App\Privilege::checkPermission()

Complexity

Conditions	104
Paths	3758

Size

Total Lines	276
Code Lines	208

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	23
CRAP Score	7672.5398

Importance

Changes

0

<?php
	public static function checkPermission($moduleName, $actionName = null, $record = false, $userId = false)
	{
		\App\Log::trace("Entering isPermitted($moduleName,$actionName,$record,$userId) method ...");
		if (!$userId) {
			$userId = \App\User::getCurrentUserId();
		}
		$userId = (int) $userId;
		$userPrivileges = \App\User::getPrivilegesFile($userId);
		$permission = false;
		$tabId = Module::getModuleId($moduleName);
		if ('Settings' !== Request::_get('parent')) {

The method _get() does not exist on App\Request. Since you implemented __callStatic, consider adding a @method annotation.

			if ('Users' === $moduleName && $record == \App\User::getCurrentUserId()) {
				static::$isPermittedLevel = 'SEC_IS_CURRENT_USER';
				\App\Log::trace('Exiting isPermitted method ... - yes');
				return true;
			}
		} elseif (false === $tabId) {
			$permission = $userPrivileges['is_admin'] ? true : false;
			static::$isPermittedLevel = 'SEC_ADMINISTRATION_MODULE_' . ($permission ? 'YES' : 'NO');
			\App\Log::trace('Exiting isPermitted method ... - ' . ($permission) ? 'YES' : 'NO');
			return $permission;
		}
		if (!Module::isModuleActive($moduleName)) {
			static::$isPermittedLevel = 'SEC_MODULE_IS_INACTIVE';
			\App\Log::trace('Exiting isPermitted method ... - yes');
			return false;
		}
		$actionId = Module::getActionId($actionName);
		//Checking whether the user is admin
		if ($userPrivileges['is_admin']) {
			if ($record && 'Users' !== $moduleName) {
				$recordMetaData = \vtlib\Functions::getCRMRecordMetadata($record);
				if (empty($recordMetaData)) {
					static::$isPermittedLevel = 'SEC_RECORD_DOES_NOT_EXIST';
					\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_DOES_NOT_EXIST');
					return false;
				}
				if (0 !== $recordMetaData['deleted'] && (1 === $actionId || 0 === $actionId || 17 === $actionId)) {
					switch ($recordMetaData['deleted']) {
						case 1:
							static::$isPermittedLevel = 'SEC_RECORD_DELETED';
							\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_DELETED');
							break;
						case 2:
							static::$isPermittedLevel = 'SEC_RECORD_ARCHIVED';
							\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_ARCHIVED');
							break;
						default:
							break;
					}
					return false;
				}
			}
			static::$isPermittedLevel = 'SEC_USER_IS_ADMIN';
			\App\Log::trace('Exiting isPermitted method ... - SEC_USER_IS_ADMIN');
			return true;
		}
		//If no actionid, then allow action is vtiger_tab permission is available
		if ('' === $actionId || null === $actionId) {
			if (isset($userPrivileges['profile_tabs_permission'][$tabId]) && 0 == $userPrivileges['profile_tabs_permission'][$tabId]) {
				$permission = true;
			} else {
				$permission = false;
			}
			static::$isPermittedLevel = 'SEC_NO_ACTION_MODULE_PERMISSIONS' . ($permission ? 'YES' : 'NO');
			\App\Log::trace('Exiting isPermitted method ... - ' . static::$isPermittedLevel);
			return $permission;
		}
		//Checking for vtiger_tab permission
		if (!isset($userPrivileges['profile_tabs_permission'][$tabId]) || 0 != $userPrivileges['profile_tabs_permission'][$tabId]) {
			static::$isPermittedLevel = 'SEC_MODULE_PERMISSIONS_NO';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_PERMISSIONS_NO');
			return false;
		}
		if (false === $actionId) {

The condition false === $actionId is always false.

			static::$isPermittedLevel = 'SEC_ACTION_DOES_NOT_EXIST';
			\App\Log::trace('Exiting isPermitted method ... - SEC_ACTION_DOES_NOT_EXIST');
			return false;
		}
		//Checking for Action Permission
		if (!isset($userPrivileges['profile_action_permission'][$tabId][$actionId])) {
			static::$isPermittedLevel = 'SEC_MODULE_NO_ACTION_TOOL';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_NO_ACTION_TOOL');
			return false;
		}
		if (\strlen($userPrivileges['profile_action_permission'][$tabId][$actionId]) < 1 && '' === $userPrivileges['profile_action_permission'][$tabId][$actionId]) {
			static::$isPermittedLevel = 'SEC_MODULE_RIGHTS_TO_ACTION';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_RIGHTS_TO_ACTION');
			return true;
		}
		if (0 != $userPrivileges['profile_action_permission'][$tabId][$actionId] && '' != $userPrivileges['profile_action_permission'][$tabId][$actionId]) {
			static::$isPermittedLevel = 'SEC_MODULE_NO_RIGHTS_TO_ACTION';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_NO_RIGHTS_TO_ACTION');
			return false;
		}
		//Checking for view all permission
		if ((0 == $userPrivileges['profile_global_permission'][1] || 0 == $userPrivileges['profile_global_permission'][2]) && (3 == $actionId || 4 == $actionId)) {
			static::$isPermittedLevel = 'SEC_MODULE_VIEW_ALL_PERMISSION';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_VIEW_ALL_PERMISSION');
			return true;
		}
		//Checking for edit all permission
		if (0 == $userPrivileges['profile_global_permission'][2] && (3 == $actionId || 4 == $actionId || 0 == $actionId || 1 == $actionId)) {
			static::$isPermittedLevel = 'SEC_MODULE_EDIT_ALL_PERMISSION';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_EDIT_ALL_PERMISSION');
			return true;
		}
		//Checking and returning true if recorid is null
		if (empty($record)) {
			static::$isPermittedLevel = 'SEC_RECORD_ID_IS_NULL';
			\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_ID_IS_NULL');
			return true;
		}
		//If modules is Products,Vendors,Faq,PriceBook then no sharing
		if (1 === Module::getModuleOwner($tabId)) {
			static::$isPermittedLevel = 'SEC_MODULE_IS_OWNEDBY';
			\App\Log::trace('Exiting isPermitted method ... - SEC_MODULE_IS_OWNEDBY');
			return true;
		}

		$recordMetaData = \vtlib\Functions::getCRMRecordMetadata($record);
		if (empty($recordMetaData)) {
			static::$isPermittedLevel = 'SEC_RECORD_DOES_NOT_EXIST';
			\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_DOES_NOT_EXIST');
			return false;
		}
		if (0 !== $recordMetaData['deleted'] && (1 === $actionId || 0 === $actionId || 17 === $actionId)) {
			switch ($recordMetaData['deleted']) {
				case 1:
					static::$isPermittedLevel = 'SEC_RECORD_DELETED';
					\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_DELETED');
					break;
				case 2:
					static::$isPermittedLevel = 'SEC_RECORD_ARCHIVED';
					\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_ARCHIVED');
					break;
				default:
					break;
			}
			return false;
		}
		if (\App\Config::security('PERMITTED_BY_PRIVATE_FIELD') && $recordMetaData['private']
			&& ($fieldInfo = \App\Field::getFieldInfo('private', $recordMetaData['setype'])) && \in_array($fieldInfo['presence'], [0, 2])) {
			$level = 'SEC_PRIVATE_RECORD_NO';
			$isPermittedPrivateRecord = false;
			$recOwnId = $recordMetaData['smownerid'];
			$recOwnType = \App\Fields\Owner::getType($recOwnId);
			if ('Users' === $recOwnType) {

The condition 'Users' === $recOwnType is always false.

				if ($userId === $recOwnId) {
					$level = 'SEC_PRIVATE_RECORD_OWNER_CURRENT_USER';
					$isPermittedPrivateRecord = true;
				}
			} elseif ('Groups' === $recOwnType) {

The condition 'Groups' === $recOwnType is always false.

				if (\in_array($recOwnId, $userPrivileges['groups'])) {
					$level = 'SEC_PRIVATE_RECORD_OWNER_CURRENT_GROUP';
					$isPermittedPrivateRecord = true;
				}
			}
			if (!$isPermittedPrivateRecord && \App\Config::security('PERMITTED_BY_SHARED_OWNERS')) {

The condition $isPermittedPrivateRecord is always false.

				$shownerIds = Fields\SharedOwner::getById($record);
				if (\in_array($userId, $shownerIds) || \count(array_intersect($shownerIds, $userPrivileges['groups'])) > 0) {
					$level = 'SEC_PRIVATE_RECORD_SHARED_OWNER';
					$isPermittedPrivateRecord = true;
				}
			}
			static::$isPermittedLevel = $level;
			\App\Log::trace('Exiting isPermitted method ... - ' . static::$isPermittedLevel);
			return $isPermittedPrivateRecord;
		}
		// Check advanced permissions
		if (\App\Config::security('PERMITTED_BY_ADVANCED_PERMISSION')) {
			$prvAdv = PrivilegeAdvanced::checkPermissions($record, $moduleName, $userId);
			if (false !== $prvAdv) {
				if (0 === $prvAdv) {
					static::$isPermittedLevel = 'SEC_ADVANCED_PERMISSION_NO';
					\App\Log::trace('Exiting isPermitted method ... - SEC_ADVANCED_PERMISSION_NO');
					return false;
				}
				static::$isPermittedLevel = 'SEC_ADVANCED_PERMISSION_YES';
				\App\Log::trace('Exiting isPermitted method ... - SEC_ADVANCED_PERMISSION_YES');
				return true;
			}
		}
		if (($modules = \App\Config::security('permittedModulesByCreatorField')) && \in_array($moduleName, $modules) && $userId === $recordMetaData['smcreatorid']) {
			if (3 == $actionId || 4 == $actionId) {
				static::$isPermittedLevel = 'SEC_RECORD_CREATOR_CURRENT_USER_READ_ACCESS';
				\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_CREATOR_CURRENT_USER_READ_ACCESS');
				return true;
			}
			if (\App\Config::security('permittedWriteAccessByCreatorField') && (0 == $actionId || 1 == $actionId)) {
				static::$isPermittedLevel = 'SEC_RECORD_CREATOR_CURRENT_USER_WRITE_ACCESS';
				\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_CREATOR_CURRENT_USER_WRITE_ACCESS');
				return true;
			}
		}
		if (\App\Config::security('PERMITTED_BY_SHARED_OWNERS')) {
			$shownerids = Fields\SharedOwner::getById($record);
			if (\in_array($userId, $shownerids) || \count(array_intersect($shownerids, $userPrivileges['groups'])) > 0) {
				static::$isPermittedLevel = 'SEC_RECORD_SHARED_OWNER';
				\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_SHARED_OWNER');
				return true;
			}
		}
		//Retreiving the RecordOwnerId
		$recOwnId = $recordMetaData['smownerid'];
		$recOwnType = Fields\Owner::getType($recOwnId);
		if ('Users' === $recOwnType) {

The condition 'Users' === $recOwnType is always false.

			//Checking if the Record Owner is the current User
			if ($userId === $recOwnId) {
				static::$isPermittedLevel = 'SEC_RECORD_OWNER_CURRENT_USER';
				\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_OWNER_CURRENT_USER');
				return true;
			}
			if (\App\Config::security('PERMITTED_BY_ROLES')) {
				//Checking if the Record Owner is the Subordinate User
				foreach ($userPrivileges['subordinate_roles_users'] as $usersByRole) {
					if (isset($usersByRole[$recOwnId])) {
						static::$isPermittedLevel = 'SEC_RECORD_OWNER_SUBORDINATE_USER';
						\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_OWNER_SUBORDINATE_USER');
						return true;
					}
				}
			}
		} elseif ('Groups' === $recOwnType) {

The condition 'Groups' === $recOwnType is always false.

			//Checking if the record owner is the current user's group
			if (\in_array($recOwnId, $userPrivileges['groups'])) {
				static::$isPermittedLevel = 'SEC_RECORD_OWNER_CURRENT_GROUP';
				\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_OWNER_CURRENT_GROUP');
				return true;
			}
		}
		if (\App\Config::security('PERMITTED_BY_RECORD_HIERARCHY')) {
			$userPrivilegesModel = \Users_Privileges_Model::getInstanceById($userId);
			$role = $userPrivilegesModel->getRoleDetail();
			if (((3 == $actionId || 4 == $actionId) && 0 != $role->get('previewrelatedrecord')) || ((0 == $actionId || 1 == $actionId) && 0 != $role->get('editrelatedrecord'))) {

It seems like you are loosely comparing $role->get('editrelatedrecord') of type mixed|null to 0; this is ambiguous as not only 0 == 0 is true, but null == 0 is true, too. Consider using a strict comparison ===.

Consider adding parentheses for clarity. Current Interpretation: (3 == $actionId || 4 == $actionId && 0 != $role->get('previewrelatedrecord')) || 0 == $actionId || 1 == $actionId && 0 != $role->get('editrelatedrecord'), Probably Intended Meaning: 3 == $actionId || 4 == $actionId && (0 != $role->get('previewrelatedrecord') || 0 == $actionId || 1 == $actionId && 0 != $role->get('editrelatedrecord'))

It seems like you are loosely comparing $role->get('previewrelatedrecord') of type mixed|null to 0; this is ambiguous as not only 0 == 0 is true, but null == 0 is true, too. Consider using a strict comparison ===.

				$parentRecord = \Users_Privileges_Model::getParentRecord($record, $moduleName, $role->get('previewrelatedrecord'), $actionId);

$actionId of type integer is incompatible with the type type expected by parameter $actionid of Users_Privileges_Model::getParentRecord().

				if ($parentRecord && Record::isExists($parentRecord)) {
					$recordMetaData = \vtlib\Functions::getCRMRecordMetadata($parentRecord);
					$permissionsRoleForRelatedField = $role->get('permissionsrelatedfield');
					$permissionsRelatedField = '' === $permissionsRoleForRelatedField ? [] : explode(',', $role->get('permissionsrelatedfield'));
					$relatedPermission = false;
					foreach ($permissionsRelatedField as $row) {
						switch ($row) {
							case 0:
								$relatedPermission = $recordMetaData['smownerid'] === $userId || \in_array($recordMetaData['smownerid'], $userPrivileges['groups']);
								break;
							case 1:
								$relatedPermission = \in_array($userId, Fields\SharedOwner::getById($parentRecord));
								break;
							case 2:
								if (\App\Config::security('PERMITTED_BY_SHARING')) {
									$relatedPermission = static::isPermittedBySharing($recordMetaData['setype'], Module::getModuleId($recordMetaData['setype']), $actionId, $parentRecord, $userId);
								}
								break;
							case 3:
								$relatedPermission = static::isPermitted($recordMetaData['setype'], 'DetailView', $parentRecord);
								break;
							default:
								break;
						}
						if ($relatedPermission) {
							static::$isPermittedLevel = 'SEC_RECORD_HIERARCHY_USER';
							\App\Log::trace('Exiting isPermitted method ... - SEC_RECORD_HIERARCHY_USER');
							return true;
						}
					}
				}
			}
		}
		if (\App\Config::security('PERMITTED_BY_SHARING')) {
			$permission = static::isPermittedBySharing($moduleName, $tabId, $actionId, $record, $userId);
		}
		static::$isPermittedLevel = 'SEC_RECORD_BY_SHARING_' . ($permission ? 'YES' : 'NO');
		\App\Log::trace('Exiting isPermitted method ... - ' . static::$isPermittedLevel);

		return $permission;
	}