ILIAS  release_6 Revision v6.24-5-g0c8bfefb3b8
class.ilObjRole.php
Go to the documentation of this file.
1<?php
2
3/* Copyright (c) 1998-2010 ILIAS open source, Extended GPL, see docs/LICENSE */
4
5require_once "./Services/Object/classes/class.ilObject.php";
6require_once('./Services/Repository/classes/class.ilObjectPlugin.php');
7
16class ilObjRole extends ilObject
17{
22
23 public const MODE_ADD_OPERATIONS = 1;
24 public const MODE_READ_OPERATIONS = 2;
25 public const MODE_REMOVE_OPERATIONS = 3;
26
30 private $logger = null;
31
39 public $parent;
40
43
53 public function __construct($a_id = 0, $a_call_by_reference = false)
54 {
55 global $DIC;
56
57 $this->logger = $DIC->logger()->ac();
58 $this->type = "role";
59 $this->disk_quota = 0;
60 $this->wsp_disk_quota = 0;
61 parent::__construct($a_id, $a_call_by_reference);
62 }
63
72 public static function createDefaultRole($a_title, $a_description, $a_tpl_name, $a_ref_id)
73 {
74 global $DIC;
75
76 $ilDB = $DIC['ilDB'];
77
78 // SET PERMISSION TEMPLATE OF NEW LOCAL CONTRIBUTOR ROLE
79 $res = $ilDB->query("SELECT obj_id FROM object_data " .
80 " WHERE type=" . $ilDB->quote("rolt", "text") .
81 " AND title=" . $ilDB->quote($a_tpl_name, "text"));
82 while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
83 $tpl_id = $row->obj_id;
84 }
85
86 if (!$tpl_id) {
87 return null;
88 }
89
90 include_once './Services/AccessControl/classes/class.ilObjRole.php';
91 $role = new ilObjRole();
92 $role->setTitle($a_title);
93 $role->setDescription($a_description);
94 $role->create();
95
96 $GLOBALS['DIC']['rbacadmin']->assignRoleToFolder($role->getId(), $a_ref_id, 'y');
97
98 $GLOBALS['DIC']['rbacadmin']->copyRoleTemplatePermissions(
99 $tpl_id,
100 ROLE_FOLDER_ID,
101 $a_ref_id,
102 $role->getId()
103 );
104
105 $ops = $GLOBALS['DIC']['rbacreview']->getOperationsOfRole(
106 $role->getId(),
107 ilObject::_lookupType($a_ref_id, true),
108 $a_ref_id
109 );
110 $GLOBALS['DIC']['rbacadmin']->grantPermission(
111 $role->getId(),
112 $ops,
113 $a_ref_id
114 );
115 return $role;
116 }
117
118
123 public function validate()
124 {
125 global $DIC;
126
127 $ilErr = $DIC['ilErr'];
128
129 if (substr($this->getTitle(), 0, 3) == 'il_') {
130 $ilErr->setMessage('msg_role_reserved_prefix');
131 return false;
132 }
133 return true;
134 }
135
140 public function getPresentationTitle()
141 {
142 return ilObjRole::_getTranslation($this->getTitle());
143 }
144
145 public function toggleAssignUsersStatus($a_assign_users)
146 {
147 $this->assign_users = (int) $a_assign_users;
148 }
149 public function getAssignUsersStatus()
150 {
151 return $this->assign_users ? $this->assign_users : 0;
152 }
153 // Same method (static)
154 public static function _getAssignUsersStatus($a_role_id)
155 {
156 global $DIC;
157
158 $ilDB = $DIC['ilDB'];
159
160 $query = "SELECT assign_users FROM role_data WHERE role_id = " . $ilDB->quote($a_role_id, 'integer') . " ";
161 $res = $ilDB->query($query);
162 while ($row = $ilDB->fetchObject($res)) {
163 return $row->assign_users ? true : false;
164 }
165 return false;
166 }
167
172 public function read()
173 {
174 global $DIC;
175
176 $ilDB = $DIC['ilDB'];
177
178 $query = "SELECT * FROM role_data WHERE role_id= " . $ilDB->quote($this->id, 'integer') . " ";
179
180 $res = $ilDB->query($query);
181 if ($res->numRows() > 0) {
182 $data = $ilDB->fetchAssoc($res);
183
184 // fill member vars in one shot
185 $this->assignData($data);
186 } else {
187 $this->ilias->raiseError("<b>Error: There is no dataset with id " . $this->id . "!</b><br />class: " . get_class($this) . "<br />Script: " . __FILE__ . "<br />Line: " . __LINE__, $this->ilias->FATAL);
188 }
189
190 parent::read();
191 }
192
198 public function assignData($a_data)
199 {
200 $this->setTitle(ilUtil::stripSlashes($a_data["title"]));
201 $this->setDescription(ilUtil::stripslashes($a_data["desc"]));
202 $this->setAllowRegister($a_data["allow_register"]);
203 $this->toggleAssignUsersStatus($a_data['assign_users']);
204 $this->setDiskQuota($a_data['disk_quota']);
205 $this->setPersonalWorkspaceDiskQuota($a_data['wsp_disk_quota']);
206 }
207
212 public function update()
213 {
214 global $DIC;
215
216 $ilDB = $DIC['ilDB'];
217
218 $query = "UPDATE role_data SET " .
219 "allow_register= " . $ilDB->quote($this->allow_register, 'integer') . ", " .
220 "assign_users = " . $ilDB->quote($this->getAssignUsersStatus(), 'integer') . ", " .
221 "disk_quota = " . $ilDB->quote($this->getDiskQuota(), 'integer') . ", " .
222 "wsp_disk_quota = " . $ilDB->quote($this->getPersonalWorkspaceDiskQuota(), 'integer') . " " .
223 "WHERE role_id= " . $ilDB->quote($this->id, 'integer') . " ";
224 $res = $ilDB->manipulate($query);
225
226 parent::update();
227
228 $this->read();
229
230 return true;
231 }
232
240 public function create()
241 {
242 global $DIC;
243
244 $ilDB = $DIC['ilDB'];
245
246 $this->id = parent::create();
247
248 $query = "INSERT INTO role_data " .
249 "(role_id,allow_register,assign_users,disk_quota,wsp_disk_quota) " .
250 "VALUES " .
251 "(" . $ilDB->quote($this->id, 'integer') . "," .
252 $ilDB->quote($this->getAllowRegister(), 'integer') . "," .
253 $ilDB->quote($this->getAssignUsersStatus(), 'integer') . "," .
254 $ilDB->quote($this->getDiskQuota(), 'integer') . "," .
255 $ilDB->quote($this->getPersonalWorkspaceDiskQuota(), 'integer') . ")"
256 ;
257 $res = $ilDB->query($query);
258
259 return $this->id;
260 }
261
268 public function setAllowRegister($a_allow_register)
269 {
270 if (empty($a_allow_register)) {
271 $a_allow_register == 0;
272 }
273
274 $this->allow_register = (int) $a_allow_register;
275 }
276
283 public function getAllowRegister()
284 {
285 return $this->allow_register ? $this->allow_register : false;
286 }
287
296 public function setDiskQuota($a_disk_quota)
297 {
298 $this->disk_quota = $a_disk_quota;
299 }
300
310 public function getDiskQuota()
311 {
312 return $this->disk_quota;
313 }
314
315
324 public function setPersonalWorkspaceDiskQuota($a_disk_quota)
325 {
326 $this->wsp_disk_quota = $a_disk_quota;
327 }
328
339 {
341 }
342
349 public static function _lookupRegisterAllowed()
350 {
351 global $DIC;
352
353 $ilDB = $DIC['ilDB'];
354
355 $query = "SELECT * FROM role_data " .
356 "JOIN object_data ON object_data.obj_id = role_data.role_id " .
357 "WHERE allow_register = 1";
358 $res = $ilDB->query($query);
359
360 $roles = array();
361 while ($role = $ilDB->fetchAssoc($res)) {
362 $roles[] = array("id" => $role["obj_id"],
363 "title" => $role["title"],
364 "auth_mode" => $role['auth_mode']);
365 }
366
367 return $roles;
368 }
369
376 public static function _lookupAllowRegister($a_role_id)
377 {
378 global $DIC;
379
380 $ilDB = $DIC['ilDB'];
381
382 $query = "SELECT * FROM role_data " .
383 " WHERE role_id =" . $ilDB->quote($a_role_id, 'integer');
384
385 $res = $ilDB->query($query);
386 if ($role_rec = $ilDB->fetchAssoc($res)) {
387 if ($role_rec["allow_register"]) {
388 return true;
389 }
390 }
391 return false;
392 }
393
401 public function setParent($a_parent_ref)
402 {
403 $this->parent = $a_parent_ref;
404 }
405
412 public function getParent()
413 {
414 return $this->parent;
415 }
416
417
424 public function delete()
425 {
426 global $DIC;
427
428 $rbacadmin = $DIC['rbacadmin'];
429 $rbacreview = $DIC['rbacreview'];
430 $ilDB = $DIC['ilDB'];
431
432 // Temporary bugfix
433 if ($rbacreview->hasMultipleAssignments($this->getId())) {
434 ilLoggerFactory::getLogger('ac')->warning('Found role with multiple assignments: role_id: ' . $this->getId());
435 ilLoggerFactory::getLogger('ac')->warning('Aborted deletion of role.');
436 return false;
437 }
438
439 if ($rbacreview->isAssignable($this->getId(), $this->getParent())) {
440 ilLoggerFactory::getLogger('ac')->debug('Handling assignable role...');
441 // do not delete a global role, if the role is the last
442 // role a user is assigned to.
443 //
444 // Performance improvement: In the code section below, we
445 // only need to consider _global_ roles. We don't need
446 // to check for _local_ roles, because a user who has
447 // a local role _always_ has a global role too.
448 $last_role_user_ids = array();
449 if ($this->getParent() == ROLE_FOLDER_ID) {
450 ilLoggerFactory::getLogger('ac')->debug('Handling global role...');
451 // The role is a global role: check if
452 // we find users who aren't assigned to any
453 // other global role than this one.
454 $user_ids = $rbacreview->assignedUsers($this->getId());
455
456 foreach ($user_ids as $user_id) {
457 // get all roles each user has
458 $role_ids = $rbacreview->assignedRoles($user_id);
459
460 // is last role?
461 if (count($role_ids) == 1) {
462 $last_role_user_ids[] = $user_id;
463 }
464 }
465 }
466
467 // users with last role found?
468 if (count($last_role_user_ids) > 0) {
469 $user_names = array();
470 foreach ($last_role_user_ids as $user_id) {
471 // GET OBJECT TITLE
472 $user_names[] = ilObjUser::_lookupLogin($user_id);
473 }
474
475 // TODO: This check must be done in rolefolder object because if multiple
476 // roles were selected the other roles are still deleted and the system does not
477 // give any feedback about this.
478 $users = implode(', ', $user_names);
479 ilLoggerFactory::getLogger('ac')->info('Cannot delete last global role of users.');
480 $this->ilias->raiseError($this->lng->txt("msg_user_last_role1") . " " .
481 $users . "<br/>" . $this->lng->txt("msg_user_last_role2"), $this->ilias->error_obj->WARNING);
482 } else {
483 ilLoggerFactory::getLogger('ac')->debug('Starting deletion of assignable role: role_id: ' . $this->getId());
484 $rbacadmin->deleteRole($this->getId(), $this->getParent());
485
486 // Delete ldap role group mappings
487 include_once('./Services/LDAP/classes/class.ilLDAPRoleGroupMappingSettings.php');
489
490 // delete object_data entry
491 parent::delete();
492
493 // delete role_data entry
494 $query = "DELETE FROM role_data WHERE role_id = " . $ilDB->quote($this->getId(), 'integer');
495 $res = $ilDB->manipulate($query);
496 }
497 } else {
498 ilLoggerFactory::getLogger('ac')->debug('Starting deletion of linked role: role_id ' . $this->getId());
499 // linked local role: INHERITANCE WAS STOPPED, SO DELETE ONLY THIS LOCAL ROLE
500 $rbacadmin->deleteLocalRole($this->getId(), $this->getParent());
501 }
502 return true;
503 }
504
505 public function getCountMembers()
506 {
507 global $DIC;
508
509 $rbacreview = $DIC['rbacreview'];
510
511 return count($rbacreview->assignedUsers($this->getId()));
512 }
513
514 public static function _getTranslation($a_role_title)
515 {
516 global $DIC;
517
518 $lng = $DIC['lng'];
519 $objDefinition = $DIC['objDefinition'];
520
521 $role_title = self::_removeObjectId($a_role_title);
522
523 if (preg_match("/^il_([a-z]{1,4})_./", $role_title, $type)) {
524 //BT ID 0032909: language variables for roles from plugins were not resolved properly
525 if ($objDefinition->isPlugin($type[1])) {
526 return ilObjectPlugin::lookupTxtById($type[1], $role_title);
527 }
528
529 return $lng->txt($role_title);
530 }
531
532 return $a_role_title;
533 }
534
535 public static function _removeObjectId($a_role_title)
536 {
537 $role_title_parts = explode('_', $a_role_title);
538
539 $test2 = (int) $role_title_parts[3];
540 if ($test2 > 0) {
541 unset($role_title_parts[3]);
542 }
543
544 return implode('_', $role_title_parts);
545 }
546
554 public static function getSubObjects($a_obj_type, $a_add_admin_objects)
555 {
556 global $DIC;
560 $objDefinition = $DIC['objDefinition'];
561 $lng = $DIC->language();
562 $subs = $objDefinition->getSubObjectsRecursively($a_obj_type, true, $a_add_admin_objects);
563
564 $filter = array();
565 $sorted = array();
566
568 $filter = array_merge($filter, ilECSUtils::getPossibleRemoteTypes(false));
569 $filter[] = 'rtst';
570 }
571
572 foreach ($subs as $subtype => $def) {
573 if (in_array($def["name"], $filter)) {
574 continue;
575 }
576
577 if ($objDefinition->isPlugin($subtype)) {
578 $translation = ilObjectPlugin::lookupTxtById($subtype, "obj_" . $subtype);
579 } elseif ($objDefinition->isSystemObject($subtype)) {
580 $translation = $lng->txt("obj_" . $subtype);
581 } else {
582 $translation = $lng->txt('objs_' . $subtype);
583 }
584
585 $sorted[$subtype] = $def;
586 $sorted[$subtype]['translation'] = $translation;
587 }
588
589 return ilUtil::sortArray($sorted, 'translation', 'asc', true, true);
590 }
591
592 public static function _updateAuthMode($a_roles)
593 {
594 global $DIC;
595
596 $ilDB = $DIC['ilDB'];
597
598 foreach ($a_roles as $role_id => $auth_mode) {
599 $query = "UPDATE role_data SET " .
600 "auth_mode= " . $ilDB->quote($auth_mode, 'text') . " " .
601 "WHERE role_id= " . $ilDB->quote($role_id, 'integer') . " ";
602 $res = $ilDB->manipulate($query);
603 }
604 }
605
606 public static function _getAuthMode($a_role_id)
607 {
608 global $DIC;
609
610 $ilDB = $DIC['ilDB'];
611
612 $query = "SELECT auth_mode FROM role_data " .
613 "WHERE role_id= " . $ilDB->quote($a_role_id, 'integer') . " ";
614 $res = $ilDB->query($query);
615 $row = $ilDB->fetchAssoc($res);
616
617 return $row['auth_mode'];
618 }
619
627 public static function _getRolesByAuthMode($a_auth_mode)
628 {
629 global $DIC;
630
631 $ilDB = $DIC['ilDB'];
632
633 $query = "SELECT * FROM role_data " .
634 "WHERE auth_mode = " . $ilDB->quote($a_auth_mode, 'text');
635 $res = $ilDB->query($query);
636 $roles = array();
637 while ($row = $ilDB->fetchObject($res)) {
638 $roles[] = $row->role_id;
639 }
640 return $roles;
641 }
642
651 public static function _resetAuthMode($a_auth_mode)
652 {
653 global $DIC;
654
655 $ilDB = $DIC['ilDB'];
656
657 $query = "UPDATE role_data SET auth_mode = 'default' WHERE auth_mode = " . $ilDB->quote($a_auth_mode, 'text');
658 $res = $ilDB->manipulate($query);
659 }
660
661 // returns array of operation/objecttype definitions
662 // private
664 {
665 global $DIC;
666
667 $ilDB = $DIC['ilDB'];
668 $lng = $DIC['lng'];
669 $objDefinition = $DIC['objDefinition'];
670 $rbacreview = $DIC['rbacreview'];
671
672 $operation_info = $rbacreview->getOperationAssignment();
673 foreach ($operation_info as $info) {
674 if ($objDefinition->getDevMode($info['type'])) {
675 continue;
676 }
677 $rbac_objects[$info['typ_id']] = array("obj_id" => $info['typ_id'],
678 "type" => $info['type']);
679
680 // handle plugin permission texts
681 $txt = $objDefinition->isPlugin($info['type'])
682 ? ilObjectPlugin::lookupTxtById($info['type'], $info['type'] . "_" . $info['operation'])
683 : $lng->txt($info['type'] . "_" . $info['operation']);
684 if (substr($info['operation'], 0, 7) == "create_" &&
685 $objDefinition->isPlugin(substr($info['operation'], 7))) {
686 $txt = ilObjectPlugin::lookupTxtById(substr($info['operation'], 7), $info['type'] . "_" . $info['operation']);
687 }
688 $rbac_operations[$info['typ_id']][$info['ops_id']] = array(
689 "ops_id" => $info['ops_id'],
690 "title" => $info['operation'],
691 "name" => $txt);
692 }
693 return array($rbac_objects,$rbac_operations);
694 }
695
696
697 public static function isAutoGenerated($a_role_id)
698 {
699 return substr(ilObject::_lookupTitle($a_role_id), 0, 3) == 'il_';
700 }
701
709 public function changeExistingObjects($a_start_node, $a_mode, $a_filter, $a_exclusion_filter = array(),$a_operation_mode = self::MODE_READ_OPERATIONS, $a_operation_stack = [])
710 {
711 global $DIC;
712
713 $tree = $DIC->repositoryTree();
714 $rbacreview = $DIC->rbac()->review();
715
716 // Get node info of subtree
717 $nodes = $tree->getRbacSubtreeInfo($a_start_node);
718
719 // get local policies
720 $all_local_policies = $rbacreview->getObjectsWithStopedInheritance($this->getId());
721
722 // filter relevant roles
723 $local_policies = array();
724 foreach ($all_local_policies as $lp) {
725 if (isset($nodes[$lp])) {
726 $local_policies[] = $lp;
727 }
728 }
729
730 // Delete deprecated policies
731 switch ($a_mode) {
734 $local_policies = $this->deleteLocalPolicies($a_start_node, $local_policies, $a_filter);
735 break;
736 }
737 $this->adjustPermissions($a_mode, $nodes, $local_policies, $a_filter, $a_exclusion_filter, $a_operation_mode, $a_operation_stack);
738 }
739
745 protected function deleteLocalPolicies($a_start, $a_policies, $a_filter)
746 {
747 global $DIC;
748
749 $rbacreview = $DIC['rbacreview'];
750 $rbacadmin = $DIC['rbacadmin'];
751
752 $local_policies = array();
753 foreach ($a_policies as $policy) {
754 if ($policy == $a_start or $policy == SYSTEM_FOLDER_ID) {
755 $local_policies[] = $policy;
756 continue;
757 }
758 if (!in_array('all', $a_filter) and !in_array(ilObject::_lookupType(ilObject::_lookupObjId($policy)), $a_filter)) {
759 $local_policies[] = $policy;
760 continue;
761 }
762 $rbacadmin->deleteLocalRole($this->getId(), $policy);
763 }
764 return $local_policies;
765 }
766
775 protected function adjustPermissions($a_mode, $a_nodes, $a_policies, $a_filter, $a_exclusion_filter = array(), $a_operation_mode = self::MODE_READ_OPERATIONS, $a_operation_stack = [])
776 {
777 global $DIC;
778
779 $rbacadmin = $DIC['rbacadmin'];
780 $rbacreview = $DIC['rbacreview'];
781 $tree = $DIC['tree'];
782 $logger = $DIC->logger()->ac();
783
784 $operation_stack = array();
785 $policy_stack = array();
786 $node_stack = array();
787
788 $start_node = current($a_nodes);
789 array_push($node_stack, $start_node);
790 $this->updatePolicyStack($policy_stack, $start_node['child']);
791
792 if ($a_operation_mode == self::MODE_READ_OPERATIONS) {
793 $this->updateOperationStack($operation_stack, $start_node['child'], true);
794 }
795 else {
796 $operation_stack = $a_operation_stack;
797 }
798
799 $this->logger->debug('adjust permissions operation stack');
800 $this->logger->dump($operation_stack, ilLogLevel::DEBUG);
801
802 include_once "Services/AccessControl/classes/class.ilRbacLog.php";
803 $rbac_log_active = ilRbacLog::isActive();
804
805 $local_policy = false;
806 foreach ($a_nodes as $node) {
807 $cmp_node = end($node_stack);
808 while ($relation = $tree->getRelationOfNodes($node, $cmp_node)) {
809 switch ($relation) {
812 $logger->debug('Handling sibling/none relation.');
813 array_pop($operation_stack);
814 array_pop($policy_stack);
815 array_pop($node_stack);
816 $cmp_node = end($node_stack);
817 $local_policy = false;
818 break;
819
823 default:
824 $logger->debug('Handling child/equals/parent ' . $relation);
825 break 2;
826 }
827 }
828
829 if ($local_policy) {
830 continue;
831 }
832
833 // Start node => set permissions and continue
834 if ($node['child'] == $start_node['child']) {
835 if ($this->isHandledObjectType($a_filter, $a_exclusion_filter, $node['type'])) {
836 if ($rbac_log_active) {
837 $rbac_log_roles = $rbacreview->getParentRoleIds($node['child'], false);
838 $rbac_log_old = ilRbacLog::gatherFaPa($node['child'], array_keys($rbac_log_roles));
839 }
840
841 // Set permissions
842 $perms = end($operation_stack);
844 $this->getId(),
845 (array) $perms[$node['type']],
846 $node['child'],
847 $a_operation_mode
848 );
849
850 if ($rbac_log_active) {
851 $rbac_log_new = ilRbacLog::gatherFaPa($node['child'], array_keys($rbac_log_roles));
852 $rbac_log = ilRbacLog::diffFaPa($rbac_log_old, $rbac_log_new);
853 ilRbacLog::add(ilRbacLog::EDIT_TEMPLATE_EXISTING, $node['child'], $rbac_log);
854 }
855 }
856 continue;
857 }
858
859 // Node has local policies => update permission stack and continue
860 if (in_array($node['child'], $a_policies) and ($node['child'] != SYSTEM_FOLDER_ID)) {
861 $local_policy = true;
862 $this->updatePolicyStack($policy_stack, $node['child']);
863 $this->updateOperationStack($operation_stack, $node['child']);
864 array_push($node_stack, $node);
865 continue;
866 }
867
868 // Continue if this object type is not in filter
869 if (!$this->isHandledObjectType($a_filter, $a_exclusion_filter, $node['type'])) {
870 continue;
871 }
872
873 if ($rbac_log_active) {
874 $rbac_log_roles = $rbacreview->getParentRoleIds($node['child'], false);
875 $rbac_log_old = ilRbacLog::gatherFaPa($node['child'], array_keys($rbac_log_roles));
876 }
877
878 // Node is course or group => create permission intersection
879 if (
880 ($a_mode == self::MODE_UNPROTECTED_DELETE_LOCAL_POLICIES || $a_mode == self::MODE_UNPROTECTED_KEEP_LOCAL_POLICIES) &&
881 ($node['type'] == 'crs' || $node['type'] == 'grp')
882 ) {
883 // Copy role permission intersection
884 $perms = end($operation_stack);
885 $this->createPermissionIntersection($policy_stack, $perms[$node['type']], $node['child'], $node['type']);
886 if ($this->updateOperationStack($operation_stack, $node['child'])) {
887 $this->updatePolicyStack($policy_stack, $node['child']);
888 array_push($node_stack, $node);
889 }
890 }
891
892 // Set permission
893 $perms = end($operation_stack);
895 $this->getId(),
896 (array) $perms[$node['type']],
897 $node['child'],
898 $a_operation_mode
899 );
900 if ($rbac_log_active) {
901 $rbac_log_new = ilRbacLog::gatherFaPa($node['child'], array_keys($rbac_log_roles));
902 $rbac_log = ilRbacLog::diffFaPa($rbac_log_old, $rbac_log_new);
903 ilRbacLog::add(ilRbacLog::EDIT_TEMPLATE_EXISTING, $node['child'], $rbac_log);
904 }
905 }
906 }
907
914 protected function changeExistingObjectsGrantPermissions($a_role_id, $a_permissions, $a_ref_id, $a_operation_mode)
915 {
916 global $DIC;
917
918 $admin = $DIC->rbac()->admin();
919 $review = $DIC->rbac()->review();
920 if ($a_operation_mode == self::MODE_READ_OPERATIONS) {
921 $admin->grantPermission(
922 $a_role_id,
923 $a_permissions,
924 $a_ref_id
925 );
926 }
927 elseif ($a_operation_mode == self::MODE_ADD_OPERATIONS) {
928 $current_operations = $review->getRoleOperationsOnObject(
929 $a_role_id,
930 $a_ref_id
931 );
932 $this->logger->debug('Current operations');
933 $this->logger->dump($current_operations);
934
935 $new_ops = array_unique(array_merge($a_permissions, $current_operations));
936 $this->logger->debug('New operations');
937 $this->logger->dump($new_ops);
938
939 $admin->grantPermission(
940 $a_role_id,
941 $new_ops,
942 $a_ref_id
943 );
944 }
945 elseif ($a_operation_mode == self::MODE_REMOVE_OPERATIONS) {
946 $current_operations = $review->getRoleOperationsOnObject(
947 $a_role_id,
948 $a_ref_id
949 );
950 $this->logger->debug('Current operations');
951 $this->logger->dump($current_operations);
952
953 $new_ops = array_diff($current_operations, $a_permissions);
954
955 $admin->grantPermission(
956 $a_role_id,
957 $new_ops,
958 $a_ref_id
959 );
960 }
961 }
962
963
970 protected function isHandledObjectType($a_filter, $a_exclusion_filter, $a_type)
971 {
972 if (in_array($a_type, $a_exclusion_filter)) {
973 return false;
974 }
975
976 if (in_array('all', $a_filter)) {
977 return true;
978 }
979 return in_array($a_type, $a_filter);
980 }
981
988 protected function updateOperationStack(&$a_stack, $a_node, $a_init = false)
989 {
990 global $DIC;
991
992 $rbacreview = $DIC['rbacreview'];
993
994 $has_policies = null;
995 $policy_origin = null;
996
997 if ($a_node == ROOT_FOLDER_ID) {
998 $has_policies = true;
999 $policy_origin = ROLE_FOLDER_ID;
1000 } else {
1001 $has_policies = $rbacreview->getLocalPolicies($a_node);
1002 $policy_origin = $a_node;
1003
1004 if ($a_init) {
1005 $parent_roles = $rbacreview->getParentRoleIds($a_node, false);
1006 if ($parent_roles[$this->getId()]) {
1007 $a_stack[] = $rbacreview->getAllOperationsOfRole(
1008 $this->getId(),
1009 $parent_roles[$this->getId()]['parent']
1010 );
1011 }
1012 return true;
1013 }
1014 }
1015
1016 if (!$has_policies) {
1017 return false;
1018 }
1019
1020 $a_stack[] = $rbacreview->getAllOperationsOfRole(
1021 $this->getId(),
1022 $policy_origin
1023 );
1024 return true;
1025 }
1026
1032 protected function updatePolicyStack(&$a_stack, $a_node)
1033 {
1034 global $DIC;
1035
1036 $rbacreview = $DIC['rbacreview'];
1037
1038 $has_policies = null;
1039 $policy_origin = null;
1040
1041 if ($a_node == ROOT_FOLDER_ID) {
1042 $has_policies = true;
1043 $policy_origin = ROLE_FOLDER_ID;
1044 } else {
1045 $has_policies = $rbacreview->getLocalPolicies($a_node);
1046 $policy_origin = $a_node;
1047 }
1048
1049 if (!$has_policies) {
1050 return false;
1051 }
1052
1053 $a_stack[] = $policy_origin;
1054 return true;
1055 }
1056
1064 protected function createPermissionIntersection($policy_stack, $a_current_ops, $a_id, $a_type)
1065 {
1066 global $DIC;
1067
1068 $ilDB = $DIC['ilDB'];
1069 $rbacreview = $DIC['rbacreview'];
1070 $rbacadmin = $DIC['rbacadmin'];
1071
1072 static $course_non_member_id = null;
1073 static $group_non_member_id = null;
1074 static $group_open_id = null;
1075 static $group_closed_id = null;
1076
1077 // Get template id
1078 switch ($a_type) {
1079 case 'grp':
1080
1081 include_once './Modules/Group/classes/class.ilObjGroup.php';
1083 #var_dump("GROUP TYPE",$type);
1084 switch ($type) {
1085 case GRP_TYPE_CLOSED:
1086 if (!$group_closed_id) {
1087 $query = "SELECT obj_id FROM object_data WHERE type='rolt' AND title='il_grp_status_closed'";
1088 $res = $ilDB->query($query);
1089 while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
1090 $group_closed_id = $row->obj_id;
1091 }
1092 }
1093 $template_id = $group_closed_id;
1094 #var_dump("GROUP CLOSED id:" . $template_id);
1095 break;
1096
1097 case GRP_TYPE_OPEN:
1098 default:
1099 if (!$group_open_id) {
1100 $query = "SELECT obj_id FROM object_data WHERE type='rolt' AND title='il_grp_status_open'";
1101 $res = $ilDB->query($query);
1102 while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
1103 $group_open_id = $row->obj_id;
1104 }
1105 }
1106 $template_id = $group_open_id;
1107 #var_dump("GROUP OPEN id:" . $template_id);
1108 break;
1109 }
1110 break;
1111
1112 case 'crs':
1113 if (!$course_non_member_id) {
1114 $query = "SELECT obj_id FROM object_data WHERE type='rolt' AND title='il_crs_non_member'";
1115 $res = $ilDB->query($query);
1116 while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
1117 $course_non_member_id = $row->obj_id;
1118 }
1119 }
1120 $template_id = $course_non_member_id;
1121 break;
1122 }
1123
1124 $current_ops = $a_current_ops[$a_type];
1125
1126 // Create intersection template permissions
1127 if ($template_id) {
1128 //$rolf = $rbacreview->getRoleFolderIdOfObject($a_id);
1129
1130 $rbacadmin->copyRolePermissionIntersection(
1131 $template_id,
1132 ROLE_FOLDER_ID,
1133 $this->getId(),
1134 end($policy_stack),
1135 $a_id,
1136 $this->getId()
1137 );
1138 } else {
1139 #echo "No template id for ".$a_id.' of type'.$a_type.'<br>';
1140 }
1141 #echo "ROLE ASSIGN: ".$rolf.' AID'.$a_id;
1142 if ($a_id and !$GLOBALS['DIC']['rbacreview']->isRoleAssignedToObject($this->getId(), $a_id)) {
1143 $rbacadmin->assignRoleToFolder($this->getId(), $a_id, "n");
1144 }
1145 return true;
1146 }
1147} // END class.ilObjRole
if(!defined('PATH_SEPARATOR')) $GLOBALS['_PEAR_default_error_mode']
Definition: PEAR.php:64
An exception for terminatinating execution or to throw for unit testing.
const GRP_TYPE_OPEN
const GRP_TYPE_CLOSED
static ecsConfigured()
Checks if an ecs server is configured.
static getPossibleRemoteTypes($a_with_captions=false)
Get all possible remote object types.
static getLogger($a_component_id)
Get component logger.
static lookupGroupTye($a_id)
Lookup group type.
Class ilObjRole.
setAllowRegister($a_allow_register)
set allow_register of role
const MODE_UNPROTECTED_KEEP_LOCAL_POLICIES
const MODE_PROTECTED_DELETE_LOCAL_POLICIES
createPermissionIntersection($policy_stack, $a_current_ops, $a_id, $a_type)
Create course group permission intersection.
const MODE_UNPROTECTED_DELETE_LOCAL_POLICIES
changeExistingObjectsGrantPermissions($a_role_id, $a_permissions, $a_ref_id, $a_operation_mode)
__getPermissionDefinitions()
create()
create
updatePolicyStack(&$a_stack, $a_node)
Update policy stack.
static _getRolesByAuthMode($a_auth_mode)
Get roles by auth mode.
getPersonalWorkspaceDiskQuota()
Gets the minimal personal workspace disk quota imposed by this role.
static _lookupAllowRegister($a_role_id)
check whether role is allowed in user registration or not
isHandledObjectType($a_filter, $a_exclusion_filter, $a_type)
Check if type is filterer.
setParent($a_parent_ref)
set reference id of parent object this is neccessary for non RBAC protected objects!...
static _getAuthMode($a_role_id)
getAllowRegister()
get allow_register
const MODE_REMOVE_OPERATIONS
deleteLocalPolicies($a_start, $a_policies, $a_filter)
Delete local policies.
static _getTranslation($a_role_title)
updateOperationStack(&$a_stack, $a_node, $a_init=false)
Update operation stack.
update()
updates a record "role" and write it into database @access public
const MODE_PROTECTED_KEEP_LOCAL_POLICIES
adjustPermissions($a_mode, $a_nodes, $a_policies, $a_filter, $a_exclusion_filter=array(), $a_operation_mode=self::MODE_READ_OPERATIONS, $a_operation_stack=[])
Adjust permissions.
static _removeObjectId($a_role_title)
read()
loads "role" from database @access private
$disk_quota
The disk quota in bytes.
static isAutoGenerated($a_role_id)
getDiskQuota()
Gets the minimal disk quota imposed by this role.
toggleAssignUsersStatus($a_assign_users)
static _resetAuthMode($a_auth_mode)
Reset auth mode to default.
static _getAssignUsersStatus($a_role_id)
static _lookupRegisterAllowed()
get all roles that are activated in user registration
const MODE_ADD_OPERATIONS
getPresentationTitle()
return translated title for autogenerated roles
static _updateAuthMode($a_roles)
validate()
Validate role data.
const MODE_READ_OPERATIONS
__construct($a_id=0, $a_call_by_reference=false)
Constructor @access public.
assignData($a_data)
loads a record "role" from array @access public
setDiskQuota($a_disk_quota)
Sets the minimal disk quota imposed by this role.
getParent()
get reference id of parent object
static createDefaultRole($a_title, $a_description, $a_tpl_name, $a_ref_id)
setPersonalWorkspaceDiskQuota($a_disk_quota)
Sets the minimal personal workspace disk quota imposed by this role.
changeExistingObjects($a_start_node, $a_mode, $a_filter, $a_exclusion_filter=array(), $a_operation_mode=self::MODE_READ_OPERATIONS, $a_operation_stack=[])
Change existing objects.
static _lookupLogin($a_user_id)
lookup login
static lookupTxtById($plugin_id, $lang_var)
Class ilObject Basic functions for all objects.
static _lookupObjId($a_id)
static _lookupTitle($a_id)
lookup object title
setTitle($a_title)
set object title
setDescription($a_desc)
set object description
getId()
get object id @access public
static _lookupType($a_id, $a_reference=false)
lookup object type
getTitle()
get object title @access public
static diffFaPa(array $a_old, array $a_new)
static add($a_action, $a_ref_id, array $a_diff, $a_source_ref_id=false)
const EDIT_TEMPLATE_EXISTING
static gatherFaPa($a_ref_id, array $a_role_ids, $a_add_action=false)
static isActive()
const RELATION_EQUALS
const RELATION_PARENT
const RELATION_NONE
const RELATION_SIBLING
const RELATION_CHILD
static sortArray( $array, $a_array_sortby, $a_array_sortorder=0, $a_numeric=false, $a_keep_keys=false)
sortArray
static stripSlashes($a_str, $a_strip_html=true, $a_allow="")
strip slashes if magic qoutes is enabled
$txt
Definition: error.php:13
__construct(Container $dic, ilPlugin $plugin)
@inheritDoc
redirection script todo: (a better solution should control the processing via a xml file)
$query
$ilErr
Definition: raiseError.php:18
foreach($_POST as $key=> $value) $res
global $ilDB
$data
Definition: storeScorm.php:23
$a_type
Definition: workflow.php:92
$DIC
Definition: xapitoken.php:46