Peter M. Groen / knowledgetree

Commit cb5b2b763c0279449da584d9b9d42b0719f0bafd

Authored by Michael Joseph
1 parent 79865a49

overhauled sitemap permission handling 


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@540 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 53 additions and 15 deletions
lib/session/SiteMap.inc
  View file @cb5b2b7
... ... @@ -2,6 +2,11 @@
2 2  
3 3 require_once("$default->owl_fs_root/lib/security/permission.inc");
4 4  
  5 +// define access constants
  6 +define("SA", 0);
  7 +define("UA", 1);
  8 +define("A", 2);
  9 +
5 10 /**
6 11 * $Id$
7 12 *
... ... @@ -77,6 +82,47 @@ class SiteMap {
77 82 }
78 83  
79 84 /**
  85 + * Returns true if the user has the necessary rights to access
  86 + * a sitemap entry
  87 + *
  88 + * @param int the required access (defined above class)
  89 + * @return boolean true if the user has the access, else false.
  90 + */
  91 + function hasPermission($requiredAccess) {
  92 + // sitemap access rules:
  93 + // if anonymous
  94 + // or the user is in the required group
  95 + // or the user is a SA
  96 + switch ($requiredAccess) {
  97 + case A : // everyone has access to anonymous pages
  98 + return true;
  99 + break;
  100 +
  101 + case UA : // check that this user is in a group with unit admin access
  102 + // or is a system adminstrator
  103 + if (Permission::userIsSystemAdministrator() ||
  104 + Permission::userIsUnitAdministrator()) {
  105 + return true;
  106 + } else {
  107 + return false;
  108 + }
  109 + break;
  110 +
  111 + case SA : // check that this user is a system administrator
  112 + if (Permission::userIsSystemAdministrator()) {
  113 + return true;
  114 + } else {
  115 + return false;
  116 + }
  117 + break;
  118 + }
  119 + // if we haven't returned by here, $requiredAccess is unknown
  120 +
  121 + // TODO: add a check in addPage/addDefaultPage
  122 + return false;
  123 + }
  124 +
  125 + /**
80 126 * Returns controller links for a section
81 127 *
82 128 * @param string the section to return links for
... ... @@ -89,12 +135,8 @@ class SiteMap {
89 135 $results = array("descriptions" => array(), "links" => array());
90 136  
91 137 // need to loop through all (groupName, page) arrays in this section
92   - foreach ($this->siteMapArray[$sSectionName] as $requiredGroupName => $pages) {
93   - // if anonymous
94   - // or the user is in the required group or the user is the SA
95   - if ( ($requiredGroupName == "Anonymous") ||
96   - ( Permission::userIsInGroupName($requiredGroupName) ||
97   - Permission::userIsInGroupName("System Administrators") ) ) {
  138 + foreach ($this->siteMapArray[$sSectionName] as $requiredAccess => $pages) {
  139 + if ($this->hasPermission($requiredAccess)) {
98 140 foreach ($pages as $action => $pageDetail) {
99 141 // add this array to the resultset array
100 142 $results["descriptions"][] = $pages[$action]["description"];
... ... @@ -130,24 +172,20 @@ class SiteMap {
130 172 foreach ($this->siteMapArray as $section => $valArr) {
131 173 $default->log->debug("Sitemap::getPage section=$section");
132 174 // for each group, page array combination
133   - foreach ($valArr as $requiredGroupName => $pageArr) {
  175 + foreach ($valArr as $requiredAccess => $pageArr) {
134 176 // now loop through pages until we find the right one
135 177 foreach ($pageArr as $ackshin => $page) {
136 178 if ($ackshin == $action) {
137   - $default->log->debug("Sitemap::getPage current requiredGroup=$requiredGroupName, action=$ackshin");
138   - // if anonymous
139   - // or the user is in the required group or the user is the SA
140   - if ( ($requiredGroupName == "Anonymous") ||
141   - ( Permission::userIsInGroupName($requiredGroupName) ||
142   - Permission::userIsInGroupName("System Administrators") ) ) {
  179 + $default->log->debug("Sitemap::getPage current requiredAccess=$requiredAccess, action=$ackshin");
  180 + if ($this->hasPermission($requiredAccess)) {
143 181 return $page["page"];
144 182 }
145 183 }
146 184 }
147 185 }
148 186 }
149   - // if the function hasn't returned already then the specified
150   - // userGroup does not have access to the action
  187 + // if the function hasn't returned already then the current
  188 + // user does not have access to the action
151 189 $default->log->info("Sitemap::getPage: access denied for ($action, " . $_SESSION["userID"] . ")");
152 190 return false;
153 191 }
... ...