nabble /
ajde
| Conditions | 25 |
| Paths | 768 |
| Total Lines | 246 |
| Code Lines | 134 |
| Lines | 42 |
| Ratio | 17.07 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 215 | public static function doValidation( |
||
| 216 | $entity, |
||
| 217 | $module, |
||
| 218 | $action, |
||
| 219 | $extra, |
||
| 220 | $ownerCallback = false, |
||
| 221 | $parentCallback = false, |
||
| 222 | $determineWildcard = false |
||
| 223 | ) { |
||
| 224 | $uid = self::getUserId(); |
||
| 225 | $usergroup = self::getUsergroupId(); |
||
| 226 | |||
| 227 | $isWildcard = false; |
||
| 228 | |||
| 229 | $callbackHash = ''; |
||
| 230 | if ($ownerCallback !== false && $parentCallback !== false) { |
||
| 231 | $callbackHash = md5(get_class($ownerCallback[0]).get_class($parentCallback[0]).$ownerCallback[1].$parentCallback[1]); |
||
| 232 | } |
||
| 233 | $validationHash = md5($entity.'/'.$module.'/'.$action.'/'.$extra.'/'.$uid.'/'.$usergroup.'/'.$callbackHash); |
||
| 234 | |||
| 235 | if (isset(self::$_aclRulesCache[$validationHash])) { |
||
| 236 | $orderedRules = self::$_aclRulesCache[$validationHash]; |
||
| 237 | } else { |
||
| 238 | |||
| 239 | /* |
||
| 240 | * Allright, this is how things go down here: |
||
| 241 | * We want to check for at least one allowed or owner record in this direction: |
||
| 242 | * |
||
| 243 | * 1. Wildcard usergroup AND module/action |
||
| 244 | * 2. Wildcard user AND module/action |
||
| 245 | * 3. Specific usergroup AND module/action |
||
| 246 | * 4. Specific user AND module/action |
||
| 247 | * 5. Public AND module/action |
||
| 248 | * |
||
| 249 | * Module/action goes down in this order: |
||
| 250 | * |
||
| 251 | * A1. Wildcard module AND wildcard action |
||
| 252 | * A2. Wildcard module AND wildcard action (with extra) |
||
| 253 | * B1. Wildcard module AND specific action |
||
| 254 | * B2. Wildcard module AND specific action (with extra) |
||
| 255 | * C1. Specific module AND wildcard action |
||
| 256 | * C2. Specific module AND wildcard action (with extra) |
||
| 257 | * D1. Specific module AND specific action |
||
| 258 | * D2. Specific module AND specific action (with extra) |
||
| 259 | * |
||
| 260 | * This makes for 20 checks. |
||
| 261 | * |
||
| 262 | * If a denied record is found and no allowed or owner record is present |
||
| 263 | * further down, deny access. |
||
| 264 | */ |
||
| 265 | |||
| 266 | $access = null; |
||
| 267 | |||
| 268 | $moduleAction = [ |
||
| 269 | 'A1' => [ |
||
| 270 | 'module' => '*', |
||
| 271 | 'action' => '*', |
||
| 272 | 'extra' => '*', |
||
| 273 | ], |
||
| 274 | 'A2' => [ |
||
| 275 | 'module' => '*', |
||
| 276 | 'action' => '*', |
||
| 277 | 'extra' => $extra, |
||
| 278 | ], |
||
| 279 | 'B1' => [ |
||
| 280 | 'module' => '*', |
||
| 281 | 'action' => $action, |
||
| 282 | 'extra' => '*', |
||
| 283 | ], |
||
| 284 | 'B2' => [ |
||
| 285 | 'module' => '*', |
||
| 286 | 'action' => $action, |
||
| 287 | 'extra' => $extra, |
||
| 288 | ], |
||
| 289 | 'C1' => [ |
||
| 290 | 'module' => $module, |
||
| 291 | 'action' => '*', |
||
| 292 | 'extra' => '*', |
||
| 293 | ], |
||
| 294 | 'C2' => [ |
||
| 295 | 'module' => $module, |
||
| 296 | 'action' => '*', |
||
| 297 | 'extra' => $extra, |
||
| 298 | ], |
||
| 299 | 'D1' => [ |
||
| 300 | 'module' => $module, |
||
| 301 | 'action' => $action, |
||
| 302 | 'extra' => '*', |
||
| 303 | ], |
||
| 304 | 'D2' => [ |
||
| 305 | 'module' => $module, |
||
| 306 | 'action' => $action, |
||
| 307 | 'extra' => $extra, |
||
| 308 | ], |
||
| 309 | ]; |
||
| 310 | |||
| 311 | $userGroup = [ |
||
| 312 | 1 => ['usergroup', null], |
||
| 313 | 2 => ['user', null], |
||
| 314 | 3 => ['usergroup', $usergroup], |
||
| 315 | 4 => ['user', $uid], |
||
| 316 | 5 => ['public', null], |
||
| 317 | ]; |
||
| 318 | |||
| 319 | /* |
||
| 320 | * Allright, let's prepare the SQL! |
||
| 321 | */ |
||
| 322 | |||
| 323 | // From cache |
||
| 324 | if (isset(self::$_aclCollectionCache[$entity])) { |
||
| 325 | $rules = self::$_aclCollectionCache[$entity]; |
||
| 326 | // Load collection |
||
| 327 | } else { |
||
| 328 | $rules = self::getAclCollection(); |
||
| 329 | $rules->reset(); |
||
| 330 | |||
| 331 | // $moduleActionWhereGroup = new Ajde_Filter_WhereGroup(Ajde_Query::OP_AND); |
||
| 332 | // foreach($moduleAction as $moduleActionPart) { |
||
| 333 | // $group = new Ajde_Filter_WhereGroup(Ajde_Query::OP_OR); |
||
| 334 | // foreach($moduleActionPart as $key => $value) { |
||
| 335 | // $group->addFilter(new Ajde_Filter_Where($key, Ajde_Filter::FILTER_EQUALS, $value, Ajde_Query::OP_AND)); |
||
| 336 | // } |
||
| 337 | // $moduleActionWhereGroup->addFilter($group); |
||
| 338 | // } |
||
| 339 | // |
||
| 340 | // foreach($userGroup as $userGroupPart) { |
||
| 341 | // $group = new Ajde_Filter_WhereGroup(Ajde_Query::OP_OR); |
||
| 342 | // $comparison = is_null($userGroupPart[1]) ? Ajde_Filter::FILTER_IS : Ajde_Filter::FILTER_EQUALS; |
||
| 343 | // $group->addFilter(new Ajde_Filter_Where('type', Ajde_Filter::FILTER_EQUALS, $userGroupPart[0], Ajde_Query::OP_AND)); |
||
| 344 | // if ($userGroupPart[0] !== 'public') { |
||
| 345 | // $group->addFilter(new Ajde_Filter_Where($userGroupPart[0], $comparison, $userGroupPart[1], Ajde_Query::OP_AND)); |
||
| 346 | // } |
||
| 347 | // $group->addFilter($moduleActionWhereGroup, Ajde_Query::OP_AND); |
||
| 348 | // $rules->addFilter($group, Ajde_Query::OP_OR); |
||
| 349 | // } |
||
| 350 | |||
| 351 | // add the entity filter |
||
| 352 | $rules->filterByEntity($entity); |
||
| 353 | |||
| 354 | // do the load |
||
| 355 | $rules->load(); |
||
| 356 | |||
| 357 | self::$_aclCollectionCache[$entity] = $rules; |
||
| 358 | } |
||
| 359 | |||
| 360 | /* |
||
| 361 | * Oempfff... now let's traverse and set the order |
||
| 362 | * |
||
| 363 | * Update: It seems that we can just load the entire ACL table in the collection |
||
| 364 | * and use this traversal to find matching rules instead of executing this |
||
| 365 | * overly complicated SQL query constructed above... |
||
| 366 | */ |
||
| 367 | |||
| 368 | $orderedRules = []; |
||
| 369 | foreach ($userGroup as $ugpKey => $userGroupPart) { |
||
| 370 | $type = $userGroupPart[0]; |
||
| 371 | $ugId = $userGroupPart[1]; |
||
| 372 | foreach ($moduleAction as $maKey => $moduleActionPart) { |
||
| 373 | $module = $moduleActionPart['module']; |
||
| 374 | $action = $moduleActionPart['action']; |
||
| 375 | $extra = $moduleActionPart['extra']; |
||
| 376 | $rule = $rules->findRule($type, $ugId, $module, $action, $extra); |
||
| 377 | if ($rule !== false) { |
||
| 378 | $orderedRules[$ugpKey.$maKey] = $rule; |
||
| 379 | } |
||
| 380 | } |
||
| 381 | } |
||
| 382 | |||
| 383 | self::$_aclRulesCache[$validationHash] = $orderedRules; |
||
| 384 | } |
||
| 385 | |||
| 386 | /* |
||
| 387 | * Finally, determine access |
||
| 388 | */ |
||
| 389 | $extra = ($extra !== '*' && $extra !== '') ? ' ('.$extra.')' : ''; |
||
| 390 | foreach ($orderedRules as $key => $rule) { |
||
| 391 | if ($rule->type === 'public' && self::getUser() === false) { |
||
| 392 | switch ($rule->permission) { |
||
| 393 | View Code Duplication | case 'allow': |
|
| 394 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' allows access for '.$module.'/'.$action.$extra.' (public)'; |
||
| 395 | $access = true; |
||
| 396 | $isWildcard = $rule->extra == '*'; |
||
| 397 | break 2; |
||
| 398 | case 'deny': |
||
| 399 | View Code Duplication | default: |
|
| 400 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' denies access for '.$module.'/'.$action.$extra.' (public)'; |
||
| 401 | $access = false; |
||
| 402 | break; |
||
| 403 | } |
||
| 404 | } else { |
||
| 405 | if ($rule->type !== 'public') { |
||
| 406 | if (self::getUser()) { |
||
| 407 | switch ($rule->permission) { |
||
| 408 | View Code Duplication | case 'deny': |
|
| 409 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' denies access for '.$module.'/'.$action.$extra; |
||
| 410 | $access = false; |
||
| 411 | break; |
||
| 412 | View Code Duplication | case 'own': |
|
| 413 | if (call_user_func_array($ownerCallback, [$uid, $usergroup])) { |
||
| 414 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' allows access for '.$module.'/'.$action.$extra.' (owner)'; |
||
| 415 | $access = true; |
||
| 416 | $isWildcard = $rule->extra == '*'; |
||
| 417 | break 2; |
||
| 418 | } else { |
||
| 419 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' denies access for '.$module.'/'.$action.$extra.' (owner)'; |
||
| 420 | // TODO: or inherit? |
||
| 421 | $access = false; |
||
| 422 | } |
||
| 423 | break; |
||
| 424 | View Code Duplication | case 'parent': |
|
| 425 | if (call_user_func_array($parentCallback, [$uid, $usergroup])) { |
||
| 426 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' allows access for '.$module.'/'.$action.$extra.' (parent)'; |
||
| 427 | $access = true; |
||
| 428 | $isWildcard = $rule->extra == '*'; |
||
| 429 | break 2; |
||
| 430 | } else { |
||
| 431 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' denies access for '.$module.'/'.$action.$extra.' (parent)'; |
||
| 432 | // TODO: or inherit? |
||
| 433 | $access = false; |
||
| 434 | } |
||
| 435 | break; |
||
| 436 | View Code Duplication | case 'allow': |
|
| 437 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' allows access for '.$module.'/'.$action.$extra; |
||
| 438 | $access = true; |
||
| 439 | $isWildcard = $rule->extra == '*'; |
||
| 440 | break 2; |
||
| 441 | } |
||
| 442 | } else { |
||
| 443 | self::$log[] = $key.' match with ACL rule id '.$rule->getPK().' denies access for '.$module.'/'.$action.$extra.' (not logged in)'; |
||
| 444 | $access = false; |
||
| 445 | } |
||
| 446 | } |
||
| 447 | } |
||
| 448 | } |
||
| 449 | |||
| 450 | if (!isset($access)) { |
||
| 451 | self::$log[] = 'No match in ACL rules denies access for '.$module.'/'.$action.$extra; |
||
| 452 | $access = false; |
||
| 453 | } |
||
| 454 | |||
| 455 | if ($determineWildcard) { |
||
| 456 | return $isWildcard; |
||
| 457 | } |
||
| 458 | |||
| 459 | return $access; |
||
| 460 | } |
||
| 461 | } |
||
| 462 |
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.