Go to file

Kirill Solomko 956314d23c MT#66497 restrict subscriber roles in /api/subscribers * subscriber and subscriberadmin can no longer modify fields they are not allowed to. A changed value is rejected with 422 "Read-only field(s) for authenticated role: <fields>", unchanged values are accepted (clients sending the fetched values back keep working), omitted fields keep the stored values. Invalid values (e.g. administrative "true" or {}) are rejected with 422 as well: - subscriber on itself: lock, status, primary_number, alias_numbers, pbx_extension, profile_set_id, profile_id, administrative - subscriberadmin on itself: the same except pbx_extension, which can be changed to an extension not used by another subscriber or PBX group of the customer - subscriberadmin on the pilot: lock, status, primary_number, alias_numbers, profile_set_id, profile_id, administrative - subscriberadmin on its other subscribers: profile_set_id, profile_id, administrative The rules are in Utils::Subscriber::get_readonly_fields(), checked by get_readonly_changes() in prepare_resource(), so PUT and PATCH behave the same. Fields a role is allowed to change keep the existing PUT semantics. Previously e.g. a subscriber could unlock itself or assign itself any number or subscriber profile. * replaces the lock/status checks added in MT#66467. * subscriberadmin on its PBX seats: primary_number is derived from pbx_extension, a value other than the stored or the derived one is rejected with 422 (was silently replaced). * subscriberadmin POST with administrative set is rejected with 422 (was silently reset to 0). * subscriberadmin can assign alias numbers to its subscribers only from the PBX pool (non-primary numbers of the pilot), 422 otherwise. Assigned numbers are moved from the pilot, revoked ones are moved back to the pilot via update_subadmin_sub_aliases() (as in the web UI), for POST, PUT and PATCH. Previously any new or unassigned number could be assigned and revoked numbers were released from the customer. /api/numbers is unchanged. * PUT/PATCH/DELETE of subscribers outside of the caller's scope return 404 like GET (subscriber: other subscribers, subscriberadmin: subscribers outside its customer) instead of 403. 403 stays for non-PBX subscriberadmin without the write privilege. * non-PBX subscriberadmin POST returns 403 without the write privilege instead of 500, with it the subscriber is created in the own customer. * SubscriberSubAdminAPI form: add the lock field, so subscriberadmin lock changes of its subscribers are validated as in the admin form and no longer dropped on PUT. PUT without lock/status still resets them (lock 0, status active) as before, PATCH without lock keeps it (previously any subscriberadmin PATCH unlocked the subscriber). * fields visibility is unchanged. * api-subscribers.t: - add restricted fields, PBX pool and access tests for subscriber, subscriberadmin (own, pilot, its subscribers, non-PBX) and admin - fix subscriber credentials, webpassword is not returned by the API, the subscriberadmin tests were not executed at all - other reseller fixture uses its own domain - adapt expectations: subscriberadmin profile changes and subscriberadmin creation are rejected with 422 - TT#28510: re-fetch the pilot, the TT#15441 cleanup may have deleted it (hash order dependent, failed with "Customer has no pbx pilot subscriber yet") * Test::FakeData: unique billing profile name/handle per creation, the profile can be created twice per run (fails on an empty DB). Change-Id: I637330111df278eb62edca25f3406966d8a6ebf1 (cherry picked from commit `c6cf9adfa9`)		2 days ago
assets	TT#7515 Clean up good original polycom template	9 years ago
debian	Release new version 26.3.2.0+0~mr26.3.2.0	3 weeks ago
etc	MT#51865 add calllistsuppressions API endpoint	3 months ago
inc/Local/Module	TT#53701 Stop requiring Moose during builds	8 years ago
lib	MT#66497 restrict subscriber roles in /api/subscribers	2 days ago
sandbox	MT#62763 Rename PHP test script to use .php extension	2 years ago
script	TT#115002 Fix collecting i18n strings from Forms	5 years ago
share	MT#65090 generate_invoices: Remove obsolete backwards compatibility code	6 months ago
t	MT#66497 restrict subscriber roles in /api/subscribers	2 days ago
tools	MT#62763 Set vim file type to bash for shell scripts not being detected	1 year ago
tools_bin	MT#66160 fix 500 on contract-only provisioning templates	1 month ago
tools_man	TT#78502 Fix man pages formatting	7 years ago
.gitignore	MT#57776 update dockerfile to make python tests work on debian 12	3 years ago
.gitreview	MT#7505 Add .gitreview file for ngcp-panel	12 years ago
.mailmap	TT#91650 Add a .mailmap file to correct author information	6 years ago
.perlcriticrc	TT#71950 Fix typos	7 years ago
.shellcheckrc	MT#62763 Fix shellcheck issues	1 year ago
Build.PL	MT#59492 Use reserved IPs following RFC5737	3 years ago
Changes	Initial commit of catalyst skeleton.	14 years ago
ISSUES	Implement destination set handling.	14 years ago
MANIFEST	MT#6551 Add empty MANIFEST file	13 years ago
MANIFEST.SKIP	MT#6551 Add empty MANIFEST file	13 years ago
README.md	TT#115002 Convert README.md to actual Markdown syntax	6 years ago
ngcp_panel.psgi	MT#62763 Add a shebang to treat file as a program	2 years ago
ngcp_panel_testing.conf	use config file ngcp-schema/share/test.conf for testing	13 years ago
pyproject.toml	MT#62763 Fix pycodestyle issues	9 months ago
tox.ini	MT#62763 Fix pycodestyle issues	9 months ago

README.md

NGCP-Panel

A completely overhauled provisioning interface for the NGCP system.

NAME

Build.PL - NGCP-Panel build system including test fixtures

SYNOPSIS

Usage:

$ perl ./Build
$ ./Build test --webdriver='phantomjs --webdriver=4444'
$ ./Build test --webdriver='java -jar selenium-server-standalone.jar'
$ ./Build test --webdriver='chromedriver --url-base=wd/hub --port=4444'
$ ./Build test --webdriver=selenium-rc # from CPAN distro Alien-SeleniumRC
$ ./Build test --webdriver=external --wd-server=127.0.0.1:5555

$ ./Build test_tap --webdriver=external # outputs tap to tap/ folder

$ ./Build testcover --webdriver='phantomjs --webdriver=4444'

OPTIONS

--webdriver COMMAND: (required) COMMAND to launch a webdriver external if the webdriver is launched externally
--wd-server HOST:PORT: HOST:PORT of the webdriver to which the tests should connect. Default is set by Test::WebDriver to localhost:4444.
--server URI: URI for the HTTP::Server::PSGI socket server run for testing, default http://localhost:5000.
--schema-base-dir DIR: If the NGCP::Schema is not installed to a known path to perl, this option can specify the base DIR of its development location. It will then be included via blib, so we have access to its lib and share.
--mysqld-port PORT: If this option and --mysqld-dir are supplied, a mysqld will be started at the specified PORT and be used for the tests. mysqld will be stopped and the temporary data deleted when this script finishes.
--mysql-dump: If this option and --mysqld-port are supplied, a mysqld will be started and be used for the tests. It will import all dumps supplied with this option. This option can be set multiple times. In this case all specified files will be dumped into the database.
--help: Print a brief help message and exits.
--man: Prints the manual page and exits.

I18N

Update strings from database:

$ script/ngcp_panel_dump_db_strings.pl

Regenerate messages.pot (use -v for verbose output):

$ xgettext.pl --output=lib/NGCP/Panel/I18N/messages.pot --directory=lib/ --directory=share/templates/ --directory=share/layout -P perl=tt,pm

In case your language does not exist already:

$ msginit --input=lib/NGCP/Panel/I18N/messages.pot --output=lib/NGCP/Panel/I18N/$LANG.po --locale=$LANG

Update or create $LANG.po files:

$ msgmerge --update $LANG.po messages.pot