add: defense-in-depth mechanism to prevent unauthorized adding of groups

[gigi.git] / src / org / cacert / gigi / output / GroupSelector.java

diff --git a/src/org/cacert/gigi/output/GroupSelector.java b/src/org/cacert/gigi/output/GroupSelector.java
index a26be9b8bbae20174ac3165d62b4da5f3e64a841..850e1d5ac72272c1e2b4e577b4b60007fb326723 100644 (file)
--- a/src/org/cacert/gigi/output/GroupSelector.java
+++ b/src/org/cacert/gigi/output/GroupSelector.java
@@ -13,19 +13,22 @@ import org.cacert.gigi.util.HTMLEncoder;
 
 public class GroupSelector implements Outputable {
 
-    String name;
+    private final String name;
 
-    Group value = null;
+    private Group value = null;
 
-    public GroupSelector(String name) {
+    private final boolean bySupporter;
+
+    public GroupSelector(String name, boolean bySupporter) {
         this.name = HTMLEncoder.encodeHTML(name);
+        this.bySupporter = bySupporter;
     }
 
     public void update(HttpServletRequest r) throws GigiApiException {
         String vS = r.getParameter(name);
         value = null;
         for (Group g : Group.values()) {
-            if (g.getDatabaseName().equals(vS)) {
+            if (g.getDatabaseName().equals(vS) && mayManage(g)) {
                 value = g;
             }
         }
@@ -35,15 +38,23 @@ public class GroupSelector implements Outputable {
     public void output(PrintWriter out, Language l, Map<String, Object> vars) {
         out.println("<select name='" + name + "'>");
         for (Group g : Group.values()) {
-            out.print("<option name='" + g.getDatabaseName());
-            if (g.equals(value)) {
-                out.print(" selected");
+            if (mayManage(g)) {
+                out.print("<option value='" + g.getDatabaseName());
+                if (g.equals(value)) {
+                    out.print(" selected");
+                }
+                out.println("'>");
+                g.getName().output(out, l, vars);
+                out.println("</option>");
             }
-            out.println("'>" + g.getDatabaseName() + "</option>");
         }
         out.println("</select>");
     }
 
+    private boolean mayManage(Group g) {
+        return (bySupporter && g.isManagedBySupport()) || ( !bySupporter && g.isManagedByUser());
+    }
+
     public Group getGroup() {
         return value;
     }