.";
* result = PR_FALSE;
goto done;
}
* result = PR_TRUE;
done:
delete callerPrinArray;
nsCaps_unlock();
*/
return NS_OK;
delete callerPrinArray;
nsCaps_unlock();
return NS_OK;
}
NS_IMETHODIMP
nsPrivilegeManager::SetPermission(nsIPrincipal * useThisPrin, nsITarget * target, nsIPrivilege * newPrivilege)
{
/*
registerPrincipalAndSetPrivileges(useThisPrin, target, newPrivilege);
// RegisterPrincipalAndSetPrivileges(useThisPrin, target, newPrivilege);
//XXX ARIEL - THIS LOOKS SO WRONG, FIX IT!!!!!!!!!!!!!!!
//System.out.println("Privilege table modified for: " +
// useThisPrin.toVerboseString() + " for target " +
// target + " Privilege " + newPrivilege);
// Save the signed applet's ACL to the persistence store
// char* err = useThisPrin->savePrincipalPermanently();
if ((err == NULL) &&
(newPrivilege->getDuration() == nsDurationState_Forever)) {
//XXX: How do we save permanent access for unsigned principals
///
PRBool * result;
useThisPrin->Equals(theUnsignedPrincipal, result);
if (!result) save(useThisPrin, target, newPrivilege);
}
*/
//System.out.println("Privilege table modified for: " + useThisPrin.toVerboseString() + " for target " +
//target + " Privilege " + newPrivilege);
// Save the signed applet's ACL to the persistence store
// char * err = useThisPrin->savePrincipalPermanently();
// if((err == NULL) && (newPrivilege->GetDuration() == nsIPrivilege::PrivilegeDuration_Forever)) {
// PRBool result;
// useThisPrin->Equals(theUnsignedPrincipal,& result);
// if (!result) Save(useThisPrin, target, newPrivilege);
// }
return NS_OK;
}

4
caps/src/nsSecurityManagerFactory.cpp
Просмотреть файл

@ -159,7 +159,7 @@ NSRegisterSelf(nsISupports * aServMgr, const char * aPath)
{
nsresult rv;
#ifdef DEBUG
printf("*** Register Security\n");
printf("***Registering Security***\n");
#endif
NS_WITH_SERVICE1(nsIComponentManager, compMgr, aServMgr, kComponentManagerCID,& rv);
if (NS_FAILED(rv)) return rv;
@ -173,7 +173,7 @@ NSUnregisterSelf(nsISupports * aServMgr, const char * aPath)
{
nsresult rv;
#ifdef DEBUG
printf("*** Unregister XPConnect\n");
printf("*** Unregistering Security***\n");
#endif
NS_WITH_SERVICE1(nsIComponentManager, compMgr, aServMgr, kComponentManagerCID,& rv);
if (NS_FAILED(rv)) return rv;