classes/class.ilRbacSystem.php

Go to the documentation of this file.

<?php
/*
        +-----------------------------------------------------------------------------+
        | ILIAS open source                                                           |
        +-----------------------------------------------------------------------------+
        | Copyright (c) 1998-2001 ILIAS open source, University of Cologne            |
        |                                                                             |
        | This program is free software; you can redistribute it and/or               |
        | modify it under the terms of the GNU General Public License                 |
        | as published by the Free Software Foundation; either version 2              |
        | of the License, or (at your option) any later version.                      |
        |                                                                             |
        | This program is distributed in the hope that it will be useful,             |
        | but WITHOUT ANY WARRANTY; without even the implied warranty of              |
        | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               |
        | GNU General Public License for more details.                                |
        |                                                                             |
        | You should have received a copy of the GNU General Public License           |
        | along with this program; if not, write to the Free Software                 |
        | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA. |
        +-----------------------------------------------------------------------------+
*/


class ilRbacSystem
{
        var $ilias;

        function ilRbacSystem()
        {
                global $ilDB,$ilErr,$ilias;

                $this->ilias =& $ilias;

                // set db & error handler
                (isset($ilDB)) ? $this->ilDB =& $ilDB : $this->ilDB =& $ilias->db;
                
                if (!isset($ilErr))
                {
                        $ilErr = new ilErrorHandling();
                        $ilErr->setErrorHandling(PEAR_ERROR_CALLBACK,array($ilErr,'errorHandler'));
                }
                else
                {
                        $this->ilErr =& $ilErr;
                }
        }
        
        function checkAccess($a_operations,$a_ref_id,$a_type = "")
        {
                global $ilUser,$ilBench;
                
                $ilBench->start("RBAC", "system_checkAccess");

                $result = $this->checkAccessOfUser($ilUser->getId(), $a_operations, $a_ref_id, $a_type);

                $ilBench->stop("RBAC", "system_checkAccess");
                
                return $result;
        }
        
        function checkAccessOfUser($a_user_id, $a_operations, $a_ref_id, $a_type = "")
        {
                global $ilUser, $rbacreview;
                
                // get roles
                if ($a_user_id == $ilUser->getId())
                {
                        $roles = $_SESSION["RoleId"];
                }
                else
                {
                        $roles = $rbacreview->assignedRoles($a_user_id);
                }
                
                // exclude system role from rbac
                if (in_array(SYSTEM_ROLE_ID, $roles))
                {
                        return true;            
                }

                if (!isset($a_operations) or !isset($a_ref_id))
                {
                        $this->ilErr->raiseError(get_class($this)."::checkAccess(): Missing parameter! ".
                                                        "ref_id: ".$a_ref_id." operations: ".$a_operations,$this->ilErr->WARNING);
                }

                if (!is_string($a_operations))
                {
                        $this->ilErr->raiseError(get_class($this)."::checkAccess(): Wrong datatype for operations!",$this->ilErr->WARNING);
                }

                $operations = explode(",",$a_operations);

                if(!$this->checkPreconditions($operations, $a_ref_id, $a_user_id))
                {
                        return false;
                }

                foreach ($operations as $operation)
                {
                        if ($operation == "create")
                        {
                                if (empty($a_type))
                                {
                                        $this->ilErr->raiseError(get_class($this)."::CheckAccess(): Expect a type definition for checking a 'create' permission",
                                                                                         $this->ilErr->WARNING);
                                }
                                
                                $ops_id = getOperationId($operation."_".$a_type);
                        }
                        else
                        {
                                $ops_id = getOperationId($operation);
                        }
                        
                        // Um nur eine Abfrage zu haben
                        $in = " IN ('";
                        $in .= implode("','", $roles);
                        $in .= "')";

                        $q = "SELECT * FROM rbac_pa ".
                                 "WHERE rol_id ".$in." ".
                                 "AND ref_id = '".$a_ref_id."' ";
                        $r = $this->ilDB->query($q);

                        $ops = array();

                        while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
                        {
                                $ops = array_merge($ops,unserialize(stripslashes($row->ops_id)));
                        }
                        if (in_array($ops_id,$ops))
                        {
                                continue;
                        }
                        else
                        {
                                return false;
                        }
                }
                
                return true;
    }
        
        function checkPermission($a_ref_id,$a_rol_id,$a_operation)
        {
                $ops = array();

                $q = "SELECT ops_id FROM rbac_operations ".
                                 "WHERE operation ='".$a_operation."'";
                
                $r = $this->ilDB->query($q);

                while($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
                {
                        $ops_id = $row->ops_id;
                }
        
                $q = "SELECT * FROM rbac_pa ".
                         "WHERE rol_id = '".$a_rol_id."' ".
                         "AND ref_id = '".$a_ref_id."' ";
                
                $r = $this->ilDB->query($q);

                while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
                {
                        $ops = array_merge($ops,unserialize(stripslashes($row->ops_id)));
                }
                return in_array($ops_id,$ops);
        }

        function checkPreconditions($a_operations,$a_ref_id, $a_user_id = "")
        {
                if ($a_user_id == "")
                {
                        $a_user_id = $this->ilias->account->getId();
                }
                
                // get obj_type 
                $query = "SELECT type FROM object_data AS obd,object_reference AS obr ".
                        "WHERE obd.obj_id = obr.obj_id AND ".
                        "obr.ref_id = '".$a_ref_id."'";
                
                $res = $this->ilDB->query($query);
                while($row = $res->fetchRow(DB_FETCHMODE_OBJECT))
                {
                        $type = $row->type;
                }
                switch($type)
                {
                        case "crs":
                                if(in_array('visible',$a_operations) or in_array('join',$a_operations) or in_array('leave',$a_operations))
                                {
                                        return true;
                                }
                                $tmp_obj =& ilObjectFactory::getInstanceByRefId($a_ref_id);
                                $tmp_obj->initCourseMemberObject();

                                // CHECK COURSE SPECIFIC THINGS
                                if(!$tmp_obj->members_obj->hasAccess($a_user_id))
                                {
                                        unset($tmp_obj);
                                        return false;
                                }
                                unset($tmp_obj);
                                return true;

                        default:
                                return true;
                }
        }
} // END class.RbacSystem
?>