ilAccess Class Reference

This file is part of ILIAS, a powerful learning management system published by ILIAS open source e-Learning e.V. More...

Inheritance diagram for ilAccess:

Collaboration diagram for ilAccess:

Public Member Functions
	__construct ()
	storeAccessResult (string $a_permission, string $a_cmd, int $a_ref_id, bool $a_access_granted, ?int $a_user_id=null, ?ilAccessInfo $a_info=null)
	store access result More...
	setPreventCachingLastResult (bool $a_val)
	Set prevent caching last result. More...
	getPreventCachingLastResult ()
	Get prevent caching last result. More...
	getStoredAccessResult (string $a_permission, string $a_cmd, int $a_ref_id, ?int $a_user_id=null)
	get stored access result Parameters string $a_permission permission string $a_cmd command string int $a_ref_id reference id int | null $a_user_id user id (if no id passed, current user id) Returns array<{granted: bool, info: ?ilAccessInfo, prevent_db_cache: bool}> More...
	storeCache ()
	readCache (int $a_secs=0)
	getResults ()
	setResults (array $a_results)
	addInfoItem (string $a_type, string $a_text, string $a_data="")
	add an info item to current info object More...
	checkAccess (string $a_permission, string $a_cmd, int $a_ref_id, string $a_type="", ?int $a_obj_id=null, ?int $a_tree_id=null)
	check access for an object (provide $a_type and $a_obj_id if available for better performance) More...
	checkAccessOfUser (int $a_user_id, string $a_permission, string $a_cmd, int $a_ref_id, string $a_type="", ?int $a_obj_id=0, ?int $a_tree_id=0)
	check access for an object (provide $a_type and $a_obj_id if available for better performance) More...
	getInfo ()
	get last info object See also ilAccessInfo::getInfoItems() More...
	getResultLast ()
	get last info object More...
	getResultAll (int $a_ref_id=0)
	doCacheCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id)
	look if result for current query is already in cache Returns array<{hit: bool, granted: bool, prevent_db_cache: bool}> More...
	doTreeCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id)
	check if object is in tree and not deleted More...
	doRBACCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id, string $a_type)
	rbac check for current object -> type is used for create permission More...
	doPathCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id, bool $a_all=false)
	check read permission for all parents More...
	doActivationCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id, int $a_obj_id, string $a_type)
	check for activation and centralized offline status. More...
	doConditionCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id, int $a_obj_id, string $a_type)
	condition check (currently only implemented for read permission) More...
	doStatusCheck (string $a_permission, string $a_cmd, int $a_ref_id, int $a_user_id, int $a_obj_id, string $a_type)
	object type specific check More...
	clear ()
	enable (string $a_str, bool $a_bool)
	filterUserIdsForCurrentUsersPositionsAndPermission (array $user_ids, string $permission)
	Parameters int[] $user_ids List of ILIAS-User-IDs which shall be filtered string $permission Returns int[] Filtered List of ILIAS-User-IDs Exceptions More...
	filterUserIdsForUsersPositionsAndPermission (array $user_ids, int $for_user_id, string $permission)
	Parameters int[] $user_ids List of ILIAS-User-IDs which shall be filtered int $for_user_id string $permission Returns int[] Filtered List of ILIAS-User-IDs Exceptions More...
	isCurrentUserBasedOnPositionsAllowedTo (string $permission, array $on_user_ids)
	Parameters string $permission int[] $on_user_ids List of ILIAS-User-IDs Returns bool See also getAvailablePositionRelatedPermissions for available permissions More...
	isUserBasedOnPositionsAllowedTo (int $which_user_id, string $permission, array $on_user_ids)
	Parameters int $which_user_id Permission check for this ILIAS-User-ID string $permission int[] $on_user_ids List of ILIAS-User-IDs Returns bool See also getAvailablePositionRelatedPermissions for available permissions More...
	checkPositionAccess (string $pos_perm, int $ref_id)
	Parameters string $pos_perm int $ref_id Reference-ID of the desired Object in the tree Returns bool See also getAvailablePositionRelatedPermissions for available permissions More...
	checkRbacOrPositionPermissionAccess (string $rbac_perm, string $pos_perm, int $ref_id)
	Parameters string $rbac_perm string $pos_perm See the list of available permissions in interface ilOrgUnitPositionAccessHandler int $ref_id Reference-ID of the desired Object in the tree Returns bool More...
	filterUserIdsByPositionOfCurrentUser (string $pos_perm, int $ref_id, array $user_ids)
	Parameters string $pos_perm int $ref_id int[] $user_ids Returns int[] See also getAvailablePositionRelatedPermissions for available permissions More...
	filterUserIdsByPositionOfUser (int $user_id, string $pos_perm, int $ref_id, array $user_ids)
	Parameters int $user_id string $pos_perm int $ref_id int[] $user_ids Returns int[] See also getAvailablePositionRelatedPermissions for available permissions More...
	filterUserIdsByRbacOrPositionOfCurrentUser (string $rbac_perm, string $pos_perm, int $ref_id, array $user_ids)
	Parameters string $rbac_perm string $pos_perm See the list of available permissions in interface ilOrgUnitPositionAccessHandler int $ref_id Reference-ID of the desired Object in the tree int[] $user_ids Returns int[] More...
	hasCurrentUserAnyPositionAccess (int $ref_id)
	Parameters int $ref_id Returns bool More...
	hasUserRBACorAnyPositionAccess (string $rbac_perm, int $ref_id)

Protected Attributes
ilOrgUnitPositionAccess	$ilOrgUnitPositionAccess
array	$obj_tree_cache
array	$obj_type_cache
array	$obj_id_cache
array	$ac_cache
bool	$status
bool	$path
bool	$condition
bool	$tree
bool	$rbac
bool	$cache
ilAccessInfo	$current_info
ilAccessInfo	$last_info = null
array	$results = []
array	$last_result = []
array	$stored_rbac_access = []
array	$current_result_element = []
ilRbacSystem	$rbacsystem
ilObjUser	$user
ilLogger	$ac_logger
ilDBInterface	$db
ilTree	$repositoryTree
ilObjectDefinition	$objDefinition
ilLanguage	$language = null

Private Member Functions
	getLanguage ()

Private Attributes
const	MAX_CACHE_SIZE = 1000
bool	$prevent_caching_last_result = false

Detailed Description

This file is part of ILIAS, a powerful learning management system published by ILIAS open source e-Learning e.V.

ILIAS is licensed with the GPL-3.0, see https://www.gnu.org/licenses/gpl-3.0.en.html You should have received a copy of said license along with the source code, too.

If this is not the case or you just want to try ILIAS, you'll find us at: https://www.ilias.de https://github.com/ILIAS-eLearning Class ilAccessHandler Checks access for ILIAS objects

Author

Alex Killing alex..nosp@m.kill.nosp@m.ing@g.nosp@m.mx.d.nosp@m.e

Sascha Hofmann sasch.nosp@m.ahof.nosp@m.mann@.nosp@m.gmx..nosp@m.de

Definition at line 27 of file class.ilAccess.php.

Constructor & Destructor Documentation

__construct()

ilAccess::__construct

(

)

Definition at line 62 of file class.ilAccess.php.

References $DIC, ilLoggerFactory\getLogger(), ILIAS\Repository\rbac(), ILIAS\Repository\repositoryTree(), and ILIAS\Repository\user().

    {
        global $DIC;

        $this->user = $DIC->user();
        $this->db = $DIC->database();
        $this->rbacsystem = $DIC['rbacsystem'];
        $this->results = array();
        $this->current_info = new ilAccessInfo();
        $this->repositoryTree = $DIC->repositoryTree();
        $this->objDefinition = $DIC['objDefinition'];

        // use function enable to switch on/off tests (only cache is used so far)
        $this->cache = true;
        $this->rbac = true;
        $this->tree = true;
        $this->condition = true;
        $this->path = true;
        $this->status = true;
        $this->obj_id_cache = [];
        $this->obj_type_cache = [];
        $this->obj_tree_cache = [];
        $this->ac_cache = [];

        $this->ilOrgUnitPositionAccess = new ilOrgUnitPositionAccess($this);

        $this->ac_logger = ilLoggerFactory::getLogger('ac');
    }

Here is the call graph for this function:

Member Function Documentation

addInfoItem()

ilAccess::addInfoItem	(	string	$a_type,
		string	$a_text,
		string	$a_data = ""
	)

add an info item to current info object

Implements ilRBACAccessHandler.

Definition at line 218 of file class.ilAccess.php.

                                                                                    : void
    {
        $this->current_info->addInfoItem($a_type, $a_text, $a_data);
    }

checkAccess()

ilAccess::checkAccess	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		string	$a_type = "",
		?int	$a_obj_id = null,
		?int	$a_tree_id = null
	)

check access for an object (provide $a_type and $a_obj_id if available for better performance)

Implements ilRBACAccessHandler.

Definition at line 226 of file class.ilAccess.php.

References checkAccessOfUser(), and ILIAS\Repository\user().

Referenced by ilSessionClassificationPathGUI\findSessionContainerForItem(), and ilOrgUnitRecursiveUserAssignmentTableGUI\mayViewLPIn().

     : bool {
        return $this->checkAccessOfUser(
            $this->user->getId(),
            $a_permission,
            $a_cmd,
            $a_ref_id,
            $a_type,
            $a_obj_id,
            $a_tree_id
        );
    }

Here is the call graph for this function:

Here is the caller graph for this function:

checkAccessOfUser()

ilAccess::checkAccessOfUser	(	int	$a_user_id,
		string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		string	$a_type = "",
		?int	$a_obj_id = 0,
		?int	$a_tree_id = 0
	)

check access for an object (provide $a_type and $a_obj_id if available for better performance)

Implements ilRBACAccessHandler.

Definition at line 248 of file class.ilAccess.php.

References $DIC, ilObject\_lookupObjId(), ilObject\_lookupType(), doActivationCheck(), doCacheCheck(), doConditionCheck(), doPathCheck(), doRBACCheck(), doStatusCheck(), doTreeCheck(), getLanguage(), ilAccessInfo\IL_NO_PERMISSION, setPreventCachingLastResult(), and storeAccessResult().

Referenced by checkAccess(), doActivationCheck(), doConditionCheck(), doPathCheck(), and ilExerciseDerivedTaskProvider\getFirstRefIdWithPermission().

     : bool {
        global $DIC;

        $ilBench = $DIC['ilBench'];

        $this->setPreventCachingLastResult(false);    // for external db based caches

        $ilBench->start("AccessControl", "0400_clear_info");
        $this->current_info->clear();
        $ilBench->stop("AccessControl", "0400_clear_info");

        // get stored result (internal memory based cache)
        $cached = $this->doCacheCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id);
        if ($cached["hit"]) {
            // Store access result
            if (!$cached["granted"]) {
                $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            }
            if ($cached["prevent_db_cache"]) {
                $this->setPreventCachingLastResult(true);    // should have been saved in previous call already
            }
            return $cached["granted"];
        }

        $ilBench->start("AccessControl", "0500_lookup_id_and_type");
        // get object id if not provided
        if ($a_obj_id == 0) {
            if (isset($this->obj_id_cache[$a_ref_id]) && $this->obj_id_cache[$a_ref_id] > 0) {
                $a_obj_id = $this->obj_id_cache[$a_ref_id];
            } else {
                $a_obj_id = ilObject::_lookupObjId($a_ref_id);
                $this->obj_id_cache[$a_ref_id] = $a_obj_id;
            }
        }
        if ($a_type == "") {
            if (isset($this->obj_type_cache[$a_ref_id]) && $this->obj_type_cache[$a_ref_id] != "") {
                $a_type = $this->obj_type_cache[$a_ref_id];
            } else {
                $a_type = ilObject::_lookupType($a_ref_id, true);
                $this->obj_type_cache[$a_ref_id] = $a_type;
            }
        }

        $ilBench->stop("AccessControl", "0500_lookup_id_and_type");

        // if supplied tree id is not = 1 (= repository main tree),
        // check if object is in tree and not deleted
        if ($a_tree_id != 1 &&
            !$this->doTreeCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id)) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }

        // rbac check for current object
        if (!$this->doRBACCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id, $a_type)) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }

        // Check object activation
        $act_check = $this->doActivationCheck(
            $a_permission,
            $a_cmd,
            $a_ref_id,
            $a_user_id,
            $a_obj_id,
            $a_type
        );

        if (!$act_check) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt('status_no_permission'));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }

        // check read permission for all parents
        $par_check = $this->doPathCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id);
        if (!$par_check) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }

        // condition check (currently only implemented for read permission)
        if (!$this->doConditionCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id, $a_obj_id, $a_type)) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            $this->setPreventCachingLastResult(true);        // do not store this in db, since condition updates are not monitored
            return false;
        }

        // object type specific check
        if (!$this->doStatusCheck($a_permission, $a_cmd, $a_ref_id, $a_user_id, $a_obj_id, $a_type)) {
            $this->current_info->addInfoItem(ilAccessInfo::IL_NO_PERMISSION, $this->getLanguage()->txt("status_no_permission"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            $this->setPreventCachingLastResult(true);        // do not store this in db, since status updates are not monitored
            return false;
        }

        // all checks passed
        $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, true, $a_user_id);
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

checkPositionAccess()

ilAccess::checkPositionAccess	(	string	$pos_perm,
		int	$ref_id
	)

Parameters

string	$pos_perm
int	$ref_id	Reference-ID of the desired Object in the tree

Returns

bool

See also

getAvailablePositionRelatedPermissions for available permissions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 807 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\checkPositionAccess().

                                                                      : bool
    {
        return $this->ilOrgUnitPositionAccess->checkPositionAccess($pos_perm, $ref_id);
    }

Here is the call graph for this function:

checkRbacOrPositionPermissionAccess()

ilAccess::checkRbacOrPositionPermissionAccess	(	string	$rbac_perm,
		string	$pos_perm,
		int	$ref_id
	)

Parameters

string	$rbac_perm
string	$pos_perm	See the list of available permissions in interface ilOrgUnitPositionAccessHandler
int	$ref_id	Reference-ID of the desired Object in the tree

Returns

bool

Implements ilOrgUnitPositionAndRBACAccessHandler.

Definition at line 815 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\checkRbacOrPositionPermissionAccess().

                                                                                                         : bool
    {
        return $this->ilOrgUnitPositionAccess->checkRbacOrPositionPermissionAccess($rbac_perm, $pos_perm, $ref_id);
    }

Here is the call graph for this function:

clear()

ilAccess::clear

(

)

Implements ilRBACAccessHandler.

Definition at line 738 of file class.ilAccess.php.

                           : void
    {
        $this->results = array();
        $this->last_result = [];
        $this->current_info = new ilAccessInfo();
        $this->stored_rbac_access = [];
    }

doActivationCheck()

ilAccess::doActivationCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id,
		int	$a_obj_id,
		string	$a_type
	)

check for activation and centralized offline status.

Implements ilRBACAccessHandler.

Definition at line 545 of file class.ilAccess.php.

References checkAccessOfUser(), ilMemberViewSettings\getInstance(), ilObjectActivation\getItem(), ilObject\lookupOfflineStatus(), ilObjectActivation\TIMINGS_ACTIVATION, and ILIAS\Repository\user().

Referenced by checkAccessOfUser().

     : bool {
        $cache_perm = ($a_permission === "visible" || $a_permission === 'leave')
            ? "visible"
            : "other";

        if (isset($this->ac_cache[$cache_perm][$a_ref_id][$a_user_id])) {
            return $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id];
        }

        // nothings needs to be done if current permission is write permission
        if ($a_permission === 'write') {
            return true;
        }

        // #10852 - member view check
        if ($a_user_id === $this->user->getId()) {
            // #10905 - activate parent container ONLY
            $memview = ilMemberViewSettings::getInstance();
            if ($memview->isActiveForRefId($a_ref_id) &&
                $memview->getContainer() == $a_ref_id) {
                return true;
            }
        }

        // in any case, if user has write permission return true
        if ($this->checkAccessOfUser($a_user_id, "write", "", $a_ref_id)) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }

        // no write access => check centralized offline status
        if (
            $this->objDefinition->supportsOfflineHandling($a_type) &&
            ilObject::lookupOfflineStatus($a_obj_id)
        ) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = false;
            return false;
        }
        $item_data = ilObjectActivation::getItem($a_ref_id);
        // if activation isn't enabled
        if ($item_data === null || (is_array($item_data) && count($item_data) == 0) ||
            $item_data['timing_type'] != ilObjectActivation::TIMINGS_ACTIVATION) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }
        // if within activation time
        if (($item_data['timing_start'] == 0 || time() >= $item_data['timing_start']) and
            ($item_data['timing_end'] == 0 || time() <= $item_data['timing_end'])) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }

        // if user has write permission
        if ($this->checkAccessOfUser($a_user_id, "write", "", $a_ref_id)) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }

        // if current permission is visible or leave and visible is set in activation
        if (($a_permission === 'visible' || $a_permission === 'leave')
            && $item_data['visible']) {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }

        // learning progress must be readable, regardless of the activation
        if ($a_permission == 'read_learning_progress') {
            $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
            return true;
        }
        // no access
        $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = false;
        return false;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doCacheCheck()

ilAccess::doCacheCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id
	)

look if result for current query is already in cache

Returns

array<{hit: bool, granted: bool, prevent_db_cache: bool}>

Implements ilRBACAccessHandler.

Definition at line 393 of file class.ilAccess.php.

References getStoredAccessResult().

Referenced by checkAccessOfUser().

                                                                                                    : array
    {
        $stored_access = $this->getStoredAccessResult($a_permission, $a_cmd, $a_ref_id, $a_user_id);

        //var_dump($stored_access);
        if ($stored_access !== []) {
            if (isset($stored_access['info']) && $stored_access['info'] instanceof ilAccessInfo) {
                $this->current_info = $stored_access["info"];
            }
            //var_dump("cache-treffer:");
            return [
                "hit" => true,
                "granted" => $stored_access["granted"],
                "prevent_db_cache" => $stored_access["prevent_db_cache"]
            ];
        }

        // not in cache
        return [
            "hit" => false,
            "granted" => false,
            "prevent_db_cache" => false
        ];
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doConditionCheck()

ilAccess::doConditionCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id,
		int	$a_obj_id,
		string	$a_type
	)

condition check (currently only implemented for read permission)

Implements ilRBACAccessHandler.

Definition at line 630 of file class.ilAccess.php.

References ilConditionHandler\_checkAllConditionsOfTarget(), ilObject\_lookupTitle(), checkAccessOfUser(), getLanguage(), and ilAccessInfo\IL_MISSING_PRECONDITION.

Referenced by checkAccessOfUser().

     : bool {
        if (
            ($a_permission == 'visible') &&
            !$this->checkAccessOfUser($a_user_id, "write", "", $a_ref_id, $a_type, $a_obj_id)
        ) {
            if (ilConditionHandler::lookupEffectiveHiddenStatusByTarget($a_ref_id)) {
                if (!ilConditionHandler::_checkAllConditionsOfTarget($a_ref_id, $a_obj_id, $a_type, $a_user_id)) {
                    $conditions = ilConditionHandler::_getEffectiveConditionsOfTarget($a_ref_id, $a_obj_id, $a_type);
                    foreach ($conditions as $condition) {
                        $this->current_info->addInfoItem(
                            ilAccessInfo::IL_MISSING_PRECONDITION,
                            $this->getLanguage()->txt("missing_precondition") . ": " .
                            ilObject::_lookupTitle($condition["trigger_obj_id"]) . " " .
                            $this->getLanguage()->txt("condition_" . $condition["operator"]) . " " .
                            $condition["value"],
                            serialize($condition)
                        );
                    }
                    return false;
                }
            }
        }

        if (($a_permission == "read" or $a_permission == 'join') &&
            !$this->checkAccessOfUser($a_user_id, "write", "", $a_ref_id, $a_type, $a_obj_id)) {
            if (!ilConditionHandler::_checkAllConditionsOfTarget($a_ref_id, $a_obj_id, $a_type, $a_user_id)) {
                $conditions = ilConditionHandler::_getEffectiveConditionsOfTarget($a_ref_id, $a_obj_id, $a_type);
                foreach ($conditions as $condition) {
                    $this->current_info->addInfoItem(
                        ilAccessInfo::IL_MISSING_PRECONDITION,
                        $this->getLanguage()->txt("missing_precondition") . ": " .
                        ilObject::_lookupTitle($condition["trigger_obj_id"]) . " " .
                        $this->getLanguage()->txt("condition_" . $condition["operator"]) . " " .
                        $condition["value"],
                        serialize($condition)
                    );
                }
                return false;
            }
        }
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doPathCheck()

ilAccess::doPathCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id,
		bool	$a_all = false
	)

check read permission for all parents

Implements ilRBACAccessHandler.

Definition at line 515 of file class.ilAccess.php.

References $id, checkAccessOfUser(), getLanguage(), ilAccessInfo\IL_NO_PARENT_ACCESS, and ILIAS\Repository\repositoryTree().

Referenced by checkAccessOfUser().

     : bool {
        $path = $this->repositoryTree->getPathId($a_ref_id);
        foreach ($path as $id) {
            if ($a_ref_id === $id) {
                continue;
            }
            $access = $this->checkAccessOfUser($a_user_id, "read", "info", $id);
            if ($access == false) {
                $this->current_info->addInfoItem(
                    ilAccessInfo::IL_NO_PARENT_ACCESS,
                    $this->getLanguage()->txt("no_parent_access"),
                    (string) $id
                );
                if ($a_all == false) {
                    return false;
                }
            }
        }
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doRBACCheck()

ilAccess::doRBACCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id,
		string	$a_type
	)

rbac check for current object -> type is used for create permission

Implements ilRBACAccessHandler.

Definition at line 472 of file class.ilAccess.php.

References $message, getLanguage(), ilAccessInfo\IL_NO_PERMISSION, and storeAccessResult().

Referenced by checkAccessOfUser().

     : bool {
        if ($a_permission == "") {
            $message = sprintf(
                '%s::doRBACCheck(): No operations given! $a_ref_id: %s',
                get_class($this),
                $a_ref_id
            );
            $this->ac_logger->error($message);
            throw new ilPermissionException($message);
        }

        if (isset($this->stored_rbac_access[$a_user_id . "-" . $a_permission . "-" . $a_ref_id])) {
            $access = $this->stored_rbac_access[$a_user_id . "-" . $a_permission . "-" . $a_ref_id];
        } else {
            $access = $this->rbacsystem->checkAccessOfUser($a_user_id, $a_permission, $a_ref_id, $a_type);
            if (!is_array($this->stored_rbac_access) || count($this->stored_rbac_access) < self::MAX_CACHE_SIZE) {
                if ($a_permission != "create") {
                    $this->stored_rbac_access[$a_user_id . "-" . $a_permission . "-" . $a_ref_id] = $access;
                }
            }
        }
        // Store in result cache
        if (!$access) {
            $this->current_info->addInfoItem(
                ilAccessInfo::IL_NO_PERMISSION,
                $this->getLanguage()->txt("status_no_permission")
            );
        }
        if ($a_permission != "create") {
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, true, $a_user_id);
        }
        return $access;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doStatusCheck()

ilAccess::doStatusCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id,
		int	$a_obj_id,
		string	$a_type
	)

object type specific check

Implements ilRBACAccessHandler.

Definition at line 683 of file class.ilAccess.php.

References $location, and storeAccessResult().

Referenced by checkAccessOfUser().

     : bool {
        // check for a deactivated plugin
        if ($this->objDefinition->isPluginTypeName($a_type) && !$this->objDefinition->isPlugin($a_type)) {
            return false;
        }
        if (!$a_type) {
            return false;
        }

        $class = $this->objDefinition->getClassName($a_type);
        $location = $this->objDefinition->getLocation($a_type);
        $full_class = "ilObj" . $class . "Access";

        // use autoloader for standard objects
        if ($this->objDefinition->isPluginTypeName($a_type)) {
            include_once($location . "/class." . $full_class . ".php");
        }

        if ($class == "") {
            $this->ac_logger->error("Cannot find class for object type $a_type, obj id $a_obj_id, ref id $a_ref_id. Abort status check.");
            return false;
        }

        $full_class = new $full_class();

        $obj_access = call_user_func(
            array($full_class, "_checkAccess"),
            $a_cmd,
            $a_permission,
            $a_ref_id,
            $a_obj_id,
            $a_user_id
        );
        if ($obj_access !== true) {
            //Note: We must not add an info item here, because one is going
            //      to be added by the user function we just called a few
            //      lines above.
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }
        $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, true, $a_user_id);
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

doTreeCheck()

ilAccess::doTreeCheck	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		int	$a_user_id
	)

check if object is in tree and not deleted

Implements ilRBACAccessHandler.

Definition at line 421 of file class.ilAccess.php.

References getLanguage(), ilAccessInfo\IL_DELETED, ilAccessInfo\IL_NO_PERMISSION, ILIAS\Repository\repositoryTree(), and storeAccessResult().

Referenced by checkAccessOfUser().

                                                                                                   : bool
    {
        // Get stored result
        $tree_cache_key = $a_user_id . ':' . $a_ref_id;
        if (array_key_exists($tree_cache_key, $this->obj_tree_cache)) {
            // Store access result
            if (!$this->obj_tree_cache[$tree_cache_key]) {
                $this->current_info->addInfoItem(
                    ilAccessInfo::IL_NO_PERMISSION,
                    $this->getLanguage()->txt("status_no_permission")
                );
            }
            $this->storeAccessResult(
                $a_permission,
                $a_cmd,
                $a_ref_id,
                $this->obj_tree_cache[$tree_cache_key],
                $a_user_id
            );

            return $this->obj_tree_cache[$tree_cache_key];
        }

        if (!$this->repositoryTree->isInTree($a_ref_id) || $this->repositoryTree->isDeleted($a_ref_id)) {
            // Store negative access results
            // Store in tree cache
            // Note, we only store up to 1000 results to avoid memory overflow.
            if (count($this->obj_tree_cache) < self::MAX_CACHE_SIZE) {
                $this->obj_tree_cache[$tree_cache_key] = false;
            }

            // Store in result cache
            $this->current_info->addInfoItem(ilAccessInfo::IL_DELETED, $this->getLanguage()->txt("object_deleted"));
            $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, false, $a_user_id);
            return false;
        }

        // Store positive access result.
        // Store in tree cache
        // Note, we only store up to 1000 results to avoid memory overflow.
        if (count($this->obj_tree_cache) < self::MAX_CACHE_SIZE) {
            $this->obj_tree_cache[$tree_cache_key] = true;
        }
        // Store in result cache
        $this->storeAccessResult($a_permission, $a_cmd, $a_ref_id, true, $a_user_id);
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

enable()

ilAccess::enable	(	string	$a_str,
		bool	$a_bool
	)

Todo:

check for valid properties

Implements ilRBACAccessHandler.

Definition at line 750 of file class.ilAccess.php.

                                                       : void
    {
        $this->$a_str = $a_bool;
    }

filterUserIdsByPositionOfCurrentUser()

ilAccess::filterUserIdsByPositionOfCurrentUser	(	string	$pos_perm,
		int	$ref_id,
		array	$user_ids
	)

Parameters

string	$pos_perm
int	$ref_id
	int[]	$user_ids

Returns

int[]

See also

getAvailablePositionRelatedPermissions for available permissions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 823 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\filterUserIdsByPositionOfCurrentUser().

                                                                                                        : array
    {
        return $this->ilOrgUnitPositionAccess->filterUserIdsByPositionOfCurrentUser($pos_perm, $ref_id, $user_ids);
    }

Here is the call graph for this function:

filterUserIdsByPositionOfUser()

ilAccess::filterUserIdsByPositionOfUser	(	int	$user_id,
		string	$pos_perm,
		int	$ref_id,
		array	$user_ids
	)

Parameters

int	$user_id
string	$pos_perm
int	$ref_id
	int[]	$user_ids

Returns

int[]

See also

getAvailablePositionRelatedPermissions for available permissions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 831 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\filterUserIdsByPositionOfUser().

                                                                                                               : array
    {
        return $this->ilOrgUnitPositionAccess->filterUserIdsByPositionOfUser($user_id, $pos_perm, $ref_id, $user_ids);
    }

Here is the call graph for this function:

filterUserIdsByRbacOrPositionOfCurrentUser()

ilAccess::filterUserIdsByRbacOrPositionOfCurrentUser	(	string	$rbac_perm,
		string	$pos_perm,
		int	$ref_id,
		array	$user_ids
	)

Parameters

string	$rbac_perm
string	$pos_perm	See the list of available permissions in interface ilOrgUnitPositionAccessHandler
int	$ref_id	Reference-ID of the desired Object in the tree
	int[]	$user_ids

Returns

int[]

Implements ilOrgUnitPositionAndRBACAccessHandler.

Definition at line 839 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\filterUserIdsByRbacOrPositionOfCurrentUser().

                                                                                                                                 : array
    {
        return $this->ilOrgUnitPositionAccess->filterUserIdsByRbacOrPositionOfCurrentUser(
            $rbac_perm,
            $pos_perm,
            $ref_id,
            $user_ids
        );
    }

Here is the call graph for this function:

filterUserIdsForCurrentUsersPositionsAndPermission()

ilAccess::filterUserIdsForCurrentUsersPositionsAndPermission	(	array	$user_ids,
		string	$permission
	)

Parameters

	int[]	$user_ids List of ILIAS-User-IDs which shall be filtered
string	$permission

Returns

int[] Filtered List of ILIAS-User-IDs

Exceptions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 764 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\filterUserIdsForCurrentUsersPositionsAndPermission().

                                                                                                           : array
    {
        return $this->ilOrgUnitPositionAccess->filterUserIdsForCurrentUsersPositionsAndPermission(
            $user_ids,
            $permission
        );
    }

Here is the call graph for this function:

filterUserIdsForUsersPositionsAndPermission()

ilAccess::filterUserIdsForUsersPositionsAndPermission	(	array	$user_ids,
		int	$for_user_id,
		string	$permission
	)

Parameters

	int[]	$user_ids List of ILIAS-User-IDs which shall be filtered
int	$for_user_id
string	$permission

Returns

int[] Filtered List of ILIAS-User-IDs

Exceptions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 775 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\filterUserIdsForUsersPositionsAndPermission().

                                                                                                                      : array
    {
        return $this->ilOrgUnitPositionAccess->filterUserIdsForUsersPositionsAndPermission(
            $user_ids,
            $for_user_id,
            $permission
        );
    }

Here is the call graph for this function:

getInfo()

ilAccess::getInfo

(

)

get last info object

See also

ilAccessInfo::getInfoItems()

Implements ilRBACAccessHandler.

Definition at line 365 of file class.ilAccess.php.

                             : array
    {
        return is_object($this->last_info) ? $this->last_info->getInfoItems() : array();
    }

getLanguage()

ilAccess::getLanguage ( )

private

Definition at line 91 of file class.ilAccess.php.

References $DIC, $language, and ILIAS\UI\examples\Symbol\Glyph\Language\language().

Referenced by checkAccessOfUser(), doConditionCheck(), doPathCheck(), doRBACCheck(), and doTreeCheck().

                                  : ilLanguage
    {
        if ($this->language === null) {
            global $DIC;
            $this->language = $DIC['lng'];
        }

        return $this->language;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getPreventCachingLastResult()

ilAccess::getPreventCachingLastResult

(

)

Get prevent caching last result.

Implements ilRBACAccessHandler.

Definition at line 143 of file class.ilAccess.php.

References $prevent_caching_last_result.

Referenced by storeAccessResult().

                                                 : bool
    {
        return $this->prevent_caching_last_result;
    }

Here is the caller graph for this function:

getResultAll()

ilAccess::getResultAll

(

int

$a_ref_id = 0

)

Implements ilRBACAccessHandler.

Definition at line 381 of file class.ilAccess.php.

References $results.

                                                   : array
    {
        if ($a_ref_id == "") {
            return $this->results;
        }

        return $this->results[$a_ref_id];
    }

getResultLast()

ilAccess::getResultLast

(

)

get last info object

Implements ilRBACAccessHandler.

Definition at line 373 of file class.ilAccess.php.

References $last_result.

                                   : array
    {
        return $this->last_result;
    }

getResults()

ilAccess::getResults

(

)

Implements ilRBACAccessHandler.

Definition at line 202 of file class.ilAccess.php.

References $results.

                                : array
    {
        return $this->results;
    }

getStoredAccessResult()

ilAccess::getStoredAccessResult	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		?int	$a_user_id = null
	)

get stored access result

Parameters

string	$a_permission	permission
string	$a_cmd	command string
int	$a_ref_id	reference id
int | null	$a_user_id	user id (if no id passed, current user id)

Returns

array<{granted: bool, info: ?ilAccessInfo, prevent_db_cache: bool}>

Implements ilRBACAccessHandler.

Definition at line 151 of file class.ilAccess.php.

References ILIAS\Repository\user().

Referenced by doCacheCheck().

     : array {
        if ($a_user_id === null) {
            $a_user_id = $this->user->getId();
        }
        if (isset($this->results[$a_ref_id][$a_permission][$a_cmd][$a_user_id])) {
            return $this->results[$a_ref_id][$a_permission][$a_cmd][$a_user_id];
        }
        return [];
    }

Here is the call graph for this function:

Here is the caller graph for this function:

hasCurrentUserAnyPositionAccess()

ilAccess::hasCurrentUserAnyPositionAccess

(

int

$ref_id

)

Parameters

int

$ref_id

Returns

bool

Implements ilOrgUnitPositionAccessHandler.

Definition at line 852 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\hasCurrentUserAnyPositionAccess().

                                                                : bool
    {
        return $this->ilOrgUnitPositionAccess->hasCurrentUserAnyPositionAccess($ref_id);
    }

Here is the call graph for this function:

hasUserRBACorAnyPositionAccess()

ilAccess::hasUserRBACorAnyPositionAccess	(	string	$rbac_perm,
		int	$ref_id
	)

Implements ilOrgUnitPositionAndRBACAccessHandler.

Definition at line 860 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\hasUserRBACorAnyPositionAccess().

                                                                                  : bool
    {
        return $this->ilOrgUnitPositionAccess->hasUserRBACorAnyPositionAccess($rbac_perm, $ref_id);
    }

Here is the call graph for this function:

isCurrentUserBasedOnPositionsAllowedTo()

ilAccess::isCurrentUserBasedOnPositionsAllowedTo	(	string	$permission,
		array	$on_user_ids
	)

Parameters

string	$permission
	int[]	$on_user_ids List of ILIAS-User-IDs

Returns

bool

See also

getAvailablePositionRelatedPermissions for available permissions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 787 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\isCurrentUserBasedOnPositionsAllowedTo().

                                                                                                  : bool
    {
        return $this->ilOrgUnitPositionAccess->isCurrentUserBasedOnPositionsAllowedTo($permission, $on_user_ids);
    }

Here is the call graph for this function:

isUserBasedOnPositionsAllowedTo()

ilAccess::isUserBasedOnPositionsAllowedTo	(	int	$which_user_id,
		string	$permission,
		array	$on_user_ids
	)

Parameters

int	$which_user_id	Permission check for this ILIAS-User-ID
string	$permission
	int[]	$on_user_ids List of ILIAS-User-IDs

Returns

bool

See also

getAvailablePositionRelatedPermissions for available permissions

Implements ilOrgUnitPositionAccessHandler.

Definition at line 795 of file class.ilAccess.php.

References ilOrgUnitPositionAccess\isUserBasedOnPositionsAllowedTo().

                                                                                                               : bool
    {
        return $this->ilOrgUnitPositionAccess->isUserBasedOnPositionsAllowedTo(
            $which_user_id,
            $permission,
            $on_user_ids
        );
    }

Here is the call graph for this function:

readCache()

ilAccess::readCache

(

int

$a_secs = 0

)

Implements ilRBACAccessHandler.

Definition at line 184 of file class.ilAccess.php.

References $query, ilDBConstants\FETCHMODE_ASSOC, and ILIAS\Repository\user().

                                              : bool
    {
        if ($a_secs > 0) {
            $query = "SELECT * FROM acc_cache WHERE user_id = " .
                $this->db->quote($this->user->getId(), 'integer');
            $set = $this->db->query($query);
            $rec = $set->fetchRow(ilDBConstants::FETCHMODE_ASSOC);
            if ((time() - $rec["time"]) < $a_secs) {
                $this->results = unserialize($rec["result"]);
                return true;
            }
        }
        return false;
    }

Here is the call graph for this function:

setPreventCachingLastResult()

ilAccess::setPreventCachingLastResult

(

bool

$a_val

)

Set prevent caching last result.

Implements ilRBACAccessHandler.

Definition at line 135 of file class.ilAccess.php.

Referenced by checkAccessOfUser().

                                                            : void
    {
        $this->prevent_caching_last_result = $a_val;
    }

Here is the caller graph for this function:

setResults()

ilAccess::setResults

(

array

$a_results

)

Implements ilRBACAccessHandler.

Definition at line 210 of file class.ilAccess.php.

                                                : void
    {
        $this->results = $a_results;
    }

storeAccessResult()

ilAccess::storeAccessResult	(	string	$a_permission,
		string	$a_cmd,
		int	$a_ref_id,
		bool	$a_access_granted,
		?int	$a_user_id = null,
		?ilAccessInfo	$a_info = null
	)

store access result

Implements ilRBACAccessHandler.

Definition at line 104 of file class.ilAccess.php.

References $current_info, getPreventCachingLastResult(), and ILIAS\Repository\user().

Referenced by checkAccessOfUser(), doRBACCheck(), doStatusCheck(), and doTreeCheck().

     : void {
        if ($a_user_id === null) {
            $a_user_id = $this->user->getId();
        }
        if ($a_info === null) {
            $a_info = $this->current_info;
        }
        if ($this->cache) {
            $this->results[$a_ref_id][$a_permission][$a_cmd][$a_user_id] = [
                "granted" => $a_access_granted,
                "info" => $a_info,
                "prevent_db_cache" => $this->getPreventCachingLastResult()
            ];
            $this->current_result_element = [$a_access_granted, $a_ref_id, $a_permission, $a_cmd, $a_user_id];
            $this->last_result = $this->results[$a_ref_id][$a_permission][$a_cmd][$a_user_id];
            $this->last_info = $a_info;
        }
        // get new info object
        $this->current_info = new ilAccessInfo();
    }

Here is the call graph for this function:

Here is the caller graph for this function:

storeCache()

ilAccess::storeCache

(

)

Implements ilRBACAccessHandler.

Definition at line 169 of file class.ilAccess.php.

References $query, $res, and ILIAS\Repository\user().

                                : void
    {
        $query = "DELETE FROM acc_cache WHERE user_id = " . $this->db->quote($this->user->getId(), 'integer');
        $res = $this->db->manipulate($query);

        $this->db->insert('acc_cache', array(
            'user_id' => array('integer', $this->user->getId()),
            'time' => array('integer', time()),
            'result' => array('clob', serialize($this->results))
        ));
    }

Here is the call graph for this function:

Field Documentation

$ac_cache

array ilAccess::$ac_cache

protected

Definition at line 35 of file class.ilAccess.php.

$ac_logger

ilLogger ilAccess::$ac_logger

protected

Definition at line 55 of file class.ilAccess.php.

$cache

bool ilAccess::$cache

protected

Definition at line 42 of file class.ilAccess.php.

$condition

bool ilAccess::$condition

protected

Definition at line 39 of file class.ilAccess.php.

$current_info

ilAccessInfo ilAccess::$current_info

protected

Definition at line 46 of file class.ilAccess.php.

Referenced by storeAccessResult().

$current_result_element

array ilAccess::$current_result_element = []

protected

Definition at line 51 of file class.ilAccess.php.

$db

ilDBInterface ilAccess::$db

protected

Definition at line 56 of file class.ilAccess.php.

$ilOrgUnitPositionAccess

ilOrgUnitPositionAccess ilAccess::$ilOrgUnitPositionAccess

protected

Definition at line 31 of file class.ilAccess.php.

$language

ilLanguage ilAccess::$language = null

protected

Definition at line 60 of file class.ilAccess.php.

Referenced by getLanguage().

$last_info

ilAccessInfo ilAccess::$last_info = null

protected

Definition at line 47 of file class.ilAccess.php.

$last_result

array ilAccess::$last_result = []

protected

Definition at line 49 of file class.ilAccess.php.

Referenced by getResultLast().

$obj_id_cache

array ilAccess::$obj_id_cache

protected

Definition at line 34 of file class.ilAccess.php.

$obj_tree_cache

array ilAccess::$obj_tree_cache

protected

Definition at line 32 of file class.ilAccess.php.

$obj_type_cache

array ilAccess::$obj_type_cache

protected

Definition at line 33 of file class.ilAccess.php.

$objDefinition

ilObjectDefinition ilAccess::$objDefinition

protected

Definition at line 58 of file class.ilAccess.php.

$path

bool ilAccess::$path

protected

Definition at line 38 of file class.ilAccess.php.

$prevent_caching_last_result

bool ilAccess::$prevent_caching_last_result = false

private

Definition at line 44 of file class.ilAccess.php.

Referenced by getPreventCachingLastResult().

$rbac

bool ilAccess::$rbac

protected

Definition at line 41 of file class.ilAccess.php.

$rbacsystem

ilRbacSystem ilAccess::$rbacsystem

protected

Definition at line 53 of file class.ilAccess.php.

$repositoryTree

ilTree ilAccess::$repositoryTree

protected

Definition at line 57 of file class.ilAccess.php.

$results

array ilAccess::$results = []

protected

Definition at line 48 of file class.ilAccess.php.

Referenced by getResultAll(), and getResults().

$status

bool ilAccess::$status

protected

Definition at line 37 of file class.ilAccess.php.

$stored_rbac_access

array ilAccess::$stored_rbac_access = []

protected

Definition at line 50 of file class.ilAccess.php.

$tree

bool ilAccess::$tree

protected

Definition at line 40 of file class.ilAccess.php.

$user

ilObjUser ilAccess::$user

protected

Definition at line 54 of file class.ilAccess.php.

MAX_CACHE_SIZE

const ilAccess::MAX_CACHE_SIZE = 1000

private

Definition at line 29 of file class.ilAccess.php.

---

The documentation for this class was generated from the following file:

• Services/AccessControl/classes/class.ilAccess.php