ilWebAccessChecker Class Reference

Class ilWebAccessChecker. More...

Collaboration diagram for ilWebAccessChecker:

Public Member Functions
	__construct (GlobalHttpState $httpState, CookieFactory $cookieFactory)
	ilWebAccessChecker constructor. More...
	check ()
	initILIAS ()
	isChecked ()
	setChecked ($checked)
	getPathObject ()
	setPathObject (ilWACPath $path_object)
	getDisposition ()
	setDisposition ($disposition)
	getOverrideMimetype ()
	setOverrideMimetype ($override_mimetype)
	isInitialized ()
	setInitialized ($initialized)
	isSendStatusCode ()
	setSendStatusCode ($send_status_code)
	isRevalidateFolderTokens ()
	setRevalidateFolderTokens ($revalidate_folder_tokens)
	getAppliedCheckingMethods ()
	setAppliedCheckingMethods (array $applied_checking_methods)

Static Public Member Functions
static	isUseSeperateLogfile ()
static	setUseSeperateLogfile ($use_seperate_logfile)

Data Fields
const	DISPOSITION = 'disposition'
const	STATUS_CODE = 'status_code'
const	REVALIDATE = 'revalidate'
const	CM_FILE_TOKEN = 1
const	CM_FOLDER_TOKEN = 2
const	CM_CHECKINGINSTANCE = 3
const	CM_SECFOLDER = 4

Protected Member Functions
	sendHeader ($message)
	checkPublicSection ()
	checkUser ()
	addAppliedCheckingMethod ($method)
	isRequestNotFromLoginPage ()

Protected Attributes
	$path_object = null
	$checked = false
	$disposition = ilFileDelivery::DISP_INLINE
	$override_mimetype = ''
	$send_status_code = false
	$initialized = false
	$revalidate_folder_tokens = true
	$applied_checking_methods = array()

Static Protected Attributes
static	$use_seperate_logfile = false

Private Attributes
	$http
	$cookieFactory

Detailed Description

Class ilWebAccessChecker.

Author

Fabian Schmid fs@st.nosp@m.uder.nosp@m.-raim.nosp@m.ann..nosp@m.ch

Version

1.0.0

Definition at line 36 of file class.ilWebAccessChecker.php.

Constructor & Destructor Documentation

__construct()

ilWebAccessChecker::__construct	(	GlobalHttpState	$httpState,
		CookieFactory	$cookieFactory
	)

ilWebAccessChecker constructor.

Parameters

GlobalHttpState	$httpState
CookieFactory	$cookieFactory

Definition at line 97 of file class.ilWebAccessChecker.php.

References $cookieFactory, ILIAS\FileDelivery\http(), ILIAS\HTTP\GlobalHttpState\request(), and setPathObject().

    {
        $this->setPathObject(new ilWACPath($httpState->request()->getRequestTarget()));
        $this->http = $httpState;
        $this->cookieFactory = $cookieFactory;
    }

Here is the call graph for this function:

Member Function Documentation

addAppliedCheckingMethod()

ilWebAccessChecker::addAppliedCheckingMethod (   $method )

protected

Parameters

int

$method

Returns

void

Definition at line 482 of file class.ilWebAccessChecker.php.

References $DIC, ilContext\CONTEXT_WAC, ilContext\init(), and ilInitialisation\reinitILIAS().

Referenced by check().

    {
        assert(is_int($method));
        $this->applied_checking_methods[] = $method;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

check()

ilWebAccessChecker::check

(

)

Returns

bool

Exceptions

ilWACException

Definition at line 109 of file class.ilWebAccessChecker.php.

References addAppliedCheckingMethod(), ilWACException\CODE_NO_PATH, getPathObject(), ilWACSecurePath\hasCheckingInstanceRegistered(), ILIAS\FileDelivery\http(), initILIAS(), isRevalidateFolderTokens(), sendHeader(), and setChecked().

Referenced by ilWebAccessCheckerDelivery\handleRequest(), ilWACCheckingInstanceTest\testBasic(), and ilWACCheckingInstanceTest\testNonCheckingInstanceNoSec().

    {
        if (!$this->getPathObject()) {
            throw new ilWACException(ilWACException::CODE_NO_PATH);
        }

        // Check if Path has been signed with a token
        $ilWACSignedPath = new ilWACSignedPath($this->getPathObject(), $this->http, $this->cookieFactory);
        if ($ilWACSignedPath->isSignedPath()) {
            $this->addAppliedCheckingMethod(self::CM_FILE_TOKEN);
            if ($ilWACSignedPath->isSignedPathValid()) {
                $this->setChecked(true);
                $this->sendHeader('checked using token');

                return true;
            }
        }

        // Check if the whole secured folder has been signed
        if ($ilWACSignedPath->isFolderSigned()) {
            $this->addAppliedCheckingMethod(self::CM_FOLDER_TOKEN);
            if ($ilWACSignedPath->isFolderTokenValid()) {
                if ($this->isRevalidateFolderTokens()) {
                    $ilWACSignedPath->revalidatingFolderToken();
                }
                $this->setChecked(true);
                $this->sendHeader('checked using secure folder');

                return true;
            }
        }

        // Fallback, have to initiate ILIAS
        $this->initILIAS();

        // Check if Path is within accepted paths
        if ($this->getPathObject()->getModuleType() !== 'rs') {
            $path = realpath($this->getPathObject()->getCleanURLdecodedPath());
            $data_dir = realpath(CLIENT_WEB_DIR);
            if (strpos($path, $data_dir) !== 0) {
                return false;
            }
            if (dirname($path) === $data_dir && is_file($path)) {
                return false;
            }
        }

        if (ilWACSecurePath::hasCheckingInstanceRegistered($this->getPathObject())) {
            // Maybe the path has been registered, lets check
            $checkingInstance = ilWACSecurePath::getCheckingInstance($this->getPathObject());
            $this->addAppliedCheckingMethod(self::CM_CHECKINGINSTANCE);
            $canBeDelivered = $checkingInstance->canBeDelivered($this->getPathObject());
            if ($canBeDelivered) {
                $this->sendHeader('checked using fallback');
                if ($ilWACSignedPath->isFolderSigned() && $this->isRevalidateFolderTokens()) {
                    $ilWACSignedPath->revalidatingFolderToken();
                }

                $this->setChecked(true);

                return true;
            } else {
                $this->setChecked(true);

                return false;
            }
        }

        // none of the checking mechanisms could have been applied. no access
        $this->setChecked(true);
        if ($this->getPathObject()->isInSecFolder()) {
            $this->addAppliedCheckingMethod(self::CM_SECFOLDER);

            return false;
        } else {
            $this->addAppliedCheckingMethod(self::CM_SECFOLDER);

            return true;
        }
    }

Here is the call graph for this function:

Here is the caller graph for this function:

checkPublicSection()

ilWebAccessChecker::checkPublicSection ( )

protected

Returns

void

Exceptions

ilWACException

Definition at line 249 of file class.ilWebAccessChecker.php.

References $DIC, ilWACException\ACCESS_DENIED_NO_PUB, and isRequestNotFromLoginPage().

Referenced by initILIAS().

    {
        global $DIC;
        $on_login_page = !$this->isRequestNotFromLoginPage();
        $is_anonymous = ((int) $DIC->user()->getId() === (int) ANONYMOUS_USER_ID);
        $is_null_user = ($DIC->user()->getId() === 0);
        $pub_section_activated = (bool) $DIC['ilSetting']->get('pub_section');
        $isset = isset($DIC['ilSetting']);
        $instanceof = $DIC['ilSetting'] instanceof ilSetting;

        if (!$isset || !$instanceof) {
            throw new ilWACException(ilWACException::ACCESS_DENIED_NO_PUB);
        }

        if ($on_login_page && ($is_null_user || $is_anonymous)) {
            // Request is initiated from login page
            return;
        }

        if ($pub_section_activated && ($is_null_user || $is_anonymous)) {
            // Request is initiated from an enabled public area
            return;
        }

        if ($is_anonymous || $is_null_user) {
            throw new ilWACException(ilWACException::ACCESS_DENIED_NO_PUB);
        }
    }

Here is the call graph for this function:

Here is the caller graph for this function:

checkUser()

ilWebAccessChecker::checkUser ( )

protected

Definition at line 279 of file class.ilWebAccessChecker.php.

References $DIC, ilWACException\ACCESS_DENIED_NO_LOGIN, and isRequestNotFromLoginPage().

Referenced by initILIAS().

    {
        global $DIC;

        $is_user = $DIC->user() instanceof ilObjUser;
        $user_id_is_zero = ((int) $DIC->user()->getId() === 0);
        $not_on_login_page = $this->isRequestNotFromLoginPage();
        if (!$is_user || ($user_id_is_zero && $not_on_login_page)) {
            throw new ilWACException(ilWACException::ACCESS_DENIED_NO_LOGIN);
        }
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getAppliedCheckingMethods()

ilWebAccessChecker::getAppliedCheckingMethods

(

)

Returns

int[]

Definition at line 460 of file class.ilWebAccessChecker.php.

References $applied_checking_methods.

    {
        return (array) $this->applied_checking_methods;
    }

getDisposition()

ilWebAccessChecker::getDisposition

(

)

Returns

string

Definition at line 336 of file class.ilWebAccessChecker.php.

References $disposition.

Referenced by ilWebAccessCheckerDelivery\deliver(), ilWebAccessCheckerDelivery\deliverDummyImage(), and ilWebAccessCheckerDelivery\deliverDummyVideo().

    {
        return (string) $this->disposition;
    }

Here is the caller graph for this function:

getOverrideMimetype()

ilWebAccessChecker::getOverrideMimetype

(

)

Returns

string

Definition at line 357 of file class.ilWebAccessChecker.php.

References $override_mimetype.

    {
        return (string) $this->override_mimetype;
    }

getPathObject()

ilWebAccessChecker::getPathObject

(

)

Returns

ilWACPath

Definition at line 316 of file class.ilWebAccessChecker.php.

References $path_object.

Referenced by check(), ilWebAccessCheckerDelivery\deliver(), ilWebAccessCheckerDelivery\handleAccessErrors(), and initILIAS().

    {
        return $this->path_object;
    }

Here is the caller graph for this function:

initILIAS()

ilWebAccessChecker::initILIAS

(

)

Returns

void

Definition at line 206 of file class.ilWebAccessChecker.php.

References Vendor\Package\$e, $GLOBALS, $response, ilWACException\ACCESS_DENIED_NO_LOGIN, checkPublicSection(), checkUser(), ilContext\CONTEXT_WAC, getPathObject(), ILIAS\FileDelivery\http(), ilContext\init(), ilInitialisation\initILIAS(), isInitialized(), and setInitialized().

Referenced by check(), and ilWebAccessCheckerDelivery\handleAccessErrors().

    {
        if ($this->isInitialized()) {
            return;
        }

        $GLOBALS['COOKIE_PATH'] = '/';

        $cookie = $this->cookieFactory->create('ilClientId', $this->getPathObject()->getClient())
                                      ->withPath('/')
                                      ->withExpires(0);

        $response = $this->http->cookieJar()
                               ->with($cookie)
                               ->renderIntoResponseHeader($this->http->response());

        $this->http->saveResponse($response);

        ilContext::init(ilContext::CONTEXT_WAC);
        try {
            ilInitialisation::initILIAS();
            $this->checkUser();
            $this->checkPublicSection();
        } catch (Exception $e) {
            if ($e instanceof ilWACException
                && $e->getCode() !== ilWACException::ACCESS_DENIED_NO_LOGIN) {
                throw  $e;
            }
            if (($e instanceof Exception && $e->getMessage() == 'Authentication failed.')
                || $e->getCode() === ilWACException::ACCESS_DENIED_NO_LOGIN) {
                $this->initAnonymousSession();
                $this->checkUser();
                $this->checkPublicSection();
            }
        }
        $this->setInitialized(true);
    }

Here is the call graph for this function:

Here is the caller graph for this function:

isChecked()

ilWebAccessChecker::isChecked

(

)

Returns

bool

Definition at line 295 of file class.ilWebAccessChecker.php.

References $checked.

Referenced by ilWebAccessCheckerDelivery\deliver(), and ilWebAccessCheckerDelivery\deny().

    {
        return (bool) $this->checked;
    }

Here is the caller graph for this function:

isInitialized()

ilWebAccessChecker::isInitialized

(

)

Returns

bool

Definition at line 378 of file class.ilWebAccessChecker.php.

References $initialized.

Referenced by initILIAS().

    {
        return (bool) $this->initialized;
    }

Here is the caller graph for this function:

isRequestNotFromLoginPage()

ilWebAccessChecker::isRequestNotFromLoginPage ( )

protected

Returns

bool

Definition at line 513 of file class.ilWebAccessChecker.php.

References $_SERVER, and ilUtil\_getHttpPath().

Referenced by checkPublicSection(), and checkUser().

    {
        $referrer = (string) ($_SERVER['HTTP_REFERER'] ?? '');
        $not_on_login_page = (strpos($referrer, 'login.php') === false
                              && strpos($referrer, '&baseClass=ilStartUpGUI') === false);

        if ($not_on_login_page && $referrer !== '') {
            // In some scenarios (observed for content styles on login page, the HTTP_REFERER does not contain a PHP script
            $referrer_url_parts = parse_url($referrer);
            $ilias_url_parts = parse_url(ilUtil::_getHttpPath());
            if (
                $ilias_url_parts['host'] === $referrer_url_parts['host'] &&
                (
                    !isset($referrer_url_parts['path']) ||
                    strpos($referrer_url_parts['path'], '.php') === false
                )
            ) {
                $not_on_login_page = false;
            }
        }

        return $not_on_login_page;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

isRevalidateFolderTokens()

ilWebAccessChecker::isRevalidateFolderTokens

(

)

Returns

bool

Definition at line 418 of file class.ilWebAccessChecker.php.

References $revalidate_folder_tokens.

Referenced by check().

    {
        return (bool) $this->revalidate_folder_tokens;
    }

Here is the caller graph for this function:

isSendStatusCode()

ilWebAccessChecker::isSendStatusCode

(

)

Returns

bool

Definition at line 397 of file class.ilWebAccessChecker.php.

References $send_status_code.

    {
        return (bool) $this->send_status_code;
    }

isUseSeperateLogfile()

static ilWebAccessChecker::isUseSeperateLogfile ( )

static

Returns

bool

Definition at line 439 of file class.ilWebAccessChecker.php.

    {
        return (bool) self::$use_seperate_logfile;
    }

sendHeader()

ilWebAccessChecker::sendHeader (   $message )

protected

Parameters

string

$message

Returns

void

Definition at line 196 of file class.ilWebAccessChecker.php.

References $message, $response, and ILIAS\FileDelivery\http().

Referenced by check().

    {
        $response = $this->http->response()->withHeader('X-ILIAS-WebAccessChecker', $message);
        $this->http->saveResponse($response);
    }

Here is the call graph for this function:

Here is the caller graph for this function:

setAppliedCheckingMethods()

ilWebAccessChecker::setAppliedCheckingMethods

(

array

$applied_checking_methods

)

Parameters

int[]

$applied_checking_methods

Returns

void

Definition at line 471 of file class.ilWebAccessChecker.php.

References $applied_checking_methods.

    {
        $this->applied_checking_methods = $applied_checking_methods;
    }

setChecked()

ilWebAccessChecker::setChecked

(

$checked

)

Parameters

boolean

$checked

Returns

void

Definition at line 306 of file class.ilWebAccessChecker.php.

References $checked.

Referenced by check().

    {
        assert(is_bool($checked));
        $this->checked = $checked;
    }

Here is the caller graph for this function:

setDisposition()

ilWebAccessChecker::setDisposition

(

$disposition

)

Parameters

string

$disposition

Returns

void

Definition at line 347 of file class.ilWebAccessChecker.php.

References $disposition.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

    {
        assert(is_string($disposition));
        $this->disposition = $disposition;
    }

Here is the caller graph for this function:

setInitialized()

ilWebAccessChecker::setInitialized

(

$initialized

)

Parameters

bool

$initialized

Definition at line 387 of file class.ilWebAccessChecker.php.

References $initialized.

Referenced by initILIAS().

    {
        assert(is_bool($initialized));
        $this->initialized = $initialized;
    }

Here is the caller graph for this function:

setOverrideMimetype()

ilWebAccessChecker::setOverrideMimetype

(

$override_mimetype

)

Parameters

string

$override_mimetype

Returns

void

Definition at line 368 of file class.ilWebAccessChecker.php.

References $override_mimetype.

    {
        assert(is_string($override_mimetype));
        $this->override_mimetype = $override_mimetype;
    }

setPathObject()

ilWebAccessChecker::setPathObject

(

ilWACPath

$path_object

)

Parameters

ilWACPath

$path_object

Returns

void

Definition at line 327 of file class.ilWebAccessChecker.php.

References $path_object.

Referenced by __construct().

    {
        $this->path_object = $path_object;
    }

Here is the caller graph for this function:

setRevalidateFolderTokens()

ilWebAccessChecker::setRevalidateFolderTokens

(

$revalidate_folder_tokens

)

Parameters

bool

$revalidate_folder_tokens

Returns

void

Definition at line 429 of file class.ilWebAccessChecker.php.

References $revalidate_folder_tokens.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

    {
        assert(is_bool($revalidate_folder_tokens));
        $this->revalidate_folder_tokens = $revalidate_folder_tokens;
    }

Here is the caller graph for this function:

setSendStatusCode()

ilWebAccessChecker::setSendStatusCode

(

$send_status_code

)

Parameters

bool

$send_status_code

Returns

void

Definition at line 408 of file class.ilWebAccessChecker.php.

References $send_status_code.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

    {
        assert(is_bool($send_status_code));
        $this->send_status_code = $send_status_code;
    }

Here is the caller graph for this function:

setUseSeperateLogfile()

static ilWebAccessChecker::setUseSeperateLogfile (   $use_seperate_logfile )

static

Parameters

bool

$use_seperate_logfile

Returns

void

Definition at line 450 of file class.ilWebAccessChecker.php.

References $use_seperate_logfile.

    {
        assert(is_bool($use_seperate_logfile));
        self::$use_seperate_logfile = $use_seperate_logfile;
    }

Field Documentation

$applied_checking_methods

ilWebAccessChecker::$applied_checking_methods = array()

protected

Definition at line 80 of file class.ilWebAccessChecker.php.

Referenced by getAppliedCheckingMethods(), and setAppliedCheckingMethods().

$checked

ilWebAccessChecker::$checked = false

protected

Definition at line 52 of file class.ilWebAccessChecker.php.

Referenced by isChecked(), and setChecked().

$cookieFactory

CookieFactory ilWebAccessChecker::$cookieFactory

private

Definition at line 88 of file class.ilWebAccessChecker.php.

Referenced by __construct().

$disposition

ilWebAccessChecker::$disposition = ilFileDelivery::DISP_INLINE

protected

Definition at line 56 of file class.ilWebAccessChecker.php.

Referenced by getDisposition(), and setDisposition().

$http

ILIAS DI HTTPServices ilWebAccessChecker::$http

private

Definition at line 84 of file class.ilWebAccessChecker.php.

$initialized

ilWebAccessChecker::$initialized = false

protected

Definition at line 68 of file class.ilWebAccessChecker.php.

Referenced by isInitialized(), and setInitialized().

$override_mimetype

ilWebAccessChecker::$override_mimetype = ''

protected

Definition at line 60 of file class.ilWebAccessChecker.php.

Referenced by getOverrideMimetype(), and setOverrideMimetype().

$path_object

ilWebAccessChecker::$path_object = null

protected

Definition at line 48 of file class.ilWebAccessChecker.php.

Referenced by getPathObject(), and setPathObject().

$revalidate_folder_tokens

ilWebAccessChecker::$revalidate_folder_tokens = true

protected

Definition at line 72 of file class.ilWebAccessChecker.php.

Referenced by isRevalidateFolderTokens(), and setRevalidateFolderTokens().

$send_status_code

ilWebAccessChecker::$send_status_code = false

protected

Definition at line 64 of file class.ilWebAccessChecker.php.

Referenced by isSendStatusCode(), and setSendStatusCode().

$use_seperate_logfile

ilWebAccessChecker::$use_seperate_logfile = false

staticprotected

Definition at line 76 of file class.ilWebAccessChecker.php.

Referenced by setUseSeperateLogfile().

CM_CHECKINGINSTANCE

const ilWebAccessChecker::CM_CHECKINGINSTANCE = 3

Definition at line 43 of file class.ilWebAccessChecker.php.

CM_FILE_TOKEN

const ilWebAccessChecker::CM_FILE_TOKEN = 1

Definition at line 41 of file class.ilWebAccessChecker.php.

CM_FOLDER_TOKEN

const ilWebAccessChecker::CM_FOLDER_TOKEN = 2

Definition at line 42 of file class.ilWebAccessChecker.php.

CM_SECFOLDER

const ilWebAccessChecker::CM_SECFOLDER = 4

Definition at line 44 of file class.ilWebAccessChecker.php.

DISPOSITION

const ilWebAccessChecker::DISPOSITION = 'disposition'

Definition at line 38 of file class.ilWebAccessChecker.php.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

REVALIDATE

const ilWebAccessChecker::REVALIDATE = 'revalidate'

Definition at line 40 of file class.ilWebAccessChecker.php.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

STATUS_CODE

const ilWebAccessChecker::STATUS_CODE = 'status_code'

Definition at line 39 of file class.ilWebAccessChecker.php.

Referenced by ilWebAccessCheckerDelivery\handleRequest().

---

The documentation for this class was generated from the following file:

• Services/WebAccessChecker/classes/class.ilWebAccessChecker.php