upd: cleanup SQL statements to make them statically verifiable.

[gigi.git] / src / org / cacert / gigi / output / GroupSelector.java

diff --git a/src/org/cacert/gigi/output/GroupSelector.java b/src/org/cacert/gigi/output/GroupSelector.java
index a26be9b8bbae20174ac3165d62b4da5f3e64a841..9d3080ddc1aaf3646ebc08631d6edd3553affc7e 100644 (file)
--- a/src/org/cacert/gigi/output/GroupSelector.java
+++ b/src/org/cacert/gigi/output/GroupSelector.java
@@ -13,21 +13,26 @@ import org.cacert.gigi.util.HTMLEncoder;
 
 public class GroupSelector implements Outputable {
 
-    String name;
+    private final String name;
 
-    Group value = null;
+    private Group value = null;
 
-    public GroupSelector(String name) {
+    private final boolean bySupporter;
+
+    public GroupSelector(String name, boolean bySupporter) {
         this.name = HTMLEncoder.encodeHTML(name);
+        this.bySupporter = bySupporter;
     }
 
     public void update(HttpServletRequest r) throws GigiApiException {
         String vS = r.getParameter(name);
-        value = null;
-        for (Group g : Group.values()) {
-            if (g.getDatabaseName().equals(vS)) {
-                value = g;
-            }
+        if (vS == null) {
+            throw new GigiApiException("No value for group.");
+        }
+        try {
+            value = Group.getByString(vS);
+        } catch (IllegalArgumentException e) {
+            throw new GigiApiException("Invalid value for group.");
         }
     }
 
@@ -35,15 +40,23 @@ public class GroupSelector implements Outputable {
     public void output(PrintWriter out, Language l, Map<String, Object> vars) {
         out.println("<select name='" + name + "'>");
         for (Group g : Group.values()) {
-            out.print("<option name='" + g.getDatabaseName());
-            if (g.equals(value)) {
-                out.print(" selected");
+            if (mayManage(g)) {
+                out.print("<option value='" + g.getDBName());
+                if (g.equals(value)) {
+                    out.print(" selected");
+                }
+                out.println("'>");
+                g.getName().output(out, l, vars);
+                out.println("</option>");
             }
-            out.println("'>" + g.getDatabaseName() + "</option>");
         }
         out.println("</select>");
     }
 
+    private boolean mayManage(Group g) {
+        return (bySupporter && g.isManagedBySupport()) || ( !bySupporter && g.isManagedByUser());
+    }
+
     public Group getGroup() {
         return value;
     }