ILIAS  Release_3_10_x_branch Revision 61812
 All Data Structures Namespaces Files Functions Variables Groups Pages
class.ilRbacAdmin.php
Go to the documentation of this file.
1 <?php
2 /*
3  +-----------------------------------------------------------------------------+
4  | ILIAS open source |
5  +-----------------------------------------------------------------------------+
6  | Copyright (c) 1998-2001 ILIAS open source, University of Cologne |
7  | |
8  | This program is free software; you can redistribute it and/or |
9  | modify it under the terms of the GNU General Public License |
10  | as published by the Free Software Foundation; either version 2 |
11  | of the License, or (at your option) any later version. |
12  | |
13  | This program is distributed in the hope that it will be useful, |
14  | but WITHOUT ANY WARRANTY; without even the implied warranty of |
15  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16  | GNU General Public License for more details. |
17  | |
18  | You should have received a copy of the GNU General Public License |
19  | along with this program; if not, write to the Free Software |
20  | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
21  +-----------------------------------------------------------------------------+
22 */
23 
24 
38 class ilRbacAdmin
39 {
44  function ilRbacAdmin()
45  {
46  global $ilDB,$ilErr,$ilias;
47 
48  // set db & error handler
49  (isset($ilDB)) ? $this->ilDB =& $ilDB : $this->ilDB =& $ilias->db;
50 
51  if (!isset($ilErr))
52  {
53  $ilErr = new ilErrorHandling();
54  $ilErr->setErrorHandling(PEAR_ERROR_CALLBACK,array($ilErr,'errorHandler'));
55  }
56  else
57  {
58  $this->ilErr =& $ilErr;
59  }
60  }
61 
69  function removeUser($a_usr_id)
70  {
71  global $ilDB;
72 
73  if (!isset($a_usr_id))
74  {
75  $message = get_class($this)."::removeUser(): No usr_id given!";
76  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
77  }
78 
79  $q = "DELETE FROM rbac_ua WHERE usr_id = ".$ilDB->quote($a_usr_id)." ";
80  $this->ilDB->query($q);
81 
82  return true;
83  }
84 
92  function deleteRole($a_rol_id,$a_ref_id)
93  {
94  global $lng,$ilDB;
95 
96  if (!isset($a_rol_id) or !isset($a_ref_id))
97  {
98  $message = get_class($this)."::deleteRole(): Missing parameter! role_id: ".$a_rol_id." ref_id of role folder: ".$a_ref_id;
99  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
100  }
101 
102  // exclude system role from rbac
103  if ($a_rol_id == SYSTEM_ROLE_ID)
104  {
105  $this->ilErr->raiseError($lng->txt("msg_sysrole_not_deletable"),$this->ilErr->MESSAGE);
106  }
107 
108  include_once('Services/LDAP/classes/class.ilLDAPRoleGroupMapping.php');
109  $mapping = ilLDAPRoleGroupMapping::_getInstance();
110  $mapping->deleteRole($a_rol_id);
111 
112 
113  // TODO: check assigned users before deletion
114  // This is done in ilObjRole. Should be better moved to this place?
115 
116  // delete user assignements
117  $q = "DELETE FROM rbac_ua ".
118  "WHERE rol_id = ".$ilDB->quote($a_rol_id) ." ";
119  $this->ilDB->query($q);
120 
121  // delete permission assignments
122  $q = "DELETE FROM rbac_pa ".
123  "WHERE rol_id = ".$ilDB->quote($a_rol_id)." ";
124  $this->ilDB->query($q);
125 
126  //delete rbac_templates and rbac_fa
127  $this->deleteLocalRole($a_rol_id);
128 
129  return true;
130  }
131 
138  function deleteTemplate($a_obj_id)
139  {
140  global $ilDB;
141 
142  if (!isset($a_obj_id))
143  {
144  $message = get_class($this)."::deleteTemplate(): No obj_id given!";
145  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
146  }
147 
148  $q = "DELETE FROM rbac_templates ".
149  "WHERE rol_id = ".$ilDB->quote($a_obj_id) ." ";
150  $this->ilDB->query($q);
151 
152  $q = "DELETE FROM rbac_fa ".
153  "WHERE rol_id = ".$ilDB->quote($a_obj_id) ." ";
154  $this->ilDB->query($q);
155 
156  return true;
157  }
158 
166  function deleteLocalRole($a_rol_id,$a_ref_id = 0)
167  {
168  global $ilDB;
169 
170  if (!isset($a_rol_id))
171  {
172  $message = get_class($this)."::deleteLocalRole(): Missing parameter! role_id: '".$a_rol_id."'";
173  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
174  }
175 
176  // exclude system role from rbac
177  if ($a_rol_id == SYSTEM_ROLE_ID)
178  {
179  return true;
180  }
181 
182  if ($a_ref_id != 0)
183  {
184  $clause = "AND parent = ".$ilDB->quote($a_ref_id)." ";
185  }
186 
187  $q = "DELETE FROM rbac_fa ".
188  "WHERE rol_id = ".$ilDB->quote($a_rol_id)." ".
189  $clause;
190 
191  $this->ilDB->query($q);
192 
193  $q = "DELETE FROM rbac_templates ".
194  "WHERE rol_id = ".$ilDB->quote($a_rol_id)." ".
195  $clause;
196  $this->ilDB->query($q);
197 
198  return true;
199  }
200 
201 
211  function assignUser($a_rol_id,$a_usr_id,$a_default = false)
212  {
213  global $ilDB,$rbacreview;
214 
215  if (!isset($a_rol_id) or !isset($a_usr_id))
216  {
217  $message = get_class($this)."::assignUser(): Missing parameter! role_id: ".$a_rol_id." usr_id: ".$a_usr_id;
218  #$this->ilErr->raiseError($message,$this->ilErr->WARNING);
219  }
220 
221  // check if already assigned user id and role_id
222  $alreadyAssigned = $rbacreview->isAssigned($a_usr_id,$a_rol_id);
223 
224  // enhanced: only if we haven't had this role for this user
225  if (!$alreadyAssigned)
226  {
227  $q = "REPLACE INTO rbac_ua ".
228  "VALUES (".$ilDB->quote($a_usr_id).",".$ilDB->quote($a_rol_id).")";
229 
230  // Finally assign desktop items assigned to this role
231 
232  $res = $this->ilDB->query($q);
233 
234  include_once './classes/class.ilRoleDesktopItem.php';
235 
236  $role_desk_item_obj =& new ilRoleDesktopItem($a_rol_id);
237 
238  if(is_object($tmp_user = ilObjectFactory::getInstanceByObjId($a_usr_id,false)))
239  {
240  foreach($role_desk_item_obj->getAll() as $item_data)
241  {
242  if(!$tmp_user->isDesktopItem($item_data['item_id'],$item_data['item_type']))
243  {
244  $tmp_user->addDesktopItem($item_data['item_id'],$item_data['item_type']);
245  }
246  }
247  }
248  }
249 
250  include_once('Services/LDAP/classes/class.ilLDAPRoleGroupMapping.php');
251  $mapping = ilLDAPRoleGroupMapping::_getInstance();
252  $mapping->assign($a_rol_id,$a_usr_id);
253 
254  return true;
255  }
256 
264  function deassignUser($a_rol_id,$a_usr_id)
265  {
266  global $ilDB;
267 
268  if (!isset($a_rol_id) or !isset($a_usr_id))
269  {
270  $message = get_class($this)."::deassignUser(): Missing parameter! role_id: ".$a_rol_id." usr_id: ".$a_usr_id;
271  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
272  }
273 
274  $q = "DELETE FROM rbac_ua ".
275  "WHERE usr_id= ".$ilDB->quote($a_usr_id)." ".
276  "AND rol_id=".$ilDB->quote($a_rol_id)." ";
277  $this->ilDB->query($q);
278 
279  include_once('Services/LDAP/classes/class.ilLDAPRoleGroupMapping.php');
280  $mapping = ilLDAPRoleGroupMapping::_getInstance();
281  $mapping->deassign($a_rol_id,$a_usr_id);
282 
283  return true;
284  }
285 
294  function grantPermission($a_rol_id,$a_ops,$a_ref_id)
295  {
296  global $ilDB;
297 
298  if (!isset($a_rol_id) or !isset($a_ops) or !isset($a_ref_id))
299  {
300  $this->ilErr->raiseError(get_class($this)."::grantPermission(): Missing parameter! ".
301  "role_id: ".$a_rol_id." ref_id: ".$a_ref_id." operations: ",$this->ilErr->WARNING);
302  }
303 
304  if (!is_array($a_ops))
305  {
306  $this->ilErr->raiseError(get_class($this)."::grantPermission(): Wrong datatype for operations!",
307  $this->ilErr->WARNING);
308  }
309 
310  if (count($a_ops) == 0)
311  {
312  return false;
313  }
314 
315  // exclude system role from rbac
316  if ($a_rol_id == SYSTEM_ROLE_ID)
317  {
318  return true;
319  }
320 
321  // convert all values to integer
322  foreach ($a_ops as $key => $operation)
323  {
324  $a_ops[$key] = (int) $operation;
325  }
326 
327  // Serialization des ops_id Arrays
328  $ops_ids = addslashes(serialize($a_ops));
329 
330  $q = "REPLACE INTO rbac_pa (rol_id,ops_id,ref_id) ".
331  "VALUES ".
332  "(".$ilDB->quote($a_rol_id).",".$ilDB->quote($ops_ids).",".$ilDB->quote($a_ref_id).")";
333  $this->ilDB->query($q);
334 
335  return true;
336  }
337 
347  function revokePermission($a_ref_id,$a_rol_id = 0,$a_keep_protected = true)
348  {
349  global $rbacreview,$log,$ilDB;
350 
351  if (!isset($a_ref_id))
352  {
353  $message = get_class($this)."::revokePermission(): Missing parameter! ref_id: ".$a_ref_id;
354  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
355  }
356 #$log->write("ilRBACadmin::revokePermission(), 0");
357 
358  // bypass protected status of roles
359  if ($a_keep_protected != true)
360  {
361  // exclude system role from rbac
362  if ($a_rol_id == SYSTEM_ROLE_ID)
363  {
364  return true;
365  }
366 
367  if ($a_rol_id)
368  {
369  $and1 = " AND rol_id = ".$ilDB->quote($a_rol_id)." ";
370  }
371  else
372  {
373  $and1 = "";
374  }
375 
376  $q = "DELETE FROM rbac_pa ".
377  "WHERE ref_id = ".$ilDB->quote($a_ref_id)." ".
378  $and1;
379  $this->ilDB->query($q);
380 
381  return true;
382  }
383 
384  // consider protected status of roles
385 
386  // in any case, get all roles in scope first
387 
388  if (!$a_rol_id)
389  {
390 #$log->write("ilRBACadmin::revokePermission(), 1");
391  // TODO: REMOVE THIS
392  $roles_in_scope = $rbacreview->getParentRoleIds($a_ref_id);
393 
394  $role_ids = array();
395 
396  foreach ($roles_in_scope as $role)
397  {
398  if ($role['protected'] == true)
399  {
400  continue;
401  }
402 
403  $role_ids[] = $role['obj_id'];
404  }
405 
406  // return if no role in array
407  if (!$role_ids)
408  {
409  return true;
410  }
411 
412  $q = "DELETE FROM rbac_pa ".
413  "WHERE rol_id IN (".implode(',',ilUtil::quoteArray($role_ids)).") ".
414  "AND ref_id = ".$ilDB->quote($a_ref_id)." ";
415  $this->ilDB->query($q);
416  }
417  else
418  {
419 #$log->write("ilRBACadmin::revokePermission(), 2");
420  // exclude system role from rbac
421  if ($a_rol_id == SYSTEM_ROLE_ID)
422  {
423  return true;
424  }
425 
426  if($this->isProtected($a_rol_id))
427  {
428  return true;
429  }
430 
431  $q = "DELETE FROM rbac_pa ".
432  "WHERE ref_id = ".$ilDB->quote($a_ref_id)." ".
433  "AND rol_id = ".$ilDB->quote($a_rol_id)." ";
434  $this->ilDB->query($q);
435  }
436 
437  return true;
438  }
439 
447  function revokePermissionList($a_ref_ids,$a_rol_id)
448  {
449  global $ilDB;
450 
451  if (!isset($a_ref_ids) or !is_array($a_ref_ids))
452  {
453  $message = get_class($this)."::revokePermissionList(): Missing parameter or parameter is not an array! reference_list: ".var_dump($a_ref_ids);
454  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
455  }
456 
457  if (!isset($a_rol_id))
458  {
459  $message = get_class($this)."::revokePermissionList(): Missing parameter! rol_id: ".$a_rol_id;
460  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
461  }
462 
463  // exclude system role from rbac
464  if ($a_rol_id == SYSTEM_ROLE_ID)
465  {
466  return true;
467  }
468 
469  $ref_ids = implode(",",ilUtil::quoteArray($a_ref_ids));
470 
471  // TODO: rename db_field from obj_id to ref_id and remove db-field set_id
472  $q = "DELETE FROM rbac_pa ".
473  "WHERE ref_id IN (".$ref_ids.") ".
474  "AND rol_id = ".$ilDB->quote($a_rol_id);
475  $this->ilDB->query($q);
476 
477  return true;
478  }
479 
490  public function copyRolePermissions($a_source_id,$a_source_parent,$a_dest_parent,$a_dest_id,$a_consider_protected = true)
491  {
492  global $tree,$rbacreview;
493 
494  // Copy template permissions
495  $this->copyRoleTemplatePermissions($a_source_id,$a_source_parent,$a_dest_parent,$a_dest_id,$a_consider_protected);
496 
497  $source_obj = $tree->getParentId($a_source_parent);
498  $target_obj = $tree->getParentId($a_dest_parent);
499  $ops = $rbacreview->getRoleOperationsOnObject($a_source_id,$source_obj);
500 
501  $this->revokePermission($target_obj,$a_dest_id);
502  $this->grantPermission($a_dest_id,$ops,$target_obj);
503  return true;
504  }
505 
516  function copyRoleTemplatePermissions($a_source_id,$a_source_parent,$a_dest_parent,$a_dest_id,$a_consider_protected = true)
517  {
518  global $rbacreview,$ilDB;
519 
520  if (!isset($a_source_id) or !isset($a_source_parent) or !isset($a_dest_id) or !isset($a_dest_parent))
521  {
522  $message = __METHOD__.": Missing parameter! source_id: ".$a_source_id.
523  " source_parent_id: ".$a_source_parent.
524  " dest_id : ".$a_dest_id.
525  " dest_parent_id: ".$a_dest_parent;
526  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
527  }
528 
529  // exclude system role from rbac
530  if ($a_dest_id == SYSTEM_ROLE_ID)
531  {
532  return true;
533  }
534 
535  $query = "DELETE FROM rbac_templates WHERE rol_id = ".$ilDB->quote($a_dest_id)." ".
536  "AND parent = ".$ilDB->quote($a_dest_parent);
537  $ilDB->query($query);
538 
539 
540  $q = "SELECT * FROM rbac_templates ".
541  "WHERE rol_id = ".$ilDB->quote($a_source_id)." ".
542  "AND parent = ".$ilDB->quote($a_source_parent)." ";
543  $r = $this->ilDB->query($q);
544 
545  while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
546  {
547  $q = "INSERT INTO rbac_templates ".
548  "VALUES ".
549  "(".$ilDB->quote($a_dest_id).",".$ilDB->quote($row->type).",".$ilDB->quote($row->ops_id).",".$ilDB->quote($a_dest_parent).")";
550  $this->ilDB->query($q);
551  }
552 
553  // copy also protection status if applicable
554  if ($a_consider_protected == true)
555  {
556  if ($rbacreview->isProtected($a_source_parent,$a_source_id))
557  {
558  $this->setProtected($a_dest_parent,$a_dest_id,'y');
559  }
560  }
561 
562  return true;
563  }
577  function copyRolePermissionIntersection($a_source1_id,$a_source1_parent,$a_source2_id,$a_source2_parent,$a_dest_parent,$a_dest_id)
578  {
579  global $rbacreview,$ilDB;
580 
581  if (!isset($a_source1_id) or !isset($a_source1_parent)
582  or !isset($a_source2_id) or !isset($a_source2_parent)
583  or !isset($a_dest_id) or !isset($a_dest_parent))
584  {
585  $message = get_class($this)."::copyRolePermissionIntersection(): Missing parameter! source1_id: ".$a_source1_id.
586  " source1_parent: ".$a_source1_parent.
587  " source2_id: ".$a_source2_id.
588  " source2_parent: ".$a_source2_parent.
589  " dest_id: ".$a_dest_id.
590  " dest_parent_id: ".$a_dest_parent;
591  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
592  }
593 
594  // exclude system role from rbac
595  if ($a_dest_id == SYSTEM_ROLE_ID)
596  {
597  return true;
598  }
599 
600  if ($rbacreview->isProtected($a_source2_parent,$a_source2_id))
601  {
602  return true;
603  }
604 
605  $q = "SELECT s1.type, s1.ops_id ".
606  "FROM rbac_templates AS s1, rbac_templates AS s2 ".
607  "WHERE s1.rol_id = ".$ilDB->quote($a_source1_id)." ".
608  "AND s1.parent = ".$ilDB->quote($a_source1_parent)." ".
609  "AND s2.rol_id = ".$ilDB->quote($a_source2_id)." ".
610  "AND s2.parent = ".$ilDB->quote($a_source2_parent)." ".
611  "AND s1.type = s2.type ".
612  "AND s1.ops_id = s2.ops_id";
613  $r = $this->ilDB->query($q);
614 
615  while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
616  {
617  $q = "INSERT INTO rbac_templates ".
618  "VALUES ".
619  "(".$ilDB->quote($a_dest_id).",".$ilDB->quote($row->type).",".$ilDB->quote($row->ops_id).",".$ilDB->quote($a_dest_parent).")";
620  $this->ilDB->query($q);
621  }
622 
623  return true;
624  }
625 
636  function deleteRolePermission($a_rol_id,$a_ref_id,$a_type = false)
637  {
638  global $ilDB;
639 
640  if (!isset($a_rol_id) or !isset($a_ref_id))
641  {
642  $message = get_class($this)."::deleteRolePermission(): Missing parameter! role_id: ".$a_rol_id." ref_id: ".$a_ref_id;
643  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
644  }
645 
646  // exclude system role from rbac
647  if ($a_rol_id == SYSTEM_ROLE_ID)
648  {
649  return true;
650  }
651 
652  if ($a_type !== false)
653  {
654  $and_type = " AND type=".$ilDB->quote($a_type)." ";
655  }
656 
657  $q = "DELETE FROM rbac_templates ".
658  "WHERE rol_id = ".$ilDB->quote($a_rol_id)." ".
659  "AND parent = ".$ilDB->quote($a_ref_id)." ".
660  $and_type;
661  $this->ilDB->query($q);
662 
663  return true;
664  }
665 
676  function setRolePermission($a_rol_id,$a_type,$a_ops,$a_ref_id)
677  {
678  global $ilDB;
679 
680  if (!isset($a_rol_id) or !isset($a_type) or !isset($a_ops) or !isset($a_ref_id))
681  {
682  $message = get_class($this)."::setRolePermission(): Missing parameter!".
683  " role_id: ".$a_rol_id.
684  " type: ".$a_type.
685  " operations: ".$a_ops.
686  " ref_id: ".$a_ref_id;
687  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
688  }
689 
690  if (!is_string($a_type) or empty($a_type))
691  {
692  $message = get_class($this)."::setRolePermission(): a_type is no string or empty!";
693  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
694  }
695 
696  if (!is_array($a_ops) or empty($a_ops))
697  {
698  $message = get_class($this)."::setRolePermission(): a_ops is no array or empty!";
699  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
700  }
701 
702  // exclude system role from rbac
703  if ($a_rol_id == SYSTEM_ROLE_ID)
704  {
705  return true;
706  }
707 
708  foreach ($a_ops as $op)
709  {
710  $q = "INSERT INTO rbac_templates ".
711  "VALUES ".
712  "(".$ilDB->quote($a_rol_id).",".$ilDB->quote($a_type).",".$ilDB->quote($op).",".$ilDB->quote($a_ref_id).")";
713  $this->ilDB->query($q);
714  }
715 
716  return true;
717  }
718 
732  function assignRoleToFolder($a_rol_id,$a_parent,$a_assign = "y")
733  {
734  global $ilDB;
735 
736  if (!isset($a_rol_id) or !isset($a_parent))
737  {
738  $message = get_class($this)."::assignRoleToFolder(): Missing Parameter!".
739  " role_id: ".$a_rol_id.
740  " parent_id: ".$a_parent.
741  " assign: ".$a_assign;
742  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
743  }
744 
745  // exclude system role from rbac
746  if ($a_rol_id == SYSTEM_ROLE_ID)
747  {
748  return true;
749  }
750 
751  // if a wrong value is passed, always set assign to "n"
752  if ($a_assign != "y")
753  {
754  $a_assign = "n";
755  }
756 
757  $q = "INSERT INTO rbac_fa (rol_id,parent,assign) ".
758  "VALUES (".$ilDB->quote($a_rol_id).",".$ilDB->quote($a_parent).",".$ilDB->quote($a_assign).")";
759  $this->ilDB->query($q);
760 
761  return true;
762  }
763 
772  function assignOperationToObject($a_type_id,$a_ops_id)
773  {
774  global $ilDB;
775 
776  if (!isset($a_type_id) or !isset($a_ops_id))
777  {
778  $message = get_class($this)."::assignOperationToObject(): Missing parameter!".
779  "type_id: ".$a_type_id.
780  "ops_id: ".$a_ops_id;
781  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
782  }
783 
784  $q = "INSERT INTO rbac_ta ".
785  "VALUES(".$ilDB->quote($a_type_id).",".$ilDB->quote($a_ops_id).")";
786  $this->ilDB->query($q);
787 
788  return true;
789  }
790 
799  function deassignOperationFromObject($a_type_id,$a_ops_id)
800  {
801  global $ilDB;
802 
803  if (!isset($a_type_id) or !isset($a_ops_id))
804  {
805  $message = get_class($this)."::deassignPermissionFromObject(): Missing parameter!".
806  "type_id: ".$a_type_id.
807  "ops_id: ".$a_ops_id;
808  $this->ilErr->raiseError($message,$this->ilErr->WARNING);
809  }
810 
811  $q = "DELETE FROM rbac_ta ".
812  "WHERE typ_id = ".$ilDB->quote($a_type_id)." ".
813  "AND ops_id = ".$ilDB->quote($a_ops_id)." ";
814  $this->ilDB->query($q);
815 
816  return true;
817  }
818 
819  function setProtected($a_ref_id,$a_role_id,$a_value)
820  {
821  global $ilDB;
822 
823  // ref_id not used yet. protected permission acts 'global' for each role, regardless of any broken inheritance before
824  $q = "UPDATE rbac_fa ".
825  "SET protected = ".$ilDB->quote($a_value)." ".
826  //"WHERE parent = '".$a_ref_id."' ".
827  "WHERE rol_id = ".$ilDB->quote($a_role_id)." ";
828  $this->ilDB->query($q);
829 
830  return true;
831  }
832 
838  public function isProtected($a_role_id)
839  {
840  global $ilDB;
841 
842  $query = "SELECT * FROM rbac_fa WHERE rol_id = ".$ilDB->quote($a_role_id);
843  $res = $ilDB->query($query);
844  while($row = $res->fetchRow(DB_FETCHMODE_OBJECT))
845  {
846  return $row->protected == 'y' ? true : false;
847  }
848  return false;
849  }
850 
861  public function copyLocalRoles($a_source_id,$a_target_id)
862  {
863  global $rbacreview,$ilLog,$ilObjDataCache;
864 
865  $source_rolf = $rbacreview->getRoleFolderIdOfObject($a_source_id);
866  $target_rolf = $rbacreview->getRoleFolderIdOfObject($a_target_id);
867 
868  if(!$source_rolf)
869  {
870  // Nothing to do
871  return true;
872  }
873  $real_local = array();
874  foreach($rbacreview->getRolesOfRoleFolder($source_rolf,false) as $role_data)
875  {
876  $title = $ilObjDataCache->lookupTitle($role_data);
877  if(substr($title,0,3) == 'il_')
878  {
879  continue;
880  }
881  $real_local[] = $role_data;
882  }
883  if(!count($real_local))
884  {
885  return true;
886  }
887  // Create role folder
888  if(!$target_rolf)
889  {
890  $tmp_obj = ilObjectFactory::getInstanceByRefId($a_target_id,false);
891  if(!is_object($tmp_obj))
892  {
893  return false;
894  }
895  $rolf = $tmp_obj->createRoleFolder();
896  $target_rolf = $rolf->getRefId();
897  $ilLog->write(__METHOD__.': Created new role folder with id '.$rolf->getRefId());
898  }
899  foreach($real_local as $role)
900  {
901  include_once ("./Services/AccessControl/classes/class.ilObjRole.php");
902  $orig = new ilObjRole($role);
903  $orig->read();
904 
905  $ilLog->write(__METHOD__.': Start copying of role '.$orig->getTitle());
906  $roleObj = new ilObjRole();
907  $roleObj->setTitle($orig->getTitle());
908  $roleObj->setDescription($orig->getDescription());
909  $roleObj->setImportId($orig->getImportId());
910  $roleObj->create();
911 
912  $this->assignRoleToFolder($roleObj->getId(),$target_rolf,"y");
913  $this->copyRolePermissions($role,$source_rolf,$target_rolf,$roleObj->getId(),true);
914  $ilLog->write(__METHOD__.': Added new local role, id '.$roleObj->getId());
915  }
916 
917  }
918 
930  public function adjustMovedObjectPermissions($a_ref_id,$a_old_parent)
931  {
932  global $rbacreview,$tree,$ilLog;
933 
934  $new_parent = $tree->getParentId($a_ref_id);
935  $old_context_roles = $rbacreview->getParentRoleIds($a_old_parent,false);
936  $new_context_roles = $rbacreview->getParentRoleIds($new_parent,false);
937 
938  $for_addition = $for_deletion = array();
939  foreach($new_context_roles as $new_role_id => $new_role)
940  {
941  if(!isset($old_context_roles[$new_role_id]))
942  {
943  $for_addition[$new_role_id] = $new_role;
944  }
945  elseif($new_role['parent'] != $old_context_roles[$new_role_id]['parent'])
946  {
947  // handle stopped inheritance
948  $for_deletion[$new_role_id] = $new_role;
949  $for_addition[$new_role_id] = $new_role;
950  }
951  }
952  foreach($old_context_roles as $old_role_id => $old_role)
953  {
954  if(!isset($new_context_roles[$old_role_id]))
955  {
956  $for_deletion[$old_role_id] = $old_role;
957  }
958  }
959 
960  if(!count($for_deletion) and !count($for_addition))
961  {
962  return true;
963  }
964  foreach($nodes = $tree->getSubTree($node_data = $tree->getNodeData($a_ref_id),true) as $node_data)
965  {
966  $node_id = $node_data['child'];
967 
968  // If $node_data['type'] is not set, this means there is a tree entry without
969  // object_reference and/or object_data entry
970  // Continue in this case
971  if(!$node_data['type'])
972  {
973  $ilLog->write(__METHOD__.': No type give. Choosing next tree entry.');
974  continue;
975  }
976 
977  if(!$node_id)
978  {
979  $ilLog->write(__METHOD__.': Missing subtree node_id');
980  continue;
981  }
982 
983  foreach($for_deletion as $role_id => $role_data)
984  {
985  if($rolf_id = $rbacreview->getRoleFolderIdOfObject($node_id))
986  {
987  $this->deleteLocalRole($role_id,$rolf_id);
988  }
989  $this->revokePermission($node_id,$role_id,false);
990 //var_dump("<pre>",'REVOKE',$role_id,$node_id,$rolf_id,"</pre>");
991  }
992  foreach($for_addition as $role_id => $role_data)
993  {
994  $this->grantPermission(
995  $role_id,
996  $ops = $rbacreview->getOperationsOfRole($role_id,$node_data['type'],$role_data['parent']),
997  $node_id);
998 //var_dump("<pre>",'GRANT',$role_id,$ops,$role_id,$node_data['type'],$role_data['parent'],"</pre>");
999 
1000  }
1001  }
1002 
1003  }
1004 } // END class.ilRbacAdmin
1005 ?>