Peter M. Groen / knowledgetree

Commit c3b6a7b1e08d2e8ea35ddd78c56ed249186acee9

Authored by rob
1 parent 48f59064

Updated to work with new tables and objects 


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@512 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 95 additions and 54 deletions
lib/security/permission.inc
  View file @c3b6a7b
... ... @@ -27,8 +27,8 @@ class Permission {
27 27 * @return boolean true if the current user has document write permission, false otherwise and set $_SESSION["errorMessage"]
28 28 */
29 29 function userHasDocumentWritePermission($iDocumentID) {
30   - if (Permission::userHasFolderWritePermission(DocumentLib::getDocumentFolderID($iDocumentID)) ||
31   - Permission::userHasWriteRoleForFolder($iDocumentID)) {
  30 + $oDocument = & Document::get($iDocumentID);
  31 + if (Permission::userHasFolderWritePermission($oDocument->getFolderID()) {
32 32 return true;
33 33 }
34 34 $_SESSION["errorMessage"] = $lang_err_user_doc_write . "id " . $iDocumentID;
... ... @@ -37,7 +37,8 @@ class Permission {
37 37  
38 38 /**
39 39 * Checks if the current user has read permission for a specific document.
40   - * To have document read permission the user must satisfy ONE of the following conditions:
  40 + * To have document read permission the folder must be public or the user must satisfy ONE of the following conditions:
  41 + * o have write permission for the document
41 42 * o have read permission for the folder in which the document resides
42 43 * o be assigned a role which has read permission for the document
43 44 *
... ... @@ -47,8 +48,8 @@ class Permission {
47 48 */
48 49 function userHasDocumentReadPermission($iDocumentID) {
49 50 $oDocument = & Document::get($iDocumentID);
50   - if (Permission::userHasFolderReadPermission($oDocument->getFolderID()) ||
51   - Permission::userHasReadRoleForFolder($iDocumentID)) {
  51 + if (Permission::userHasDocumentWritePermission($iDocumentID) ||
  52 + Permission::userHasFolderReadPermission($oDocument->getFolderID()) {
52 53 return true;
53 54 }
54 55 $_SESSION["errorMessage"] = $lang_err_user_doc_read . "id " . $iDocumentID;
... ... @@ -60,7 +61,8 @@ class Permission {
60 61 * To have write permission on a folder the user must satisfy ONE of the following conditions:
61 62 * o be in the system administrator group
62 63 * o be in the unit administrator group for the unit to which the folder belongs
63   - * o belong to a group that has write access to the folder
  64 + * o belong to a group that has write access to the folder
  65 + * o be assigned a role that has write access to the folder
64 66 *
65 67 * @param $iFolderID Primary key of folder to check
66 68 *
... ... @@ -69,8 +71,9 @@ class Permission {
69 71 function userHasFolderWritePermission($iFolderID) {
70 72 global $lang_err_user_folder_write;
71 73 if (Permission::userHasGroupWritePermissionForFolder($iFolderID) ||
72   - Permission::userIsInGroupName("System Administrators") ||
73   - Permission::userIsInUnitAdministratorGroup($iFolderID)) {
  74 + Permission::userHasWriteRoleForFolder($iFolderID) ||
  75 + Permission::userIsSystemAdministrator() ||
  76 + Permission::userIsUnitAdministrator($iFolderID)) {
74 77 return true;
75 78 }
76 79 $_SESSION["errorMessage"] = $lang_err_user_folder_write . "id " . $iFolderID;
... ... @@ -80,10 +83,10 @@ class Permission {
80 83  
81 84 /**
82 85 * Checks if the current user has read permission for a specific folder
83   - * To have read permission on a folder the user must satisfy ONE of the following conditions
  86 + * To have read permission on a folder, the folder must be public or the user must satisfy ONE of the following conditions
84 87 * o have write permission for the folder
85 88 * o belong to a group that has read access to the folder
86   - * o the folder is a public folder
  89 + * o be assigned a role that has read permission for the folder
87 90 *
88 91 * @param $iFolderID Primary key of folder to check
89 92 *
... ... @@ -93,7 +96,8 @@ class Permission {
93 96 global $lang_err_user_folder_write;
94 97 if (Permission::folderIsPublic($iFolderID) ||
95 98 Permission::userHasFolderWritePermission($iFolderID) ||
96   - Permission::userHasGroupReadPermissionForFolder($iFolderID)) {
  99 + Permission::userHasGroupReadPermissionForFolder($iFolderID))
  100 + Permission::userHasReadRoleForFolder($iFolderID) {
97 101 return true;
98 102 }
99 103 $_SESSION["errorMessage"] = $lang_err_user_folder_write . "id " . $iFolderID;
... ... @@ -118,33 +122,6 @@ class Permission {
118 122 return false;
119 123 }
120 124  
121   -
122   - /**
123   - * Checks if the current user is in the unit administrator group for the unit
124   - * to which the folder belongs
125   - *
126   - * @param $iFolderID Primary key of folder to check
127   - *
128   - * @return boolean true if the user has folder write permission, false otherwise and set $_SESSION["errorMessage"]
129   - *
130   - * @todo Remove hardcoding of 'Unit Administrators'
131   - */
132   - function userIsInUnitAdministratorGroup($iFolderID) {
133   - global $lang_err_user_unitadmin_group, $default;
134   - $sql = new Owl_DB();
135   - $sql->query("SELECT * FROM " . $default->owl_groups_folders_table ." AS GFL INNER JOIN " . $default->owl_users_groups_table . " as GUL ON GFL.group_id = GUL.group_id " .
136   - "INNER JOIN " . $default->owl_groups_table . " AS G ON G.ID = GFL.group_id " .
137   - "WHERE GFL.folder_id = " . $iFolderID . " " .
138   - "AND GUL.user_id = " . $_SESSION["userID"] . " " .
139   - "AND G.Name = 'Unit Administrators' ");
140   - if ($sql->next_record()) {
141   - return true;
142   - }
143   - $_SESSION["errorMessage"] = $lang_err_user_unitadmin_group . " id = " . $iFolderID;
144   - return false;
145   -
146   - }
147   -
148 125 /**
149 126 * Checks if the current user has write permission through group membership for a particular folder
150 127 *
... ... @@ -154,13 +131,12 @@ class Permission {
154 131 */
155 132 function userHasGroupWritePermissionForFolder($iFolderID) {
156 133 global $default, $lang_err_user_folder_write;
157   - $sql = new Owl_DB();
158   - //$sql->query("SELECT * FROM " . $default->owl_groups_folders_table . " WHERE folder_id = " . $iFolderID . " AND user_id = " . $_SESSION["userID"] . " AND can_write = 1");
159   - $sql->query("SELECT * FROM " . $default->owl_groups_folders_table . " GLF, $default->owl_users_groups_table GUL " .
160   - " WHERE GLF.folder_id = " . $iFolderID .
161   - " AND GUL.user_id = " . $_SESSION["userID"] .
162   - " AND GLF.group_id = GUL.group_id " .
163   - " AND can_write = 1");
  134 + $sql = new Owl_DB();
  135 + $sql->query("SELECT GFL.folder_id " .
  136 + "FROM groups_folders_link AS GFL INNER JOIN users_groups_link AS UGL ON GFL.group_id = UGL.group_id " .
  137 + "WHERE UGL.user_id = " . $_SESSION["userID"] . " " .
  138 + "AND GFL.can_write = 1 " .
  139 + "AND GFL.folder_id IN (" . Permission::generateParentFolderString($iFolderID) . ")");
164 140 if ($sql->next_record()) {
165 141 return true;
166 142 }
... ... @@ -169,6 +145,29 @@ class Permission {
169 145 }
170 146  
171 147 /**
  148 + * Generate a string to be used in a where clause
  149 + * that consists of a list of id that are a folders
  150 + * parent Used this because user has read/write permission for a folder if s/he
  151 + * has read/write permission for the folder's parent (have to recurse up
  152 + * entire hierarchy)
  153 + *
  154 + * @param int Primary key of folder to start at
  155 + *
  156 + */
  157 + function generateParentFolderString($iFolderID) {
  158 + $sFolderIDString = $iFolderID;
  159 + //$iParentFolderID = $iFolderID;
  160 + //recurse up the hierarchy, building the string as we go
  161 + $iParentFolderID = Folder::getParentFolderID($iFolderID);
  162 + while ($iParentFolderID != 0) {
  163 + $sFolderIDString .= ", " . $iParentFolderID;
  164 + $iFolderID = $iParentFolderID;
  165 + $iParentFolderID = Folder::getParentFolderID($iFolderID);
  166 + }
  167 + return $sFolderIDString;
  168 + }
  169 +
  170 + /**
172 171 * Checks if the current user has read permission through group membership for a particular folder
173 172 *
174 173 * @param $iFolderID Primary key of folder to check
... ... @@ -179,11 +178,11 @@ class Permission {
179 178 global $default, $lang_err_user_folder_read;
180 179 $sql = new Owl_DB();
181 180 //$sql->query("SELECT * FROM " . $default->owl_groups_folders_table = "groups_folders_link" . " WHERE folder_id = " . $iFolderID . " AND user_id = " . $_SESSION["userID"] . " AND can_read = 1");
182   - $sql->query("SELECT * FROM " . $default->owl_groups_folders_table . " GLF, $default->owl_users_groups_table GUL " .
183   - " WHERE GLF.folder_id = " . $iFolderID .
184   - " AND GUL.user_id = " . $_SESSION["userID"] .
185   - " AND GLF.group_id = GUL.group_id " .
186   - " AND can_read = 1");
  181 + $sql->query("SELECT GFL.folder_id " .
  182 + "FROM groups_folders_link AS GFL INNER JOIN users_groups_link AS UGL ON GFL.group_id = UGL.group_id " .
  183 + "WHERE UGL.user_id = " . $_SESSION["userID"] . " " .
  184 + "AND GFL.can_read = 1 " .
  185 + "AND GFL.folder_id IN (" . Permission::generateParentFolderString($iFolderID) . ")");
187 186 if ($sql->next_record()) {
188 187 return true;
189 188 }
... ... @@ -238,7 +237,10 @@ class Permission {
238 237 function userHasWriteRoleForFolder($iFolderID) {
239 238 global $default, $lang_err_user_role;
240 239 $sql = new Owl_DB();
241   - $sql->query("SELECT * FROM " . $default->owl_folders_user_table . " AS FURL INNER JOIN " . $default->owl_role_table . " AS R ON FURL.role_id = R.id WHERE folder_id = " . $iFolderID . " AND user_id = " . $_SESSION["userID"] . " AND R.can_write = 1");
  240 + $sql->query("SELECT * FROM " . $default->owl_folders_user_roles_table . " AS FURL INNER JOIN " . $default->owl_roles_table . " AS R ON FURL.role_type_id = R.id " .
  241 + "WHERE folder_id = " . $iFolderID . " " .
  242 + "AND user_id = " . $_SESSION["userID"] . " " .
  243 + "AND R.can_write = 1");
242 244 if ($sql->next_record()) {
243 245 return true;
244 246 }
... ... @@ -256,7 +258,11 @@ class Permission {
256 258 function userHasReadRoleForFolder($iFolderID) {
257 259 global $default, $lang_err_user_role;
258 260 $sql = new Owl_DB();
259   - $sql->query("SELECT * FROM " . $default->owl_folders_user_table . " AS FURL INNER JOIN " . $default->owl_role_table . " AS R ON FURL.role_id = R.id WHERE folder_id = " . $iFolderID . " AND user_id = " . $_SESSION["userID"] . " AND R.can_read = 1");
  261 + $sql->query("SELECT * " .
  262 + "FROM " . $default->owl_folders_user_roles_table . " AS FURL INNER JOIN " . $default->owl_roles_table . " AS R ON FURL.role_type_id = R.id " .
  263 + "WHERE folder_id = " . $iFolderID . " " .
  264 + "AND user_id = " . $_SESSION["userID"] . " " .
  265 + "AND R.can_read = 1");
260 266 if ($sql->next_record()) {
261 267 return true;
262 268 }
... ... @@ -308,17 +314,52 @@ class Permission {
308 314 * @return ID if role exists, false otherwise and set $_SESSION["errorMessage"]
309 315 */
310 316 function getRoleID($sRoleName) {
311   - global $default, $lang_database_error;
  317 + global $default, $lang_err_database;
312 318 if (roleExists($sRoleName)) {
313 319 $sql = new Owl_DB();
314 320 $sql->query("SELECT id FROM " . $default->owl_roles_table . " WHERE name = '" . $sRoleName . "'");
315 321 $sql->next_record();
316 322 return $sql->f("id");
317 323 }
318   - $_SESSION["errorMessage"] = $lang_database_error;
  324 + $_SESSION["errorMessage"] = $lang_err_database;
319 325 return false;
320 326 }
321 327  
  328 + /**
  329 + * Check if the current user is a system administrator
  330 + *
  331 + * @return boolean true is user is system administrator, false otherwise and set $_SESSION["errorMessage"]
  332 + *
  333 + */
  334 + function userIsSystemAdministrator() {
  335 + global $default, $lang_err_database;
  336 + $sql = new Owl_DB();
  337 + $sql->query("SELECT UGL.group_id " .
  338 + "FROM $default->owl_users_groups_table AS UGL INNER JOIN $default->owl_groups_table AS GL ON UGL.group_id = GL.id " .
  339 + "WHERE UGL.user_id = " . $_SESSION["userID"] . " " .
  340 + "AND is_sys_admin = 1";);
  341 + return $sql->next_record();
  342 + }
  343 +
  344 + /**
  345 + * Checks if the current user is the unit administrator
  346 + * for the unit to which the folder belongs
  347 + *
  348 + *
  349 + * @param int Primary key of folder to check
  350 + *
  351 + * @return boolean true if the user is the unit administrator for the unit to which the folder belongs, false otherwise
  352 + */
  353 + function userIsUnitAdministrator($iFolderID) {
  354 + $sql = new Owl_DB();
  355 + $sql->query("SELECT UGL.group_id " .
  356 + "FROM $default->owl_users_groups_table AS UGL INNER JOIN $default->owl_groups_units_table AS GUL ON GUL.group_id = UGL.group_id " .
  357 + "INNER JOIN $default->owl_groups_table AS GL ON GL.id = UGL.group_id " .
  358 + "WHERE UGL.user_id = " . $_SESSION["userID"] . " " .
  359 + "AND GL.is_unit_admin = 1";);
  360 + return $sql->next_record();
  361 + }
  362 +
322 363  
323 364 }
324 365  
... ...