class.ilRbacReview.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2010 ILIAS open source, Extended GPL, see docs/LICENSE */
 
class ilRbacReview
{
        const FILTER_ALL = 1;
        const FILTER_ALL_GLOBAL = 2;
        const FILTER_ALL_LOCAL = 3;
        const FILTER_INTERNAL = 4;
        const FILTER_NOT_INTERNAL = 5;
        const FILTER_TEMPLATES = 6;
 
    // Cache operation ids
    private static $_opsCache = null;
 
        protected static $assigned_users_cache = array();
 
        protected static $is_assigned_cache = array();
        
        protected $log;
 
        public function __construct()
        {
                global $ilDB,$ilErr,$ilias;
 
                $this->log = ilLoggerFactory::getLogger('ac');
 
                // set db & error handler
                (isset($ilDB)) ? $this->ilDB =& $ilDB : $this->ilDB =& $ilias->db;
                
                if (!isset($ilErr))
                {
                        $ilErr = new ilErrorHandling();
                        $ilErr->setErrorHandling(PEAR_ERROR_CALLBACK,array($ilErr,'errorHandler'));
                }
                else
                {
                        $this->ilErr =& $ilErr;
                }
        }
 
        public function roleExists($a_title,$a_id = 0)
        {
                global $ilDB;
                
                if (empty($a_title))
                {
                        $message = get_class($this)."::roleExists(): No title given!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
                
                $clause = ($a_id) ? " AND obj_id != ".$ilDB->quote($a_id)." " : "";
                
                $q = "SELECT DISTINCT(obj_id) obj_id FROM object_data ".
                         "WHERE title =".$ilDB->quote($a_title)." ".
                         "AND type IN('role','rolt')".
                         $clause." ";
                $r = $this->ilDB->query($q);
 
                while($row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        return $row->obj_id;
                }
                return false;
        }
 
        protected function __getParentRoles($a_path,$a_templates)
        {
                if (!isset($a_path) or !is_array($a_path))
                {
                        $message = get_class($this)."::getParentRoles(): No path given or wrong datatype!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
 
                $parent_roles = array();
                $role_hierarchy = array();
                
                foreach($a_path as $ref_id)
                {
                        $roles = $this->getRoleListByObject($ref_id,$a_templates);
                        foreach($roles as $role)
                        {
                $id = $role["obj_id"];
                $role["parent"] = $ref_id;
                $parent_roles[$id] = $role;
 
                if (!array_key_exists($role['obj_id'],$role_hierarchy))
                {
                    $role_hierarchy[$id] = $ref_id;
                }
                        }
                }
                return $this->__setProtectedStatus($parent_roles,$role_hierarchy,reset($a_path));
        }
 
        public function getParentRoleIds($a_endnode_id,$a_templates = false)
        {
                global $tree;
 
                if (!isset($a_endnode_id))
                {
                        $GLOBALS['ilLog']->logStack();
                        $message = get_class($this)."::getParentRoleIds(): No node_id (ref_id) given!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
                
                //var_dump($a_endnode_id);exit;
                //$log->write("ilRBACreview::getParentRoleIds(), 0");   
                $pathIds  = $tree->getPathId($a_endnode_id);
                
                // add system folder since it may not in the path
                //$pathIds[0] = SYSTEM_FOLDER_ID;
                $pathIds[0] = ROLE_FOLDER_ID;
                //$log->write("ilRBACreview::getParentRoleIds(), 1");
                #return $this->getParentRoles($a_endnode_id,$a_templates,$a_keep_protected);
                return $this->__getParentRoles($pathIds,$a_templates);
        }
 
        public function getRoleListByObject($a_ref_id,$a_templates = false)
        {
                global $ilDB;
                
                if (!isset($a_ref_id) or !isset($a_templates))
                {
                        $message = get_class($this)."::getRoleListByObject(): Missing parameter!".
                                           "ref_id: ".$a_ref_id.
                                           "tpl_flag: ".$a_templates;
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
 
                $role_list = array();
 
                $where = $this->__setTemplateFilter($a_templates);
        
                $query = "SELECT * FROM object_data ".
                         "JOIN rbac_fa ON obj_id = rol_id ".
                         $where.
                         "AND object_data.obj_id = rbac_fa.rol_id ".
                         "AND rbac_fa.parent = ".$ilDB->quote($a_ref_id,'integer')." ";
                         
                $res = $ilDB->query($query);
                while ($row = $ilDB->fetchAssoc($res))
                {
                        $row["desc"] = $row["description"];
                        $row["user_id"] = $row["owner"];
                        $role_list[] = $row;
                }
 
                $role_list = $this->__setRoleType($role_list);
                
                return $role_list;
        }
        
        function getAssignableRoles($a_templates = false,$a_internal_roles = false, $title_filter = '')
        {
                global $ilDB;
 
                $role_list = array();
 
                $where = $this->__setTemplateFilter($a_templates);
 
                $query = "SELECT * FROM object_data ".
                         "JOIN rbac_fa ON obj_id = rol_id ".
                         $where.
                         "AND rbac_fa.assign = 'y' ";
 
                if(strlen($title_filter))
                {
                        $query .= (' AND '.$ilDB->like(
                                'title',
                                'text',
                                $title_filter.'%'
                        ));
                }
                $res = $ilDB->query($query);
 
                while ($row = $ilDB->fetchAssoc($res))
                {
                        $row["desc"] = $row["description"];
                        $row["user_id"] = $row["owner"];
                        $role_list[] = $row;
                }
                
                $role_list = $this->__setRoleType($role_list);
 
                return $role_list;
        }
 
        public function getAssignableRolesInSubtree($ref_id)
        {
                global $ilDB;
                
                $query = 'SELECT rol_id FROM rbac_fa fa '.
                                'JOIN tree t1 ON t1.child = fa.parent '.
                                'JOIN object_data obd ON fa.rol_id = obd.obj_id ' .
                                'WHERE assign = '.$ilDB->quote('y','text').' '.
                                'AND obd.type = '.$ilDB->quote('role','text').' '.
                                'AND t1.child IN ('.
                                $GLOBALS['tree']->getSubTreeQuery($ref_id,array('child')).' '.
                                ') ';
                
 
                $res = $ilDB->query($query);
                
                $role_list = array();
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        $role_list[] = $row->rol_id;
                }
                return $role_list;
        }
 
        public function getAssignableChildRoles($a_ref_id)
        {
                global $ilDB;
 
                $query = "SELECT fa.*, rd.* ".
                         "FROM object_data rd ".
                         "JOIN rbac_fa fa ON rd.obj_id = fa.rol_id ".
                         "WHERE fa.assign = 'y' ".
                         "AND fa.parent = ".$this->ilDB->quote($a_ref_id,'integer')." "
                        ;
                
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchAssoc($res))
                {
                        $roles_data[] = $row;
                }
                return $roles_data ? $roles_data : array();
        }
        
        protected function __setTemplateFilter($a_templates)
        {
                global $ilDB;
                
                if ($a_templates === true)
                {
                        $where = "WHERE ".$ilDB->in('object_data.type',array('role','rolt'),false,'text')." ";
                }
                else
                {
                        $where = "WHERE ".$ilDB->in('object_data.type',array('role'),false,'text')." ";
                }
                
                return $where;
        }
 
        protected function __setRoleType($a_role_list)
        {
                foreach ($a_role_list as $key => $val)
                {
                        // determine role type
                        if ($val["type"] == "rolt")
                        {
                                $a_role_list[$key]["role_type"] = "template";
                        }
                        else
                        {
                                if ($val["assign"] == "y")
                                {
                                        if ($val["parent"] == ROLE_FOLDER_ID)
                                        {
                                                $a_role_list[$key]["role_type"] = "global";
                                        }
                                        else
                                        {
                                                $a_role_list[$key]["role_type"] = "local";
                                        }
                                }
                                else
                                {
                                        $a_role_list[$key]["role_type"] = "linked";
                                }
                        }
                        
                        if ($val["protected"] == "y")
                        {
                                $a_role_list[$key]["protected"] = true;
                        }
                        else
                        {
                                $a_role_list[$key]["protected"] = false;
                        }
                }
                
                return $a_role_list;
        }
 
        public function getNumberOfAssignedUsers(Array $a_roles)
        {
                global $ilDB;
 
                $query = 'SELECT COUNT(DISTINCT(usr_id)) as num FROM rbac_ua '.
                        'WHERE '.$ilDB->in('rol_id', $a_roles, false, 'integer').' ';
 
                $res = $ilDB->query($query);
                $row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT);
                return $row->num ? $row->num : 0;
        }
 
 
        public function assignedUsers($a_rol_id)
        {
                global $ilBench,$ilDB;
                
                if (!isset($a_rol_id))
                {
                        $message = get_class($this)."::assignedUsers(): No role_id given!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
                if(isset(self::$assigned_users_cache[$a_rol_id]))
                {
                        return self::$assigned_users_cache[$a_rol_id];
                }
                
        $result_arr = array();
 
                $query = "SELECT usr_id FROM rbac_ua WHERE rol_id= ".$ilDB->quote($a_rol_id,'integer');
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchAssoc($res))
                {
                        array_push($result_arr, $row["usr_id"]);
                }
 
                self::$assigned_users_cache[$a_rol_id] = $result_arr;
 
                return $result_arr;
        }
 
 
        public function isAssigned($a_usr_id,$a_role_id)
        {
        if(isset(self::$is_assigned_cache[$a_role_id][$a_usr_id])) {
                return self::$is_assigned_cache[$a_role_id][$a_usr_id];
        }
        // Quickly determine if user is assigned to a role
                global $ilDB;
 
            $ilDB->setLimit(1,0);
            $query = "SELECT usr_id FROM rbac_ua WHERE ".
                    "rol_id= ".$ilDB->quote($a_role_id,'integer')." ".
                    "AND usr_id= ".$ilDB->quote($a_usr_id);
                $res = $ilDB->query($query);
 
                $is_assigned = $res->numRows() == 1;
                self::$is_assigned_cache[$a_role_id][$a_usr_id] = $is_assigned;
 
                return $is_assigned;
        }
    
        public function isAssignedToAtLeastOneGivenRole($a_usr_id,$a_role_ids)
        {
                global $ilDB;
 
            $ilDB->setLimit(1,0);
            $query = "SELECT usr_id FROM rbac_ua WHERE ".
                    $ilDB->in('rol_id',$a_role_ids,false,'integer').
                    " AND usr_id= ".$ilDB->quote($a_usr_id);
                $res = $ilDB->query($query);
 
        return $ilDB->numRows($res) == 1;
        }
        
        public function assignedRoles($a_usr_id)
        {
                global $ilDB;
                
                $role_arr = array();
                
                $query = "SELECT rol_id FROM rbac_ua WHERE usr_id = ".$ilDB->quote($a_usr_id,'integer');
 
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $role_arr[] = $row->rol_id;
                }
                return $role_arr ? $role_arr : array();
        }
        
        public function assignedGlobalRoles($a_usr_id)
        {
                global $ilDB;
                
                $query = "SELECT ua.rol_id FROM rbac_ua ua ".
                        "JOIN rbac_fa fa ON ua.rol_id = fa.rol_id ".
                        "WHERE usr_id = ".$ilDB->quote($a_usr_id,'integer').' '.
                        "AND parent = ".$ilDB->quote(ROLE_FOLDER_ID)." ".
                        "AND assign = 'y' ";
                
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $role_arr[] = $row->rol_id;
                }
                return $role_arr ? $role_arr : array();
        }
 
        public function isAssignable($a_rol_id, $a_ref_id)
        {
                global $ilBench,$ilDB;
 
                $ilBench->start("RBAC", "review_isAssignable");
 
                // exclude system role from rbac
                if ($a_rol_id == SYSTEM_ROLE_ID)
                {
                        $ilBench->stop("RBAC", "review_isAssignable");
                        return true;
                }
 
                if (!isset($a_rol_id) or !isset($a_ref_id))
                {
                        $message = get_class($this)."::isAssignable(): Missing parameter!".
                                           " role_id: ".$a_rol_id." ,ref_id: ".$a_ref_id;
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
                $query = "SELECT * FROM rbac_fa ".
                         "WHERE rol_id = ".$ilDB->quote($a_rol_id,'integer')." ".
                         "AND parent = ".$ilDB->quote($a_ref_id,'integer')." ";
                $res = $ilDB->query($query);
                $row = $ilDB->fetchObject($res);
        
                $ilBench->stop("RBAC", "review_isAssignable");
                return $row->assign == 'y' ? true : false;
        }
        
        public function hasMultipleAssignments($a_role_id)
        {
                global $ilDB;
                
                $query = "SELECT * FROM rbac_fa WHERE rol_id = ".$ilDB->quote($a_role_id,'integer').' '.
                        "AND assign = ".$ilDB->quote('y','text');
                $res = $ilDB->query($query);
                return $res->numRows() > 1;
        }
 
        public function getFoldersAssignedToRole($a_rol_id, $a_assignable = false)
        {
                global $ilDB;
                
                if (!isset($a_rol_id))
                {
                        $message = get_class($this)."::getFoldersAssignedToRole(): No role_id given!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
                
                if ($a_assignable)
                {
                        $where = " AND assign ='y'";
                }
 
                $query = "SELECT DISTINCT parent FROM rbac_fa ".
                         "WHERE rol_id = ".$ilDB->quote($a_rol_id,'integer')." ".$where." ";
 
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $folders[] = $row->parent;
                }
                return $folders ? $folders : array();
        }
        
        public function getRolesOfObject($a_ref_id, $a_assignable_only = FALSE)
        {
                global $ilDB;
                
                if(!isset($a_ref_id))
                {
                        $GLOBALS['ilLog']->logStack();
                        throw new InvalidArgumentException(__METHOD__.': No ref_id given!');
                }
                if($a_assignable_only === TRUE)
                {
                        $and = 'AND assign = '.$ilDB->quote('y','text');
                }
                $query = "SELECT rol_id FROM rbac_fa ".
                         "WHERE parent = ".$ilDB->quote($a_ref_id,'integer')." ".
                         $and;
 
                $res = $ilDB->query($query);
                
                $role_ids = array();
                while($row = $ilDB->fetchObject($res))
                {
                        $role_ids[] = $row->rol_id;
                }
                return $role_ids;
        }
         
        
        
 
        public function getRolesOfRoleFolder($a_ref_id,$a_nonassignable = true)
        {
                global $ilBench,$ilDB,$ilLog;
                
                $ilBench->start("RBAC", "review_getRolesOfRoleFolder");
 
                if (!isset($a_ref_id))
                {
                        $message = get_class($this)."::getRolesOfRoleFolder(): No ref_id given!";
                        ilLoggerFactory::getLogger('ac')->logStack();
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                        
                }
                
                if ($a_nonassignable === false)
                {
                        $and = " AND assign='y'";
                }
 
                $query = "SELECT rol_id FROM rbac_fa ".
                         "WHERE parent = ".$ilDB->quote($a_ref_id,'integer')." ".
                         $and;
 
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $rol_id[] = $row->rol_id;
                }
 
                $ilBench->stop("RBAC", "review_getRolesOfRoleFolder");
 
                return $rol_id ? $rol_id : array();
        }
        
        public function getGlobalRoles()
        {
                return $this->getRolesOfRoleFolder(ROLE_FOLDER_ID,false);
        }
 
        public function getLocalRoles($a_ref_id)
        {
                global $ilDB;
 
                $lroles = array();
                foreach($this->getRolesOfRoleFolder($a_ref_id) as $role_id)
                {
                        if($this->isAssignable($role_id, $a_ref_id))
                        {
                                $lroles[] = $role_id;
                        }
                }
                return $lroles;
        }
 
        public function getLocalPolicies($a_ref_id)
        {
                $lroles = array();
                foreach($this->getRolesOfRoleFolder($a_ref_id) as $role_id)
                {
                        $lroles[] = $role_id;
                }
                return $lroles;
        }
 
        public function getGlobalRolesArray()
        {
                foreach($this->getRolesOfRoleFolder(ROLE_FOLDER_ID,false) as $role_id)
                {
                        $ga[] = array('obj_id'          => $role_id,
                                                  'role_type'   => 'global');
                }
                return $ga ? $ga : array();
        }
 
        public function getGlobalAssignableRoles()
        {
                include_once './Services/AccessControl/classes/class.ilObjRole.php';
 
                foreach($this->getGlobalRoles() as $role_id)
                {
                        if(ilObjRole::_getAssignUsersStatus($role_id))
                        {
                                $ga[] = array('obj_id' => $role_id,
                                                          'role_type' => 'global');
                        }
                }
                return $ga ? $ga : array();
        }
 
 
        public function isRoleAssignedToObject($a_role_id, $a_parent_id)
        {
                global $rbacreview, $ilDB;
 
                $query = 'SELECT * FROM rbac_fa '.
                        'WHERE rol_id = '.$ilDB->quote($a_role_id,'integer').' '.
                        'AND parent = '.$ilDB->quote($a_parent_id,'integer');
                $res = $ilDB->query($query);
                return $res->numRows() ? true : false;
        }
 
        public function getOperations()
        {
                global $ilDB;
 
                $query = 'SELECT * FROM rbac_operations ORDER BY ops_id ';
                $res = $this->ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $ops[] = array('ops_id' => $row->ops_id,
                                                   'operation' => $row->operation,
                                                   'description' => $row->description);
                }
 
                return $ops ? $ops : array();
        }
 
        public function getOperation($ops_id)
        {
                global $ilDB;
 
                $query = 'SELECT * FROM rbac_operations WHERE ops_id = '.$ilDB->quote($ops_id,'integer');
                $res = $this->ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $ops = array('ops_id' => $row->ops_id,
                                                 'operation' => $row->operation,
                                                 'description' => $row->description);
                }
 
                return $ops ? $ops : array();
        }
        
        public function getAllOperationsOfRole($a_rol_id, $a_parent = 0)
        {
                global $ilDB;
 
                if(!$a_parent)
                {
                        $a_parent = ROLE_FOLDER_ID;
                }
                
                $query = "SELECT ops_id,type FROM rbac_templates ".
                        "WHERE rol_id = ".$ilDB->quote($a_rol_id,'integer')." ".
                        "AND parent = ".$ilDB->quote($a_parent,'integer');
                $res = $ilDB->query($query);
 
                $ops_arr = array();
                while ($row = $ilDB->fetchObject($res))
                {
                        $ops_arr[$row->type][] = $row->ops_id;
                }
                return (array) $ops_arr;
        }
        
        public function getActiveOperationsOfRole($a_ref_id, $a_role_id)
        {
                global $ilDB;
                
                $query = 'SELECT * FROM rbac_pa '.
                        'WHERE ref_id = '.$ilDB->quote($a_ref_id,'integer').' '.
                        'AND rol_id = '.$ilDB->quote($a_role_id,'integer').' ';
                        
                $res = $ilDB->query($query);
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_ASSOC))
                {
                        return unserialize($row['ops_id']);
                }
                return array();
        }
        
 
        public function getOperationsOfRole($a_rol_id, $a_type, $a_parent = 0)
        {
                global $ilDB,$ilLog;
                
                if (!isset($a_rol_id) or !isset($a_type))
                {
                        $message = get_class($this)."::getOperationsOfRole(): Missing Parameter!".
                                           "role_id: ".$a_rol_id.
                                           "type: ".$a_type.
                                           "parent_id: ".$a_parent;
                        $ilLog->logStack("Missing parameter! ");
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
 
                $ops_arr = array();
 
                // if no rolefolder id is given, assume global role folder as target
                if ($a_parent == 0)
                {
                        $a_parent = ROLE_FOLDER_ID;
                }
                
                $query = "SELECT ops_id FROM rbac_templates ".
                         "WHERE type =".$ilDB->quote($a_type,'text')." ".
                         "AND rol_id = ".$ilDB->quote($a_rol_id,'integer')." ".
                         "AND parent = ".$ilDB->quote($a_parent,'integer');
                $res = $ilDB->query($query);
                while ($row = $ilDB->fetchObject($res))
                {
                        $ops_arr[] = $row->ops_id;
                }
                
                return $ops_arr;
        }
        
        public function getRoleOperationsOnObject($a_role_id,$a_ref_id)
        {
                global $ilDB;
                
                $query = "SELECT * FROM rbac_pa ".
                        "WHERE rol_id = ".$ilDB->quote($a_role_id,'integer')." ".
                        "AND ref_id = ".$ilDB->quote($a_ref_id,'integer')." ";
 
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $ops = unserialize($row->ops_id);
                }
 
                return $ops ? $ops : array();
        }
 
        public function getOperationsOnType($a_typ_id)
        {
                global $ilDB;
 
                if (!isset($a_typ_id))
                {
                        $message = get_class($this)."::getOperationsOnType(): No type_id given!";
                        $this->ilErr->raiseError($message,$this->ilErr->WARNING);
                }
 
                #$query = "SELECT * FROM rbac_ta WHERE typ_id = ".$ilDB->quote($a_typ_id,'integer');
                
                $query = 'SELECT * FROM rbac_ta ta JOIN rbac_operations o ON ta.ops_id = o.ops_id '.
                        'WHERE typ_id = '.$ilDB->quote($a_typ_id,'integer').' '.
                        'ORDER BY op_order';
 
                $res = $ilDB->query($query);
 
                while($row = $ilDB->fetchObject($res))
                {
                        $ops_id[] = $row->ops_id;
                }
 
                return $ops_id ? $ops_id : array();
        }
 
        public function getOperationsOnTypeString($a_type)
        {
                global $ilDB;
 
                $query = "SELECT * FROM object_data WHERE type = 'typ' AND title = ".$ilDB->quote($a_type ,'text')." ";
                        
 
                $res = $this->ilDB->query($query);
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        return $this->getOperationsOnType($row->obj_id);
                }
                return false;
        }
        
        public function getOperationsByTypeAndClass($a_type,$a_class)
        {
                global $ilDB;
                
                if($a_class != 'create')
                {
                        $condition = "AND class != ".$ilDB->quote('create','text');
                }
                else
                {
                        $condition = "AND class = ".$ilDB->quote('create','text');
                }
                
                $query = "SELECT ro.ops_id FROM rbac_operations ro ".
                        "JOIN rbac_ta rt ON  ro.ops_id = rt.ops_id ".
                        "JOIN object_data od ON rt.typ_id = od.obj_id ".
                        "WHERE type = ".$ilDB->quote('typ','text')." ".
                        "AND title = ".$ilDB->quote($a_type,'text')." ".
                        $condition." ".
                        "ORDER BY op_order ";
                        
                $res = $ilDB->query($query);
                
                $ops = array();
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        $ops[] = $row->ops_id;
                }
                return $ops; 
        }
 
        
        public function getObjectsWithStopedInheritance($a_rol_id,$a_filter = array())
        {
                global $ilDB;
                
                #$query = 'SELECT t.parent p FROM tree t JOIN rbac_fa fa ON fa.parent = child '.
                #       'WHERE assign = '.$ilDB->quote('n','text').' '.
                #       'AND rol_id = '.$ilDB->quote($a_rol_id,'integer').' ';
                
                $query = 'SELECT parent p FROM rbac_fa '.
                                'WHERE assign = '.$ilDB->quote('n','text').' '.
                                'AND rol_id = '.$ilDB->quote($a_rol_id,'integer').' ';
                
                if($a_filter)
                {
                        $query .= ('AND '.$ilDB->in('parent',(array) $a_filter,false,'integer'));
                }
 
                $res = $ilDB->query($query);
                $parent = array();
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        $parent[] = $row->p;
                }
                return $parent;
        }
 
        public function isDeleted($a_node_id)
        {
                global $ilDB;
                
                $q = "SELECT tree FROM tree WHERE child =".$ilDB->quote($a_node_id)." ";
                $r = $this->ilDB->query($q);
                
                $row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT);
                
                if (!$row)
                {
                        $message = sprintf('%s::isDeleted(): Role folder with ref_id %s not found!',
                                                           get_class($this),
                                                           $a_node_id);
                        $this->log->write($message,$this->log->FATAL);
 
                        return true;
                }
 
                // rolefolder is deleted
                if ($row->tree < 0)
                {
                        return true;
                }
                
                return false;
        }
        
        public function isGlobalRole($a_role_id)
        {
                return in_array($a_role_id,$this->getGlobalRoles());
        }
        
        public function getRolesByFilter($a_filter = 0,$a_user_id = 0, $title_filter = '')
        {
                global $ilDB;
                
        $assign = "y";
 
                switch($a_filter)
                {
            // all (assignable) roles
            case self::FILTER_ALL:
                                return $this->getAssignableRoles(true,true,$title_filter);
                                break;
 
            // all (assignable) global roles
            case self::FILTER_ALL_GLOBAL:
                                $where = 'WHERE '.$ilDB->in('rbac_fa.rol_id',$this->getGlobalRoles(),false,'integer').' ';
                                break;
 
            // all (assignable) local roles
            case self::FILTER_ALL_LOCAL:
            case self::FILTER_INTERNAL:
            case self::FILTER_NOT_INTERNAL:
                                $where = 'WHERE '.$ilDB->in('rbac_fa.rol_id',$this->getGlobalRoles(),true,'integer');
                                break;
                                
            // all role templates
            case self::FILTER_TEMPLATES:
                                $where = "WHERE object_data.type = 'rolt'";
                                $assign = "n";
                                break;
 
            // only assigned roles, handled by ilObjUserGUI::roleassignmentObject()
            case 0:
                        default:
                if(!$a_user_id) 
                        return array();
 
                                $where = 'WHERE '.$ilDB->in('rbac_fa.rol_id',$this->assignedRoles($a_user_id),false,'integer').' ';
                break;
                }
                
                $roles = array();
 
                $query = "SELECT * FROM object_data ".
                         "JOIN rbac_fa ON obj_id = rol_id ".
                         $where.
                         "AND rbac_fa.assign = ".$ilDB->quote($assign,'text')." ";
 
                if(strlen($title_filter))
                {
                        $query .= (' AND '.$ilDB->like(
                                'title',
                                'text',
                                '%'.$title_filter.'%'
                        ));
                }
                
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchAssoc($res))
                {
            $prefix = (substr($row["title"],0,3) == "il_") ? true : false;
 
            // all (assignable) internal local roles only
            if ($a_filter == 4 and !$prefix)
                        {
                continue;
            }
 
            // all (assignable) non internal local roles only
                        if ($a_filter == 5 and $prefix)
                        {
                continue;
            }
            
                        $row["desc"] = $row["description"];
                        $row["user_id"] = $row["owner"];
                        $roles[] = $row;
                }
 
                $roles = $this->__setRoleType($roles);
 
                return $roles ? $roles : array();
        }
 
        public function getTypeId($a_type)
        {
                global $ilDB;
 
                $q = "SELECT obj_id FROM object_data ".
                         "WHERE title=".$ilDB->quote($a_type ,'text')." AND type='typ'";
                $r = $ilDB->query($q);
                
                $row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT);
                return $row->obj_id;
        }
 
        public static function _getOperationIdsByName($operations)
        {
                global $ilDB;
 
                if(!count($operations))
                {
                        return array();
                }
                
                $query = 'SELECT ops_id FROM rbac_operations '.
                        'WHERE '.$ilDB->in('operation',$operations,false,'text');
                
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchObject($res))
                {
                        $ops_ids[] = $row->ops_id;
                }
                return $ops_ids ? $ops_ids : array();
        }
        
        public static function _getOperationIdByName($a_operation)
        {
                global $ilDB,$ilErr;
 
                if (!isset($a_operation))
                {
                        $message = "perm::getOperationId(): No operation given!";
                        $ilErr->raiseError($message,$ilErr->WARNING);   
                }
 
        // Cache operation ids
        if (! is_array(self::$_opsCache)) {
            self::$_opsCache = array();
 
            $q = "SELECT ops_id, operation FROM rbac_operations";
            $r = $ilDB->query($q);
            while ($row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
            {
                self::$_opsCache[$row->operation] = $row->ops_id;
            }
        }
 
        // Get operation ID by name from cache
        if (array_key_exists($a_operation, self::$_opsCache)) {
            return self::$_opsCache[$a_operation];
        }
        return null;
        }
        
        public static function lookupCreateOperationIds($a_type_arr)
        {
                global $ilDB;
                
                $operations = array();
                foreach($a_type_arr as $type)
                {
                        $operations[] = ('create_'.$type);
                }
                
                if(!count($operations))
                {
                        return array();
                }
                
                $query = 'SELECT ops_id, operation FROM rbac_operations '.
                        'WHERE '.$ilDB->in('operation',$operations,false,'text');
                        
                $res = $ilDB->query($query);
        
                $ops_ids = array();
                while($row = $ilDB->fetchObject($res))
                {
                        $type_arr = explode('_', $row->operation);
                        $type = $type_arr[1];
                        
                        $ops_ids[$type] = $row->ops_id;
                }
                return $ops_ids;
        }
 
 
        
        public function isProtected($a_ref_id,$a_role_id)
        {
                global $ilDB;
 
                // ref_id not used yet. protected permission acts 'global' for each role,
                $query = "SELECT protected FROM rbac_fa ".
                         "WHERE rol_id = ".$ilDB->quote($a_role_id,'integer')." ";
                $res = $ilDB->query($query);
                $row = $ilDB->fetchAssoc($res);
                
                return ilUtil::yn2tf($row['protected']);
        }
        
        public function isBlockedAtPosition($a_role_id, $a_ref_id)
        {
                global $ilDB;
                
                $query = 'SELECT blocked from rbac_fa '.
                                'WHERE rol_id = '. $ilDB->quote($a_role_id,'integer').' '.
                                'AND parent = '.$ilDB->quote($a_ref_id,'integer');
                $res = $ilDB->query($query);
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        return (bool) $row->blocked;
                }
                return FALSE;
        }
        
        public function isBlockedInUpperContext($a_role_id, $a_ref_id)
        {
                global $ilDB, $tree;
                
                if($this->isBlockedAtPosition($a_role_id, $a_ref_id))
                {
                        return FALSE;
                }
                $query = 'SELECT parent from rbac_fa '.
                                'WHERE rol_id = '.$ilDB->quote($a_role_id,'integer').' '.
                                'AND blocked = '.$ilDB->quote(1,'integer');
                $res = $ilDB->query($query);
                
                $parent_ids = array();
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        $parent_ids[] = $row->parent;
                }
                
                foreach($parent_ids as $parent_id)
                {
                        if($tree->isGrandChild($parent_id, $a_ref_id))
                        {
                                return TRUE;
                        }
                }
                return FALSE;
        }
        
        // this method alters the protected status of role regarding the current user's role assignment
        // and current postion in the hierarchy.
 
        protected function __setProtectedStatus($a_parent_roles,$a_role_hierarchy,$a_ref_id)
        {
                //vd('refId',$a_ref_id,'parent roles',$a_parent_roles,'role-hierarchy',$a_role_hierarchy);
                
                global $rbacsystem,$ilUser,$log;
                
                if (in_array(SYSTEM_ROLE_ID,$this->assignedRoles($ilUser->getId())))
                {
                        $leveladmin = true;
                }
                else
                {
                        $leveladmin = false;
                }
                #vd("RoleHierarchy",$a_role_hierarchy);
                foreach ($a_role_hierarchy as $role_id => $rolf_id)
                {
                        //$log->write("ilRBACreview::__setProtectedStatus(), 0");       
                        #echo "<br/>ROLF: ".$rolf_id." ROLE_ID: ".$role_id." (".$a_parent_roles[$role_id]['title'].") ";
                        //var_dump($leveladmin,$a_parent_roles[$role_id]['protected']);
 
                        if ($leveladmin == true)
                        {
                                $a_parent_roles[$role_id]['protected'] = false;
                                continue;
                        }
                                
                        if ($a_parent_roles[$role_id]['protected'] == true)
                        {
                                $arr_lvl_roles_user = array_intersect($this->assignedRoles($ilUser->getId()),array_keys($a_role_hierarchy,$rolf_id));
                                
                                #vd("intersection",$arr_lvl_roles_user);
                                
                                foreach ($arr_lvl_roles_user as $lvl_role_id)
                                {
                                        #echo "<br/>level_role: ".$lvl_role_id;
                                        #echo "<br/>a_ref_id: ".$a_ref_id;
                                        
                                        //$log->write("ilRBACreview::__setProtectedStatus(), 1");
                                        // check if role grants 'edit_permission' to parent
                                        $rolf = $a_parent_roles[$role_id]['parent'];
                                        #$parent_obj = $GLOBALS['tree']->getParentId($rolf);
                                        if ($rbacsystem->checkPermission($rolf,$lvl_role_id,'edit_permission'))
                                        {
                                                #echo "<br />Permission granted";
                                                //$log->write("ilRBACreview::__setProtectedStatus(), 2");
                                                // user may change permissions of that higher-ranked role
                                                $a_parent_roles[$role_id]['protected'] = false;
                                                
                                                // remember successful check
                                                //$leveladmin = true;
                                        }
                                }
                        }
                }
                return $a_parent_roles;
        }
        
        public static function _getOperationList($a_type = null)
         {
                global $ilDB;
        
                $arr = array();
 
                if ($a_type)
                {
                        $query = sprintf('SELECT * FROM rbac_operations '.
                                'JOIN rbac_ta ON rbac_operations.ops_id = rbac_ta.ops_id '.
                                'JOIN object_data ON rbac_ta.typ_id = object_data.obj_id '.
                                'WHERE object_data.title = %s '.
                                'AND object_data.type = %s '.
                                'ORDER BY op_order ASC',
                                $ilDB->quote($a_type,'text'),
                                $ilDB->quote('typ','text'));
                }
                else
                {
                        $query = 'SELECT * FROM rbac_operations ORDER BY op_order ASC';
                }
                $res = $ilDB->query($query);
                while ($row = $ilDB->fetchAssoc($res))
                {
                        $arr[] = array(
                                                "ops_id"        => $row['ops_id'],
                                                "operation"     => $row['operation'],
                                                "desc"          => $row['description'],
                                                "class"         => $row['class'],
                                                "order"         => $row['op_order']
                                                );
                }
                return $arr;
        }
        
        public static function _groupOperationsByClass($a_ops_arr)
        {
                $arr = array();
 
                foreach ($a_ops_arr as $ops)
                {
                        $arr[$ops['class']][] = array ('ops_id' => $ops['ops_id'],
                                                                                   'name'       => $ops['operation']
                                                                                 );
                }
                return $arr; 
        }
 
        public function getObjectOfRole($a_role_id)
        {
                // internal cache
                static $obj_cache = array();
 
                global $ilDB;
                
                
                if(isset($obj_cache[$a_role_id]) and $obj_cache[$a_role_id])
                {
                        return $obj_cache[$a_role_id];
                }
                
                $query = 'SELECT obr.obj_id FROM rbac_fa rfa '.
                                'JOIN object_reference obr ON rfa.parent = obr.ref_id '.
                                'WHERE assign = '.$ilDB->quote('y','text'). ' '.
                                'AND rol_id = '.$ilDB->quote($a_role_id,'integer').' '.
                                'AND deleted IS NULL';
                
                #$query = "SELECT obr.obj_id FROM rbac_fa rfa ".
                #       "JOIN tree ON rfa.parent = tree.child ".
                #       "JOIN object_reference obr ON tree.parent = obr.ref_id ".
                #       "WHERE tree.tree = 1 ".
                #       "AND assign = 'y' ".
                #       "AND rol_id = ".$ilDB->quote($a_role_id,'integer')." ";
                $res = $ilDB->query($query);
                
                $obj_cache[$a_role_id] = 0;
                while($row = $ilDB->fetchObject($res))
                {
                        $obj_cache[$a_role_id] = $row->obj_id;
                }
                return $obj_cache[$a_role_id];
        }
        
        public function getObjectReferenceOfRole($a_role_id)
        {
                global $ilDB;
                
                $query = 'SELECT parent p_ref FROM rbac_fa '.
                                'WHERE rol_id = '.$ilDB->quote($a_role_id,'integer').' '.
                                'AND assign = '.$ilDB->quote('y','text');
                
                $res = $ilDB->query($query);
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        return $row->p_ref;
                }
                return 0;
        }
        
        public function isRoleDeleted ($a_role_id)
        {
                $rolf_list = $this->getFoldersAssignedToRole($a_role_id, false);
                $deleted = true;
                if (count($rolf_list))
                {
                        foreach ($rolf_list as $rolf) {                 
                        // only list roles that are not set to status "deleted"
                        if (!$this->isDeleted($rolf))
                                {
                                        $deleted = false;
                                        break;
                                }
                        }
                }
                return $deleted;        
        }
        
        
        public function getRolesForIDs($role_ids, $use_templates)
        {
                global $ilDB;
                
                $role_list = array();
 
                $where = $this->__setTemplateFilter($use_templates);
 
                $query = "SELECT * FROM object_data ".
                         "JOIN rbac_fa ON object_data.obj_id = rbac_fa.rol_id ".
                         $where.
                         "AND rbac_fa.assign = 'y' " .
                         'AND '.$ilDB->in('object_data.obj_id',$role_ids,false,'integer');
                         
                $res = $ilDB->query($query);
                while($row = $ilDB->fetchAssoc($res))
                {
                        $row["desc"] = $row["description"];
                        $row["user_id"] = $row["owner"];
                        $role_list[] = $row;
                }
                
                $role_list = $this->__setRoleType($role_list);
                return $role_list;
        }
        
        public function getOperationAssignment()
        {
                global $ilDB;
 
                $query = 'SELECT ta.typ_id, obj.title, ops.ops_id, ops.operation FROM rbac_ta ta '.
                         'JOIN object_data obj ON obj.obj_id = ta.typ_id '.
                         'JOIN rbac_operations ops ON ops.ops_id = ta.ops_id ';
                $res = $ilDB->query($query);
                
                $counter = 0;
                while($row = $ilDB->fetchObject($res))
                {
                        $info[$counter]['typ_id'] = $row->typ_id;
                        $info[$counter]['type'] = $row->title;
                        $info[$counter]['ops_id'] = $row->ops_id;
                        $info[$counter]['operation'] = $row->operation;
                        $counter++;
                }
                return $info ? $info : array();
                
        }
        
        public function isDeleteable($a_role_id, $a_rolf_id)
        {
                if(!$this->isAssignable($a_role_id, $a_rolf_id))
                {
                        return false;
                }
                if($a_role_id == SYSTEM_ROLE_ID or $a_role_id == ANONYMOUS_ROLE_ID)
                {
                        return false;
                }
                if(substr(ilObject::_lookupTitle($a_role_id),0,3) == 'il_')
                {
                        return false;
                }
                return true;
        }
 
        public function isSystemGeneratedRole($a_role_id)
        {
                $title = ilObject::_lookupTitle($a_role_id);
                return substr($title,0,3) == 'il_' ? true : false;
        }
 
 
        public function getRoleFolderOfRole($a_role_id)
        {
                global $ilDB;
                
                if(ilObject::_lookupType($a_role_id) == 'role')
                {
                        $and = ('AND assign = '.$ilDB->quote('y','text'));
                }
                else
                {
                        $and = '';
                }
 
                $query = 'SELECT * FROM rbac_fa '.
                        'WHERE rol_id = '.$ilDB->quote($a_role_id,'integer').' '.
                        $and;
                $res = $ilDB->query($query);
                while($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT))
                {
                        return $row->parent;
                }
                return 0;
        }
        
        public function getUserPermissionsOnObject($a_user_id, $a_ref_id)
        {
                global $ilDB;
                
                $query = "SELECT ops_id FROM rbac_pa JOIN rbac_ua ".
                        "ON (rbac_pa.rol_id = rbac_ua.rol_id) ".
                        "WHERE rbac_ua.usr_id = ".$ilDB->quote($a_user_id,'integer')." ".
                        "AND rbac_pa.ref_id = ".$ilDB->quote($a_ref_id,'integer')." ";
 
                $res = $ilDB->query($query);
                $all_ops = array();
                while ($row = $ilDB->fetchObject($res))
                {
                        $ops = unserialize($row->ops_id);
                        $all_ops = array_merge($all_ops, $ops);
                }
                $all_ops = array_unique($all_ops);
                
                $set = $ilDB->query("SELECT operation FROM rbac_operations ".
                        " WHERE ".$ilDB->in("ops_id", $all_ops, false, "integer"));
                $perms = array();
                while ($rec = $ilDB->fetchAssoc($set))
                {
                        $perms[] = $rec["operation"];
                }
                
                return $perms;
        }
 
        public function setAssignedCacheEntry($a_role_id,$a_user_id, $a_value)
        {
                self::$is_assigned_cache[$a_role_id][$a_user_id] = $a_value;
        }
 
        public function getAssignedCacheEntry($a_role_id,$a_user_id)
        {
                return self::$is_assigned_cache[$a_role_id][$a_user_id];
        }
        
        public function clearCaches() 
        {
                self::$is_assigned_cache = array();
                self::$assigned_users_cache = array();
        }
} // END class.ilRbacReview
?>