_acl.utils.php

Vai alla documentazione di questo file.

<?php

    function getAccessPermission( $p ) {

        // namespace globale
            global $cf;

        // controllo
            if( ! isset( $cf['contents']['pages'][ $p ]['auth']['groups'] ) || ( isset( $_SESSION['account']['gruppi'] ) && count( array_intersect( $cf['contents']['pages'][ $p ]['auth']['groups'], $_SESSION['account']['gruppi'] ) ) > 0 ) ) {
                return true;
            }

        // ritorno false
            return false;

    }

    function getAclPermission( $t, $a, &$i = NULL ) {

        // log
            logWrite( 'richiesta di accesso per ' . $t . '/' . $a, 'auth', LOG_DEBUG );

        // debug
            // echo 'getAclPermission ' . $t . '/' . $a . PHP_EOL;

        // controllo permessi
            if( isset( $_SESSION['account']['permissions'][ $t ] ) ) {

                // passaggio ricorsivo dei permessi
                    $i['__auth__'] = $_SESSION['account']['permissions'][ $t ];

                // autorizzazione
//                  if( in_array( $a, $i['__auth__'] ) || in_array( FULL_CONTROL, $i['__auth__'] ) || ( $a != FULL_CONTROL && in_array( FILTERED_CONTROL, $i['__auth__'] ) ) ) {
                    if( in_array( $a, $i['__auth__'] ) || in_array( FULL_CONTROL, $i['__auth__'] ) || in_array( FILTERED_CONTROL, $i['__auth__'] ) ) {
//                  if( in_array( $a, $i['__auth__'] ) || in_array( FULL_CONTROL, $i['__auth__'] ) ) {
                        logWrite( 'accesso consentito per ' . $t . '/' . $a . ' -> ' . implode( ',',$i['__auth__'] ), 'auth', LOG_DEBUG );
                        // echo 'getAclPermission ' . $t . '/' . $a . ' OK' . PHP_EOL;
                        return true;
                    }

                // log
                    logWrite( 'accesso non consentito per ' . $t . '/' . $a . ' in ' . implode( ', ', $i['__auth__'] ), 'auth', LOG_ERR );

            }

        // debug
            // echo 'getAclPermission ' . $t . '/' . $a . ' NO' . PHP_EOL;

        // log
            logWrite( 'accesso non consentito per ' . $t, 'auth', LOG_ERR );

        // default
            return false;

    }

//    function getAclRights( $c, $t, $a, $id, &$i = NULL, $pi = NULL ) {
    function getAclRights( $c, $t, $a, $id, &$i = NULL ) {

        // log
            logWrite( 'richiesta di accesso per ' . $t . '/' . $id . '/' . $a, 'auth', LOG_DEBUG );

        // passaggio ricorsivo dei permessi
            $i['__auth__'] = $_SESSION['account']['permissions'][ $t ];

        // debug
            // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . PHP_EOL;
            // echo 'getAclRights parent id -> ' . $p . PHP_EOL;
            // print_r( $i );
            // print_r( $pi );

        // verifico se l'utente non è root
//          if( $_SESSION['account']['username'] == 'root' || in_array( 'roots', $_SESSION['account']['gruppi'] ) ) {
//          if( getAclPermission( $t, FULL_CONTROL ) ) {
            if( in_array( FULL_CONTROL, $i['__auth__'] ) ) {

                // log
                    logWrite( 'accesso FULL per ' . $t . '/' . $id . '/' . $a, 'auth', LOG_DEBUG );

                // debug
                    // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' FULL OK' . PHP_EOL;

                // default
                    return true;

            } else {

                // prelevo la tabella delle ACL
                    $aclTb = getAclRightsTable( $c, $t );

                // prelevo l'utente per il controllo ACL
                    $aclId = getAclRightsAccountId();

                // log
                    logWrite( 'accesso FULL non consentito per ' . $t . '/' . $id . '/' . $a . ' procedo con le verifiche', 'auth', LOG_DEBUG );

                // debug
                    // echo 'tabella: ' . $aclTb . PHP_EOL;
                    // echo 'id account: ' . $aclId . PHP_EOL;

                // se esistono ACL per questa entità
                    if( empty( $aclTb ) ) {

                        // debug
                            // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' ACL table non esiste' . PHP_EOL;

                        // log
                            logWrite( 'nessuna tabella di ACL presente per ' . $t . ', autorizzazione concessa', 'auth', LOG_DEBUG );

                        // default
                            return true;

                    } else {

                        // debug
                            // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' ACL table esiste' . PHP_EOL;

/*
                        // valuto la riga
                            $r = mysqlSelectValue(
                                $c,
                                "SELECT concat_ws( ',', group_concat( ${aclTb}.permesso SEPARATOR ',' ), if( ${t}_view.id_account_inserimento = ?, 'FULL', NULL ) ) AS t ".
                                "FROM ${t}_view ".
                                "LEFT JOIN ${aclTb} ON ${aclTb}.id_entita = ${t}_view.id ".
                                "LEFT JOIN account_gruppi ON account_gruppi.id_gruppo = ${aclTb}.id_gruppo ".
                                "WHERE ( account_gruppi.id_account = ? OR ${t}_view.id_account_inserimento = ? ) ".
                                "AND ${t}_view.id = ? ",
                                array( array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $id ) )
                            );
*/
/*
                        // genero l'array dei diritti
//                          if( getAclPermission( $t, FILTERED_CONTROL ) ) {
                            if( in_array( FILTERED_CONTROL, $i['__auth__'] ) ) {
                                logWrite( 'accesso FILTERED per ' . $t . '/' . $id . '/' . $a, 'auth', LOG_NOTICE );
                                // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' accesso FILTRATO' . PHP_EOL;
                                $y = ( ! empty( $pi ) ) ? 'GET' : NULL;
                                $r = mysqlSelectValue(
                                    $c,
//                                  "SELECT if( ${t}_view.id_account_inserimento = ?, 'FULL', '${y}' ) AS t ".
                                    "SELECT if( ${t}_view.id_account_inserimento = ?, 'FULL', NULL ) AS t ".
                                    "FROM ${t}_view ".
                                    "WHERE ${t}_view.id = ? ",
                                    array( array( 's' => $aclId ), array( 's' => $id ) )
                                );
                            } else {
                                logWrite( 'accesso STANDARD per ' . $t . '/' . $id . '/' . $a, 'auth', LOG_NOTICE );
                                // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' accesso STANDARD' . PHP_EOL;
                                $r = mysqlSelectValue(
                                    $c,
                                    "SELECT concat_ws( ',', group_concat( ${aclTb}.permesso SEPARATOR ',' ), if( ${t}_view.id_account_inserimento = ?, 'FULL', NULL ) ) AS t ".
                                    "FROM ${t}_view ".
                                    "LEFT JOIN ${aclTb} ON ${aclTb}.id_entita = ${t}_view.id ".
                                    "LEFT JOIN account_gruppi ON account_gruppi.id_gruppo = ${aclTb}.id_gruppo ".
                                    "WHERE ( account_gruppi.id_account = ? OR ${t}_view.id_account_inserimento = ? ) ".
                                    "AND ${t}_view.id = ? ",
                                    array( array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $id ) )
                                );
                            }
*/

                                $r = mysqlSelectValue(
                                    $c,
                                    "SELECT concat_ws( ',', group_concat( ${aclTb}.permesso SEPARATOR ',' ), if( ( ${t}_view.id_account_inserimento = ? OR ${t}_view.id_account_editor = ? ), 'FULL', NULL ) ) AS t ".
                                    "FROM ${t}_view ".
                                    "LEFT JOIN ${aclTb} ON ${aclTb}.id_entita = ${t}_view.id ".
# NON GERARCHICO                    "LEFT JOIN account_gruppi ON account_gruppi.id_gruppo = ${aclTb}.id_gruppo ".
                                    "LEFT JOIN account_gruppi ON ( account_gruppi.id_gruppo = ${aclTb}.id_gruppo OR gruppi_path_check( ${aclTb}.id_gruppo, account_gruppi.id_gruppo ) ) ".
# NON CONSIDERA EDITOR              "WHERE ( account_gruppi.id_account = ? OR ${t}_view.id_account_inserimento = ? ) ".
                                    "WHERE ( account_gruppi.id_account = ? OR ${t}_view.id_account_inserimento = ? OR ${t}_view.id_account_editor = ? ) ".
                                    "AND ${t}_view.id = ? ",
# NON CONSIDERA EDITOR              array( array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $id ) )
                                    array( array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $id ) )
                                );

                            $i['__auth__'] = explode( ',', $r );

                        // debug
                            // echo 'risultato: ' . $r . ' per ' . $a . PHP_EOL;
                            // echo $a . PHP_EOL;
                            // print_r( $i['__auth__'] );

                        // controllo dei diritti
                            if( in_array( $a, $i['__auth__'] ) || in_array( FULL_CONTROL, $i['__auth__'] ) || in_array( FILTERED_CONTROL, $i['__auth__'] ) ) {

                                // debug
                                    // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' OK' . PHP_EOL;

                                // log
                                    logWrite( 'permessi presenti sulla tabella di ACL per ' . $t . '/' . $id . '/' . $a . ', autorizzazione concessa', 'auth', LOG_DEBUG );

                                // default
                                    return true;

                            } else {

                                // log
                                    logWrite( 'permessi NON presenti sulla tabella di ACL per ' . $t . '/' . $id . '/' . $a . ' in (' . $r . '), autorizzazione negata', 'auth', LOG_DEBUG );

                            }

/*
                        // valuto la riga
                            $r = mysqlSelectValue(
                                $cf['mysql']['connection'],
                                "SELECT count( ${t}_view.id ) FROM ${t}_view ".
                                "LEFT JOIN ${aclTb} ON ${aclTb}.id_entita = ${t}_view.id ".
                                "LEFT JOIN account_gruppi ON account_gruppi.id_gruppo = ${aclTb}.id_gruppo ".
                                "WHERE ( account_gruppi.id_account = ? OR ${t}_view.id_account_inserimento = ? ) ".
                                "AND ${t}_view.id = ? ",
                                array( array( 's' => $aclId ), array( 's' => $aclId ), array( 's' => $id ) )
                            );

                        // debug
                            // echo 'risultato ' . $r . PHP_EOL;

                        // risultato
                            return $r;
*/
                    }

            }

        // debug
            // echo 'getAclRights ' . $t . '/' . $id . '/' . $a . ' NO' . PHP_EOL;

        // default
            return false;

    }

    function getAclRightsAccountId() {
        return ( isset( $_SESSION['account']['id'] ) ) ? $_SESSION['account']['id'] : false;
    }

    function getAclRightsTable( $c, $t ) {

        // verifico se l'utente non è root
            if( $_SESSION['account']['username'] != 'root' && ! in_array( 'roots', $_SESSION['account']['gruppi'] ) ) {

                // verifico se esiste la tabella $t_gruppi
#                   $r = mysqlSelectCachedValue(
                    $r = mysqlSelectValue(
                        $c,
                        "SELECT table_name FROM information_schema.tables WHERE table_name = '__acl_${t}__' AND table_schema = database()"
                    );

                // log
                    logWrite( $_SESSION['account']['username'] . ' (' . implode(',',$_SESSION['account']['gruppi']) . ') tabella di ACL ' . $r . ' trovata per ' . $t, 'auth', LOG_DEBUG );

                // risultato
                    return $r;

            }

        // log
            logWrite( 'accesso non filtrato concesso a ' . $_SESSION['account']['username'] . ' (' . implode(',',$_SESSION['account']['gruppi']) . ') per ' . $t, 'auth', LOG_DEBUG );

        // default
            return NULL;

    }

?>