Fix: only allow affiliating with org when user is assurer.

[gigi.git] / src / org / cacert / gigi / pages / orga / AffiliationForm.java

diff --git a/src/org/cacert/gigi/pages/orga/AffiliationForm.java b/src/org/cacert/gigi/pages/orga/AffiliationForm.java
index e9ab64b4a56f631be54925c39b5e5514ba88875a..ad988895b351d5c26e375813257ba881cbf5639c 100644 (file)
--- a/src/org/cacert/gigi/pages/orga/AffiliationForm.java
+++ b/src/org/cacert/gigi/pages/orga/AffiliationForm.java
@@ -12,10 +12,11 @@ import org.cacert.gigi.dbObjects.Organisation;
 import org.cacert.gigi.dbObjects.Organisation.Affiliation;
 import org.cacert.gigi.dbObjects.User;
 import org.cacert.gigi.localisation.Language;
-import org.cacert.gigi.output.Form;
+import org.cacert.gigi.output.template.Form;
 import org.cacert.gigi.output.template.IterableDataset;
 import org.cacert.gigi.output.template.Template;
 import org.cacert.gigi.pages.LoginPage;
+import org.cacert.gigi.pages.Page;
 
 public class AffiliationForm extends Form {
 
@@ -30,8 +31,21 @@ public class AffiliationForm extends Form {
 
     @Override
     public boolean submit(PrintWriter out, HttpServletRequest req) throws GigiApiException {
-        o.addAdmin(User.getByEmail(req.getParameter("email")), LoginPage.getUser(req), req.getParameter("master") != null);
-        return true;
+        if (req.getParameter("del") != null) {
+            User toRemove = User.getByEmail(req.getParameter("del"));
+            if (toRemove != null) {
+                o.removeAdmin(toRemove, LoginPage.getUser(req));
+                return true;
+            }
+        } else if (req.getParameter("do_affiliate") != null) {
+            User byEmail = User.getByEmail(req.getParameter("email"));
+            if (byEmail != null && byEmail.canAssure()) {
+                o.addAdmin(byEmail, LoginPage.getUser(req), req.getParameter("master") != null);
+                return true;
+            }
+        }
+        out.println(Page.getLanguage(req).getTranslation("No action could have been carried out."));
+        return false;
     }
 
     @Override
@@ -43,11 +57,13 @@ public class AffiliationForm extends Form {
 
             @Override
             public boolean next(Language l, Map<String, Object> vars) {
-                if ( !iter.hasNext())
+                if ( !iter.hasNext()) {
                     return false;
+                }
                 Affiliation aff = iter.next();
                 vars.put("name", aff.getTarget().getName());
                 vars.put("master", aff.isMaster() ? l.getTranslation("master") : "");
+                vars.put("e-mail", aff.getTarget().getEmail());
                 return true;
             }
         });