workflow-security control.

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@5920 c91229c3-7414-0410-bfa2-8a42b809f60b

workflow-security control.
git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@5920 c91229c3-7414-0410-bfa2-8a42b809f60b
bshuttle
1 parent 243a1b27
Showing 9 changed files with 436 additions and 10 deletions
lib/workflow/workflowadminutil.inc.php
lib/workflow/workflowutil.inc.php
plugins/ktcore/admin/workflowsv2.php
sql/mysql/upgrade/3.1.6.2/workflow_state_disabled_actions.sql
templates/ktcore/workflow/admin/actions_edit.smarty
templates/ktcore/workflow/admin/actions_overview.smarty
templates/ktcore/workflow/admin/restrictions_edit.smarty
templates/ktcore/workflow/admin/security_overview.smarty
templates/ktcore/workflow/admin/transition_guards_overview.smarty
@@ -114,5 +114,6 @@ class KTWorkflowAdminUtil {
         }
         return $aRet;
     }
-      
+            
+
 }
@@ -253,6 +253,8 @@ class KTWorkflowUtil {
     }
     // }}}
  
+    // FIXME DEPRECATED
+
     // {{{ setEnabledActionsForState
     /**
      * Sets the actions that are enabled by this workflow state.
@@ -295,6 +297,34 @@ class KTWorkflowUtil {
     }
     // }}}
  
+    function setDisabledActionsForState($oState, $aActions) {
+        $iStateId = KTUtil::getId($oState);
+        $sTable = KTUtil::getTableName('workflow_state_disabled_actions');
+
+        $aQuery = array(
+            "DELETE FROM $sTable WHERE state_id = ?",
+            array($iStateId),
+        );
+        $res = DBUtil::runQuery($aQuery);
+        if (PEAR::isError($res)) {
+            return $res;
+        }
+
+        if(!is_array($aActions)) return;
+        
+        $aOptions = array('noid' => true);
+        foreach ($aActions as $sAction) {
+            $res = DBUtil::autoInsert($sTable, array(
+                'state_id' => $iStateId,
+                'action_name' => $sAction,
+            ), $aOptions);
+            if (PEAR::isError($res)) {
+                return $res;
+            }
+        }
+        return;
+    }      
+
     // {{{ getEnabledActionsForState
     /**
      * Gets the actions that are enabled by this workflow state.
@@ -320,6 +350,17 @@ class KTWorkflowUtil {
     }
     // }}}
  
+    function getDisabledActionsForState($oState) {
+        $iStateId = KTUtil::getId($oState);
+        $sTable = KTUtil::getTableName('workflow_state_disabled_actions');
+
+        $aQuery = array(
+            "SELECT action_name FROM $sTable WHERE state_id = ?",
+            array($iStateId),
+        );
+        return DBUtil::getResultArrayKey($aQuery, 'action_name');
+    }
+
     // {{{ actionEnabledForDocument
     /**
      * Checks if a particular action is enabled to occur on a document
@@ -343,7 +384,7 @@ class KTWorkflowUtil {
             return true;
         }
         $oState =& KTWorkflowState::getByDocument($oDocument);
-        if (!in_array($sName, KTWorkflowUtil::getEnabledActionsForState($oState))) {
+        if (in_array($sName, KTWorkflowUtil::getDisabledActionsForState($oState))) {
             return false;
         }
         return true;
@@ -1073,40 +1073,300 @@ class KTWorkflowAdminV2 extends KTAdminDispatcher {
         }
  
         $states = KTWorkflowState::getByWorkflow($this->oWorkflow);
+        $action_grid = array();
+        foreach ($states as $oState) {
+            $state_actions = array();
+            $disabled = KTWorkflowUtil::getDisabledActionsForState($oState);
+            
+            foreach ($disabled as $name) {
+                $state_actions[$name] = $name;
+            }
+            
+            $action_grid[$oState->getId()] = $state_actions;
+        }
  
         $oTemplate->setData(array(
             'context' => $this,
             'states' => $states,
             'actions' => $actions,
+            'grid' => $action_grid,
         ));
         return $oTemplate->render();    
     }   
  
     function do_editactions() {
-        $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/actions_overview');            
+        $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/actions_edit');            
         $this->oPage->setBreadcrumbDetails(_kt("Actions"));
+        $actions = KTUtil::keyArray(KTDocumentActionUtil::getAllDocumentActions(), 'getName');
+        $blacklist = array('ktcore.actions.document.displaydetails');
+        
+        foreach ($blacklist as $name) {
+            unset($actions[$name]);   
+        }
+        
+        $states = KTWorkflowState::getByWorkflow($this->oWorkflow);
+        $action_grid = array();
+        foreach ($states as $oState) {
+            $state_actions = array();
+            $disabled = KTWorkflowUtil::getDisabledActionsForState($oState);
+            
+            foreach ($disabled as $name) {
+                $state_actions[$name] = $name;
+            }
+            
+            $action_grid[$oState->getId()] = $state_actions;
+        }
  
         $oTemplate->setData(array(
             'context' => $this,
-            'workflow_name' => $this->oWorkflow->getName(),
+            'states' => $states,
+            'actions' => $actions,
+            'grid' => $action_grid,
+            'args' => $this->meldPersistQuery("","saveactions", true),
         ));
         return $oTemplate->render();    
     }       
  
     function do_saveactions() {
-        $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/actions_overview');            
-        $this->oPage->setBreadcrumbDetails(_kt("Actions"));
+        $disabled_actions = (array) $_REQUEST['fActions'];
  
-        $res = KTWorkflowUtil::setEnabledActionsForState($oState, $_REQUEST['fActions']);
+        
+        $states = KTWorkflowState::getByWorkflow($this->oWorkflow);
+        $actions = KTUtil::keyArray(KTDocumentActionUtil::getAllDocumentActions(), 'getName');
+
+        $this->startTransaction();
+
+        foreach ($states as $oState) {
+            $disable = array();
+            $state_disabled = (array) $disabled_actions[$oState->getId()];
+            if (!empty($state_disabled)) {
+                foreach ($actions as $name => $oAction) {
+                    if ($state_disabled[$name]) {
+                        $disable[] = $name;
+                    }
+                }
+            }
+
+            $res = KTWorkflowUtil::setDisabledActionsForState($oState, $disable);
+        }
+
+        $this->successRedirectTo('actionsoverview', _kt('Disabled actions updated.'));
+    }   
+
+    function do_transitionsecurityoverview() {
+        $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/transition_guards_overview');            
+        $this->oPage->setBreadcrumbDetails(_kt("Transition Guards"));
+
+        $transitions = KTWorkflowTransition::getByWorkflow($this->oWorkflow);
  
         $oTemplate->setData(array(
             'context' => $this,
-            'workflow_name' => $this->oWorkflow->getName(),
+            'transitions' => $transitions,
         ));
         return $oTemplate->render();    
     }   
  
+    // helper
+    function describeTransitionGuards($oTransition) {
+        $restrictions = KTWorkflowUtil::getGuardTriggersForTransition($oTransition);
+        
+        if (empty($restrictions)) {
+            return _kt("No restrictions in place for this transition.");
+        }
+        
+        $restriction_text = array();
+        foreach ($restrictions as $oGuard) {
+            $restriction_text[] = $oGuard->getConfigDescription();
+        }
+        
+        return implode('. ', $restriction_text);
+    }
+    
+    function form_addtransitionguard() {
+        $oForm = new KTForm;
+        $oForm->setOptions(array(
+            'identifier' => 'ktcore.admin.workflow.addguard',
+            'label' => _kt("Add New Transition Restriction"),
+            'action' => 'addguard',
+            'cancel_action' => 'manageguards',
+            'fail_action' => 'manageguards', 
+            'submit_label' => _kt("Add Restriction"),
+            'context' => $this,
+        ));
+        
+        $oTriggerSingleton =& KTWorkflowTriggerRegistry::getSingleton();
+        $aTriggerList = $oTriggerSingleton->listWorkflowTriggers();
+        $vocab = array();
+        foreach ($aTriggerList as $ns => $aTriggerInfo) {
+            $aInfo = $aTriggerInfo; // i am lazy.
+            //var_dump($aInfo);
+            $actions = array();
+            if ($aInfo['guard']) {
+                $actions[] = _kt('Guard');
+            } else { 
+                continue;
+            }
+            if ($aInfo['action']) {
+                $actions[] = _kt('Action');
+            }
+            $sActStr = implode(', ', $actions);
+            $vocab[$ns] = sprintf(_kt("%s (%s)"), $aInfo['name'], $sActStr);
+        }    
+        
+        $oForm->setWidgets(array(
+            array('ktcore.widgets.selection', array(
+                'label' => _kt("Restriction Type"),
+                'name' => 'guard_name',
+                'vocab' => $vocab,
+                'simple_select' => false,
+                'required' => true,
+            )),
+        ));
+        
+        $oForm->setValidators(array(
+            array('ktcore.validators.string', array(
+                'test' => 'guard_name',
+                'output' => 'guard_name',
+            )),
+        ));
+        return $oForm;
+    }   
+    
+    function do_manageguards() {
+        $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/restrictions_edit');            
+        $this->oPage->setBreadcrumbDetails(_kt("Actions"));
+        
+        $restrictions = KTWorkflowUtil::getGuardTriggersForTransition($this->oTransition);
+        $add_form = $this->form_addtransitionguard();
+        
+        $oTemplate->setData(array(
+            'context' => $this,
+            'add_form' => $add_form,
+            'aGuardTriggers' => $restrictions,
+        ));
+        return $oTemplate->render();    
+    }       
+    
+    function do_addguard() {
+        $oForm = $this->form_addtransitionguard();
+        $res = $oForm->validate();
+        $data = $res['results'];
+        $errors = $res['errors'];
+        
+        if (!empty($errors)) {
+            return $oForm->handleError();
+        }
+
+        $KTWFTriggerReg =& KTWorkflowTriggerRegistry::getSingleton();
+
+        $this->startTransaction();
+
+        $oTrigger = $KTWFTriggerReg->getWorkflowTrigger(KTUtil::arrayGet($data, 'guard_name'));
+        if (PEAR::isError($oTrigger)) {
+            return $oForm->handleError(_kt('Unable to add trigger.'));
+        }
+
+        $oTriggerConfig = KTWorkflowTriggerInstance::createFromArray(array(
+            'transitionid' => KTUtil::getId($this->oTransition),
+            'namespace' =>  KTUtil::arrayGet($data, 'guard_name'),
+            'config' => array(),
+        ));
+        
+        if (PEAR::isError($oTriggerConfig)) {
+            return $oForm->handleError(_kt('Unable to add trigger.') . $oTriggerConfig->getMessage());
+        }
+
+        // now, if the trigger is editable...
+        $oTrigger->loadConfig($oTriggerConfig);
+        if ($oTrigger->bIsConfigurable) {
+            $this->successRedirectTo('editguardtrigger', _kt("New restriction added. This restriction requires configuration:  please specify this below."), array('fTriggerInstanceId' => $oTriggerConfig->getId()));        
+        } else {
+            $this->successRedirectTo('manageguards', _kt("New restriction added."));
+        }
+        exit(0);        
+    }
+    
+    
+    function do_editguardtrigger() {
+        $this->oPage->setBreadcrumbDetails(_kt('editing restriction'));
+        $oTriggerInstance =& KTWorkflowTriggerInstance::get($_REQUEST['fTriggerInstanceId']);        
+        if (PEAR::isError($oTriggerInstance)) {
+            return $this->errorRedirectTo('manageguards', _kt('Unable to load trigger.'));
+        }
  
+        // grab the transition ns from the request.
+        $KTWFTriggerReg =& KTWorkflowTriggerRegistry::getSingleton();
+
+        $this->startTransaction();
+
+        $oTrigger = $KTWFTriggerReg->getWorkflowTrigger($oTriggerInstance->getNamespace());
+        if (PEAR::isError($oTrigger)) {
+            $this->errorRedirectTo('editTransition', _kt('Unable to add trigger.'), 'fWorkflowId=' . $oWorkflow->getId() . '&fTransitionId=' .  $oTransition->getId());
+            exit(0);
+        }
+        $oTrigger->loadConfig($oTriggerInstance);
+
+        return $oTrigger->displayConfiguration($this->meldPersistQuery(array('fTriggerInstanceId' => $oTriggerInstance->getId()), 'saveguardtrigger', true));
+    }
+
+    // }}}
+
+    function do_saveguardtrigger() {
+        $oTriggerInstance =& KTWorkflowTriggerInstance::get($_REQUEST['fTriggerInstanceId']);        
+        if (PEAR::isError($oTriggerInstance)) {
+            $this->errorRedirectTo('manageguards', _kt('Unable to load trigger.'));
+            exit(0);        
+        }
+        
+        $KTWFTriggerReg =& KTWorkflowTriggerRegistry::getSingleton();
+
+        $this->startTransaction();
+
+        $oTrigger = $KTWFTriggerReg->getWorkflowTrigger($oTriggerInstance->getNamespace());
+        if (PEAR::isError($oTrigger)) {
+            $this->errorRedirectTo('manageguards', _kt('Unable to load trigger.'));
+            exit(0);
+        }
+        $oTrigger->loadConfig($oTriggerInstance);
+        
+        $res = $oTrigger->saveConfiguration();
+        if (PEAR::isError($res)) {
+            $this->errorRedirectTo('manageguards', _kt('Unable to save trigger: ') . $res->getMessage());
+            exit(0);            
+        }
+    
+        $this->successRedirectTo('manageguards', _kt('Trigger saved.'));
+        exit(0);    
+    }
+
+    function do_deleteguardtrigger() {
+        $oTriggerInstance =& KTWorkflowTriggerInstance::get($_REQUEST['fTriggerInstanceId']);        
+        if (PEAR::isError($oTriggerInstance)) {
+            return $this->errorRedirectTo('manageguards', _kt('Unable to load trigger.'));
+        }
+
+        // grab the transition ns from the request.
+        $KTWFTriggerReg =& KTWorkflowTriggerRegistry::getSingleton();
+        $this->startTransaction();
+
+        $oTrigger = $KTWFTriggerReg->getWorkflowTrigger($oTriggerInstance->getNamespace());
+        if (PEAR::isError($oTrigger)) {
+            $this->errorRedirectTo('manageguards', _kt('Unable to load trigger.'));
+            exit(0);
+        }
+        $oTrigger->loadConfig($oTriggerInstance);
+        
+        $res = $oTriggerInstance->delete();
+        if (PEAR::isError($res)) {
+            $this->errorRedirectTo('editTransition', _kt('Unable to delete trigger: ') . $res->getMessage(), 'fWorkflowId=' . $oWorkflow->getId() . '&fTransitionId=' .  $oTransition->getId());
+            exit(0);            
+        }
+    
+        $this->successRedirectTo('manageguards', _kt('Trigger deleted.'));
+        exit(0);    
+    }
+
+    
     // ----------------- Effects ---------------------
     function do_effects() {
         $oTemplate = $this->oValidator->validateTemplate('ktcore/workflow/admin/effects_overview');            
+CREATE TABLE `workflow_state_disabled_actions` (
+  `state_id` int(11) NOT NULL default '0',
+  `action_name` char(255) NOT NULL default '0',
+  KEY `state_id` (`state_id`),
+  KEY `action_name` (`action_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+
+CREATE TABLE `zseq_workflow_state_disabled_actions` (
+  `id` int(10) unsigned NOT NULL auto_increment,
+  PRIMARY KEY  (`id`)
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
+<h2>Assign blocked actions</h2>
+
+<p class="descriptiveText important">Actions which are checked on this page will 
+<strong>not</strong> be available to users.</p>
+
+<form method="POST" action="{$smarty.server.PHP_SELF}">
+<fieldset><legend>Assign Blocked Actions</legend>
+
+{foreach from=$args item=v key=k}
+    <input type="hidden" name="{$k}" value="{$v}" />
+{/foreach}
+
+<table class="kt_collection narrow" cellspacing="0">
+    <thead>
+        <th>State</th>
+      {foreach from=$actions item=oAction}
+        <th>{$oAction->getDisplayName()}</th>  
+      {/foreach}
+    </thead>
+    
+    <tbody>
+      {foreach from=$states item=oState}
+      {assign value=$oState->getId() var=state_id}
+        <tr>
+            <td>{$oState->getName()}</td>
+            {foreach from=$actions item=oAction}
+            {assign value=$oAction->getName() var=action_id}
+                <td class="centered">            
+              <input type="checkbox" name="fActions[{$state_id}][{$action_id}]" value="{$action_id}" {if ($grid.$state_id.$action_id)}checked="true"{/if} />
+                </td>
+            {/foreach}
+        </tr>
+      {/foreach}
+    </tbody>
+</table>
+
+<div class="form_actions">
+    <input type="submit" value="{i18n}Block actions{/i18n}" />
+</div>
+
+</fieldset>
+</form>
@@ -4,6 +4,9 @@
 possible to block certain <strong>actions</strong> at any given point.  Actions
 which are not blocked are still controlled by the usual permissions.</p>
  
+<p><a class="ktAction ktActionDescribed ktEdit" href="{addQS context=$context}action=editactions{/addQS}">Edit Actions</a>
+<a href="{addQS context=$context}action=editactions{/addQS}">Edit Actions</a></p>
+
 <table class="kt_collection narrow" cellspacing="0">
     <thead>
         <th>State</th>
@@ -19,7 +22,11 @@ which are not blocked are still controlled by the usual permissions.&lt;/p&gt;
             <td>{$oState->getName()}</td>
             {foreach from=$actions item=oAction}
             {assign value=$oAction->getName() var=action_id}
-             <td>&mdash;</td>
+              {if $grid.$state_id.$action_id}
+                <td class="centered"><span class="ktAction ktDenied">Denied</span></td>              
+              {else}
+                <td class="centered">&mdash;</td>
+              {/if}
             {/foreach}
         </tr>
       {/foreach}
+<h2>{i18n}Transition Restrictions{/i18n}</h2>
+    
+<p class="descriptiveText important">{i18n}All of these must allow the user to perform the transition.{/i18n}</p>
+
+{$add_form->render()}
+    
+<br />    
+    
+{if empty($aGuardTriggers)}
+  <div class="ktInfo"><p>{i18n}Anybody (with the ability to see the document) can perform this transition.{/i18n}</p></div>    
+{else}
+    
+<table class="kt_collection narrow" cellspacing="0">
+    <thead>
+        <tr>
+            <th>{i18n}Restriction{/i18n}</th>        
+            <th>{i18n}Edit{/i18n}</th>        
+            <th>{i18n}Delete{/i18n}</th>                                          
+            <th>{i18n}Configuration{/i18n}</th>                    
+        </tr>    
+    </thead>    
+    <tbody>
+        {foreach from=$aGuardTriggers item=oTrigger}
+         <tr>
+             <td>{$oTrigger->getName()}</td>
+             <td>{if $oTrigger->bIsConfigurable}<a class="ktAction ktEdit" href="{addQS context=$context}action=editguardtrigger&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">edit</a>{else}&mdash;{/if}</td>
+             <td><a class="ktAction ktDelete" href="{addQS context=$context}action=deleteguardtrigger&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>                                       
+             <td>{$oTrigger->getConfigDescription()}</td>             
+         </tr>
+        {/foreach}    
+    </tbody>
+    </table>    
+    
+    {/if}
@@ -11,7 +11,7 @@ with the system&#39;s security:&lt;/p&gt;
 <ol>
     <li><a href="{addQS context=$context}action=permissionsoverview{/addQS}">Document Permissions</a> (by state)</li>
     <li><a href="{addQS context=$context}action=actionsoverview{/addQS}">Action Restrictions</a> (by state)</li>            
-    <li><a href="{addQS context=$context}action=transitionrestrictionoverview{/addQS}">Transition Restrictions</a></li>    
+    <li><a href="{addQS context=$context}action=transitionsecurityoverview{/addQS}">Transition Restrictions</a></li>    
  
 </ol>
  
+<h2>Transition Restrictions Overview</h2>
+
+<p class="descriptiveText">In order to ensure that the workflow is followed 
+correctly, it is often necessary to restrict the situations in which a 
+transition can be followed.  This can include things like the permissions the
+user has on the document, the user's groups or roles, or whether the document
+is checked-out or not.</p>
+
+<p class="descriptiveText important">Please note that the plugins that are installed
+will affect the available options</p>
+
+<table class="kt_collection narrow" cellspacing="0">
+    <thead>
+        <th>Transition</th>
+        <th>Edit</th>
+        <th>Existing Restrictions</th>        
+    </thead>
+    
+    <tbody>
+      {foreach from=$transitions item=oTransition}
+      {assign value=$oTransition->getId() var=transition_id}
+        <tr>
+            <td>{$oTransition->getName()}</td>
+            <td class="centered"><a href="{addQS context=$context}action=manageguards&fTransitionId={$transition_id}{/addQS}" class="ktAction ktEdit"></a></td>
+            <td><span class="descriptiveText">{$context->describeTransitionGuards($oTransition)}</span></td>
+        </tr>
+      {/foreach}
+    </tbody>
+</table>