Menu="Disk Share"
Title="AFP Security Settings"
Tag="apple"
Cond="(($var['shareAFPEnabled']!='no') && (isset($name)?array_key_exists($name,$sec_afp):0))"
---
<?PHP
/* Copyright 2005-2020, Lime Technology
 * Copyright 2012-2020, Bergware International.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version 2,
 * as published by the Free Software Foundation.
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 */
?>
<?
require_once "$docroot/webGui/include/InputSecurity.php";

$width = [123,300];
?>
:help22
> This section is used to configure the security settings for the share when accessed using AFP and
> appears only when AFP is enabled on the Network Services page.
>
> *Read settings from* is used to preset the AFP security settings of the current selected share with the settings of an existing share.
>
> Select the desired share name and press **Read** to copy the AFP security settings from the selected source.
>
> *Write settings to* is used to copy the AFP security settings of the current selected share to one or more other existing shares.
>
> Select the desired destinations and press **Write** to copy the AFP security settings to the selected shares.
:end

<div class="clone1">
<span class="clone">_(Read settings from)_</span><i class="fa fa-arrow-left fa-fw"></i>
<span class="wrap"><select name="readafp" class="clone" onchange="toggleButton('readafp',false)">
<option disabled selected>_(select)_...</option>
<?
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name) echo mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name) echo mk_option("", $list['name'], $list['name']);
}
?>
</select></span><input type="button" id="readafp" value="_(Read)_" class="clone" onclick="readAFP()" disabled>
</div>
<div class="clone2">
<span class="clone">_(Write settings to)_</span><i class="fa fa-arrow-right fa-fw"></i>
<span class="wrap"><select id="afp1" name="writeafp" multiple="multiple" style="display:none" onchange="toggleButton('writeafp',this.id)">
<?
$rows = [];
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name) $rows[] = mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name) $rows[] = mk_option("", $list['name'], $list['name']);
}
if ($rows) echo "<option>("._('All').")</option>";
foreach ($rows as $row) echo $row;
?>
</select></span><input type="button" id="writeafp" value="_(Write)_" class="clone" onclick="writeAFP()" disabled>
</div>

<form markdown="1" name="afp_edit" method="POST" action="/update.htm" target="progressFrame" onchange="toggleButton('writeafp',true);$('#afp1').dropdownchecklist('disable')">
<input type="hidden" name="shareName" value="<?=htmlspecialchars($name)?>">

_(Share name)_:
: <?=htmlspecialchars($name)?>

_(Export)_:
: <select name="shareExportAFP" onchange="checkShareSettingsAFP(this.form)">
  <?=mk_option($sec_afp[$name]['export'], "-", _('No'));?>
  <?=mk_option($sec_afp[$name]['export'], "e", _('Yes'));?>
  <?=mk_option($sec_afp[$name]['export'], "et", _('Yes (Time Machine)'));?>
  </select>

:help23
> The Export setting determines whether this share is exported via AFP (Yes or No)
> The Export setting also includes a third option (Yes - Time Machine).  This setting enables various
> special options for Time Machine; in particular a "volume size limit".  Note: Apple recommends not
> to use the volume for anything but Time Machine due to the way locks are used.
:end

_(Time Machine volume size limit)_:
: <input type="text" name="shareVolsizelimitAFP" maxlen="20" value="<?=$sec_afp[$name]['volsizelimit']?>"> MB

:help24
> This limits the reported volume size, preventing Time Machine from using the entire real disk space
> for backup.  For example, setting this value to "1024" would limit the reported disk space to 1GB.
:end

_(Volume dbpath)_:
: <input type="text" name="shareVoldbpathAFP" maxlen="20" value="<?=htmlspecialchars($sec_afp[$name]['voldbpath'])?>">

:help25
> Sets where to store netatalk database information.  A directory with same name as the share will be
> created here.
>
> Leave this field blank to have the database created in the root of the share.
:end

_(Security)_:
: <select name="shareSecurityAFP">
  <?=mk_option($sec_afp[$name]['security'], "public", _('Public'));?>
  <?=mk_option($sec_afp[$name]['security'], "secure", _('Secure'));?>
  <?=mk_option($sec_afp[$name]['security'], "private", _('Private'));?>
  </select>

:help26
> The Unraid AFP implementation supports Guest access and fully supports the three security
> modes: Public, Secure, and Private.
> In general, when you click on your server's icon in Finder, you will be asked to log in as Guest or to
> specify a set of login credentials (user name/password).  In order to use Secure or Private security on
> a share, you must have a user already defined on the server with appropriate access rights.
>
> Note: netatalk does not permit the user name <tt>root</tt> to be used for log in purposes.
>
> **Public** When logged into the server as Guest, a macOS user can view and read/write all shares set as
> Public.  Files created or modified in the share will be owned by user `nobody` of
> the `users` group.<br>
> macOS users logged in with a user name/password previously created on the server can also view
> and read/write all shares set as Public.  In this case, files created or modified on the server will
> be owned by the logged in user.
>
> **Secure** When logged into the server as Guest, a macOS user can view and read (but not write) all
> shares set as Secure.<br>
> macOS users logged in with a user name/password previously created on the server can also view and
> read all shares set as Secure.  If their access right is set to read/write for the share on the server,
> they may also write the share.
>
> **Private** When logged onto the server as Guest, no Private shares are visible or accessible to any
> macOS user.<br>
> macOS users logged in with a user name/password previously created on the server may read or
> read/write (or have no access) according their access right for the share on the server.
:end

&nbsp;
: <input type="submit" name="changeShareSecurityAFP" value="_(Apply)_" disabled><input type="button" value="_(Done)_" onclick="done()">
</form>

<?if ($sec_afp[$name]['security'] == 'secure'):?>
<div id="title" class="nocontrol"><dt>_(AFP)_ _(User Access)_</dt><i>_(Guests have **read-only** access)_.</i></div>

:help27
> *Read settings from* is used to preset the AFP User Access settings of the current selected share with the settings of an existing share.
>
> Select the desired share name and press **Read** to copy the AFP security settings from the selected source.
>
> *Write settings to* is used to copy the AFP User Access settings of the current share to one or more other existing shares.
>
> Select the desired destinations and press **Write** to copy the AFP User access settings to the selected shares.
:end

<div class="clone1">
<span class="clone">_(Read settings from)_</span><i class="fa fa-arrow-left fa-fw"></i>
<span class="wrap"><select name="readuserafp" class="clone" onchange="toggleButton('readuserafp',false)">
<option disabled selected>_(select)_...</option>
<?
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='secure') echo mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='secure') echo mk_option("", $list['name'], $list['name']);
}
?>
</select></span><input type="button" id="readuserafp" value="_(Read)_" class="clone" onclick="readUserAFP()" disabled>
</div>
<div class="clone2">
<span class="clone">_(Write settings to)_</span><i class="fa fa-arrow-right fa-fw"></i>
<span class="wrap"><select id="afp2" name="writeuserafp" multiple="multiple" style="display:none" onchange="toggleButton('writeuserafp',this.id)">
<?
$rows = [];
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='secure') $rows[] = mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='secure') $rows[] = mk_option("", $list['name'], $list['name']);
}
if ($rows) echo "<option>("._('All').")</option>";
foreach ($rows as $row)echo $row;
?>
</select></span><input type="button" id="writeuserafp" value="_(Write)_" class="clone" onclick="writeUserAFP()" disabled>
</div>

<form markdown="1" name="afp_user_edit" method="POST" action="/update.htm" target="progressFrame" onchange="toggleButton('writeuserafp',true);$('#afp2').dropdownchecklist('disable')">
<input type="hidden" name="shareName" value="<?=htmlspecialchars($name)?>">
<?input_secure_users($sec_afp);?>

&nbsp;
: <input type="submit" name="changeShareAccessAFP" value="_(Apply)_" disabled><input type="button" value="_(Done)_" onclick="done()">
</form>

<?elseif ($sec_afp[$name]['security'] == 'private'):?>
<div id="title" class="nocontrol"><dt>_(AFP)_ _(User Access)_</dt><i>_(Guests have **no** access)_.</i></div>

:help28
> *Read settings from* is used to preset the AFP User Access settings of the current selected share with the settings of an existing share.
>
> Select the desired share name and press **Read** to copy the AFP security settings from the selected source.
>
> *Write settings to* is used to copy the AFP User Access settings of the current share to one or more other existing shares.
>
> Select the desired destinations and press **Write** to copy the AFP User access settings to the selected shares.
:end

<div class="clone1">
<span class="clone">_(Read settings from)_</span><i class="fa fa-arrow-left fa-fw"></i>
<span class="wrap"><select name="readuserafp" class="clone" onchange="toggleButton('readuserafp',false)">
<option disabled selected>_(select)_...</option>
<?
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='private') echo mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='private') echo mk_option("", $list['name'], $list['name']);
}
?>
</select></span><input type="button" id="readuserafp" value="_(Read)_" class="clone" onclick="readUserAFP()" disabled>
</div>
<div class="clone2">
<span class="clone">_(Write settings to)_</span><i class="fa fa-arrow-right fa-fw"></i>
<span class="wrap"><select id="afp2" name="writeuserafp" multiple="multiple" style="display:none" onchange="toggleButton('writeuserafp',this.id)">
<?
$rows = [];
if (isset($disks[$name])) {
  foreach (array_filter($disks,'clone_list') as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='private') $rows[] = mk_option("", $list['name'], my_lang(my_disk($list['name']),3));
} else {
  foreach ($shares as $list) if ($list['name']!=$name && $sec_afp[$list['name']]['security']=='private') $rows[] = mk_option("", $list['name'], $list['name']);
}
if ($rows) echo "<option>("._('All').")</option>";
foreach($rows as $row) echo $row;
?>
</select></span><input type="button" id="writeuserafp" value="_(Write)_" class="clone" onclick="writeUserAFP()" disabled>
</div>

<form markdown="1" name="afp_user_edit" method="POST" action="/update.htm" target="progressFrame" onchange="toggleButton('writeuserafp',true);$('#afp2').dropdownchecklist('disable')">
<input type="hidden" name="shareName" value="<?=htmlspecialchars($name)?>">
<?input_private_users($sec_afp);?>

&nbsp;
: <input type="submit" name="changeShareAccessAFP" value="_(Apply)_" disabled><input type="button" value="_(Done)_" onclick="done()">
</form>
<?endif;?>

<script>
$(function() {
  checkShareSettingsAFP(document.afp_edit);
  initDropdownAFP(false);
<?if ($tabbed):?>
  $('<?=$path=='Shares/Share'?'#tab2':'#tab1'?>').bind({click:function(){initDropdownAFP(true);}});
<?endif;?>
<?if (count($users)==1):?>
  toggleButton('readuserafp',true);
  toggleButton('writeuserafp',true);
  $('#afp2').dropdownchecklist('disable');
<?endif;?>
});
function checkShareSettingsAFP(form) {
  form.shareVolsizelimitAFP.disabled = form.shareExportAFP.value!="et";
}
function initDropdownAFP(reset) {
  if (reset) {
    $('#afp1').dropdownchecklist('destroy');
    $('#afp2').dropdownchecklist('destroy');
  }
  $("#afp1").dropdownchecklist({firstItemChecksAll:true, emptyText:'_(select)_...', width:<?=$width[0]?>, explicitClose:'..._(close)_'});
  $("#afp2").dropdownchecklist({firstItemChecksAll:true, emptyText:'_(select)_...', width:<?=$width[0]?>, explicitClose:'..._(close)_'});
}
function readAFP() {
  var form = document.afp_edit;
  var name = $('select[name="readafp"]').val();
  $.get('/webGui/include/ProtocolData.php',{protocol:'afp',name:name},function(json) {
    var data = $.parseJSON(json);
    form.shareExportAFP.value = data.export;
    form.shareVolsizelimitAFP.value = data.volsizelimit;
    form.shareVoldbpathAFP.value = data.voldbpath;
    form.shareSecurityAFP.value = data.security;
  });
  $(form).find('select').trigger('change');
}
function writeAFP(data,n,i) {
  if (data) {
    if (n<i) {
      $.post('/update.htm',data[n], function(){setTimeout(function(){writeAFP(data,++n,i);},3000);});
    } else {
      toggleButton('writeafp',false);
      $('div.spinner.fixed').hide();
    }
  } else {
    $('select#afp1 option').map(function(i) {
      if ($(this).prop('selected')==true && $(this).val()!='(_(All)_)') {
        data[i] = {};
        data[i]['shareName'] = $(this).val();
        data[i]['shareExportAFP'] = '<?=addslashes(htmlspecialchars($sec_afp[$name]['export']))?>';
        data[i]['shareVolsizelimitAFP'] = '<?=addslashes(htmlspecialchars($sec_afp[$name]['volsizelimit']))?>';
        data[i]['shareVoldbpathAFP'] = '<?=addslashes(htmlspecialchars($sec_afp[$name]['voldbpath']))?>';
        data[i]['shareSecurityAFP'] = '<?=addslashes(htmlspecialchars($sec_afp[$name]['security']))?>';
        data[i]['changeShareSecurityAFP'] = 'Apply';
        i++;
      }
    });
    toggleButton('writeafp',true);
    $('div.spinner.fixed').show('slow');
    writeAFP(data,0,i);
  }
}
function readUserAFP() {
  var form = document.afp_user_edit;
  var name = $('select[name="readuserafp"]').val();
  var users = {};
<?
  foreach ($users as $user) {
    if ($user['name'] == "root") continue;
    echo "users['{$user['name']}'] = {$user['idx']};\n";
  }
?>
  $.get('/webGui/include/ProtocolData.php',{protocol:'afp',name:name},function(json) {
    var data = $.parseJSON(json);
    var readList = data.readList.split(',');
    var writeList = data.writeList.split(',');
    $(form).find('select[name^="userAccess."]').each(function(){$(this).val('no-access');});
    for (var i=0; i < readList.length; i++) $(form).find('select[name="userAccess.'+users[readList[i]]+'"]').val('read-only');
    for (var i=0; i < writeList.length; i++) $(form).find('select[name="userAccess.'+users[writeList[i]]+'"]').val('read-write');
  });
  $(form).find('select').trigger('change');
}
function writeUserAFP(data,n,i) {
  if (data) {
    if (n<i) {
      $.post('/update.htm',data[n], function(){setTimeout(function(){writeUserAFP(data,++n,i);},3000);});
    } else {
      toggleButton('writeuserafp',false);
      $('div.spinner.fixed').hide();
    }
  } else {
    var data = [], i = 0;
    $('select#afp2 option').map(function(i) {
      if ($(this).prop('selected')==true && $(this).val()!='(All)') {
        data[i] = {};
        data[i]['shareName'] = $(this).val();
        data[i]['userAccess.0'] = 'no-access';
<?
        $read_list = explode(",", $sec_afp[$name]['readList']);
        $write_list = explode(",", $sec_afp[$name]['writeList']);
        foreach ($users as $user) {
          if ($user['name'] == "root") continue;
          $idx = $user['idx'];
          $userAccess = null;
          if ($sec_afp[$name]['security']=='secure') {
            $userAccess = in_array($user['name'], $write_list) ? "read-write" : "read-only";
          } elseif ($sec_afp[$name]['security'] == 'private') {
            $userAccess = in_array($user['name'], $write_list) ? "read-write" : (in_array($user['name'], $read_list) ? "read-only" : "no-access");
          }
          if ($userAccess) echo "data[i]['userAccess.$idx'] = '$userAccess';\n";
        }
?>
        data[i]['changeShareAccessAFP'] = 'Apply';
        i++;
      }
    });
    toggleButton('writeuserafp',true);
    $('div.spinner.fixed').show('slow');
    writeUserAFP(data,0,i);
  }
}
</script>