ilRbacReview Class Reference

class ilRbacReview Contains Review functions of core Rbac. More...

Collaboration diagram for ilRbacReview:

Public Member Functions
	__construct ()
	Constructor public. More...
	roleExists (string $a_title, int $a_id=0)
	Checks if a role already exists. More...
	getParentRoleIds (int $a_endnode_id, bool $a_templates=false)
	Get an array of parent role ids of all parent roles, if last parameter is set true you get also all parent templates. More...
	getRoleListByObject (int $a_ref_id, bool $a_templates=false)
	Returns a list of roles in an container. More...
	getAssignableRoles (bool $a_templates=false, bool $a_internal_roles=false, string $title_filter='')
	Returns a list of all assignable roles. More...
	getAssignableRolesInSubtree (int $ref_id)
	Returns a list of assignable roles in a subtree of the repository. More...
	getAssignableChildRoles (int $a_ref_id)
	Get all assignable roles directly under a specific node. More...
	getNumberOfAssignedUsers (array $a_roles)
	Get the number of assigned users to roles (not properly deleted user accounts are not counted) More...
	assignedUsers (int $a_rol_id)
	get all assigned users to a given role More...
	isAssigned (int $a_usr_id, int $a_role_id)
	check if a specific user is assigned to specific role More...
	isAssignedToAtLeastOneGivenRole (int $a_usr_id, array $a_role_ids)
	check if a specific user is assigned to at least one of the given role ids. More...
	assignedRoles (int $a_usr_id)
	get all assigned roles to a given user More...
	assignedGlobalRoles (int $a_usr_id)
	Get assigned global roles for an user. More...
	isAssignable (int $a_rol_id, int $a_ref_id)
	Check if its possible to assign users. More...
	hasMultipleAssignments (int $a_role_id)
	getFoldersAssignedToRole (int $a_rol_id, bool $a_assignable=false)
	Returns an array of objects assigned to a role. More...
	getRolesOfObject (int $a_ref_id, bool $a_assignable_only=false)
	Get roles of object. More...
	getRolesOfRoleFolder (int $a_ref_id, bool $a_nonassignable=true)
	get all roles of a role folder including linked local roles that are created due to stopped inheritance returns an array with role ids More...
	getGlobalRoles ()
	get only 'global' roles More...
	getLocalRoles (int $a_ref_id)
	Get local roles of object. More...
	getLocalPolicies (int $a_ref_id)
	Get all roles with local policies. More...
	getGlobalRolesArray ()
	get only 'global' roles More...
	getGlobalAssignableRoles ()
	get only 'global' roles (with flag 'assign_users') More...
	isRoleAssignedToObject (int $a_role_id, int $a_parent_id)
	Check if role is assigned to an object. More...
	getOperations ()
	get all possible operations More...
	getOperation (int $ops_id)
	get one operation by operation id More...
	getAllOperationsOfRole (int $a_rol_id, int $a_parent=0)
	get all possible operations of a specific role The ref_id of the role folder (parent object) is necessary to distinguish local roles More...
	getActiveOperationsOfRole (int $a_ref_id, int $a_role_id)
	getOperationsOfRole (int $a_rol_id, string $a_type, int $a_parent=0)
	get all possible operations of a specific role The ref_id of the role folder (parent object) is necessary to distinguish local roles More...
	getRoleOperationsOnObject (int $a_role_id, int $a_ref_id)
	getOperationsOnType (int $a_typ_id)
	all possible operations of a type More...
	getOperationsOnTypeString (string $a_type)
	all possible operations of a type More...
	getOperationsByTypeAndClass (string $a_type, string $a_class)
	Get operations by type and class. More...
	getObjectsWithStopedInheritance (int $a_rol_id, array $a_filter=[])
	get all objects in which the inheritance of role with role_id was stopped the function returns all reference ids of objects containing a role folder. More...
	isDeleted (int $a_node_id)
	Checks if a rolefolder is set as deleted (negative tree_id) More...
	isGlobalRole (int $a_role_id)
	Check if role is a global role. More...
	getRolesByFilter (int $a_filter=0, int $a_user_id=0, string $title_filter='')
	getTypeId (string $a_type)
	isProtected (int $a_ref_id, int $a_role_id)
	ref_id not used yet. More...
	isBlockedAtPosition (int $a_role_id, int $a_ref_id)
	isBlockedInUpperContext (int $a_role_id, int $a_ref_id)
	Check if role is blocked in upper context. More...
	getObjectOfRole (int $a_role_id)
	Get object id of objects a role is assigned to. More...
	getObjectReferenceOfRole (int $a_role_id)
	isRoleDeleted (int $a_role_id)
	return if role is only attached to deleted role folders More...
	getRolesForIDs (array $role_ids, bool $use_templates)
	getOperationAssignment ()
	get operation assignments More...
	isDeleteable (int $a_role_id, int $a_rolf_id)
	Check if role is deleteable at a specific position. More...
	isSystemGeneratedRole (int $a_role_id)
	Check if the role is system generate role or role template. More...
	getRoleFolderOfRole (int $a_role_id)
	getUserPermissionsOnObject (int $a_user_id, int $a_ref_id)
	Get all user permissions on an object. More...
	setAssignedCacheEntry (int $a_role_id, int $a_user_id, bool $a_value)
	set entry of assigned_chache More...
	getAssignedCacheEntry (int $a_role_id, int $a_user_id)
	clearCaches ()
	Clear assigned users caches. More...

Static Public Member Functions
static	_getOperationIdsByName (array $operations)
	get ops_id's by name. More...
static	_getOperationIdByName (string $a_operation)
	get operation id by name of operation More...
static	lookupCreateOperationIds (array $a_type_arr)
	Lookup operation ids. More...
static	_getOperationList (string $a_type='')
	get operation list by object type More...
static	_groupOperationsByClass (array $a_ops_arr)
static	_getCustomRBACOperationId (string $operation, ?\ilDBInterface $ilDB=null)
static	_isRBACOperation (int $type_id, int $ops_id, ?\ilDBInterface $ilDB=null)

Data Fields
const	FILTER_ALL = 1
const	FILTER_ALL_GLOBAL = 2
const	FILTER_ALL_LOCAL = 3
const	FILTER_INTERNAL = 4
const	FILTER_NOT_INTERNAL = 5
const	FILTER_TEMPLATES = 6

Protected Member Functions
	__getParentRoles (array $a_path, bool $a_templates)
	Note: This function performs faster than the new getParentRoles function, because it uses database indexes whereas getParentRoles needs a full table space scan. More...
	__setTemplateFilter (bool $a_templates)
	get roles and templates or only roles; returns string for where clause More...
	__setRoleType (array $a_role_list)
	computes role type in role list array: global: roles in ROLE_FOLDER_ID local: assignable roles in other role folders linked: roles with stoppped inheritance template: role templates More...
	__setProtectedStatus (array $a_parent_roles, array $a_role_hierarchy, int $a_ref_id)

Protected Attributes
ilLogger	$log
ilDBInterface	$db

Static Protected Attributes
static array	$assigned_users_cache = []
static array	$is_assigned_cache = []

Private Member Functions
	getAssignableRolesGenerator (bool $a_templates=false, bool $a_internal_roles=false, string $title_filter='')
	setRoleTypeAndProtection (array $role_list_entry)
	buildRoleType (array $role_list_entry)
	buildProtectionByStringValue (string $value)

Static Private Attributes
static array	$_opsCache = null

Detailed Description

class ilRbacReview Contains Review functions of core Rbac.

This class offers the possibility to view the contents of the user <-> role (UR) relation and the permission <-> role (PR) relation. For example, from the UA relation the administrator should have the facility to view all user assigned to a given role.

Author

Stefan Meyer meyer.nosp@m.@lei.nosp@m.fos.c.nosp@m.om

Sascha Hofmann sasch.nosp@m.ahof.nosp@m.mann@.nosp@m.gmx..nosp@m.de

Version

$Id$

-type RoleListEntry array{obj_id: int, rol_id: int, parent: int, user_id: int, owner: int, title: ?string, desc: string, description: string, create_date: ?string, last_update: ?string, import_id: ?string, tile_image_rid: ?string, role_type: string, offline: ?int, type: string, assign: string, protected: bool, blocked: int, rol_id: int}

Definition at line 33 of file class.ilRbacReview.php.

Constructor & Destructor Documentation

__construct()

ilRbacReview::__construct

(

)

Constructor public.

Definition at line 55 of file class.ilRbacReview.php.

References $DIC, and ilLoggerFactory\getLogger().

    {
        global $DIC;

        $this->log = ilLoggerFactory::getLogger('ac');
        $this->db = $DIC->database();
    }

Here is the call graph for this function:

Member Function Documentation

__getParentRoles()

ilRbacReview::__getParentRoles ( array  $a_path, bool  $a_templates  )

protected

Note: This function performs faster than the new getParentRoles function, because it uses database indexes whereas getParentRoles needs a full table space scan.

Get parent roles in a path. If last parameter is set 'true' it delivers also all templates in the path

Parameters

array	array with path_ids
bool	true for role templates (default: false)

Returns

array array with all parent roles (obj_ids)

Definition at line 95 of file class.ilRbacReview.php.

References $id, $ref_id, __setProtectedStatus(), getRoleListByObject(), and ILIAS\Repository\int().

Referenced by getParentRoleIds().

                                                                         : array
    {
        $parent_roles = [];
        $role_hierarchy = [];
        foreach ($a_path as $ref_id) {
            $roles = $this->getRoleListByObject($ref_id, $a_templates);
            foreach ($roles as $role) {
                $id = (int) $role["obj_id"];
                $role["parent"] = (int) $ref_id;
                $parent_roles[$id] = $role;

                if (!array_key_exists($role['obj_id'], $role_hierarchy)) {
                    $role_hierarchy[$id] = $ref_id;
                }
            }
        }
        return $this->__setProtectedStatus($parent_roles, $role_hierarchy, (int) reset($a_path));
    }

Here is the call graph for this function:

Here is the caller graph for this function:

__setProtectedStatus()

ilRbacReview::__setProtectedStatus ( array  $a_parent_roles, array  $a_role_hierarchy, int  $a_ref_id  )

protected

Definition at line 1107 of file class.ilRbacReview.php.

References $DIC, assignedRoles(), and SYSTEM_ROLE_ID.

Referenced by __getParentRoles().

                                                                                                          : array
    {
        global $DIC;

        $rbacsystem = $DIC->rbac()->system();
        $ilUser = $DIC->user();
        if (in_array(SYSTEM_ROLE_ID, $this->assignedRoles($ilUser->getId()))) {
            $leveladmin = true;
        } else {
            $leveladmin = false;
        }
        foreach ($a_role_hierarchy as $role_id => $rolf_id) {
            if ($leveladmin == true) {
                $a_parent_roles[$role_id]['protected'] = false;
                continue;
            }

            if ($a_parent_roles[$role_id]['protected'] == true) {
                $arr_lvl_roles_user = array_intersect(
                    $this->assignedRoles($ilUser->getId()),
                    array_keys($a_role_hierarchy, $rolf_id)
                );

                foreach ($arr_lvl_roles_user as $lvl_role_id) {
                    // check if role grants 'edit_permission' to parent
                    $rolf = $a_parent_roles[$role_id]['parent'];
                    if ($rbacsystem->checkPermission($rolf, $lvl_role_id, 'edit_permission')) {
                        $a_parent_roles[$role_id]['protected'] = false;
                    }
                }
            }
        }
        return $a_parent_roles;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

__setRoleType()

ilRbacReview::__setRoleType ( array  $a_role_list )

protected

computes role type in role list array: global: roles in ROLE_FOLDER_ID local: assignable roles in other role folders linked: roles with stoppped inheritance template: role templates

Definition at line 286 of file class.ilRbacReview.php.

References setRoleTypeAndProtection().

Referenced by getRoleListByObject(), and getRolesForIDs().

                                                        : array
    {
        foreach ($a_role_list as $key => $val) {
            $a_role_list[$key] = $this->setRoleTypeAndProtection($val);
        }
        return $a_role_list;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

__setTemplateFilter()

ilRbacReview::__setTemplateFilter ( bool  $a_templates )

protected

get roles and templates or only roles; returns string for where clause

Definition at line 269 of file class.ilRbacReview.php.

Referenced by getAssignableRolesGenerator(), getRoleListByObject(), and getRolesForIDs().

                                                             : string
    {
        if ($a_templates) {
            $where = "WHERE " . $this->db->in('object_data.type', ['role', 'rolt'], false, 'text') . " ";
        } else {
            $where = "WHERE " . $this->db->in('object_data.type', ['role'], false, 'text') . " ";
        }
        return $where;
    }

Here is the caller graph for this function:

_getCustomRBACOperationId()

static ilRbacReview::_getCustomRBACOperationId ( string  $operation, ?\ilDBInterface  $ilDB = null  )

static

Definition at line 1421 of file class.ilRbacReview.php.

References $DIC, $ilDB, $res, and null.

Referenced by ILIAS\Wiki\Setup\AccessRBACOperationClonedObjective\achieve(), ILIAS\Setup\AccessRBACOperationClonedObjective\achieve(), ilAccessRolePermissionSetObjective\achieve(), ilAccessCustomRBACOperationAddedObjective\achieve(), ilAccessRbacStandardOperationsAddedObjective\achieve(), ilAccessInitialPermissionGuidelineAppliedObjective\achieve(), ilDBUpdateNewObjectType\addCustomRBACOperation(), ilDBUpdateNewObjectType\addRBACOperations(), ilDBUpdateNewObjectType\applyInitialPermissionGuideline(), ilAccessRbacStandardOperationsAddedObjective\isApplicable(), ilAccessCustomRBACOperationAddedObjective\isApplicable(), ilAccessInitialPermissionGuidelineAppliedObjective\isApplicable(), and ilDBUpdateNewObjectType\setRolePermission().

                                                                                                     : ?int
    {
        if (!$ilDB) {
            global $DIC;
            $ilDB = $DIC->database();
        }

        $sql =
            "SELECT ops_id" . PHP_EOL
            . "FROM rbac_operations" . PHP_EOL
            . "WHERE operation = " . $ilDB->quote($operation, "text") . PHP_EOL
        ;

        $res = $ilDB->query($sql);
        if ($ilDB->numRows($res) == 0) {
            return null;
        }

        $row = $ilDB->fetchAssoc($res);
        return (int) $row["ops_id"] ?? null;
    }

Here is the caller graph for this function:

_getOperationIdByName()

static ilRbacReview::_getOperationIdByName ( string  $a_operation )

static

get operation id by name of operation

Definition at line 987 of file class.ilRbacReview.php.

References $DIC, $ilDB, $q, $r, ilDBConstants\FETCHMODE_OBJECT, and ILIAS\Repository\int().

Referenced by ilRepositoryObjectPlugin\beforeActivation(), ilRbacSystem\checkAccessOfUser(), and ilObjBlog\getRolesWithContributeOrRedact().

                                                                     : int
    {
        global $DIC;

        $ilDB = $DIC->database();

        // Cache operation ids
        if (!is_array(self::$_opsCache)) {
            self::$_opsCache = [];

            $q = "SELECT ops_id, operation FROM rbac_operations";
            $r = $ilDB->query($q);
            while ($row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
                self::$_opsCache[$row->operation] = (int) $row->ops_id;
            }
        }

        // Get operation ID by name from cache
        if (array_key_exists($a_operation, self::$_opsCache)) {
            return self::$_opsCache[$a_operation];
        }
        return 0;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

_getOperationIdsByName()

static ilRbacReview::_getOperationIdsByName ( array  $operations )

static

get ops_id's by name.

Example usage: $rbacadmin->grantPermission($roles,ilRbacReview::_getOperationIdsByName(array('visible','read'),$ref_id));

Parameters

list<string>

$operations

Returns

list<int>

Definition at line 964 of file class.ilRbacReview.php.

References $DIC, $ilDB, $res, and ILIAS\Repository\int().

Referenced by ilUtil\_getObjectsByOperations(), ilLTIProviderObjectSettingGUI\checkLocalRole(), and ilECSObjectSettings\handlePermissionUpdate().

                                                                    : array
    {
        global $DIC;

        $ilDB = $DIC->database();
        if ($operations === []) {
            return [];
        }

        $query = 'SELECT ops_id FROM rbac_operations ' .
            'WHERE ' . $ilDB->in('operation', $operations, false, 'text');

        $res = $ilDB->query($query);
        $ops_ids = [];
        while ($row = $ilDB->fetchObject($res)) {
            $ops_ids[] = (int) $row->ops_id;
        }
        return $ops_ids;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

_getOperationList()

static ilRbacReview::_getOperationList ( string  $a_type = '' )

static

get operation list by object type

Returns

list<array{obj_id: int, operation: ?string, desc: ?string, class: ?string, op_order: int}>

Definition at line 1146 of file class.ilRbacReview.php.

References $DIC, $ilDB, $res, and ILIAS\Repository\int().

Referenced by ilSettingsPermissionGUI\__construct(), ilObjTypeDefinitionGUI\editObject(), ilObjectPermissionStatusGUI\getAccessPermissionTableData(), ilObjectPermissionStatusGUI\getAssignedValidRoles(), and ilObjTypeDefinitionGUI\viewObject().

                                                                 : array
    {
        global $DIC;

        $ilDB = $DIC->database();
        $arr = [];
        if ($a_type) {
            $query = sprintf(
                'SELECT * FROM rbac_operations ' .
                'JOIN rbac_ta ON rbac_operations.ops_id = rbac_ta.ops_id ' .
                'JOIN object_data ON rbac_ta.typ_id = object_data.obj_id ' .
                'WHERE object_data.title = %s ' .
                'AND object_data.type = %s ' .
                'ORDER BY op_order ASC',
                $ilDB->quote($a_type, 'text'),
                $ilDB->quote('typ', 'text')
            );
        } else {
            $query = 'SELECT * FROM rbac_operations ORDER BY op_order ASC';
        }
        $res = $ilDB->query($query);
        while ($row = $ilDB->fetchAssoc($res)) {
            $arr[] = [
                "ops_id" => (int) $row['ops_id'],
                "operation" => $row['operation'],
                "desc" => $row['description'],
                "class" => $row['class'],
                "order" => (int) $row['op_order']
            ];
        }
        return $arr;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

_groupOperationsByClass()

static ilRbacReview::_groupOperationsByClass ( array  $a_ops_arr )

static

Returns

array<string, list<array{ops_id: int, name: ?string}>>

Definition at line 1182 of file class.ilRbacReview.php.

References ILIAS\Repository\int().

                                                                    : array
    {
        $arr = [];
        foreach ($a_ops_arr as $ops) {
            $arr[$ops['class']][] = ['ops_id' => (int) $ops['ops_id'],
                                          'name' => $ops['operation']
            ];
        }
        return $arr;
    }

Here is the call graph for this function:

_isRBACOperation()

static ilRbacReview::_isRBACOperation ( int  $type_id, int  $ops_id, ?\ilDBInterface  $ilDB = null  )

static

Definition at line 1443 of file class.ilRbacReview.php.

References $DIC, and $ilDB.

Referenced by ilAccessRbacStandardOperationsAddedObjective\achieve(), ilTreeAdminNodeAddedObjective\achieve(), and ilAccessRbacStandardOperationsAddedObjective\isApplicable().

                                                                                                    : bool
    {
        if (!$ilDB) {
            global $DIC;
            $ilDB = $DIC->database();
        }

        $sql =
            "SELECT typ_id" . PHP_EOL
            . "FROM rbac_ta" . PHP_EOL
            . "WHERE typ_id = " . $ilDB->quote($type_id, "integer") . PHP_EOL
            . "AND ops_id = " . $ilDB->quote($ops_id, "integer") . PHP_EOL
        ;

        return (bool) $ilDB->numRows($ilDB->query($sql));
    }

Here is the caller graph for this function:

assignedGlobalRoles()

ilRbacReview::assignedGlobalRoles

(

int

$a_usr_id

)

Get assigned global roles for an user.

Returns

list<int>

Definition at line 427 of file class.ilRbacReview.php.

References $res, ILIAS\Repository\int(), ROLE_FOLDER_ID, and ilDBConstants\T_INTEGER.

                                                      : array
    {
        $query = "SELECT ua.rol_id FROM rbac_ua ua " .
            "JOIN rbac_fa fa ON ua.rol_id = fa.rol_id " .
            "WHERE usr_id = " . $this->db->quote($a_usr_id, 'integer') . ' ' .
            "AND parent = " . $this->db->quote(ROLE_FOLDER_ID, ilDBConstants::T_INTEGER) . " " .
            "AND assign = 'y' ";

        $res = $this->db->query($query);
        $role_arr = [];
        while ($row = $this->db->fetchObject($res)) {
            $role_arr[] = (int) $row->rol_id;
        }

        return $role_arr;
    }

Here is the call graph for this function:

assignedRoles()

ilRbacReview::assignedRoles

(

int

$a_usr_id

)

get all assigned roles to a given user

Returns

list<int> all roles (id) the user is assigned to

Definition at line 411 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by __setProtectedStatus(), ILIAS\Portfolio\Administration\PortfolioRoleAssignmentManager\assignPortfoliosOnLogin(), ilObjCategoryGUI\assignRolesObject(), ilObjCategoryGUI\assignSaveObject(), ilObjCategoryGUI\checkGlobalRoles(), ilObjCategoryGUI\getAssignableRoles(), getRolesByFilter(), ilCalendarShared\getSharedCalendarsForUser(), ilCalendarShared\isSharedWithUser(), and ilObjCategoryGUI\listUsersObject().

                                                : array
    {
        $query = "SELECT rol_id FROM rbac_ua WHERE usr_id = " . $this->db->quote($a_usr_id, 'integer');

        $res = $this->db->query($query);
        $role_arr = [];
        while ($row = $this->db->fetchObject($res)) {
            $role_arr[] = (int) $row->rol_id;
        }
        return $role_arr;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

assignedUsers()

ilRbacReview::assignedUsers

(

int

$a_rol_id

)

get all assigned users to a given role

Returns

list<int> all users (id) assigned to role

Definition at line 349 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by ilContributorTableGUI\getItems().

                                                : array
    {
        if (isset(self::$assigned_users_cache[$a_rol_id])) {
            return self::$assigned_users_cache[$a_rol_id];
        }

        $result_arr = [];
        $query = "SELECT usr_id FROM rbac_ua WHERE rol_id= " . $this->db->quote($a_rol_id, 'integer');
        $res = $this->db->query($query);
        while ($row = $this->db->fetchAssoc($res)) {
            $result_arr[] = (int) $row["usr_id"];
        }
        self::$assigned_users_cache[$a_rol_id] = $result_arr;
        return $result_arr;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

buildProtectionByStringValue()

ilRbacReview::buildProtectionByStringValue ( string  $value )

private

Definition at line 318 of file class.ilRbacReview.php.

Referenced by setRoleTypeAndProtection().

                                                                : bool
    {
        if ($value === 'y') {
            return true;
        }
        return false;
    }

Here is the caller graph for this function:

buildRoleType()

ilRbacReview::buildRoleType ( array  $role_list_entry )

private

Definition at line 301 of file class.ilRbacReview.php.

References ROLE_FOLDER_ID.

Referenced by setRoleTypeAndProtection().

                                                          : string
    {
        if ($role_list_entry['type'] === 'rolt') {
            return 'template';
        }

        if ($role_list_entry['assign'] !== 'y') {
            return 'linked';
        }

        if ($role_list_entry['parent'] === ROLE_FOLDER_ID) {
            return 'global';
        }

        return 'local';
    }

Here is the caller graph for this function:

clearCaches()

ilRbacReview::clearCaches

(

)

Clear assigned users caches.

Definition at line 1415 of file class.ilRbacReview.php.

                                 : void
    {
        self::$is_assigned_cache = [];
        self::$assigned_users_cache = [];
    }

getActiveOperationsOfRole()

ilRbacReview::getActiveOperationsOfRole	(	int	$a_ref_id,
		int	$a_role_id
	)

Returns

list<int>

Definition at line 692 of file class.ilRbacReview.php.

References $res, and ilDBConstants\FETCHMODE_ASSOC.

                                                                            : array
    {
        $query = 'SELECT * FROM rbac_pa ' .
            'WHERE ref_id = ' . $this->db->quote($a_ref_id, 'integer') . ' ' .
            'AND rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ';

        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_ASSOC)) {
            return array_map(
                intval(...),
                $row['ops_id'] === ':' ? [] : unserialize($row['ops_id'], ['allowed_classes' => false])
            );
        }
        return [];
    }

getAllOperationsOfRole()

ilRbacReview::getAllOperationsOfRole	(	int	$a_rol_id,
		int	$a_parent = 0
	)

get all possible operations of a specific role The ref_id of the role folder (parent object) is necessary to distinguish local roles

Returns

array<string, list<int>>

Definition at line 672 of file class.ilRbacReview.php.

References $res, ILIAS\Repository\int(), and ROLE_FOLDER_ID.

                                                                            : array
    {
        if (!$a_parent) {
            $a_parent = ROLE_FOLDER_ID;
        }
        $query = "SELECT ops_id,type FROM rbac_templates " .
            "WHERE rol_id = " . $this->db->quote($a_rol_id, 'integer') . " " .
            "AND parent = " . $this->db->quote($a_parent, 'integer');
        $res = $this->db->query($query);

        $ops_arr = [];
        while ($row = $this->db->fetchObject($res)) {
            $ops_arr[$row->type][] = (int) $row->ops_id;
        }
        return $ops_arr;
    }

Here is the call graph for this function:

getAssignableChildRoles()

ilRbacReview::getAssignableChildRoles

(

int

$a_ref_id

)

Get all assignable roles directly under a specific node.

Definition at line 246 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by ilObjCategoryGUI\getAssignableRoles().

                                                          : array
    {
        $query = "SELECT fa.*, rd.* " .
            "FROM object_data rd " .
            "JOIN rbac_fa fa ON rd.obj_id = fa.rol_id " .
            "WHERE fa.assign = 'y' " .
            "AND fa.parent = " . $this->db->quote($a_ref_id, 'integer') . " ";

        $res = $this->db->query($query);
        $roles_data = [];
        while ($row = $this->db->fetchAssoc($res)) {
            $row['rol_id'] = (int) $row['rol_id'];
            $row['obj_id'] = (int) $row['obj_id'];

            $roles_data[] = $row;
        }

        return $roles_data;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getAssignableRoles()

ilRbacReview::getAssignableRoles	(	bool	$a_templates = false,
		bool	$a_internal_roles = false,
		string	$title_filter = ''
	)

Returns a list of all assignable roles.

Returns

list<RoleListEntry>

Definition at line 168 of file class.ilRbacReview.php.

References getAssignableRolesGenerator().

     : array {
        return iterator_to_array(
            $this->getAssignableRolesGenerator(
                $a_templates,
                $a_internal_roles,
                $title_filter
            )
        );
    }

Here is the call graph for this function:

getAssignableRolesGenerator()

ilRbacReview::getAssignableRolesGenerator ( bool  $a_templates = false, bool  $a_internal_roles = false, string  $title_filter = ''  )

private

Returns

Generator<RoleListEntry>

Definition at line 185 of file class.ilRbacReview.php.

References $res, __setTemplateFilter(), ILIAS\Repository\int(), and setRoleTypeAndProtection().

Referenced by getAssignableRoles(), and getRolesByFilter().

     : Generator {
        $where = $this->__setTemplateFilter($a_templates);
        $query = "SELECT * FROM object_data " .
            "JOIN rbac_fa ON obj_id = rol_id " .
            $where .
            "AND rbac_fa.assign = 'y' ";

        if (strlen($title_filter)) {
            $query .= (' AND ' . $this->db->like(
                'title',
                'text',
                $title_filter . '%'
            ));
        }
        $res = $this->db->query($query);

        while ($row = $this->db->fetchAssoc($res)) {
            $row["description"] = (string) $row["description"];
            $row["desc"] = $row["description"];
            $row["user_id"] = (int) $row["owner"];
            $row['obj_id'] = (int) $row['obj_id'];
            $row['parent'] = (int) $row['parent'];
            yield $this->setRoleTypeAndProtection($row);
        }
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getAssignableRolesInSubtree()

ilRbacReview::getAssignableRolesInSubtree

(

int

$ref_id

)

Returns a list of assignable roles in a subtree of the repository.

Todo:

move tree to construct.

Currently this is not possible due to init sequence

Returns

list<int>

Definition at line 220 of file class.ilRbacReview.php.

References $DIC, $res, ilDBConstants\FETCHMODE_OBJECT, and ILIAS\Repository\int().

                                                            : array
    {
        global $DIC;

        $tree = $DIC->repositoryTree();
        $query = 'SELECT rol_id FROM rbac_fa fa ' .
            'JOIN tree t1 ON t1.child = fa.parent ' .
            'JOIN object_data obd ON fa.rol_id = obd.obj_id ' .
            'WHERE assign = ' . $this->db->quote('y', 'text') . ' ' .
            'AND obd.type = ' . $this->db->quote('role', 'text') . ' ' .
            'AND t1.child IN (' .
            $tree->getSubTreeQuery($ref_id, ['child']) . ' ' .
            ') ';

        $res = $this->db->query($query);

        $role_list = [];
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            $role_list[] = (int) $row->rol_id;
        }
        return $role_list;
    }

Here is the call graph for this function:

getAssignedCacheEntry()

ilRbacReview::getAssignedCacheEntry	(	int	$a_role_id,
		int	$a_user_id
	)

Definition at line 1407 of file class.ilRbacReview.php.

                                                                         : bool
    {
        return self::$is_assigned_cache[$a_role_id][$a_user_id];
    }

getFoldersAssignedToRole()

ilRbacReview::getFoldersAssignedToRole	(	int	$a_rol_id,
		bool	$a_assignable = false
	)

Returns an array of objects assigned to a role.

A role with stopped inheritance may be assigned to more than one objects. To get only the original location of a role, set the second parameter to true public

Parameters

int	role id
bool	get only rolefolders where role is assignable (true)

Returns

list<int> reference IDs of role folders

Definition at line 481 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by isRoleDeleted().

                                                                                       : array
    {
        $where = '';
        if ($a_assignable) {
            $where = " AND assign ='y'";
        }

        $query = "SELECT DISTINCT parent FROM rbac_fa " .
            "WHERE rol_id = " . $this->db->quote($a_rol_id, 'integer') . " " . $where . " ";

        $res = $this->db->query($query);
        $folders = [];
        while ($row = $this->db->fetchObject($res)) {
            $folders[] = (int) $row->parent;
        }
        return $folders;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getGlobalAssignableRoles()

ilRbacReview::getGlobalAssignableRoles

(

)

get only 'global' roles (with flag 'assign_users')

Returns

list<array{obj_id: int, role_type: string}>

Definition at line 606 of file class.ilRbacReview.php.

References ilObjRole\_getAssignUsersStatus(), and getGlobalRoles().

Referenced by ilObjCategoryGUI\checkGlobalRoles(), ilObjCategoryGUI\getAssignableRoles(), and ilObjCategoryGUI\listUsersObject().

                                              : array
    {
        $ga = [];
        foreach ($this->getGlobalRoles() as $role_id) {
            if (ilObjRole::_getAssignUsersStatus($role_id)) {
                $ga[] = ['obj_id' => $role_id,
                              'role_type' => 'global'
                ];
            }
        }
        return $ga;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getGlobalRoles()

ilRbacReview::getGlobalRoles

(

)

get only 'global' roles

Returns

list<int> Array with rol_ids

Todo:

refactor rolf => DONE

Definition at line 554 of file class.ilRbacReview.php.

References getRolesOfRoleFolder(), and ROLE_FOLDER_ID.

Referenced by ilObjCategoryGUI\checkGlobalRoles(), ILIAS\Portfolio\Administration\PortfolioRoleAssignmentManager\getAvailableRoles(), getGlobalAssignableRoles(), getRolesByFilter(), and isGlobalRole().

                                    : array
    {
        return $this->getRolesOfRoleFolder(ROLE_FOLDER_ID, false);
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getGlobalRolesArray()

ilRbacReview::getGlobalRolesArray

(

)

get only 'global' roles

Returns

list<array{obj_id: int, role_type: string}>

Definition at line 591 of file class.ilRbacReview.php.

References getRolesOfRoleFolder(), and ROLE_FOLDER_ID.

Referenced by ilObjCategoryGUI\checkGlobalRoles(), and ilObjCategoryGUI\getAssignableRoles().

                                         : array
    {
        $ga = [];
        foreach ($this->getRolesOfRoleFolder(ROLE_FOLDER_ID, false) as $role_id) {
            $ga[] = ['obj_id' => $role_id,
                          'role_type' => 'global'
            ];
        }
        return $ga;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getLocalPolicies()

ilRbacReview::getLocalPolicies

(

int

$a_ref_id

)

Get all roles with local policies.

Returns

list<int>

Definition at line 578 of file class.ilRbacReview.php.

References getRolesOfRoleFolder().

                                                   : array
    {
        $lroles = [];
        foreach ($this->getRolesOfRoleFolder($a_ref_id) as $role_id) {
            $lroles[] = $role_id;
        }
        return $lroles;
    }

Here is the call graph for this function:

getLocalRoles()

ilRbacReview::getLocalRoles

(

int

$a_ref_id

)

Get local roles of object.

Returns

list<int>

Definition at line 563 of file class.ilRbacReview.php.

References getRolesOfRoleFolder(), and isAssignable().

                                                : array
    {
        $lroles = [];
        foreach ($this->getRolesOfRoleFolder($a_ref_id) as $role_id) {
            if ($this->isAssignable($role_id, $a_ref_id)) {
                $lroles[] = $role_id;
            }
        }
        return $lroles;
    }

Here is the call graph for this function:

getNumberOfAssignedUsers()

ilRbacReview::getNumberOfAssignedUsers

(

array

$a_roles

)

Get the number of assigned users to roles (not properly deleted user accounts are not counted)

Parameters

int[]

$a_roles

Definition at line 330 of file class.ilRbacReview.php.

References $res, ilDBConstants\FETCHMODE_OBJECT, and ILIAS\Repository\int().

                                                            : int
    {
        $query = 'select count(distinct(ua.usr_id)) as num from rbac_ua ua ' .
            'join object_data on ua.usr_id = obj_id ' .
            'join usr_data ud on ua.usr_id = ud.usr_id ' .
            'where ' . $this->db->in('rol_id', $a_roles, false, 'integer');

        $res = $this->db->query($query);
        if ($res->numRows() > 0) {
            $row = $res->fetchRow(\ilDBConstants::FETCHMODE_OBJECT);
            return isset($row->num) && is_numeric($row->num) ? (int) $row->num : 0;
        }
        return 0;
    }

Here is the call graph for this function:

getObjectOfRole()

ilRbacReview::getObjectOfRole

(

int

$a_role_id

)

Get object id of objects a role is assigned to.

Todo:

refactor rolf (due to performance reasons the new version does not check for deleted roles only in object reference)

Definition at line 1197 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by ilLDAPRoleGroupMappingSettings\_deleteByServerId().

                                                   : int
    {
        // internal cache
        static $obj_cache = [];

        if (isset($obj_cache[$a_role_id]) && $obj_cache[$a_role_id]) {
            return $obj_cache[$a_role_id];
        }

        $query = 'SELECT obr.obj_id FROM rbac_fa rfa ' .
            'JOIN object_reference obr ON rfa.parent = obr.ref_id ' .
            'WHERE assign = ' . $this->db->quote('y', 'text') . ' ' .
            'AND rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            'AND deleted IS NULL';

        $res = $this->db->query($query);
        $obj_cache[$a_role_id] = 0;
        while ($row = $this->db->fetchObject($res)) {
            $obj_cache[$a_role_id] = (int) $row->obj_id;
        }
        return $obj_cache[$a_role_id];
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getObjectReferenceOfRole()

ilRbacReview::getObjectReferenceOfRole

(

int

$a_role_id

)

Definition at line 1220 of file class.ilRbacReview.php.

References $res, and ilDBConstants\FETCHMODE_OBJECT.

                                                            : int
    {
        $query = 'SELECT parent p_ref FROM rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            'AND assign = ' . $this->db->quote('y', 'text');

        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return (int) $row->p_ref;
        }
        return 0;
    }

getObjectsWithStopedInheritance()

ilRbacReview::getObjectsWithStopedInheritance	(	int	$a_rol_id,
		array	$a_filter = []
	)

get all objects in which the inheritance of role with role_id was stopped the function returns all reference ids of objects containing a role folder.

Returns

list<int>

Definition at line 820 of file class.ilRbacReview.php.

References $res, ilDBConstants\FETCHMODE_OBJECT, and ILIAS\Repository\int().

                                                                                        : array
    {
        $query = 'SELECT parent p FROM rbac_fa ' .
            'WHERE assign = ' . $this->db->quote('n', 'text') . ' ' .
            'AND rol_id = ' . $this->db->quote($a_rol_id, 'integer') . ' ';

        if ($a_filter !== []) {
            $query .= ('AND ' . $this->db->in('parent', (array) $a_filter, false, 'integer'));
        }

        $res = $this->db->query($query);
        $parent = [];
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            $parent[] = (int) $row->p;
        }
        return $parent;
    }

Here is the call graph for this function:

getOperation()

ilRbacReview::getOperation

(

int

$ops_id

)

get one operation by operation id

Returns

array{}|array{ops_id: int, operation: ?string, description: ?string}

Definition at line 653 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

                                             : array
    {
        $query = 'SELECT * FROM rbac_operations WHERE ops_id = ' . $this->db->quote($ops_id, 'integer');
        $res = $this->db->query($query);
        $ops = [];
        while ($row = $this->db->fetchObject($res)) {
            $ops = ['ops_id' => (int) $row->ops_id,
                         'operation' => $row->operation,
                         'description' => $row->description
            ];
        }
        return $ops;
    }

Here is the call graph for this function:

getOperationAssignment()

ilRbacReview::getOperationAssignment

(

)

get operation assignments

Returns

list<array{typ_id: int, type: ?string, ops_id: int, operation: ?string}>

Definition at line 1275 of file class.ilRbacReview.php.

References $DIC, $res, and ILIAS\Repository\int().

                                            : array
    {
        global $DIC;

        $this->db = $DIC['ilDB'];

        $query = 'SELECT ta.typ_id, obj.title, ops.ops_id, ops.operation FROM rbac_ta ta ' .
            'JOIN object_data obj ON obj.obj_id = ta.typ_id ' .
            'JOIN rbac_operations ops ON ops.ops_id = ta.ops_id ';
        $res = $this->db->query($query);

        $counter = 0;
        $info = [];
        while ($row = $this->db->fetchObject($res)) {
            $info[$counter]['typ_id'] = (int) $row->typ_id;
            $info[$counter]['type'] = $row->title;
            $info[$counter]['ops_id'] = (int) $row->ops_id;
            $info[$counter]['operation'] = $row->operation;
            $counter++;
        }

        return array_values($info);
    }

Here is the call graph for this function:

getOperations()

ilRbacReview::getOperations

(

)

get all possible operations

Returns

list<array{ops_id: int, operation: ?string, description: ?string}>

Definition at line 635 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by ILIAS\AccessControl\Log\Table\__construct().

                                   : array
    {
        $query = 'SELECT * FROM rbac_operations ORDER BY ops_id ';
        $res = $this->db->query($query);
        $ops = [];
        while ($row = $this->db->fetchObject($res)) {
            $ops[] = ['ops_id' => (int) $row->ops_id,
                           'operation' => $row->operation,
                           'description' => $row->description
            ];
        }
        return $ops;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getOperationsByTypeAndClass()

ilRbacReview::getOperationsByTypeAndClass	(	string	$a_type,
		string	$a_class
	)

Get operations by type and class.

Returns

list<int>

Definition at line 791 of file class.ilRbacReview.php.

References $res, ilDBConstants\FETCHMODE_OBJECT, and ILIAS\Repository\int().

                                                                                : array
    {
        if ($a_class != 'create') {
            $condition = "AND class != " . $this->db->quote('create', 'text');
        } else {
            $condition = "AND class = " . $this->db->quote('create', 'text');
        }

        $query = "SELECT ro.ops_id FROM rbac_operations ro " .
            "JOIN rbac_ta rt ON  ro.ops_id = rt.ops_id " .
            "JOIN object_data od ON rt.typ_id = od.obj_id " .
            "WHERE type = " . $this->db->quote('typ', 'text') . " " .
            "AND title = " . $this->db->quote($a_type, 'text') . " " .
            $condition . " " .
            "ORDER BY op_order ";

        $res = $this->db->query($query);
        $ops = [];
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            $ops[] = (int) $row->ops_id;
        }
        return $ops;
    }

Here is the call graph for this function:

getOperationsOfRole()

ilRbacReview::getOperationsOfRole	(	int	$a_rol_id,
		string	$a_type,
		int	$a_parent = 0
	)

get all possible operations of a specific role The ref_id of the role folder (parent object) is necessary to distinguish local roles

Returns

list<int>

Definition at line 713 of file class.ilRbacReview.php.

References $res, and ROLE_FOLDER_ID.

                                                                                         : array
    {
        $ops_arr = [];
        // if no rolefolder id is given, assume global role folder as target
        if ($a_parent == 0) {
            $a_parent = ROLE_FOLDER_ID;
        }

        $query = "SELECT ops_id FROM rbac_templates " .
            "WHERE type =" . $this->db->quote($a_type, 'text') . " " .
            "AND rol_id = " . $this->db->quote($a_rol_id, 'integer') . " " .
            "AND parent = " . $this->db->quote($a_parent, 'integer');
        $res = $this->db->query($query);
        while ($row = $this->db->fetchObject($res)) {
            $ops_arr[] = $row->ops_id;
        }
        return $ops_arr;
    }

getOperationsOnType()

ilRbacReview::getOperationsOnType

(

int

$a_typ_id

)

all possible operations of a type

Returns

list<int>

Definition at line 759 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by getOperationsOnTypeString().

                                                      : array
    {
        $query = 'SELECT ta.ops_id FROM rbac_ta ta JOIN rbac_operations o ON ta.ops_id = o.ops_id ' .
            'WHERE typ_id = ' . $this->db->quote($a_typ_id, 'integer') . ' ' .
            'ORDER BY op_order';

        $res = $this->db->query($query);
        $ops_id = [];
        while ($row = $this->db->fetchObject($res)) {
            $ops_id[] = (int) $row->ops_id;
        }
        return $ops_id;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getOperationsOnTypeString()

ilRbacReview::getOperationsOnTypeString

(

string

$a_type

)

all possible operations of a type

Returns

list<int>

Definition at line 777 of file class.ilRbacReview.php.

References $res, ilDBConstants\FETCHMODE_OBJECT, and getOperationsOnType().

                                                             : array
    {
        $query = "SELECT * FROM object_data WHERE type = 'typ' AND title = " . $this->db->quote($a_type, 'text') . " ";
        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return $this->getOperationsOnType((int) $row->obj_id);
        }
        return [];
    }

Here is the call graph for this function:

getParentRoleIds()

ilRbacReview::getParentRoleIds	(	int	$a_endnode_id,
		bool	$a_templates = false
	)

Get an array of parent role ids of all parent roles, if last parameter is set true you get also all parent templates.

Parameters

int	ref_id of an object which is end node
bool	true for role templates (default: false)

Returns

array array(role_ids => role_data)

Todo:

move tree to construct. Currently this is not possible due to init sequence

Definition at line 122 of file class.ilRbacReview.php.

References $DIC, __getParentRoles(), and ROLE_FOLDER_ID.

Referenced by ilContainerGUI\performPasteIntoMultipleObjectsObject().

                                                                                  : array
    {
        global $DIC;

        $tree = $DIC->repositoryTree();

        $pathIds = $tree->getPathId($a_endnode_id);

        // add system folder since it may not in the path
        //$pathIds[0] = SYSTEM_FOLDER_ID;
        $pathIds[0] = ROLE_FOLDER_ID;
        return $this->__getParentRoles($pathIds, $a_templates);
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getRoleFolderOfRole()

ilRbacReview::getRoleFolderOfRole

(

int

$a_role_id

)

Definition at line 1352 of file class.ilRbacReview.php.

References $res, ilObject\_lookupType(), and ilDBConstants\FETCHMODE_OBJECT.

Referenced by isSystemGeneratedRole().

                                                       : int
    {
        if (ilObject::_lookupType($a_role_id) == 'role') {
            $and = ('AND assign = ' . $this->db->quote('y', 'text'));
        } else {
            $and = '';
        }

        $query = 'SELECT * FROM rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            $and;
        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return (int) $row->parent;
        }
        return 0;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getRoleListByObject()

ilRbacReview::getRoleListByObject	(	int	$a_ref_id,
		bool	$a_templates = false
	)

Returns a list of roles in an container.

Returns

list<RoleListEntry>

Definition at line 140 of file class.ilRbacReview.php.

References $res, __setRoleType(), __setTemplateFilter(), and ILIAS\Repository\int().

Referenced by __getParentRoles(), and isSystemGeneratedRole().

                                                                                 : array
    {
        $role_list = [];
        $where = $this->__setTemplateFilter($a_templates);

        $query = "SELECT * FROM object_data " .
            "JOIN rbac_fa ON obj_id = rol_id " .
            $where .
            "AND object_data.obj_id = rbac_fa.rol_id " .
            "AND rbac_fa.parent = " . $this->db->quote($a_ref_id, 'integer') . " ";

        $res = $this->db->query($query);
        while ($row = $this->db->fetchAssoc($res)) {
            $row["desc"] = $row["description"];
            $row["user_id"] = (int) $row["owner"];
            $row['obj_id'] = (int) $row['obj_id'];
            $row['rol_id'] = (int) $row['rol_id'];
            $row['parent'] = (int) $row['parent'];
            $role_list[] = $row;
        }

        return $this->__setRoleType($role_list);
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getRoleOperationsOnObject()

ilRbacReview::getRoleOperationsOnObject	(	int	$a_role_id,
		int	$a_ref_id
	)

Returns

list<int>

Definition at line 735 of file class.ilRbacReview.php.

References $res.

                                                                            : array
    {
        $query = "SELECT ops_id FROM rbac_pa " .
            "WHERE rol_id = " . $this->db->quote($a_role_id, 'integer') . " " .
            "AND ref_id = " . $this->db->quote($a_ref_id, 'integer') . " ";

        $res = $this->db->query($query);
        $ops = [];
        while ($row = $this->db->fetchObject($res)) {
            if ($row->ops_id !== ':') {
                $ops = array_map(
                    intval(...),
                    unserialize($row->ops_id, ['allowed_classes' => false])
                );
            }
        }

        return $ops;
    }

getRolesByFilter()

ilRbacReview::getRolesByFilter	(	int	$a_filter = 0,
		int	$a_user_id = 0,
		string	$title_filter = ''
	)

Returns

Generator<RoleListEntry>

Definition at line 871 of file class.ilRbacReview.php.

References $res, assignedRoles(), ILIAS\ResourceStorage\Flavour\Machine\DefaultMachines\from(), getAssignableRolesGenerator(), getGlobalRoles(), ILIAS\Repository\int(), and setRoleTypeAndProtection().

                                                                                                      : Generator
    {
        $assign = "y";
        switch ($a_filter) {
            case self::FILTER_ALL:
                return yield from $this->getAssignableRolesGenerator(true, true, $title_filter);

            case self::FILTER_ALL_GLOBAL:
                $where = 'WHERE ' . $this->db->in('rbac_fa.rol_id', $this->getGlobalRoles(), false, 'integer') . ' ';
                break;

            case self::FILTER_ALL_LOCAL:
            case self::FILTER_INTERNAL:
            case self::FILTER_NOT_INTERNAL:
                $where = 'WHERE ' . $this->db->in('rbac_fa.rol_id', $this->getGlobalRoles(), true, 'integer');
                break;

            case self::FILTER_TEMPLATES:
                $where = "WHERE object_data.type = 'rolt'";
                $assign = "n";
                break;

            case 0:
            default:
                if (!$a_user_id) {
                    return;
                }

                $where = 'WHERE ' . $this->db->in(
                    'rbac_fa.rol_id',
                    $this->assignedRoles($a_user_id),
                    false,
                    'integer'
                ) . ' ';
                break;
        }

        $query = "SELECT * FROM object_data " .
            "JOIN rbac_fa ON obj_id = rol_id " .
            $where .
            "AND rbac_fa.assign = " . $this->db->quote($assign, 'text') . " ";

        if (strlen($title_filter)) {
            $query .= (' AND ' . $this->db->like(
                'title',
                'text',
                '%' . $title_filter . '%'
            ));
        }

        $res = $this->db->query($query);
        while ($row = $this->db->fetchAssoc($res)) {
            $row['title'] = $row['title'] ?? '';
            $prefix = str_starts_with($row['title'], "il_");

            // all (assignable) internal local roles only
            if ($a_filter == 4 && !$prefix) {
                continue;
            }

            // all (assignable) non internal local roles only
            if ($a_filter == 5 && $prefix) {
                continue;
            }

            $row['description'] = $row['description'] ?? '';
            $row["desc"] = $row["description"];
            $row["user_id"] = (int) $row["owner"];
            $row['obj_id'] = (int) $row['obj_id'];
            $row['rol_id'] = (int) $row['rol_id'];
            $row['parent'] = (int) $row['parent'];

            yield $this->setRoleTypeAndProtection($row);
        }
    }

Here is the call graph for this function:

getRolesForIDs()

ilRbacReview::getRolesForIDs	(	array	$role_ids,
		bool	$use_templates
	)

Definition at line 1252 of file class.ilRbacReview.php.

References $res, __setRoleType(), __setTemplateFilter(), and ILIAS\Repository\int().

                                                                        : array
    {
        $where = $this->__setTemplateFilter($use_templates);
        $query = "SELECT * FROM object_data " .
            "JOIN rbac_fa ON object_data.obj_id = rbac_fa.rol_id " .
            $where .
            "AND rbac_fa.assign = 'y' " .
            'AND ' . $this->db->in('object_data.obj_id', $role_ids, false, 'integer');

        $res = $this->db->query($query);
        $role_list = [];
        while ($row = $this->db->fetchAssoc($res)) {
            $row["desc"] = $row["description"];
            $row["user_id"] = (int) $row["owner"];
            $role_list[] = $row;
        }
        return $this->__setRoleType($role_list);
    }

Here is the call graph for this function:

getRolesOfObject()

ilRbacReview::getRolesOfObject	(	int	$a_ref_id,
		bool	$a_assignable_only = false
	)

Get roles of object.

Returns

list<int>

Definition at line 503 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

                                                                                    : array
    {
        $and = '';
        if ($a_assignable_only === true) {
            $and = 'AND assign = ' . $this->db->quote('y', 'text');
        }
        $query = "SELECT rol_id FROM rbac_fa " .
            "WHERE parent = " . $this->db->quote($a_ref_id, 'integer') . " " .
            $and;

        $res = $this->db->query($query);

        $role_ids = [];
        while ($row = $this->db->fetchObject($res)) {
            $role_ids[] = (int) $row->rol_id;
        }
        return $role_ids;
    }

Here is the call graph for this function:

getRolesOfRoleFolder()

ilRbacReview::getRolesOfRoleFolder	(	int	$a_ref_id,
		bool	$a_nonassignable = true
	)

get all roles of a role folder including linked local roles that are created due to stopped inheritance returns an array with role ids

Returns

list<int> Array with rol_ids

Deprecated:

since version 4.5.0

Todo:

refactor rolf => RENAME

Definition at line 529 of file class.ilRbacReview.php.

References $res, and ILIAS\Repository\int().

Referenced by ilObjSessionGUI\getDefaultMemberRole(), getGlobalRoles(), getGlobalRolesArray(), getLocalPolicies(), getLocalRoles(), and ilObjSessionGUI\getLocalRoles().

                                                                                     : array
    {
        $and = '';
        if ($a_nonassignable === false) {
            $and = " AND assign='y'";
        }

        $query = "SELECT rol_id FROM rbac_fa " .
            "WHERE parent = " . $this->db->quote($a_ref_id, 'integer') . " " .
            $and;

        $res = $this->db->query($query);
        $rol_id = [];
        while ($row = $this->db->fetchObject($res)) {
            $rol_id[] = (int) $row->rol_id;
        }

        return $rol_id;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getTypeId()

ilRbacReview::getTypeId

(

string

$a_type

)

Definition at line 947 of file class.ilRbacReview.php.

References $q, $r, and ilDBConstants\FETCHMODE_OBJECT.

                                             : int
    {
        $q = "SELECT obj_id FROM object_data " .
            "WHERE title=" . $this->db->quote($a_type, 'text') . " AND type='typ'";
        $r = $this->db->query($q);
        while ($row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return (int) $row->obj_id;
        }
        return 0;
    }

getUserPermissionsOnObject()

ilRbacReview::getUserPermissionsOnObject	(	int	$a_user_id,
		int	$a_ref_id
	)

Get all user permissions on an object.

Returns

list<string>

Definition at line 1374 of file class.ilRbacReview.php.

References $res.

                                                                             : array
    {
        $query = "SELECT ops_id FROM rbac_pa JOIN rbac_ua " .
            "ON (rbac_pa.rol_id = rbac_ua.rol_id) " .
            "WHERE rbac_ua.usr_id = " . $this->db->quote($a_user_id, 'integer') . " " .
            "AND rbac_pa.ref_id = " . $this->db->quote($a_ref_id, 'integer') . " ";

        $res = $this->db->query($query);
        $all_ops = [];
        while ($row = $this->db->fetchObject($res)) {
            $ops = unserialize($row->ops_id, ['allowed_classes' => false]);
            $all_ops = array_merge($all_ops, $ops);
        }
        $all_ops = array_unique($all_ops);

        $set = $this->db->query("SELECT operation FROM rbac_operations " .
            " WHERE " . $this->db->in("ops_id", $all_ops, false, "integer"));
        $perms = [];
        while ($rec = $this->db->fetchAssoc($set)) {
            $perms[] = $rec["operation"];
        }

        return array_values(array_filter($perms));
    }

hasMultipleAssignments()

ilRbacReview::hasMultipleAssignments

(

int

$a_role_id

)

Definition at line 464 of file class.ilRbacReview.php.

References $res.

                                                          : bool
    {
        $query = "SELECT * FROM rbac_fa WHERE rol_id = " . $this->db->quote($a_role_id, 'integer') . ' ' .
            "AND assign = " . $this->db->quote('y', 'text');
        $res = $this->db->query($query);
        return $res->numRows() > 1;
    }

isAssignable()

ilRbacReview::isAssignable	(	int	$a_rol_id,
		int	$a_ref_id
	)

Check if its possible to assign users.

Definition at line 447 of file class.ilRbacReview.php.

References $res, and SYSTEM_ROLE_ID.

Referenced by getLocalRoles(), isDeleteable(), and ilRecommendedContentRoleConfigGUI\listItems().

                                                              : bool
    {
        // exclude system role from rbac
        if ($a_rol_id == SYSTEM_ROLE_ID) {
            return true;
        }

        $query = "SELECT * FROM rbac_fa " .
            "WHERE rol_id = " . $this->db->quote($a_rol_id, 'integer') . " " .
            "AND parent = " . $this->db->quote($a_ref_id, 'integer') . " ";
        $res = $this->db->query($query);
        while ($row = $this->db->fetchObject($res)) {
            return $row->assign == 'y';
        }
        return false;
    }

Here is the caller graph for this function:

isAssigned()

ilRbacReview::isAssigned	(	int	$a_usr_id,
		int	$a_role_id
	)

check if a specific user is assigned to specific role

Definition at line 368 of file class.ilRbacReview.php.

References $res, and ilDBConstants\T_INTEGER.

Referenced by ilPortfolioAccessHandler\checkAccessOfUser(), and ilWorkspaceAccessHandler\checkAccessOfUser().

                                                             : bool
    {
        if (isset(self::$is_assigned_cache[$a_role_id][$a_usr_id])) {
            return self::$is_assigned_cache[$a_role_id][$a_usr_id];
        }
        // Quickly determine if user is assigned to a role
        $this->db->setLimit(1, 0);
        $query = "SELECT usr_id FROM rbac_ua WHERE " .
            "rol_id= " . $this->db->quote($a_role_id, 'integer') . " " .
            "AND usr_id= " . $this->db->quote($a_usr_id, ilDBConstants::T_INTEGER);
        $res = $this->db->query($query);
        $is_assigned = $res->numRows() == 1;
        self::$is_assigned_cache[$a_role_id][$a_usr_id] = $is_assigned;
        return $is_assigned;
    }

Here is the caller graph for this function:

isAssignedToAtLeastOneGivenRole()

ilRbacReview::isAssignedToAtLeastOneGivenRole	(	int	$a_usr_id,
		array	$a_role_ids
	)

check if a specific user is assigned to at least one of the given role ids.

This function is used to quickly check whether a user is member of a course or a group.

Parameters

int	usr_id
int[]	role_ids

Definition at line 392 of file class.ilRbacReview.php.

References $DIC, $res, and ilDBConstants\T_INTEGER.

                                                                                     : bool
    {
        global $DIC;

        $this->db = $DIC['ilDB'];

        $this->db->setLimit(1, 0);
        $query = "SELECT usr_id FROM rbac_ua WHERE " .
            $this->db->in('rol_id', $a_role_ids, false, 'integer') .
            " AND usr_id= " . $this->db->quote($a_usr_id, ilDBConstants::T_INTEGER);
        $res = $this->db->query($query);

        return $this->db->numRows($res) == 1;
    }

isBlockedAtPosition()

ilRbacReview::isBlockedAtPosition	(	int	$a_role_id,
		int	$a_ref_id
	)

Definition at line 1062 of file class.ilRbacReview.php.

References $res, and ilDBConstants\FETCHMODE_OBJECT.

Referenced by isBlockedInUpperContext().

                                                                      : bool
    {
        $query = 'SELECT blocked from rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            'AND parent = ' . $this->db->quote($a_ref_id, 'integer');
        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return (bool) $row->blocked;
        }
        return false;
    }

Here is the caller graph for this function:

isBlockedInUpperContext()

ilRbacReview::isBlockedInUpperContext	(	int	$a_role_id,
		int	$a_ref_id
	)

Check if role is blocked in upper context.

Todo:

move tree to construct.

Currently this is not possible due to init sequence

Definition at line 1078 of file class.ilRbacReview.php.

References $DIC, $res, ilDBConstants\FETCHMODE_OBJECT, ILIAS\Repository\int(), and isBlockedAtPosition().

                                                                          : bool
    {
        global $DIC;

        $tree = $DIC['tree'];

        if ($this->isBlockedAtPosition($a_role_id, $a_ref_id)) {
            return false;
        }
        $query = 'SELECT parent from rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            'AND blocked = ' . $this->db->quote(1, 'integer');
        $res = $this->db->query($query);

        $parent_ids = [];
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            $parent_ids[] = (int) $row->parent;
        }

        foreach ($parent_ids as $parent_id) {
            if ($tree->isGrandChild($parent_id, $a_ref_id)) {
                return true;
            }
        }
        return false;
    }

Here is the call graph for this function:

isDeleteable()

ilRbacReview::isDeleteable	(	int	$a_role_id,
		int	$a_rolf_id
	)

Check if role is deleteable at a specific position.

Definition at line 1302 of file class.ilRbacReview.php.

References ilObject\_lookupTitle(), ANONYMOUS_ROLE_ID, isAssignable(), and SYSTEM_ROLE_ID.

                                                                : bool
    {
        if (!$this->isAssignable($a_role_id, $a_rolf_id)) {
            return false;
        }
        if ($a_role_id == SYSTEM_ROLE_ID or $a_role_id == ANONYMOUS_ROLE_ID) {
            return false;
        }
        if (str_starts_with(ilObject::_lookupTitle($a_role_id), 'il_')) {
            return false;
        }
        return true;
    }

Here is the call graph for this function:

isDeleted()

ilRbacReview::isDeleted

(

int

$a_node_id

)

Checks if a rolefolder is set as deleted (negative tree_id)

Todo:

delete this method

Definition at line 842 of file class.ilRbacReview.php.

References $message, $q, $r, ilDBConstants\FETCHMODE_OBJECT, and ilDBConstants\T_INTEGER.

Referenced by isRoleDeleted().

                                             : bool
    {
        $q = "SELECT tree FROM tree WHERE child =" . $this->db->quote($a_node_id, ilDBConstants::T_INTEGER) . " ";
        $r = $this->db->query($q);
        $row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT);

        if (!$row) {
            $message = sprintf(
                '%s::isDeleted(): Role folder with ref_id %s not found!',
                get_class($this),
                $a_node_id
            );
            $this->log->warning($message);
            return true;
        }
        return $row->tree < 0;
    }

Here is the caller graph for this function:

isGlobalRole()

ilRbacReview::isGlobalRole

(

int

$a_role_id

)

Check if role is a global role.

Definition at line 863 of file class.ilRbacReview.php.

References getGlobalRoles().

                                                : bool
    {
        return in_array($a_role_id, $this->getGlobalRoles());
    }

Here is the call graph for this function:

isProtected()

ilRbacReview::isProtected	(	int	$a_ref_id,
		int	$a_role_id
	)

ref_id not used yet.

Protected permission acts 'global' for each role,

Definition at line 1049 of file class.ilRbacReview.php.

References $res, ilDBConstants\FETCHMODE_OBJECT, and ilDBConstants\T_INTEGER.

                                                              : bool
    {
        $query = 'SELECT protected FROM rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, ilDBConstants::T_INTEGER);
        $res = $this->db->query($query);
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            if ($row->protected === 'y') {
                return true;
            }
        }
        return false;
    }

isRoleAssignedToObject()

ilRbacReview::isRoleAssignedToObject	(	int	$a_role_id,
		int	$a_parent_id
	)

Check if role is assigned to an object.

Definition at line 622 of file class.ilRbacReview.php.

References $res.

                                                                            : bool
    {
        $query = 'SELECT * FROM rbac_fa ' .
            'WHERE rol_id = ' . $this->db->quote($a_role_id, 'integer') . ' ' .
            'AND parent = ' . $this->db->quote($a_parent_id, 'integer');
        $res = $this->db->query($query);
        return (bool) $res->numRows();
    }

isRoleDeleted()

ilRbacReview::isRoleDeleted

(

int

$a_role_id

)

return if role is only attached to deleted role folders

Definition at line 1236 of file class.ilRbacReview.php.

References getFoldersAssignedToRole(), and isDeleted().

                                                 : bool
    {
        $rolf_list = $this->getFoldersAssignedToRole($a_role_id, false);
        $deleted = true;
        if ($rolf_list !== []) {
            foreach ($rolf_list as $rolf) {
                // only list roles that are not set to status "deleted"
                if (!$this->isDeleted($rolf)) {
                    $deleted = false;
                    break;
                }
            }
        }
        return $deleted;
    }

Here is the call graph for this function:

isSystemGeneratedRole()

ilRbacReview::isSystemGeneratedRole

(

int

$a_role_id

)

Check if the role is system generate role or role template.

Definition at line 1319 of file class.ilRbacReview.php.

References $DIC, $ref_id, ilObject\_lookupTitle(), getRoleFolderOfRole(), getRoleListByObject(), null, and ROLE_FOLDER_ID.

                                                         : bool
    {
        $title = ilObject::_lookupTitle($a_role_id);
        return substr($title, 0, 3) == 'il_';
    }

Here is the call graph for this function:

lookupCreateOperationIds()

static ilRbacReview::lookupCreateOperationIds ( array  $a_type_arr )

static

Lookup operation ids.

Parameters

list<string>

$a_type_arr e.g array('cat','crs','grp'). The operation name (e.g. 'create_cat') is generated automatically

Returns

array<string, int> Array with operation ids

Definition at line 1016 of file class.ilRbacReview.php.

References $DIC, $ilDB, $res, and ILIAS\Repository\int().

Referenced by ilObjectXMLWriter\appendOperations(), ilObjectRoleTemplatePermissionTableGUI\parse(), ilObjectRolePermissionTableGUI\parse(), and ilPermissionGUI\savePermissions().

                                                                      : array
    {
        global $DIC;

        $ilDB = $DIC->database();

        $operations = [];
        foreach ($a_type_arr as $type) {
            $operations[] = ('create_' . $type);
        }

        if ($operations === []) {
            return [];
        }

        $query = 'SELECT ops_id, operation FROM rbac_operations ' .
            'WHERE ' . $ilDB->in('operation', $operations, false, 'text');

        $res = $ilDB->query($query);

        $ops_ids = [];
        while ($row = $ilDB->fetchObject($res)) {
            $type_arr = explode('_', $row->operation);
            $type = $type_arr[1];

            $ops_ids[$type] = (int) $row->ops_id;
        }
        return $ops_ids;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

roleExists()

ilRbacReview::roleExists	(	string	$a_title,
		int	$a_id = 0
	)

Checks if a role already exists.

Role title should be unique public

Parameters

string	role title
?int	obj_id of role to exclude in the check. Commonly this is the current role you want to edit

Returns

bool

Definition at line 70 of file class.ilRbacReview.php.

References $q, $r, ilDBConstants\FETCHMODE_OBJECT, null, and ilDBConstants\T_TEXT.

                                                              : ?int
    {
        $clause = ($a_id) ? " AND obj_id != " . $this->db->quote($a_id, ilDBConstants::T_TEXT) . " " : "";

        $q = "SELECT DISTINCT(obj_id) obj_id FROM object_data " .
            "WHERE title =" . $this->db->quote($a_title, ilDBConstants::T_TEXT) . " " .
            "AND type IN('role','rolt')" .
            $clause . " ";
        $r = $this->db->query($q);
        while ($row = $r->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            return (int) $row->obj_id;
        }
        return null;
    }

setAssignedCacheEntry()

ilRbacReview::setAssignedCacheEntry	(	int	$a_role_id,
		int	$a_user_id,
		bool	$a_value
	)

set entry of assigned_chache

Definition at line 1402 of file class.ilRbacReview.php.

                                                                                        : void
    {
        self::$is_assigned_cache[$a_role_id][$a_user_id] = $a_value;
    }

setRoleTypeAndProtection()

ilRbacReview::setRoleTypeAndProtection ( array  $role_list_entry )

private

Definition at line 294 of file class.ilRbacReview.php.

References buildProtectionByStringValue(), and buildRoleType().

Referenced by __setRoleType(), getAssignableRolesGenerator(), and getRolesByFilter().

                                                                     : array
    {
        $role_list_entry['role_type'] = $this->buildRoleType($role_list_entry);
        $role_list_entry['protected'] = $this->buildProtectionByStringValue($role_list_entry['protected']);
        return $role_list_entry;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

$_opsCache

array ilRbacReview::$_opsCache = null

staticprivate

Definition at line 43 of file class.ilRbacReview.php.

$assigned_users_cache

array ilRbacReview::$assigned_users_cache = []

staticprotected

Definition at line 45 of file class.ilRbacReview.php.

$db

ilDBInterface ilRbacReview::$db

protected

Definition at line 49 of file class.ilRbacReview.php.

$is_assigned_cache

array ilRbacReview::$is_assigned_cache = []

staticprotected

Definition at line 46 of file class.ilRbacReview.php.

$log

ilLogger ilRbacReview::$log

protected

Definition at line 48 of file class.ilRbacReview.php.

FILTER_ALL

const ilRbacReview::FILTER_ALL = 1

Definition at line 35 of file class.ilRbacReview.php.

Referenced by ilRoleTableGUI\initFilter(), and ilRoleTableGUI\parse().

FILTER_ALL_GLOBAL

const ilRbacReview::FILTER_ALL_GLOBAL = 2

Definition at line 36 of file class.ilRbacReview.php.

Referenced by ilADNNotificationUIFormGUI\getHTML(), and ilRoleTableGUI\initFilter().

FILTER_ALL_LOCAL

const ilRbacReview::FILTER_ALL_LOCAL = 3

Definition at line 37 of file class.ilRbacReview.php.

Referenced by ilRoleTableGUI\initFilter().

FILTER_INTERNAL

const ilRbacReview::FILTER_INTERNAL = 4

Definition at line 38 of file class.ilRbacReview.php.

Referenced by ilRoleTableGUI\initFilter().

FILTER_NOT_INTERNAL

const ilRbacReview::FILTER_NOT_INTERNAL = 5

Definition at line 39 of file class.ilRbacReview.php.

Referenced by ilRoleTableGUI\initFilter().

FILTER_TEMPLATES

const ilRbacReview::FILTER_TEMPLATES = 6

Definition at line 40 of file class.ilRbacReview.php.

Referenced by ilRoleTableGUI\initFilter().

---

The documentation for this class was generated from the following file:

• components/ILIAS/AccessControl/classes/class.ilRbacReview.php