class.ilRbacSystem.php

Go to the documentation of this file.

<?php
/*
        +-----------------------------------------------------------------------------+
        | ILIAS open source                                                           |
        +-----------------------------------------------------------------------------+
        | Copyright (c) 1998-2001 ILIAS open source, University of Cologne            |
        |                                                                             |
        | This program is free software; you can redistribute it and/or               |
        | modify it under the terms of the GNU General Public License                 |
        | as published by the Free Software Foundation; either version 2              |
        | of the License, or (at your option) any later version.                      |
        |                                                                             |
        | This program is distributed in the hope that it will be useful,             |
        | but WITHOUT ANY WARRANTY; without even the implied warranty of              |
        | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               |
        | GNU General Public License for more details.                                |
        |                                                                             |
        | You should have received a copy of the GNU General Public License           |
        | along with this program; if not, write to the Free Software                 |
        | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA. |
        +-----------------------------------------------------------------------------+
*/


class ilRbacSystem
{
        protected static $instance = null;
        
        protected $mem_view;
        
        protected static $user_role_cache = array();
        var $ilias;

        // Cache accesses to RBAC PA
        private static $_paCache = null;

        // Cache outcomes of calls to checkAccessOfuser
        private static $_checkAccessOfUserCache = null;

        protected function ilRbacSystem()
        {
                global $ilDB,$ilErr,$ilias;

                $this->ilias =& $ilias;

                // set db & error handler
                (isset($ilDB)) ? $this->ilDB =& $ilDB : $this->ilDB =& $ilias->db;
                
                if (!isset($ilErr))
                {
                        $ilErr = new ilErrorHandling();
                        $ilErr->setErrorHandling(PEAR_ERROR_CALLBACK,array($ilErr,'errorHandler'));
                }
                else
                {
                        $this->ilErr =& $ilErr;
                }
        }
        
        public static function getInstance()
        {
                if(self::$instance)
                {
                        return self::$instance;
                }
                return self::$instance = new ilRbacSystem();
        }
        
        function checkAccess($a_operations,$a_ref_id,$a_type = "")
        {
                global $ilUser,$ilBench;
                
                $ilBench->start("RBAC", "system_checkAccess");

                $result = $this->checkAccessOfUser($ilUser->getId(), $a_operations, $a_ref_id, $a_type);

                $ilBench->stop("RBAC", "system_checkAccess");
                
                return $result;
        }
        
        function checkAccessOfUser($a_user_id, $a_operations, $a_ref_id, $a_type = "")
        {
                global $ilUser, $rbacreview,$ilObjDataCache,$ilDB,$ilLog;

                // Create the user cache key
                $cacheKey = $a_user_id.':'.$a_operations.':'.$a_ref_id.':'.$a_type;

                // Create the cache if it does not yet exist
                if (! is_array(self::$_checkAccessOfUserCache)) {
                        self::$_checkAccessOfUserCache = array();
                }
                
                // Try to return result from cache
                if (array_key_exists($cacheKey, self::$_checkAccessOfUserCache)) {
                        return self::$_checkAccessOfUserCache[$cacheKey];
                }

                #echo ++$counter;

                // DISABLED 
                // Check For owner
                // Owners do always have full access to their objects
                // Excluded are the permissions create and perm
                // This method call return all operations that are NOT granted by the owner status 
                if(!$a_operations = $this->__filterOwnerPermissions($a_user_id,$a_operations,$a_ref_id))
                {
                        // Store positive outcome in cache.
                        // Note: we only cache up to 1000 results to avoid memory overflows
                        if (count(self::$_checkAccessOfUserCache) < 1000) {
                                self::$_checkAccessOfUserCache[$cacheKey] = true;
                        }
                        return true;
                }

                
                // get roles using role cache
                $roles = $this->fetchAssignedRoles($a_user_id,$a_ref_id);
                
                // exclude system role from rbac
                if (in_array(SYSTEM_ROLE_ID, $roles))
                {
                        // Store positive outcome in cache.
                        // Note: we only cache up to 1000 results to avoid memory overflows
                        if (count(self::$_checkAccessOfUserCache) < 1000) {
                                self::$_checkAccessOfUserCache[$cacheKey] = true;
                        }
                        return true;            
                }

                if (!isset($a_operations) or !isset($a_ref_id))
                {
                        $GLOBALS['ilLog']->logStack();
                        $this->ilErr->raiseError(get_class($this)."::checkAccess(): Missing parameter! ".
                                                        "ref_id: ".$a_ref_id." operations: ".$a_operations,$this->ilErr->WARNING);
                }

                if (!is_string($a_operations))
                {
                        $GLOBALS['ilLog']->logStack();
                        $this->ilErr->raiseError(get_class($this)."::checkAccess(): Wrong datatype for operations!",$this->ilErr->WARNING);
                }

                // Create the PA cache if it does not exist yet
                $paCacheKey = $a_user_id.':'.$a_ref_id;
                if (! is_array(self::$_paCache)) {
            self::$_paCache = array();
        }

        if (array_key_exists($paCacheKey, self::$_paCache)) {
                        // Return result from PA cache
            $ops = self::$_paCache[$paCacheKey];
        } 
                else 
                {
                        // Data is not in PA cache, perform database query
                        $q = "SELECT * FROM rbac_pa ".
                                         "WHERE ref_id = ".$ilDB->quote($a_ref_id, 'integer');

                        $r = $this->ilDB->query($q);

                        $ops = array();

                        while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
                        {
                                if (in_array($row->rol_id, $roles))
                                {
                                        $ops = array_merge($ops,unserialize(stripslashes($row->ops_id)));
                                }
                        }
                        // Cache up to 1000 entries in the PA cache
                        if (count(self::$_paCache) < 1000) 
                        {
                                self::$_paCache[$paCacheKey] = $ops;
                        }
        }

                $operations = explode(",",$a_operations);
                foreach ($operations as $operation)
                {
                        if ($operation == "create")
                        {
                                if (empty($a_type))
                                {
                                        $this->ilErr->raiseError(get_class($this)."::CheckAccess(): Expect a type definition for checking a 'create' permission",
                                                                                         $this->ilErr->WARNING);
                                }

                                $ops_id = ilRbacReview::_getOperationIdByName($operation."_".$a_type);
                        }
                        else
                        {
                                $ops_id = ilRbacReview::_getOperationIdByName($operation);
                        }
                        if (! in_array($ops_id,(array) $ops)) 
                        {
                                //$ilLog->write('PERMISSION: '.$a_ref_id.' -> '.$a_ops_id.' failed');
                                // Store negative outcome in cache.
                                // Note: we only cache up to 1000 results to avoid memory overflows
                                if (count(self::$_checkAccessOfUserCache) < 1000) 
                                {
                                        self::$_checkAccessOfUserCache[$cacheKey] = false;
                                }
                                return false;
                        }
                }

                // Store positive outcome in cache.
                // Note: we only cache up to 1000 results to avoid memory overflows
                if (count(self::$_checkAccessOfUserCache) < 1000) 
                {
                        //$ilLog->write('PERMISSION: '.$a_ref_id.' -> '.$ops_id.' granted');
                        self::$_checkAccessOfUserCache[$cacheKey] = true;
                }
                return true;
        }

        function preloadRbacPaCache($a_ref_ids, $a_user_id)
        {
                global $ilDB;

                if (!is_array($a_ref_ids))
                {
                        return;
                }

                $ref_ids = array();
                foreach ($a_ref_ids as $ref_id)
                {
                        if (!isset(self::$_paCache[$a_user_id.":".$ref_id]))
                        {
                                $roles[$ref_id] = $this->fetchAssignedRoles($a_user_id, $ref_id);
                                $ops[$ref_id] = array();
                                $ref_ids[] = $ref_id;
                        }
                }

                if (count($ref_ids) > 0)
                {

                        // Data is not in PA cache, perform database query
                        $q = "SELECT * FROM rbac_pa ".
                                "WHERE ".$ilDB->in("ref_id", $ref_ids, false, "integer");

                        $r = $this->ilDB->query($q);

                        while ($row = $r->fetchRow(DB_FETCHMODE_OBJECT))
                        {
                                if (in_array($row->rol_id, $roles[$row->ref_id]))
                                {
                                        $ops[$row->ref_id] = array_merge($ops[$row->ref_id],
                                                unserialize(stripslashes($row->ops_id)));
                                }
                        }
                        foreach ($a_ref_ids as $ref_id)
                        {
                                // #11313
                                if (!isset(self::$_paCache[$a_user_id.":".$ref_id]))
                                {
                                        self::$_paCache[$a_user_id.":".$ref_id] = $ops[$ref_id];
                                }
                        }
                }
        }
        
        function checkPermission($a_ref_id,$a_rol_id,$a_operation)
        {
                global $ilDB;
                
                $ops = array();

                $query = 'SELECT ops_id FROM rbac_operations '.
                        'WHERE operation = '.$ilDB->quote($a_operation,'text');
                $res = $ilDB->query($query);            
                while($row = $ilDB->fetchObject($res))
                {
                        $ops_id = $row->ops_id;
                }
        
                $query = "SELECT * FROM rbac_pa ".
                         "WHERE rol_id = ".$ilDB->quote($a_rol_id,'integer')." ".
                         "AND ref_id = ".$ilDB->quote($a_ref_id,'integer')." ";
                $res = $ilDB->query($query);            

                while($row = $ilDB->fetchObject($res))
                {
                        $ops = array_merge($ops,unserialize($row->ops_id));
                }
                return in_array($ops_id,$ops);
        }

        function __filterOwnerPermissions($a_user_id,$a_operations,$a_ref_id)
        {
                global $ilObjDataCache,$ilUser;

                // member view constraints
                if($this->mem_view['active'] and $a_user_id == $ilUser->getId())
                {
                        if(in_array($a_ref_id, $this->mem_view['items']))
                        {
                                return $a_operations;
                        }
                }

                if($a_user_id != $ilObjDataCache->lookupOwner($ilObjDataCache->lookupObjId($a_ref_id)))
                {
                        return $a_operations;
                }
                // Is owner
                $new_ops = false;
                foreach(explode(",",$a_operations) as $operation)
                {
                        if($operation != 'cat_administrate_users' and $operation != 'edit_permission' and $operation != 'edit_learning_progress' and !preg_match('/^create/',$operation))
                        {
                                continue;
                        }
                        if(!strlen($new_ops))
                        {
                                $new_ops = $operation;
                        }
                        else
                        {
                                $new_ops .= (','.$operation);
                        }
                }
                return $new_ops;
                
                
        }
        
        private function fetchAssignedRoles($a_usr_id,$a_ref_id)
        {
                global $ilUser,$rbacreview;
                
                // Member view constraints
                if($this->mem_view['active'] and $a_usr_id == $ilUser->getId())
                {
                        // check if current ref_id is subitem of active container
                        if(in_array($a_ref_id, $this->mem_view['items']) and $this->mem_view['role'])
                        {
                                // Return default member role
                                return array($this->mem_view['role']);
                        }
                }

                if(isset(self::$user_role_cache[$a_usr_id]) and is_array(self::$user_role_cache))
                {
                        return self::$user_role_cache[$a_usr_id];
                }



                return self::$user_role_cache[$a_usr_id] = $rbacreview->assignedRoles($a_usr_id);
        }
        
        public function initMemberView()
        {
                include_once './Services/Container/classes/class.ilMemberViewSettings.php';
                $settings = ilMemberViewSettings::getInstance();
                
                if(!isset($_GET['mv']))
                {
                        // nothing to do
                        return true;
                }
                
                // disable member view
                if(!$_GET['mv'])
                {
                        // force deactivation
                        $settings->toggleActivation((int) $_GET['ref_id'], false);
                }
                else
                {
                        if($this->checkAccess('write', (int) $_GET['ref_id']))
                        {
                                $settings->toggleActivation((int) $_GET['ref_id'], true);
                        }
                }
                
                if(!$settings->isActive())
                {
                        $this->mem_view['active'] = false;
                        $this->mem_view['items'] = array();
                        $this->mem_view['role'] = 0;
                }
                else
                {
                        global $tree;
                        
                        $this->mem_view['active'] = true;
                        $this->mem_view['items'] = $tree->getSubTreeIds($settings->getContainer());
                        $this->mem_view['items'] = array_merge($this->mem_view['items'],array($settings->getContainer()));
                        include_once './Services/Membership/classes/class.ilParticipants.php';
                        $this->mem_view['role'] = ilParticipants::getDefaultMemberRole($settings->getContainer());
                        
                }
                return true;
        }
        
        public function addTemporaryRole($a_usr_id, $a_role_id)
        {
                if(!in_array($a_role_id, self::$user_role_cache[$a_usr_id]))
                {
                        self::$user_role_cache[$a_usr_id][] = $a_role_id;
                }
        }
        
        public function resetPACache($a_usr_id, $a_ref_id)
        {
                $paCacheKey = $a_usr_id.':'.$a_ref_id;          
        unset(self::$_paCache[$paCacheKey]);
        }

} // END class.RbacSystem
?>