X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=gosa-core%2Finclude%2Fclass_userinfo.inc;h=992f3da004b79c77a9db20bd85d77452b4b13287;hb=ec7198b4b87d963ce804f052eafc90e69858f93f;hp=423694c8a7df021ab160120ec0dcd4ff85b21b9e;hpb=2bdfee4e79c88d501be49c5c65fa8f39b1b376f3;p=gosa.git diff --git a/gosa-core/include/class_userinfo.inc b/gosa-core/include/class_userinfo.inc index 423694c8a..992f3da00 100644 --- a/gosa-core/include/class_userinfo.inc +++ b/gosa-core/include/class_userinfo.inc @@ -36,6 +36,9 @@ class userinfo var $ocMapping= array(); var $groups= array(); var $result_cache =array(); + var $ignoreACl = FALSE; + var $ACLperPath = array(); + var $ACLperPath_usesFilter = array(); /* get acl's an put them into the userinfo object attr subtreeACL (userdn:components, userdn:component1#sub1#sub2,component2,...) */ @@ -67,8 +70,9 @@ class userinfo $this->uid= $attrs['uid'][0]; $this->ip= $_SERVER['REMOTE_ADDR']; + $this->ignoreACL = ($this->config->get_cfg_value("ignoreAcl") == $this->dn); + /* Initialize ACL_CACHE */ - session::set('ACL_CACHE',array()); $this->reset_acl_cache(); } @@ -76,7 +80,7 @@ class userinfo public function reset_acl_cache() { /* Initialize ACL_CACHE */ - session::set('ACL_CACHE',array()); + session::global_set('ACL_CACHE',array()); } function loadACL() @@ -126,6 +130,9 @@ class userinfo $tmp = @acl::explodeAcl($attrs['gosaAclTemplate'][$i]); foreach($tmp as $new_acl){ + + /* Keep non role attributes here! */ + $new_acl['filter'] = $aclc_value['filter']; $new_acl['members'] = $aclc_value['members']; $aclc[$dn][] =$new_acl; } @@ -151,8 +158,9 @@ class userinfo /* Inspect members... */ foreach ($type['members'] as $grp => $grpdsc){ + /* Some group inside the members that is relevant for us? */ - if (in_array_ics(preg_replace('/^G:/', '', $grp), $this->groups)){ + if (in_array_ics(@LDAP::convert(preg_replace('/^G:/', '', $grp)), $this->groups)){ $interresting= TRUE; } @@ -170,31 +178,67 @@ class userinfo $this->ACL[$dn][$idx]= $type; } } - } - } + /* Create an array which represenet all relevant permissions settings + per dn. - function get_category_permissions($dn, $category) - { - /* If we are forced to skip ACLs checks for the current user - then return all permissions. - */ - if($this->ignore_acl_for_current_user()){ - return("rwcdm"); - } + The array will look like this: + + . ['ou=base'] ['ou=base'] = array(ACLs); + . + . ['ou=dep1,ou=base']['ou=dep1,ou=base'] = array(ACLs); + . ['ou=base'] = array(ACLs); - /* Get list of objectClasses and get the permissions for it */ - $acl= ""; - if (isset($this->ocMapping[$category])){ - foreach($this->ocMapping[$category] as $oc){ - $acl.= $this->get_permissions($dn, $category."/".$oc); + + For object located in 'ou=dep1,ou=base' we have to both ACLs, + for objects in 'ou=base' we only have to apply on ACL. + */ + $without_self_acl = $all_acl = array(); + foreach($this->ACL as $dn => $acl){ + $sdn =$dn; + $first= TRUE; // Run at least once + while(strpos($dn,",") !== FALSE || $first){ + $first = FALSE; + if(isset($this->ACL[$dn])){ + $all_acl[$sdn][$dn] = $this->ACL[$dn]; + $without_self_acl[$sdn][$dn] = $this->ACL[$dn]; + foreach($without_self_acl[$sdn][$dn] as $acl_id => $acl_set){ + + /* Remember which ACL set has speicial user filter + */ + if(isset($acl_set['filter']{1})){ + $this->ACLperPath_usesFilter[$sdn] = TRUE; + } + + /* Remove all acl entries which are especially for the current user (self acl) + */ + foreach($acl_set['acl'] as $object => $object_acls){ + if(strpos($object_acls[0],"s")){ + unset($without_self_acl[$sdn][$dn][$acl_id]['acl'][$object]); + } + } + } + } + $dn = preg_replace("/^[^,]*+,/","",$dn); } - }else{ - trigger_error("ACL request for an invalid category (".$category.")."); + } + $this->ACLperPath =$without_self_acl; + + /* Append Self entry */ + $dn = $this->dn; + while(strpos($dn,",") && !isset($all_acl[$dn])){ + $dn = preg_replace("/^[^,]*+,/","",$dn); + } + if(isset($all_acl[$dn])){ + $this->ACLperPath[$this->dn] = $all_acl[$dn]; } + } - return ($acl); + + function get_category_permissions($dn, $category, $any_acl = FALSE) + { + return(@$this->get_permissions($dn,$category.'/0',"")); } @@ -246,12 +290,10 @@ class userinfo if(!is_array($object)){ $object = array($object); } - $r = $w = $c = TRUE; + $r = $w = TRUE; foreach($object as $category){ $w &= preg_match("/w/",$this->has_complete_category_acls($dn, $category)); - $c &= preg_match("/c/",$this->has_complete_category_acls($dn, $category)); $r &= preg_match("/r/",$this->has_complete_category_acls($dn, $category)); -# print_a(array($category => array($r.$w.$c))); } return($r && $w ); } @@ -267,12 +309,9 @@ class userinfo if(!is_array($object)){ $object = array($object); } - $r = $w = $c = TRUE; + $r = TRUE; foreach($object as $category){ - $w &= preg_match("/w/",$this->has_complete_category_acls($dn, $category)); - $c &= preg_match("/c/",$this->has_complete_category_acls($dn, $category)); $r &= preg_match("/r/",$this->has_complete_category_acls($dn, $category)); -# print_a(array($category => array($r.$w.$c))); } return($r) ; } @@ -291,18 +330,46 @@ class userinfo } /* Push cache answer? */ - $ACL_CACHE = &session::get('ACL_CACHE'); + $ACL_CACHE = &session::global_get('ACL_CACHE'); if (isset($ACL_CACHE["$dn+$object+$attribute"])){ - - /* Remove write if needed */ - if ($skip_write){ - $ret = preg_replace('/w/', '', $ACL_CACHE["$dn+$object+$attribute"]); - }else{ - $ret = $ACL_CACHE["$dn+$object+$attribute"]; - } + $ret = $ACL_CACHE["$dn+$object+$attribute"]; + if($skip_write){ + $ret = str_replace(array('w','c','d','m'), '',$ret); + } return($ret); } + /* Detect the set of ACLs we have to check for this object + */ + $adn = $dn; + while(!isset($this->ACLperPath[$adn]) && strpos($adn,",") !== FALSE){ + $adn = preg_replace("/^[^,]*+,/","",$adn); + } + if(isset($this->ACLperPath[$adn])){ + $ACL = $this->ACLperPath[$adn]; + }else{ + $ACL_CACHE["$dn+$object+$attribute"] = ""; + return(""); + } + + /* If we do not need to respect any user-filter settings + we can skip the per object ACL checks. + */ + $orig_dn= $dn; + if(!isset($this->ACLperPath_usesFilter[$adn])){ + $dn = $adn; + if (isset($ACL_CACHE["$dn+$object+$attribute"])){ + $ret = $ACL_CACHE["$dn+$object+$attribute"]; + if(!isset($ACL_CACHE["$orig_dn+$object+$attribute"])){ + $ACL_CACHE["$orig_dn+$object+$attribute"] = $ACL_CACHE["$dn+$object+$attribute"]; + } + if($skip_write){ + $ret = str_replace('w','',$ret); + } + return($ret); + } + } + /* Get ldap object, for later filter checks */ $ldap = $this->config->get_ldap_link(); @@ -318,7 +385,7 @@ class userinfo foreach ($path as $element){ /* Clean potential ACLs for each level */ - if(in_array($cpath,$this->config->departments)){ + if(isset($this->config->idepartments[$cpath])){ $acl= $this->cleanACL($acl); } @@ -328,10 +395,10 @@ class userinfo $cpath= $element.','.$cpath; } - if (isset($this->ACL[$cpath])){ + if (isset($ACL[$cpath])){ /* Inspect this ACL, place the result into ACL */ - foreach ($this->ACL[$cpath] as $subacl){ + foreach ($ACL[$cpath] as $subacl){ /* Reset? Just clean the ACL and turn over to the next one... */ if ($subacl['type'] == 'reset'){ @@ -346,28 +413,18 @@ class userinfo /* With user filter */ if (isset($subacl['filter']) && !empty($subacl['filter'])){ - $sdn = preg_replace("/^[^,]*+,/","",$dn); - $ldap->cd($sdn); - $ldap->ls($subacl['filter'],$sdn); - if(!$ldap->count()){ + $id = $dn."-".$subacl['filter']; + if(!isset($ACL_CACHE['FILTER'][$id])){ + $ACL_CACHE['FILTER'][$id] = $ldap->object_match_filter($dn,$subacl['filter']); + } + if(!$ACL_CACHE['FILTER'][$id]){ continue; - }else{ - $found = FALSE; - while($attrs = $ldap->fetch()){ - if($attrs['dn'] == $dn){ - $found = TRUE; - break; - } - } - if(!$found){ - continue; - } } } /* Self ACLs? */ - if(isset($subacl['acl'][$object][0]) && preg_match("/s/",$subacl['acl'][$object][0]) && $dn != $this->dn){ + if($dn != $this->dn && isset($subacl['acl'][$object][0]) && (strpos($subacl['acl'][$object][0],"s") !== FALSE)){ continue; } @@ -398,6 +455,37 @@ class userinfo $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl']['all'][0]); continue; } + + /* Category ACLs (e.g. $object = "user/0") + */ + if(strstr($object,"/0")){ + $ocs = preg_replace("/\/0$/","",$object); + if(isset($this->ocMapping[$ocs])){ + + /* if $attribute is "", then check every single attribute for this object. + if it is 0, then just check the object category ACL. + */ + if($attribute == ""){ + foreach($this->ocMapping[$ocs] as $oc){ + if (isset($subacl['acl'][$ocs.'/'.$oc])){ + + if($dn != $this->dn && strpos($subacl['acl'][$ocs.'/'.$oc][0],"s") !== FALSE) continue; + + foreach($subacl['acl'][$ocs.'/'.$oc] as $attr => $dummy){ + $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$ocs.'/'.$oc][$attr]); + } + continue; + } + } + }else{ + if(isset($subacl['acl'][$ocs.'/'.$oc][0])){ + if($dn != $this->dn && strpos($subacl['acl'][$ocs.'/'.$oc][0],"s") !== FALSE) continue; + $acl= $this->mergeACL($acl, $subacl['type'], $subacl['acl'][$ocs.'/'.$oc][0]); + } + } + } + continue; + } } } } @@ -405,7 +493,7 @@ class userinfo /* If the requested ACL is for a container object, then alter ACLs by applying cleanACL a last time. */ - if(in_array($dn,$this->config->departments)){ + if(isset($this->config->idepartments[$dn])){ $acl = $this->cleanACL($acl); } @@ -418,10 +506,11 @@ class userinfo } $ACL_CACHE["$dn+$object+$attribute"]= $ret; + $ACL_CACHE["$orig_dn+$object+$attribute"]= $ret; /* Remove write if needed */ if ($skip_write){ - $ret= preg_replace('/w/', '', $ret); + $ret = str_replace(array('w','c','d','m'), '',$ret); } return ($ret); } @@ -431,7 +520,6 @@ class userinfo accessible department) */ function get_module_departments($module, $skip_self_acls = FALSE ) { - /* If we are forced to skip ACLs checks for the current user then return all departments as valid. */ @@ -440,132 +528,97 @@ class userinfo } /* Use cached results if possilbe */ - $ACL_CACHE = session::get('ACL_CACHE'); - if(isset($ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)])){ - return($ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)]); + $ACL_CACHE = &session::global_get('ACL_CACHE'); + + if(!is_array($module)){ + $module = array($module); } global $plist; - - $objects= array(); - $deps= array(); - - /* Extract all relevant objects for this module from plist */ - foreach ($plist->info as $object => $info){ - if (!isset($info['plCategory'])){ + $res = array(); + foreach($module as $mod){ + if(isset($ACL_CACHE['MODULE_DEPARTMENTS'][$mod])){ + $res = array_merge($res,$ACL_CACHE['MODULE_DEPARTMENTS'][$mod]); continue; } - foreach ($info['plCategory'] as $idx => $data){ - if (preg_match('/^[0-9]+$/', $idx)){ - if ($data == $module){ - $objects[$object]= $object; - } - } else { - if ($idx == $module){ - $objects[$object]= $object; - } - } - } - } - /* Search for per object ACLs. - */ - $this->config->get_departments(); - $this->config->make_idepartments(); - - foreach($this->ACL as $dn => $infos){ - foreach($infos as $info){ - $found = FALSE; - foreach($info['acl'] as $cat => $data){ - - /* Skip self acls? */ - if($skip_self_acls && isset($data['0']) && preg_match("//s",$data['0'])) continue; - - if(is_array($module)){ - foreach($module as $mod){ - if(preg_match("/^".normalizePreg($mod)."/",$cat)){ - $found =TRUE; - break; - } - } - }else{ - if(preg_match("/^".normalizePreg($module)."/",$cat)){ + $deps = array(); + + /* Search for per object ACLs */ + foreach($this->ACL as $dn => $infos){ + foreach($infos as $info){ + $found = FALSE; + foreach($info['acl'] as $cat => $data){ + + /* Skip self acls? */ + if($skip_self_acls && isset($data['0']) && (strpos($data['0'], "s") !== FALSE)) continue; + if(preg_match("/^".preg_quote($mod, '/')."/",$cat)){ $found =TRUE; break; } - } - } + } - if($found && !isset($this->config->idepartments[$dn])){ - while(!isset($this->config->idepartments[$dn]) && preg_match("/,/",$dn)){ - $dn = preg_replace("/^[^,]+,/","",$dn); - } - if(isset($this->config->idepartments[$dn])){ - $deps[] = $dn; + if($found && !isset($this->config->idepartments[$dn])){ + while(!isset($this->config->idepartments[$dn]) && strpos($dn, ",")){ + $dn = preg_replace("/^[^,]+,/","",$dn); + } + if(isset($this->config->idepartments[$dn])){ + $deps[$dn] = $dn; + } } } } - } - /* For all gosaDepartments */ - foreach ($this->config->departments as $dn){ - if(!is_array($module)){ - $module = array($module); - } - $acl = ""; - foreach($module as $mod){ - if(preg_match("/\//",$mod)){ + /* For all gosaDepartments */ + foreach ($this->config->departments as $dn){ + if(isset($deps[$dn])) continue; + $acl = ""; + if(strpos($mod, '/')){ $acl.= $this->get_permissions($dn,$mod); }else{ - $acl.= $this->get_category_permissions($dn,$mod); + $acl.= $this->get_category_permissions($dn,$mod,TRUE); + } + if(!empty($acl)) { + $deps[$dn] = $dn; } } - if($acl !== "") $deps[] = $dn; + + $ACL_CACHE['MODULE_DEPARTMENTS'][$mod] = $deps; + $res = array_merge($res,$deps); } - - $ACL_CACHE = &session::get('ACL_CACHE'); - $ACL_CACHE['MODULE_DEPARTMENTS'][serialize($module)] = $deps; - return ($deps); + + return (array_values($res)); } function mergeACL($acl, $type, $newACL) { + $at= array("psub" => "p", "sub" => "s", "one" => "1"); + if (strpos($newACL, 'w') !== FALSE && strpos($newACL, 'r') === FALSE){ $newACL .= "r"; } + /* Ignore invalid characters */ + $newACL= preg_replace('/[^rwcdm]/', '', $newACL); + foreach(str_split($newACL) as $char){ - /* Ignore invalid characters */ - if (!preg_match('/[rwcdm]/', $char)){ - continue; - } + /* Skip "self" ACLs without combination of rwcdm, they have no effect. + -self flag without read/write/create/... + */ + if(empty($char)) continue; /* Skip permanent and subtree entries */ if (preg_match('/[sp]/', $acl[$char])){ continue; } - switch ($type){ - case 'psub': - $acl[$char]= 'p'; - break; - - case 'sub': - $acl[$char]= 's'; - break; - - case 'one': - $acl[$char]= 1; - break; - - case 'base': - if ($acl[$char] != 1){ - $acl[$char]= 0; - } - break; - } + if ($type == "base" && $acl[$char] != 1) { + $acl[$char]= 0; + } else { + $acl[$char]= $at[$type]; + } } return ($acl); @@ -574,20 +627,25 @@ class userinfo function cleanACL($acl, $reset= FALSE) { - foreach ($acl as &$value){ + foreach ($acl as $key => $value){ + + /* Continue, if value is empty or permanent */ + if ($value == "" || $value == "p") { + continue; + } /* Reset removes everything but 'p' */ if ($reset && $value != 'p'){ - $value= ""; + $acl[$key]= ""; continue; } /* Decrease tree level */ if (is_int($value)){ if ($value){ - $value--; + $acl[$key]--; } else { - $value= ""; + $acl[$key]= ""; } } } @@ -620,7 +678,7 @@ class userinfo /* Skip objectClass '0' (e.g. users/0) get_permissions will ever return '' ?? */ if($oc == "0") continue; $tmp = $this->get_permissions($dn, $category."/".$oc); - for($i = 0 ; $i < strlen($types); $i++) { + for($i = 0, $l= strlen($types); $i < $l; $i++) { if(!preg_match("/".$types[$i]."/",$tmp)){ $acl = preg_replace("/".$types[$i]."/","",$acl); } @@ -644,7 +702,7 @@ class userinfo */ function ignore_acl_for_current_user() { - return($this->config->get_cfg_value("ignore_acl") == $this->dn); + return($this->ignoreACL); } }