Merge pull request #3341 from phil-davis/sysprvwarn2

10 files changed, 111 insertions, 4 deletions

diff --git a/src/usr/local/www/diag_backup.php b/src/usr/local/www/diag_backup.php
index bd3de22..a2a9f70 100644
--- a/src/usr/local/www/diag_backup.php
+++ b/src/usr/local/www/diag_backup.php
@@ -27,6 +27,7 @@
 ##|*IDENT=page-diagnostics-backup-restore
 ##|*NAME=Diagnostics: Backup & Restore
 ##|*DESCR=Allow access to the 'Diagnostics: Backup & Restore' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=diag_backup.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/diag_command.php b/src/usr/local/www/diag_command.php
index 30f069c..4c32495 100755
--- a/src/usr/local/www/diag_command.php
+++ b/src/usr/local/www/diag_command.php
@@ -31,6 +31,7 @@
 ##|*IDENT=page-diagnostics-command
 ##|*NAME=Diagnostics: Command
 ##|*DESCR=Allow access to the 'Diagnostics: Command' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=diag_command.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/diag_defaults.php b/src/usr/local/www/diag_defaults.php
index 8c1ee6f..fc61e34 100644
--- a/src/usr/local/www/diag_defaults.php
+++ b/src/usr/local/www/diag_defaults.php
@@ -27,6 +27,7 @@
 ##|*IDENT=page-diagnostics-factorydefaults
 ##|*NAME=Diagnostics: Factory defaults
 ##|*DESCR=Allow access to the 'Diagnostics: Factory defaults' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=diag_defaults.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/diag_edit.php b/src/usr/local/www/diag_edit.php
index 10964ea..24dedd7 100644
--- a/src/usr/local/www/diag_edit.php
+++ b/src/usr/local/www/diag_edit.php
@@ -23,6 +23,7 @@
 ##|*IDENT=page-diagnostics-edit
 ##|*NAME=Diagnostics: Edit File
 ##|*DESCR=Allow access to the 'Diagnostics: Edit File' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=diag_edit.php*
 ##|*MATCH=browser.php*
 ##|*MATCH=vendor/filebrowser/browser.php*
diff --git a/src/usr/local/www/system_authservers.php b/src/usr/local/www/system_authservers.php
index 93f0c11..86f96e8 100644
--- a/src/usr/local/www/system_authservers.php
+++ b/src/usr/local/www/system_authservers.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-system-authservers
 ##|*NAME=System: Authentication Servers
 ##|*DESCR=Allow access to the 'System: Authentication Servers' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_authservers.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/system_groupmanager.php b/src/usr/local/www/system_groupmanager.php
index 2a4da45..c36b193 100644
--- a/src/usr/local/www/system_groupmanager.php
+++ b/src/usr/local/www/system_groupmanager.php
@@ -29,6 +29,7 @@
 ##|*IDENT=page-system-groupmanager
 ##|*NAME=System: Group Manager
 ##|*DESCR=Allow access to the 'System: Group Manager' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_groupmanager.php*
 ##|-PRIV
 
@@ -234,15 +235,33 @@ function build_priv_table() {
 	$privhtml .=		'</thead>';
 	$privhtml .=		'<tbody>';
 
+	$user_has_root_priv = false;
+
 	foreach (get_user_privdesc($a_group[$id]) as $i => $priv) {
 		$privhtml .=		'<tr>';
 		$privhtml .=			'<td>' . htmlspecialchars($priv['name']) . '</td>';
-		$privhtml .=			'<td>' . htmlspecialchars($priv['descr']) . '</td>';
+		$privhtml .=			'<td>' . htmlspecialchars($priv['descr']);
+		if (isset($priv['warn']) && ($priv['warn'] == 'standard-warning-root')) {
+			$privhtml .=			' ' . gettext('(admin privilege)');
+			$user_has_root_priv = true;
+		}
+		$privhtml .=			'</td>';
 		$privhtml .=			'<td><a class="fa fa-trash" title="' . gettext('Delete Privilege') . '"	href="system_groupmanager.php?act=delpriv&amp;groupid=' . $id . '&amp;privid=' . $i . '"></a></td>';
 		$privhtml .=		'</tr>';
 
 	}
 
+	if ($user_has_root_priv) {
+		$privhtml .=		'<tr>';
+		$privhtml .=			'<td colspan="2">';
+		$privhtml .=				'<b>' . gettext('Security notice: Users in this group effectively have administrator-level access') . '</b>';
+		$privhtml .=			'</td>';
+		$privhtml .=			'<td>';
+		$privhtml .=			'</td>';
+		$privhtml .=		'</tr>';
+		
+	}
+
 	$privhtml .=		'</tbody>';
 	$privhtml .=	'</table>';
 	$privhtml .= '</div>';
diff --git a/src/usr/local/www/system_groupmanager_addprivs.php b/src/usr/local/www/system_groupmanager_addprivs.php
index 5c25e59..c165078 100644
--- a/src/usr/local/www/system_groupmanager_addprivs.php
+++ b/src/usr/local/www/system_groupmanager_addprivs.php
@@ -28,6 +28,7 @@
 ##|*IDENT=page-system-groupmanager-addprivs
 ##|*NAME=System: Group Manager: Add Privileges
 ##|*DESCR=Allow access to the 'System: Group Manager: Add Privileges' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_groupmanager_addprivs.php*
 ##|-PRIV
 
@@ -111,6 +112,20 @@ function build_priv_list() {
 	return($list);
 }
 
+function get_root_priv_item_text() {
+	global $priv_list;
+
+	$priv_text = "";
+
+	foreach ($priv_list as $pname => $pdata) {
+		if (isset($pdata['warn']) && ($pdata['warn'] == 'standard-warning-root')) {
+			$priv_text .= '<br/>' . $pdata['name'];
+		}
+	}
+
+	return($priv_text);
+}
+
 include("head.inc");
 
 if ($input_errors) {
@@ -161,6 +176,19 @@ $section->addInput(new Form_Input(
 	null
 ))->setHelp('Show only the choices containing this term');
 
+$section->addInput(new Form_StaticText(
+	gettext('Privilege information'),
+	'<span class="help-block">'.
+	gettext('The following privileges effectively give administrator-level access to users in the group' .
+		' because the user gains access to execute general commands, edit system files, ' .
+		' modify users, change passwords or similar:') .
+	'<br/>' .
+	get_root_priv_item_text() .
+	'<br/><br/>' .
+	gettext('Please take care when granting these privileges.') .
+	'</span>'
+));
+
 $btnfilter = new Form_Button(
 	'btnfilter',
 	'Filter',
@@ -205,7 +233,11 @@ events.push(function() {
 				continue;
 			}
 
-			$desc = addslashes(preg_replace("/pfSense/i", $g['product_name'], $pdata['descr']));
+			$desc = preg_replace("/pfSense/i", $g['product_name'], $pdata['descr']);
+			if (isset($pdata['warn']) && ($pdata['warn'] == 'standard-warning-root')) {
+				$desc .= ' ' . gettext('(This privilege effectively gives administrator-level access to users in the group)');
+			}
+			$desc = addslashes($desc);
 			$jdescs .= "descs[{$id}] = '{$desc}';\n";
 			$id++;
 		}
diff --git a/src/usr/local/www/system_usermanager.php b/src/usr/local/www/system_usermanager.php
index fca8657..c52c035 100644
--- a/src/usr/local/www/system_usermanager.php
+++ b/src/usr/local/www/system_usermanager.php
@@ -29,6 +29,7 @@
 ##|*IDENT=page-system-usermanager
 ##|*NAME=System: User Manager
 ##|*DESCR=Allow access to the 'System: User Manager' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_usermanager.php*
 ##|-PRIV
 
@@ -443,6 +444,7 @@ function build_priv_table() {
 	$privhtml .=		'<tbody>';
 
 	$i = 0;
+	$user_has_root_priv = false;
 
 	foreach (get_user_privdesc($a_user[$id]) as $priv) {
 		$group = false;
@@ -453,7 +455,12 @@ function build_priv_table() {
 		$privhtml .=		'<tr>';
 		$privhtml .=			'<td>' . htmlspecialchars($priv['group']) . '</td>';
 		$privhtml .=			'<td>' . htmlspecialchars($priv['name']) . '</td>';
-		$privhtml .=			'<td>' . htmlspecialchars($priv['descr']) . '</td>';
+		$privhtml .=			'<td>' . htmlspecialchars($priv['descr']);
+		if (isset($priv['warn']) && ($priv['warn'] == 'standard-warning-root')) {
+			$privhtml .=			' ' . gettext('(admin privilege)');
+			$user_has_root_priv = true;
+		}
+		$privhtml .=			'</td>';
 		$privhtml .=			'<td>';
 		if (!$group) {
 			$privhtml .=			'<a class="fa fa-trash no-confirm icon-pointer" title="' . gettext('Delete Privilege') . '" id="delprivid' . $i . '"></a>';
@@ -467,6 +474,17 @@ function build_priv_table() {
 		}
 	}
 
+	if ($user_has_root_priv) {
+		$privhtml .=		'<tr>';
+		$privhtml .=			'<td colspan="3">';
+		$privhtml .=				'<b>' . gettext('Security notice: This user effectively has administrator-level access') . '</b>';
+		$privhtml .=			'</td>';
+		$privhtml .=			'<td>';
+		$privhtml .=			'</td>';
+		$privhtml .=		'</tr>';
+		
+	}
+
 	$privhtml .=		'</tbody>';
 	$privhtml .=	'</table>';
 	$privhtml .= '</div>';
diff --git a/src/usr/local/www/system_usermanager_addprivs.php b/src/usr/local/www/system_usermanager_addprivs.php
index 3b2ec2e..8babcd5 100644
--- a/src/usr/local/www/system_usermanager_addprivs.php
+++ b/src/usr/local/www/system_usermanager_addprivs.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-system-usermanager-addprivs
 ##|*NAME=System: User Manager: Add Privileges
 ##|*DESCR=Allow access to the 'System: User Manager: Add Privileges' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_usermanager_addprivs.php*
 ##|-PRIV
 
@@ -109,6 +110,20 @@ function build_priv_list() {
 	return($list);
 }
 
+function get_root_priv_item_text() {
+	global $priv_list;
+
+	$priv_text = "";
+
+	foreach ($priv_list as $pname => $pdata) {
+		if (isset($pdata['warn']) && ($pdata['warn'] == 'standard-warning-root')) {
+			$priv_text .= '<br/>' . $pdata['name'];
+		}
+	}
+
+	return($priv_text);
+}
+
 include("head.inc");
 
 if ($input_errors) {
@@ -151,6 +166,19 @@ $section->addInput(new Form_Input(
 	null
 ))->setHelp('Show only the choices containing this term');
 
+$section->addInput(new Form_StaticText(
+	gettext('Privilege information'),
+	'<span class="help-block">'.
+	gettext('The following privileges effectively give the user administrator-level access ' .
+		' because the user gains access to execute general commands, edit system files, ' .
+		' modify users, change passwords or similar:') .
+	'<br/>' .
+	get_root_priv_item_text() .
+	'<br/><br/>' .
+	gettext('Please take care when granting these privileges.') .
+	'</span>'
+));
+
 $btnfilter = new Form_Button(
 	'btnfilter',
 	'Filter',
@@ -205,7 +233,11 @@ events.push(function() {
 			if (in_array($pname, $a_user['priv'])) {
 				continue;
 			}
-			$desc = addslashes(preg_replace("/pfSense/i", $g['product_name'], $pdata['descr']));
+			$desc = preg_replace("/pfSense/i", $g['product_name'], $pdata['descr']);
+			if (isset($pdata['warn']) && ($pdata['warn'] == 'standard-warning-root')) {
+				$desc .= ' ' . gettext('(This privilege effectively gives administrator-level access to the user)');
+			}
+			$desc = addslashes($desc);
 			$jdescs .= "descs[{$id}] = '{$desc}';\n";
 			$id++;
 		}
diff --git a/src/usr/local/www/system_usermanager_settings.php b/src/usr/local/www/system_usermanager_settings.php
index 4418f4f..501070d 100644
--- a/src/usr/local/www/system_usermanager_settings.php
+++ b/src/usr/local/www/system_usermanager_settings.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-system-usermanager-settings
 ##|*NAME=System: User Manager: Settings
 ##|*DESCR=Allow access to the 'System: User Manager: Settings' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=system_usermanager_settings.php*
 ##|-PRIV