gosa-core/plugins/generic/references/class_aclResolver.inc

   1 <?php
   2
   3 class aclResolver
   4 {
   5     private $classMapping = array();
   6     private $aclTypes = array();
   7     private $affectingACLs = array();
   8
   9     private $renderedList = "";
  10
  11     // The users 'dn' and 'uid' used to verify the collected acls
  12     private $validateDn;
  13     private $validateUid;
  14
  15     function __construct($config, $dn, $parent)
  16     {
  17         $this->config = &$config;
  18         $this->dn = $dn;
  19
  20         // Replace this with a user defined one later.
  21         $ui = get_userinfo();
  22         $this->validateUid = $ui->uid;
  23         $this->validateDn = $ui->dn;
  24
  25         // Get ACL category for the current object.
  26         if(isset($parent->acl_category) && !empty($parent->acl_category)){
  27             $this->acl_category = preg_replace("/\/$/","",$parent->acl_category);
  28         }
  29
  30         // Build class mapping - only once, will not change during session.
  31         if(!session::is_set('aclConverter::classMapping')){
  32             $tmp= session::global_get('plist');
  33             $plist= $tmp->info;
  34             $map = array();
  35             $map['all']= _("All categories");
  36             foreach($plist as $class => $plInfo){
  37                 if(isset($plInfo['plCategory']) && is_array($plInfo['plCategory'])){
  38                     foreach($plInfo['plCategory'] as $category => $desc){
  39                         if(!is_numeric($category)){
  40                             $map[$category] = $desc['description'];
  41                         }
  42                     }
  43                 }
  44             }
  45             foreach($plist as $class => $plInfo){
  46                 if(isset($plInfo['plCategory']) && is_array($plInfo['plCategory'])){
  47                     foreach($plInfo['plCategory'] as $category => $desc){
  48                         if(!is_numeric($category)){
  49                             $map[$category."/".$class] = $map[$category]." - ".$plInfo['plDescription'];
  50                         }else{
  51                             $map[$desc."/".$class] = $map[$desc]." - ".$plInfo['plDescription'];
  52                         }
  53                     }
  54
  55                 }
  56             }
  57             session::set('aclConverter::classMapping', $map);
  58         }
  59         $this->classMapping = session::get('aclConverter::classMapping');
  60
  61         // Define ACL type translations
  62         $this->aclTypes= array("reset" => _("Reset ACLs"),
  63                 "one" => _("One level"),
  64                 "base" => _("Current object"),
  65                 "sub" => _("Complete subtree"),
  66                 "psub" => _("Complete subtree (permanent)"),
  67                 "role" => _("Use ACL defined in role"));
  68
  69         $this->reload();
  70     }
  71
  72
  73     function reload()
  74     {
  75
  76         // Go through all ACLs and get those matching out DN.
  77         $ui = get_userinfo();
  78         $ui->reset_acl_cache();
  79         $ui->loadACL();
  80
  81         foreach($ui->allACLs as $dn => $acls){
  82             if(preg_match("/".preg_quote($dn,'/')."$/i", $this->dn)){
  83                 foreach($acls as $prio => $acl){
  84                     if($acl['type'] == "reset"){
  85                         $this->affectingACLs[$dn][$prio] = $acl;
  86                         continue;
  87                     }else{
  88                         foreach($acl['acl'] as $category => $attributes){
  89                             if(preg_match("/^all($|\/)/", $category) ||
  90                                     preg_match("/^".$this->acl_category."($|\/)/", $category)){
  91                                 $this->affectingACLs[$dn][$prio] = $acl;
  92                                 continue;
  93                             }
  94                         }
  95                     }
  96                 }
  97             }
  98         }
  99
 100         // Enforce to reload acl result
 101         $this->renderedList = "";
 102     }
 103
 104
 105
 106     /*! \brief   Create a human readable HTML result
 107      */
 108     function getReadableACL()
 109     {
 110         if(empty($this->renderedList)){
 111
 112             $tpl =
 113                 "\n <tr class='acl-viewer-head %s'>".
 114                 "\n  <td>%s</td>".
 115                 "\n  <td colspan=2><b>%s</b>&nbsp;-&nbsp;%s</td>".
 116                 "\n </tr>".
 117                 "\n %s".
 118                 "\n <tr>".
 119                 "\n  <td colspan=3><hr></td>".
 120                 "\n </tr>";
 121
 122             $filter_tpl =
 123                 "\n <tr class='%s'>".
 124                 "\n  <td></td>".
 125                 "\n  <td><b>"._("Filter")."</b></td>".
 126                 "\n  <td><ul><li>%s</li></ul></td>".
 127                 "\n </tr>";
 128
 129             $gmem_tpl =
 130                 "\n <tr class='%s'>".
 131                 "\n  <td></td>".
 132                 "\n  <td><b>"._("Group members")."</b></td>".
 133                 "\n  <td><ul>%s</ul></td>".
 134                 "\n </tr>";
 135
 136             $umem_tpl =
 137                 "\n <tr class='%s'>".
 138                 "\n  <td></td>".
 139                 "\n  <td><b>"._("Members")."</b></td>".
 140                 "\n  <td><ul>%s</ul></td>".
 141                 "\n </tr>";
 142
 143             $acl_tpl =
 144                 "\n <tr class='%s'>".
 145                 "\n  <td></td>".
 146                 "\n  <td><b>"._("Acls")."</b></td>".
 147                 "\n  <td><ul>%s</ul></td>".
 148                 "\n </tr>";
 149
 150
 151             $str = "<table summary='"._("Object permissions")."' class='acl-viewer'>";
 152             $ldap = $this->config->get_ldap_link();
 153             $ldap->cd($this->config->current['BASE']);
 154             $ui = get_userinfo();
 155             foreach($this->affectingACLs as $dn => $acls){
 156                 foreach($acls as $acl){
 157                     $gmem = $umem = $defs = "";
 158                     $image = (isset($this->config->idepartments[$dn]))? "images/select_department.png":"images/lists/element.png";
 159                     $aclType = $this->aclTypes[$acl['type']];
 160
 161                     // Does the filter match for current object?
 162                     $filter ="";
 163                     $match = TRUE;
 164                     if(!empty($acl['filter'])){
 165                         $match = $ldap->object_match_filter($this->dn,$acl['filter']);
 166                         $filter= $acl['filter'];
 167                         if(!$match){
 168                             $filter= "<span>".$filter."</span>";
 169                         }
 170                     }
 171
 172                     // Check if we are part of the member list
 173                     if($match){
 174                         $found = FALSE;
 175                         foreach($acl['members'] as $mem => $desc){
 176                             if($mem == "U:{$this->validateDn}"){
 177                                 $found = TRUE;
 178                                 break;
 179                             }
 180                             if($mem == "G:*"){
 181                                 $found = TRUE;
 182                                 break;
 183                             }
 184                             if(preg_match("/^G:/", $mem)){
 185                                 $gdn = preg_replace("/^G:/","",$mem);
 186                                 $ldap->cat($gdn,array('memberUid'));
 187                                 if($ldap->count()){
 188                                     $attrs = $ldap->fetch();
 189                                     if(isset($attrs['memberUid']) && in_array($this->validateUid, $attrs['memberUid'])){
 190                                         $found = TRUE;
 191                                     }
 192                                 }
 193                                 break;
 194                             }
 195                         }
 196                         $match = $found;
 197                     }
 198
 199                     $class = "";
 200                     if(!$match){
 201                         $class = "acl-viewer-blocked";
 202                     }
 203
 204                     if(!empty($filter)) $filter =sprintf($filter_tpl,$class,$filter);
 205
 206                     foreach($acl['members'] as $type => $name){
 207                         if(preg_match("/^G/", $type))
 208                             $gmem .= "\n        <li>".$name."</li>";
 209                     }
 210                     if(!empty($gmem)) $gmem =sprintf($gmem_tpl,$class,$gmem);
 211
 212                     foreach($acl['members'] as $type => $name){
 213                         if(!preg_match("/^G/", $type))
 214                             $umem .= "\n        <li>".$name."</li>";
 215                     }
 216                     if(!empty($umem)) $umem = sprintf($umem_tpl,$class,$umem);
 217
 218                     if($acl['type']!='reset'){
 219                         foreach($acl['acl'] as $type => $acl){
 220                             if(isset($this->classMapping[$type])){
 221                                 $defs .= "<li>".$this->classMapping[$type].": ".$this->aclToString($acl)."</li>";
 222                             }else{
 223                                 $defs .= "<li>".$type.": ".$this->aclToString($acl)."</li>";
 224                             }
 225                         }
 226                         if(!empty($defs)) $defs = sprintf($acl_tpl, $class,$defs);
 227                     }
 228                     $str.= sprintf($tpl,$class, image($image), $dn, $aclType, $filter.$gmem.$umem.$defs);
 229                 }
 230             }
 231             $str .= "</table>";
 232             $this->renderedList = $str;
 233         }
 234         return($this->renderedList);
 235     }
 236
 237     function aclToString($acls)
 238     {
 239         $str ="<ul>";
 240         foreach($acls as $name => $acl){
 241             if($name == "0") $name = _("All");
 242             $str .= "<li>".$name;
 243             $str .= "<ul>";
 244             if(preg_match("/s/", $acl)){
 245                 $str.="<li>"._("Grant permission to owner").'</li>';
 246             }
 247             if(preg_match("/r/", $acl)) $str.="<li>"._("read").'</li>';
 248             if(preg_match("/w/", $acl)) $str.="<li>"._("write").'</li>';
 249             if(preg_match("/c/", $acl)) $str.="<li>"._("Create").'</li>';
 250             if(preg_match("/d/", $acl)) $str.="<li>"._("Remove").'</li>';
 251             if(preg_match("/m/", $acl)) $str.="<li>"._("Move").'</li>';
 252             $str.= "</ul>";
 253         }
 254         return($str."</ul>");
 255     }
 256 }
 257
 258 ?>
 259