X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=gosa-core%2Finclude%2Fclass_userinfo.inc;h=4045821ba85e0d5311ce31f6360678db2e522c6c;hb=46e5854a4fc9e9ed72276149b64ee8399abdb7d9;hp=230bdf131f83a50fd7cd59209183473fb2b460fc;hpb=5619767048536c83513844e2bac33f44722f1549;p=gosa.git

diff --git a/gosa-core/include/class_userinfo.inc b/gosa-core/include/class_userinfo.inc
index 230bdf131..4045821ba 100644
--- a/gosa-core/include/class_userinfo.inc
+++ b/gosa-core/include/class_userinfo.inc
@@ -315,13 +315,16 @@ class userinfo
     foreach ($path as $element){
 
       /* Clean potential ACLs for each level */
-      $acl= $this->cleanACL($acl);
+      if(in_array($cpath,$this->config->departments)){
+        $acl= $this->cleanACL($acl);
+      }
 
       if ($cpath == ""){
         $cpath= $element;
       } else {
         $cpath= $element.','.$cpath;
       }
+
       if (isset($this->ACL[$cpath])){
 
         /* Inspect this ACL, place the result into ACL */
@@ -338,26 +341,42 @@ class userinfo
             continue;
           }
 
-         /* With user filter */
-         if (isset($subacl['filter']) && !empty($subacl['filter'])){
-           $sdn = preg_replace("/^[^,]*+,/","",$dn);
-           $ldap->cd($sdn);
-           $ldap->ls($subacl['filter'],$sdn);
-           if(!$ldap->count()){
-             continue;
-           }else{
-             $found = FALSE; 
-             while($attrs = $ldap->fetch()){
-               if($attrs['dn'] == $dn){
-                 $found = TRUE;
-                 break;
-               }
-             }
-             if(!$found){
-               continue;
-             }
-           }
-         }
+          /* With user filter */
+          if (isset($subacl['filter']) && !empty($subacl['filter'])){
+            $sdn = preg_replace("/^[^,]*+,/","",$dn);
+            $ldap->cd($sdn);
+            $ldap->ls($subacl['filter'],$sdn);
+            if(!$ldap->count()){
+              continue;
+            }else{
+              $found = FALSE; 
+              while($attrs = $ldap->fetch()){
+                if($attrs['dn'] == $dn){
+                  $found = TRUE;
+                  break;
+                }
+              }
+              if(!$found){
+                continue;
+              }
+            }
+          }
+
+          /* Self ACLs? 
+           */
+          if(isset($subacl['acl'][$object][0]) && preg_match("/s/",$subacl['acl'][$object][0]) && $dn != $this->dn){
+            continue;
+          }
+
+          /* If attribute is "", we want to know, if we've *any* permissions here... 
+              Merge global class ACLs [0] with attributes specific ACLs [attribute].
+           */
+          if ($attribute == "" && isset($subacl['acl'][$object])){
+            foreach($subacl['acl'][$object] as $attr => $dummy){
+              $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$object][$attr]);
+            }
+            continue;
+          }
 
           /* Per attribute ACL? */
           if (isset($subacl['acl'][$object][$attribute])){
@@ -376,19 +395,17 @@ class userinfo
             $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']['all'][0]);
             continue;
           }
-
-          /* If attribute is "", we want to know, if we've *any* permissions here... */
-          if ($attribute == "" && isset($subacl['acl'][$object])){
-            foreach($subacl['acl'][$object] as $attr => $dummy){
-              $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$object][$attr]);
-            }
-            continue;
-          }
-
         }
       }
     }
 
+    /* If the requested ACL is for a container object, then alter 
+        ACLs by applying cleanACL a last time.
+     */
+    if(in_array($dn,$this->config->departments)){
+      $acl = $this->cleanACL($acl);
+    }
+
     /* Assemble string */
     $ret= "";
     foreach ($acl as $key => $value){
@@ -409,7 +426,7 @@ class userinfo
 
   /* Extract all departments that are accessible (direct or 'on the way' to an
      accessible department) */
-  function get_module_departments($module)
+  function get_module_departments($module, $skip_self_acls = FALSE )
   {
     
     /* If we are forced to skip ACLs checks for the current user 
@@ -448,8 +465,6 @@ class userinfo
       }
     }
 
-    
-
     /* Search for per object ACLs. 
      */
     $this->config->get_departments();
@@ -459,6 +474,10 @@ class userinfo
       foreach($infos as $info){
         $found = FALSE;
         foreach($info['acl'] as $cat => $data){
+
+          /* Skip self acls? */
+          if($skip_self_acls && isset($data['0']) && preg_match("//s",$data['0'])) continue;
+
           if(is_array($module)){
             foreach($module as $mod){
               if(preg_match("/^".normalizePreg($mod)."/",$cat)){
@@ -487,73 +506,20 @@ class userinfo
 
     /* For all gosaDepartments */
     foreach ($this->config->departments as $dn){
-      $acl= array("r" => "", "w" => "", "c" => "", "d" => "", "m" => "", "a" => "");
-
-      /* Build dn array */
-      $path= split(',', $dn);
-      $path= array_reverse($path);
-
-      /* Walk along the path to evaluate the acl */
-      $cpath= "";
-      foreach ($path as $element){
-
-        /* Clean potential ACLs for each level */
-        $acl= $this->cleanACL($acl);
-
-        if ($cpath == ""){
-          $cpath= $element;
-        } else {
-          $cpath= $element.','.$cpath;
-        }
-        if (isset($this->ACL[$cpath])){
-
-          /* Inspect this ACL, place the result into ACL */
-          foreach ($this->ACL[$cpath] as $subacl){
-
-            /* Reset? Just clean the ACL and turn over to the next one... */
-            if ($subacl['type'] == 'reset'){
-              $acl= $this->cleanACL($acl, TRUE);
-              continue;
-            }
-    
-            if($subacl['type'] == 'role'){
-              echo "role skipped";
-              continue;
-            }
-
-            /* Per object ACL? */
-            foreach ($objects as $object){
-              if (isset($subacl['acl']["$module/$object"])){
-                foreach($subacl['acl']["$module/$object"] as $attribute => $dcl){
-                  $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']["$module/$object"][$attribute]);
-                }
-              }
-            }
-
-            /* Global ACL? */
-            if (isset($subacl['acl']["$module/all"][0])){
-              $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']["$module/all"][0]);
-              continue;
-            }
-
-            /* Global ACL? */
-            if (isset($subacl['acl']["all"][0])){
-              $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']["all"][0]);
-              continue;
-            }
-          }
-        }
+      if(!is_array($module)){
+        $module = array($module);
       }
-
-      /* Add department, if we have (some) permissions for the required module */
-      foreach ($acl as $val){
-        if ($val != ""){
-          $deps[]= $dn;
-          break;
+      $acl = "";
+      foreach($module as $mod){
+        if(preg_match("/\//",$mod)){
+          $acl.=  $this->get_permissions($dn,$mod);
+        }else{
+          $acl.=  $this->get_category_permissions($dn,$mod);
         }
       }
+      if($acl !== "") $deps[] = $dn;
     }
-
+  
     $ACL_CACHE = &session::get('ACL_CACHE');
     $ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)] = $deps;
     return ($deps);