Differences From
Artifact [59cb9f4fac]:
170 170 -- FIXME allow xids as well, for manual queries
171 171 if not user then goto e404 end
172 172 defer user:free()
173 173 if not co.who:overpowers(user.ptr) then goto e403 end
174 174
175 175 if path.ct == 4 then
176 176 if path(3):cmp(lib.str.lit'cred') then
177 - var pg: lib.str.acc pg:init(1024)
177 + var pg = co:stra(1024)
178 178 pg:lpush('<div class="context">editing credentials for user <a href="/conf/users/'):rpush(path(2)):lpush('">'):push(user(0).xid,0):lpush('</a></div>')
179 179 var credmgr = lib.render.conf.sec(co, uid)
180 180 pg:ppush(credmgr)
181 - credmgr:free()
181 + --credmgr:free()
182 182 return pg:finalize()
183 183 else goto e404 end
184 184 elseif path.ct == 3 then
185 - var cinp: lib.str.acc cinp:init(256)
185 + var cinp = co:stra(256)
186 186 cinp:lpush('<div class="elem-group">')
187 187 if user.ptr.rights.rank > 0 and (co.who.rights.powers.elevate() or co.who.rights.powers.demote()) then
188 188 var max = co.who.rights.rank
189 189 if not co.who.rights.powers.elevate() then max = user.ptr.rights.rank end
190 190 var min = co.srv.cfg.nranks
191 191 if not co.who.rights.powers.demote() then min = user.ptr.rights.rank end
192 192
193 193 push_num_field(cinp, 'rank', 'rank', max, min, user.ptr.rights.rank, user.ptr.id == co.who.id)
194 194 end
195 195 if co.who.rights.powers.herald() then
196 196 var sanitized: pstr
197 197 if user.ptr.epithet == nil
198 198 then sanitized = pstr {ptr='', ct=0}
199 - else sanitized = lib.html.sanitize(cs(user.ptr.epithet),true)
199 + else sanitized = lib.html.sanitize(&co.srv.pool,cs(user.ptr.epithet),true)
200 200 end
201 201 cinp:lpush('<div class="elem"><label for="epithet">epithet</label><input type="text" id="epithet" name="epithet" value="'):ppush(sanitized):lpush('"></div>')
202 - if user.ptr.epithet ~= nil then sanitized:free() end
202 + --if user.ptr.epithet ~= nil then sanitized:free() end
203 203 end
204 204 if co.who.rights.powers.invite() or co.who.rights.powers.discipline() then
205 205 var min: uint32 = 0
206 206 if not (co.who.rights.powers.discipline() or
207 207 co.who.rights.powers.demote() and co.who.rights.powers.invite())
208 208 then min = user.ptr.rights.invites end
209 209 var max: uint32 = co.srv.cfg.maxinvites
................................................................................
234 234 var map = array([lib.store.powmap])
235 235 cinp:lpush('<details><summary>powers</summary><div class="pick-list">')
236 236 for i=0, [map.type.N] do
237 237 if (co.who.rights.powers and map[i].val):sz() > 0 then
238 238 var on = (user.ptr.rights.powers and map[i].val):sz() > 0
239 239 var enabled = ( on and co.who.rights.powers.demote() ) or
240 240 ((not on) and co.who.rights.powers.elevate())
241 - var namea: lib.str.acc namea:compose('power-', map[i].name)
241 + var namea: lib.str.acc namea:pcompose(&co.srv.pool,'power-', map[i].name)
242 242 var name = namea:finalize()
243 243 push_pickbox(&cinp, name, pstr.null(), map[i].name, on, enabled, pstr.null())
244 - name:free()
244 + --name:free()
245 245 end
246 246 end
247 247 cinp:lpush('</div></details>')
248 248 end
249 249
250 250 if co.who.id ~= uid and co.who.rights.powers.purge() then
251 - var purgeconf: lib.str.acc purgeconf:init(48)
251 + var purgeconf = co:stra(48)
252 252 var purgestrs = array(
253 253 'alpha', 'beta', 'gamma', 'delta', 'epsilon', 'eta', 'nu', 'kappa',
254 254 'emerald', 'carnelian', 'sapphire', 'ruby', 'amethyst', 'glory',
255 255 'hope', 'grace', 'pearl', 'carnation', 'rose', 'peony', 'poppy'
256 256 )
257 257 for i=0,3 do
258 258 purgeconf:push(purgestrs[lib.crypt.random(intptr,0,[purgestrs.type.N])],0)
259 259 if i ~= 2 then purgeconf:lpush('-') end
260 260 end
261 261 cinp:lpush('<details><summary>purge account</summary><p>you have the authority to destroy this account and all its associated content irreversibly and irretrievably. if you really wish to apply such an extreme sanction, enter the confirmation string <strong style="user-select:none">'):push(purgeconf.buf,purgeconf.sz):lpush('</strong> below and press the “alter” button to begin the process.</p><div class="elem"><label for="purge">purge confirmation string</label><input type="text" id="purge" name="purgekey"></div><input type="hidden" name="purgestr" value="'):push(purgeconf.buf,purgeconf.sz):lpush('"></details>')
262 - purgeconf:free()
262 + --purgeconf:free()
263 263 end
264 264
265 265 -- TODO black mark system? e.g. resolution option for badthink reports
266 266 -- adds a black mark to the offending user; they can be automatically banned
267 267 -- or brought up for review after a certain number of offenses; possibly lower
268 268 -- set of default privs for marked users
269 269
270 - var cinpp = cinp:finalize() defer cinpp:free()
271 - var unym: lib.str.acc unym:init(64)
270 + var cinpp = cinp:finalize() --defer cinpp:free()
271 + var unym = co:stra(64)
272 272 unym:lpush('<a href="/')
273 273 if user(0).origin ~= 0 then unym:lpush('@') end
274 - do var sanxid = lib.html.sanitize(user(0).xid, true)
274 + do var sanxid = lib.html.sanitize(&co.srv.pool,user(0).xid, true)
275 275 unym:ppush(sanxid)
276 - sanxid:free() end
276 + --sanxid:free()
277 + end
277 278 unym:lpush('" class="id">')
278 279 lib.render.nym(user.ptr,0,&unym,false)
279 280 unym:lpush('</a>')
280 281 var ctlbox = data.view.conf_user_ctl {
281 282 name = unym:finalize();
282 283 inputcontent = cinpp;
283 284 btns = pstr{'',0};
284 285 }
285 286 if co.who.id ~= uid and co.who.rights.powers.cred() then
286 - ctlbox.btns = lib.str.acc{}:compose('<a class="button" href="/conf/users/',path(2),'/cred">security & credentials</a>'):finalize()
287 + ctlbox.btns = lib.str.acc{}:pcompose(&co.srv.pool,'<a class="button" href="/conf/users/',path(2),'/cred">security & credentials</a>'):finalize()
287 288 end
288 - var pg: lib.str.acc pg:init(512)
289 + var pg = co:stra(512)
289 290 ctlbox:append(&pg)
290 - ctlbox.name:free()
291 - if ctlbox.btns.ct > 0 then ctlbox.btns:free() end
291 + --ctlbox.name:free()
292 + --if ctlbox.btns.ct > 0 then ctlbox.btns:free() end
292 293
293 294 return pg:finalize()
294 295 end
295 296 else
296 297 var modes = array(P'local', P'remote', P'staff', P'titled', P'peons', P'all')
297 298 var idbuf: int8[lib.math.shorthand.maxlen]
298 - var ulst: lib.str.acc ulst:init(256)
299 + var ulst = co:stra(256)
299 300 var mode: uint8 = mode_local
300 301 var modestr = co:pgetv('show')
301 302 ulst:lpush('<div style="text-align: right"><em>showing ')
302 303 for i=0,[modes.type.N] do
303 304 if modestr:ref() and modes[i]:cmp(modestr) then mode = i end
304 305 end
305 306 for i=0,[modes.type.N] do