class.ilSettingsPermissionGUI.php

Go to the documentation of this file.

<?php

/* Copyright (c) 1998-2015 ILIAS open source, Extended GPL, see docs/LICENSE */

class ilSettingsPermissionGUI
{
        protected $permissions = array();                       // permissions selected by context
        protected $base_permissions = array();          // base permissions of the object type (ops_id -> permission)
        protected $base_permissions_by_op = array();// base permissions of the object type (permission -> ops_id)
        protected $role_required_permissions = array();
        protected $role_prohibited_permissions = array();

        function __construct($a_gui_obj)
        {
                global $objDefinition, $tpl, $ilCtrl, $lng, $rbacreview;

                $this->objDefinition = $objDefinition;
                $this->tpl = $tpl;
                $this->lng = $lng;
                $this->lng->loadLanguageModule("rbac");

                $this->ctrl = $ilCtrl;

                $this->gui_obj = $a_gui_obj;
                $this->obj = $a_gui_obj->object;
                $this->red_id = $this->obj->getRefId();


                foreach (ilRbacReview::_getOperationList($this->obj->getType()) as $p)
                {
                        $this->base_permissions[$p["ops_id"]] = $p["operation"];
                        $this->base_permissions_by_op[$p["operation"]] = $p["ops_id"];
                }

                $this->base_roles = $rbacreview->getParentRoleIds($this->obj->getRefId());
        }

        function determineRoles()
        {
                global $rbacreview;

                $roles = array();
                foreach ($this->base_roles as $k => $r)
                {
                        $ops = $rbacreview->getActiveOperationsOfRole($this->obj->getRefId(), $r["rol_id"]);
                        $use = true;
                        foreach ($this->getRoleRequiredPermissions() as $o)
                        {
                                if (!in_array($o, $ops))
                                {
                                        $use = false;
                                }
                        }
                        foreach ($this->getRoleProhibitedPermissions() as $o)
                        {
                                if (in_array($o, $ops))
                                {
                                        $use = false;
                                }
                        }
                        if ($use)
                        {
                                $roles[$k] = $r;
                        }
                }
                return $roles;
        }


        function setRoleRequiredPermissions($a_val)
        {
                if (is_array($a_val))
                {
                        foreach ($a_val as $p)
                        {
                                if (in_array($p, $this->base_permissions))
                                {
                                        $this->role_required_permissions[] = $this->base_permissions_by_op[$p];
                                }
                        }
                }
        }

        function getRoleRequiredPermissions()
        {
                return $this->role_required_permissions;
        }

        function setRoleProhibitedPermissions($a_val)
        {
                if (is_array($a_val))
                {
                        foreach ($a_val as $p)
                        {
                                if (in_array($p, $this->base_permissions))
                                {
                                        $this->role_prohibited_permissions[] = $this->base_permissions_by_op[$p];
                                }
                        }
                }
        }

        function getRoleProhibitedPermissions()
        {
                return $this->role_prohibited_permissions;
        }

        function setPermissions($a_val)
        {
                if (is_array($a_val))
                {
                        foreach ($a_val as $p)
                        {
                                if (in_array($p, $this->base_permissions))
                                {
                                        $this->permissions[$this->base_permissions_by_op[$p]] = $p;
                                }
                        }
                }
        }

        function getPermissions()
        {
                return $this->permissions;
        }

        function executeCommand()
        {
                $cmd = $this->ctrl->getCmd("showForm");
                if (in_array($cmd, array("showForm", "save")))
                {
                        $this->$cmd();
                }
        }

        function showForm()
        {
                $form = $this->initPermissionForm();
                $this->tpl->setContent($form->getHTML());
        }


        public function initPermissionForm()
        {
                global $rbacreview;

                include_once("Services/Form/classes/class.ilPropertyFormGUI.php");
                $form = new ilPropertyFormGUI();

                $roles = $this->determineRoles();
                $ops = array();
                foreach ($roles as $r)
                {
                        $ops[$r["rol_id"]] = $rbacreview->getActiveOperationsOfRole($this->obj->getRefId(), $r["rol_id"]);
                }

                // for each permission, collect all roles that have the permission activated
                $perm_roles = array();
                foreach ($ops as $r => $o2)
                {
                        foreach ($o2 as $o)
                        {
                                $perm_roles[$o][] = $r;
                        }
                }

                // for each permission
                foreach ($this->getPermissions() as $p)
                {
                        // roles
                        $cb = new ilCheckboxGroupInputGUI($this->lng->txt($p), $p);
                        reset($roles);
                        foreach ($roles as $k => $r)
                        {
                                $option = new ilCheckboxOption($r["title"], $k);
                                $cb->addOption($option);
                        }
                        if (is_array($perm_roles[$this->base_permissions_by_op[$p]]))
                        {
                                $cb->setValue($perm_roles[$this->base_permissions_by_op[$p]]);
                        }
                        $form->addItem($cb);

                }

                $form->addCommandButton("save", $this->lng->txt("save"));

                $form->setTitle($this->lng->txt("rbac_permissions"));
                $form->setFormAction($this->ctrl->getFormAction($this));

                return $form;
        }

        public function save()
        {
                global $rbacreview, $rbacadmin;

                $form = $this->initPermissionForm();
                if ($form->checkInput())
                {
                        foreach ($this->determineRoles() as $r)
                        {
                                // get active operations for role
                                $ops = $rbacreview->getActiveOperationsOfRole($this->obj->getRefId(), $r["rol_id"]);

                                // revode all permissions for the role
                                $rbacadmin->revokePermission($this->obj->getRefId(), $r["rol_id"]);

                                // for all permissions of the form...
                                foreach ($this->getPermissions() as $p)
                                {
                                        $roles = $form->getInput($p);
                                        if (!is_array($roles))
                                        {
                                                $roles = array();
                                        }
                                        $o = $this->base_permissions_by_op[$p];

                                        // ... if in original operations, but not checked, remove it from operations
                                        if (in_array($o, $ops) && !in_array($r["rol_id"], $roles))
                                        {
                                                if(($key = array_search($o, $ops)) !== false) {
                                                        unset($ops[$key]);
                                                }
                                        }

                                        // ...if not in original operations, but checked, add to operations
                                        if (!in_array($o, $ops) && in_array($r["rol_id"], $roles))
                                        {
                                                $ops[] = $o;
                                        }
                                }

                                // now grant resulting permissions
                                $rbacadmin->grantPermission(
                                        $r["rol_id"],
                                        array_unique($ops),
                                        $this->obj->getRefId()
                                );
                        }

                        ilUtil::sendSuccess($this->lng->txt("msg_obj_modified"), true);
                        $this->ctrl->redirect($this, "");
                }
                else
                {
                        $form->setValuesByPost();
                        $this->tpl->setContent($form->getHtml());
                }
        }


}

?>