1
|
|
|
<?php |
2
|
|
|
/* |
3
|
|
|
You may not change or alter any portion of this comment or credits |
4
|
|
|
of supporting developers from this source code or any supporting source code |
5
|
|
|
which is considered copyrighted (c) material of the original comment or credit authors. |
6
|
|
|
|
7
|
|
|
This program is distributed in the hope that it will be useful, |
8
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of |
9
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
10
|
|
|
*/ |
11
|
|
|
|
12
|
|
|
namespace Xmf\Module\Helper; |
13
|
|
|
|
14
|
|
|
use Xmf\Module\Helper; |
15
|
|
|
use Xoops\Core\Handler\Factory; |
16
|
|
|
use Xoops\Form\SelectGroup; |
17
|
|
|
|
18
|
|
|
/** |
19
|
|
|
* Methods to help manage permissions within a module |
20
|
|
|
* |
21
|
|
|
* @category Xmf\Module\Helper\Permission |
22
|
|
|
* @package Xmf |
23
|
|
|
* @author trabis <[email protected]> |
24
|
|
|
* @author Richard Griffith <[email protected]> |
25
|
|
|
* @copyright 2011-2016 XOOPS Project (http://xoops.org) |
26
|
|
|
* @license GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html) |
27
|
|
|
* @version Release: 1.0 |
28
|
|
|
* @link http://xoops.org |
29
|
|
|
* @since 1.0 |
30
|
|
|
*/ |
31
|
|
|
class Permission extends AbstractHelper |
32
|
|
|
{ |
33
|
|
|
/** |
34
|
|
|
* @var int |
35
|
|
|
*/ |
36
|
|
|
protected $mid; |
37
|
|
|
|
38
|
|
|
/** |
39
|
|
|
* @var string |
40
|
|
|
*/ |
41
|
|
|
protected $dirname; |
42
|
|
|
|
43
|
|
|
/** |
44
|
|
|
* @var \Xoops\Core\Kernel\Handlers\XoopsGroupPermHandler |
45
|
|
|
*/ |
46
|
|
|
protected $permissionHandler; |
47
|
|
|
|
48
|
|
|
/** |
49
|
|
|
* Initialize parent::__construct calls this after verifying module object. |
50
|
|
|
* |
51
|
|
|
* @return void |
52
|
|
|
*/ |
53
|
|
|
public function init() |
54
|
|
|
{ |
55
|
|
|
$this->mid = $this->module->getVar('mid'); |
56
|
|
|
$this->dirname = $this->module->getVar('dirname'); |
57
|
|
|
$this->permissionHandler = Factory::newSpec()->scheme('kernel')->name('groupperm')->build(); |
|
|
|
|
58
|
|
|
} |
59
|
|
|
|
60
|
|
|
/** |
61
|
|
|
* Check if the user has permission for an item |
62
|
|
|
* |
63
|
|
|
* @param string $gperm_name name of the permission to test |
64
|
|
|
* @param int $gperm_itemid id of the object to check |
65
|
|
|
* |
66
|
|
|
* @return bool true if user has access, false if not |
67
|
|
|
**/ |
68
|
|
|
public function checkPermission($gperm_name, $gperm_itemid) |
69
|
|
|
{ |
70
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
71
|
|
|
$gperm_groupid = \Xoops::getInstance()->getUserGroups(); |
72
|
|
|
|
73
|
|
|
return $this->permissionHandler->checkRight( |
74
|
|
|
$gperm_name, |
75
|
|
|
$gperm_itemid, |
76
|
|
|
$gperm_groupid, |
77
|
|
|
$this->mid |
78
|
|
|
); |
79
|
|
|
} |
80
|
|
|
|
81
|
|
|
/** |
82
|
|
|
* Redirect to a url if user does not have permission for an item |
83
|
|
|
* |
84
|
|
|
* @param string $gperm_name name of the permission to test |
85
|
|
|
* @param int $gperm_itemid id of the object to check |
86
|
|
|
* @param string $url module relative url to redirect to |
87
|
|
|
* @param int $time time in seconds to delay |
88
|
|
|
* @param string $message message to display with redirect |
89
|
|
|
* |
90
|
|
|
* @return void |
91
|
|
|
**/ |
92
|
|
|
public function checkPermissionRedirect( |
93
|
|
|
$gperm_name, |
94
|
|
|
$gperm_itemid, |
95
|
|
|
$url, |
96
|
|
|
$time = 3, |
97
|
|
|
$message = '' |
98
|
|
|
) { |
99
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
100
|
|
|
$gperm_groupid = \Xoops::getInstance()->getUserGroups(); |
101
|
|
|
$permission = $this->permissionHandler->checkRight( |
102
|
|
|
$gperm_name, |
103
|
|
|
$gperm_itemid, |
104
|
|
|
$gperm_groupid, |
105
|
|
|
$this->mid |
106
|
|
|
); |
107
|
|
|
if (!$permission) { |
108
|
|
|
$helper = Helper::getHelper($this->dirname); |
109
|
|
|
$helper->redirect($url, $time, $message); |
|
|
|
|
110
|
|
|
} |
111
|
|
|
} |
112
|
|
|
|
113
|
|
|
/** |
114
|
|
|
* Get array of groups with named permission to an item |
115
|
|
|
* |
116
|
|
|
* @param string $gperm_name name of the permission to test |
117
|
|
|
* @param int $gperm_itemid id of the object to check |
118
|
|
|
* |
119
|
|
|
* @return array groups with permission for item |
120
|
|
|
**/ |
121
|
|
|
public function getGroupsForItem($gperm_name, $gperm_itemid) |
122
|
|
|
{ |
123
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
124
|
|
|
return $this->permissionHandler->getGroupIds($gperm_name, $gperm_itemid, $this->mid); |
125
|
|
|
} |
126
|
|
|
|
127
|
|
|
/** |
128
|
|
|
* Save group permissions for an item |
129
|
|
|
* |
130
|
|
|
* @param string $gperm_name name of the permission to test |
131
|
|
|
* @param int $gperm_itemid id of the object to check |
132
|
|
|
* @param array $groups group ids to grant permission to |
133
|
|
|
* |
134
|
|
|
* @return bool true if no errors |
135
|
|
|
**/ |
136
|
|
|
public function savePermissionForItem($gperm_name, $gperm_itemid, $groups) |
137
|
|
|
{ |
138
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
139
|
|
|
foreach ($groups as $index => $group) { |
140
|
|
|
$groups[$index] = (int) $group; |
141
|
|
|
} |
142
|
|
|
|
143
|
|
|
$result = true; |
144
|
|
|
|
145
|
|
|
// First, delete any existing permissions for this name and id |
146
|
|
|
$this->deletePermissionForItem($gperm_name, $gperm_itemid); |
147
|
|
|
|
148
|
|
|
// Save the new permissions |
149
|
|
|
if (count($groups) > 0) { |
150
|
|
|
foreach ($groups as $group_id) { |
151
|
|
|
$this->permissionHandler->addRight( |
152
|
|
|
$gperm_name, |
153
|
|
|
$gperm_itemid, |
154
|
|
|
$group_id, |
155
|
|
|
$this->mid |
156
|
|
|
); |
157
|
|
|
} |
158
|
|
|
} |
159
|
|
|
|
160
|
|
|
return $result; |
161
|
|
|
} |
162
|
|
|
|
163
|
|
|
/** |
164
|
|
|
* Delete all permissions for an item and a specific name or array of names |
165
|
|
|
* |
166
|
|
|
* @param string|string[] $gperm_name name(s) of the permission to delete |
167
|
|
|
* @param int $gperm_itemid id of the object to check |
168
|
|
|
* |
169
|
|
|
* @return bool true if no errors |
170
|
|
|
*/ |
171
|
|
|
public function deletePermissionForItem($gperm_name, $gperm_itemid) |
172
|
|
|
{ |
173
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
174
|
|
|
if (!is_array($gperm_name)) { |
175
|
|
|
$gperm_name = (array) $gperm_name; |
176
|
|
|
} |
177
|
|
|
$return = true; |
178
|
|
|
foreach ($gperm_name as $pname) { |
179
|
|
|
$return = $return && $this->permissionHandler->deleteByModule($this->mid, $pname, $gperm_itemid); |
180
|
|
|
} |
181
|
|
|
return $return; |
182
|
|
|
} |
183
|
|
|
|
184
|
|
|
/** |
185
|
|
|
* Generate a \Xoops\Form\Element to select groups to grant permission |
186
|
|
|
* to a specific gperm_name and gperm_item. Field will be preset |
187
|
|
|
* with existing permissions. |
188
|
|
|
* |
189
|
|
|
* @param string $gperm_name name of the permission to test |
190
|
|
|
* @param int $gperm_itemid id of the object to check |
191
|
|
|
* @param string $caption caption for form field |
192
|
|
|
* @param string $name name/id of form field |
193
|
|
|
* @param bool $include_anon true to include anonymous group |
194
|
|
|
* @param int $size size of list |
195
|
|
|
* @param bool $multiple true to allow multiple selections |
196
|
|
|
* |
197
|
|
|
* @return SelectGroup |
198
|
|
|
*/ |
199
|
|
|
public function getGroupSelectFormForItem( |
200
|
|
|
$gperm_name, |
201
|
|
|
$gperm_itemid, |
202
|
|
|
$caption, |
203
|
|
|
$name = null, |
204
|
|
|
$include_anon = false, |
205
|
|
|
$size = 5, |
206
|
|
|
$multiple = true |
207
|
|
|
) { |
208
|
|
|
if (empty($name)) { |
209
|
|
|
$name = $this->defaultFieldName($gperm_name, $gperm_itemid); |
210
|
|
|
} |
211
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
212
|
|
|
$value = $this->getGroupsForItem($gperm_name, $gperm_itemid); |
213
|
|
|
$element = new SelectGroup( |
214
|
|
|
$caption, |
215
|
|
|
$name, |
216
|
|
|
$include_anon, |
217
|
|
|
$value, |
218
|
|
|
$size, |
219
|
|
|
$multiple |
220
|
|
|
); |
221
|
|
|
|
222
|
|
|
return $element; |
223
|
|
|
|
224
|
|
|
} |
225
|
|
|
|
226
|
|
|
/** |
227
|
|
|
* Generate a default name for a Xoops\Form\SelectGroup based on |
228
|
|
|
* module, gperm_name and gperm_itemid |
229
|
|
|
* |
230
|
|
|
* @param string $gperm_name name of the permission to test |
231
|
|
|
* @param int $gperm_itemid id of the object to check |
232
|
|
|
* |
233
|
|
|
* @return string |
234
|
|
|
*/ |
235
|
|
|
public function defaultFieldName($gperm_name, $gperm_itemid) |
236
|
|
|
{ |
237
|
|
|
$gperm_itemid = (int) $gperm_itemid; |
238
|
|
|
$name = $this->module->getVar('dirname') . '_' . |
239
|
|
|
$gperm_name . '_' . $gperm_itemid; |
240
|
|
|
|
241
|
|
|
return $name; |
242
|
|
|
} |
243
|
|
|
} |
244
|
|
|
|
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.
For example, imagine you have a variable
$accountId
that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to theid
property of an instance of theAccount
class. This class holds a proper account, so the id value must no longer be false.Either this assignment is in error or a type check should be added for that assignment.