From bf517dafc122edf6ccd86847f0626cfd0df9f340 Mon Sep 17 00:00:00 2001 From: x2003bruneau Date: Mon, 5 Mar 2007 14:33:53 +0000 Subject: [PATCH] Remove my old and ugly hack to check permissions and set up a new flexible way to do it. git-svn-id: svn+ssh://murphy/home/svn/platal/trunk@1548 839d8a87-29fc-0310-9880-83ba4fa771e5 --- classes/flagset.php | 12 +++++++++--- classes/platal.php | 28 ++++++++++++++++++++++++++-- classes/plmodule.php | 20 +++++++++++++++++--- classes/session.php | 2 +- include/xnet/session.inc.php | 22 ++++++++++++++++++++-- include/xorg/session.inc.php | 18 ++++++++++++++++++ modules/core.php | 2 +- templates/events/index.tpl | 2 +- templates/include/minifiche.tpl | 2 +- templates/include/trombi.tpl | 2 +- templates/lists/header_listes.tpl | 4 ++-- templates/newsletter/show.tpl | 2 +- templates/profile/profile.tpl | 2 +- templates/skin/common.menu.tpl | 2 +- templates/skin/default.tpl | 2 +- templates/skin/espace.tpl | 2 +- templates/skin/humlinux.tpl | 2 +- templates/skin/keynote.tpl | 2 +- templates/skin/linux.tpl | 2 +- templates/skin/liteskin.tpl | 2 +- templates/skin/nbviolet.tpl | 2 +- templates/skin/newxorg.tpl | 2 +- templates/skin/register.tpl | 2 +- templates/skin/spectral.tpl | 2 +- templates/skin/trapped.tpl | 2 +- templates/xnet/skin.tpl | 8 ++++---- 26 files changed, 115 insertions(+), 35 deletions(-) diff --git a/classes/flagset.php b/classes/flagset.php index 7fe89b6..d06115f 100644 --- a/classes/flagset.php +++ b/classes/flagset.php @@ -44,7 +44,7 @@ class Flagset * @param $flag XXX * @return VOID */ - public function addflag($flag) + public function addFlag($flag) { if (!$flag) return; if (!$this->hasflag($flag)) { @@ -59,7 +59,7 @@ class Flagset * @param $flag XXX * @return 1 || 0 */ - public function hasflag($flag) + public function hasFlag($flag) { $tok = strtok($this->value,$this->sep); while ($tok) { @@ -74,7 +74,7 @@ class Flagset * @param $flag XXX * @return VOID */ - public function rmflag($flag) + public function rmFlag($flag) { if (!$flag) return; $newvalue = ""; @@ -90,6 +90,12 @@ class Flagset $this->value=$newvalue; } + /** return the flagset + */ + public function flags() + { + return $this->value; + } } // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: diff --git a/classes/platal.php b/classes/platal.php index 5716199..cdfb3cb 100644 --- a/classes/platal.php +++ b/classes/platal.php @@ -175,6 +175,31 @@ class Platal return null; } + protected function check_perms($perms) + { + if (!$perms) { // No perms, no check + return true; + } + $s_perms = S::v('perms'); + + // hook perms syntax is + $perms = explode(',', $perms); + foreach ($perms as $perm) + { + $ok = true; + $rights = explode(':', $perm); + foreach ($rights as $right) { + if (($right{0} == '!' && $s_perms->hasFlag(substr($right, 1))) || !$s_perms->hasFlag($right)) { + $ok = false; + } + } + if ($ok) { + return true; + } + } + return false; + } + private function call_hook(PlatalPage &$page) { $hook = $this->find_hook(); @@ -196,8 +221,7 @@ class Platal return PL_FORBIDDEN; } } - - if (!empty($hook['perms']) && $hook['perms'] != S::v('perms')) { + if ($hook['auth'] != AUTH_PUBLIC && !$this->check_perms($hook['perms'])) { return PL_FORBIDDEN; } diff --git a/classes/plmodule.php b/classes/plmodule.php index 8a5e6ca..4cd113c 100644 --- a/classes/plmodule.php +++ b/classes/plmodule.php @@ -19,11 +19,25 @@ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * ***************************************************************************/ -class PLModule +abstract class PLModule { - function handlers() { die("implement me"); } + abstract function handlers(); - public function make_hook($fun, $auth, $perms = '', $type = DO_AUTH) + /** Register a hook + * @param fun name of the handler (the exact name will be handler_$fun) + * @param auth authentification level of needed to run this handler + * @param perms permission required to run this handler + * @param type additionnal flags + * + * Perms syntax is the following: + * perms = rights(,rights)* + * rights = right(:right)* + * right is an atomic right permission (like 'admin', 'user', 'groupadmin', 'groupmember'...) + * + * If type is set to NO_AUTH, the system will return 403 instead of asking auth data + * this is useful for Ajax handlers + */ + public function make_hook($fun, $auth, $perms = 'user', $type = DO_AUTH) { return array('hook' => array($this, 'handler_'.$fun), 'auth' => $auth, diff --git a/classes/session.php b/classes/session.php index 004066e..a06662b 100644 --- a/classes/session.php +++ b/classes/session.php @@ -58,7 +58,7 @@ class Session public static function has_perms() { - return Session::logged() && Session::v('perms') == PERMS_ADMIN; + return Session::logged() && Session::v('perms')->hasFlag(PERMS_ADMIN); } public static function logged() diff --git a/include/xnet/session.inc.php b/include/xnet/session.inc.php index de75d23..d798261 100644 --- a/include/xnet/session.inc.php +++ b/include/xnet/session.inc.php @@ -41,6 +41,20 @@ class XnetSession $url .= "&url=".urlencode($returl); $_SESSION['loginX'] = $url; } + + if (S::logged() && $globals->asso()) { + $perms = S::v('perms'); + $perms->rmFlag('groupadmin'); + $perms->rmFlag('groupmember'); + if (may_update()) { + $perms->addFlag('groupadmin'); + $perms->addFlag('groupmember'); + } + if (is_member()) { + $perms->addFlag('groupmember'); + } + $_SESSION['perms'] = $perms; + } } // }}} @@ -81,7 +95,8 @@ class XnetSession // }}} // {{{ doAuthX - public static function doAuthX() { + public static function doAuthX() + { global $globals, $page; if (md5('1'.S::v('challenge').$globals->xnet->secret.Get::i('uid').'1') != Get::v('auth')) { @@ -99,6 +114,8 @@ class XnetSession LIMIT 1", Get::i('uid')); $_SESSION = array_merge($_SESSION, $res->fetchOneAssoc()); $_SESSION['auth'] = AUTH_MDP; + require_once 'xorg/session.inc.php'; + $_SESSION['perms'] =& XorgSession::make_perms(S::v('perms')); S::kill('challenge'); S::kill('loginX'); S::kill('may_update'); @@ -125,7 +142,8 @@ class XnetSession if (!S::has('suid')) { $_SESSION['suid'] = $_SESSION; } - $_SESSION['perms'] = 'user'; + require_once 'xorg/session.inc.php'; + $_SESSION['perms'] =& XorgSession::make_perms('user'); } // }}} diff --git a/include/xorg/session.inc.php b/include/xorg/session.inc.php index 2681c2c..c6ea8e4 100644 --- a/include/xorg/session.inc.php +++ b/include/xorg/session.inc.php @@ -158,6 +158,7 @@ class XorgSession * @param page the calling page (by reference) */ public static function doAuthCookie() + { if (S::logged()) { return true; @@ -175,6 +176,22 @@ class XorgSession } // }}} + // {{{ public static function make_perms() + + public static function &make_perms($perm) + { + $flags = new FlagSet(); + if ($perm == 'disabled' || $perm == 'ext') { + return $flags; + } + $flags->addFlag(PERMS_USER); + if ($perm == 'admin') { + $flags->addFlag(PERMS_ADMIN); + } + return $flags; + } + + // }}} } // {{{ function try_cookie() @@ -250,6 +267,7 @@ function start_connexion ($uid, $identified) $_SESSION = array_merge($_SESSION, $sess); $_SESSION['log'] = $logger; $_SESSION['auth'] = ($identified ? AUTH_MDP : AUTH_COOKIE); + $_SESSION['perms'] =& XorgSession::make_perms($_SESSION['perms']); $mail_subject = null; if (check_account()) { $mail_subject = "Connexion d'un utilisateur surveillé"; diff --git a/modules/core.php b/modules/core.php index 3354449..2165d27 100644 --- a/modules/core.php +++ b/modules/core.php @@ -101,7 +101,7 @@ class CoreModule extends PLModule $_SESSION['log']->log("suid_start", "login by ".S::v('forlife')); } $_SESSION['suid'] = $_SESSION; - $_SESSION['perms'] = $level; + $_SESSION['perms'] =& XorgSession::make_perms($level); pl_redirect('/'); } diff --git a/templates/events/index.tpl b/templates/events/index.tpl index 7e64ba8..06de324 100644 --- a/templates/events/index.tpl +++ b/templates/events/index.tpl @@ -175,7 +175,7 @@ Bienvenue {$smarty.session.prenom} {/if}
- {if $smarty.session.perms eq 'admin'} + {if $smarty.session.perms->hasFlag('admin')} {icon name=page_edit title="Editer cet article"} {/if} {icon name=cross title="Cacher cet article"} diff --git a/templates/include/minifiche.tpl b/templates/include/minifiche.tpl index f1b8ddd..371026a 100644 --- a/templates/include/minifiche.tpl +++ b/templates/include/minifiche.tpl @@ -73,7 +73,7 @@ {/if} {/if} - {if $smarty.session.perms eq admin} + {if $smarty.session.perms->hasFlag('admin')} [{if !$c.wasinscrit && !$c.dcd} {* *}{icon name=email title="marketter user"} diff --git a/templates/include/trombi.tpl b/templates/include/trombi.tpl index 83192b9..fcea502 100644 --- a/templates/include/trombi.tpl +++ b/templates/include/trombi.tpl @@ -31,7 +31,7 @@ [ PHOTO ] - {if $trombi_admin && $smarty.session.perms eq 'admin' && !$urlmainsite} + {if $trombi_admin && $smarty.session.perms->hasFlag('admin') && !$urlmainsite} {icon name=wrench title="[admin]"} {/if} diff --git a/templates/lists/header_listes.tpl b/templates/lists/header_listes.tpl index 708534b..695879b 100644 --- a/templates/lists/header_listes.tpl +++ b/templates/lists/header_listes.tpl @@ -46,7 +46,7 @@ {/if} - {if $details.own || $smarty.session.perms eq admin || ($it_is_xnet && $is_admin)} + {if $details.own || $smarty.session.perms->hasFlag('admin') || $smarty.session.perms->hasFlag('groupadmin')} Administrer la liste : @@ -73,7 +73,7 @@ {/if} - {if $smarty.session.perms eq admin || ($it_is_xnet && $is_admin)} + {if $smarty.session.perms->hasFlag('admin') || $smarty.session.perms->hasFlag('groupadmin')} Administrer (avancé) : diff --git a/templates/newsletter/show.tpl b/templates/newsletter/show.tpl index e3df5df..3cf0ce9 100644 --- a/templates/newsletter/show.tpl +++ b/templates/newsletter/show.tpl @@ -31,7 +31,7 @@ {else} [version Texte] {/if} -{if $smarty.session.perms eq admin} +{if $smarty.session.perms->hasFlag('admin')} [Editer] {/if}

diff --git a/templates/profile/profile.tpl b/templates/profile/profile.tpl index 1b49918..2d62265 100644 --- a/templates/profile/profile.tpl +++ b/templates/profile/profile.tpl @@ -60,7 +60,7 @@ function chgMainWinLoc(strPage) { {icon name=cross title="Retirer de mes contacts"} {/if} - {if $smarty.session.perms eq admin} + {if $smarty.session.perms->hasFlag('admin')} {icon name=wrench title="administrer user"} {/if} diff --git a/templates/skin/common.menu.tpl b/templates/skin/common.menu.tpl index 4965e51..0209b25 100644 --- a/templates/skin/common.menu.tpl +++ b/templates/skin/common.menu.tpl @@ -74,7 +74,7 @@
Nous contacter
Signaler un bug
-{if $smarty.session.perms eq admin} +{if $smarty.session.perms->hasFlag('admin')}
***
Marketing
Administration
diff --git a/templates/skin/default.tpl b/templates/skin/default.tpl index f98f53f..f0496bf 100644 --- a/templates/skin/default.tpl +++ b/templates/skin/default.tpl @@ -33,7 +33,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/espace.tpl b/templates/skin/espace.tpl index 8754b82..a81f38e 100644 --- a/templates/skin/espace.tpl +++ b/templates/skin/espace.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/humlinux.tpl b/templates/skin/humlinux.tpl index eb0bcda..5ae3ce3 100644 --- a/templates/skin/humlinux.tpl +++ b/templates/skin/humlinux.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/keynote.tpl b/templates/skin/keynote.tpl index 24f8613..35bffa9 100644 --- a/templates/skin/keynote.tpl +++ b/templates/skin/keynote.tpl @@ -33,7 +33,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/linux.tpl b/templates/skin/linux.tpl index ea20999..319307c 100644 --- a/templates/skin/linux.tpl +++ b/templates/skin/linux.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/liteskin.tpl b/templates/skin/liteskin.tpl index 028740b..c4d671a 100644 --- a/templates/skin/liteskin.tpl +++ b/templates/skin/liteskin.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/nbviolet.tpl b/templates/skin/nbviolet.tpl index b1f4114..13290bf 100644 --- a/templates/skin/nbviolet.tpl +++ b/templates/skin/nbviolet.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/newxorg.tpl b/templates/skin/newxorg.tpl index b5d432e..e81232c 100644 --- a/templates/skin/newxorg.tpl +++ b/templates/skin/newxorg.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/register.tpl b/templates/skin/register.tpl index 3c99e2b..7ec1859 100644 --- a/templates/skin/register.tpl +++ b/templates/skin/register.tpl @@ -33,7 +33,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/spectral.tpl b/templates/skin/spectral.tpl index 1277076..cad2865 100644 --- a/templates/skin/spectral.tpl +++ b/templates/skin/spectral.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/skin/trapped.tpl b/templates/skin/trapped.tpl index 7a2ba5e..2c1d2d9 100644 --- a/templates/skin/trapped.tpl +++ b/templates/skin/trapped.tpl @@ -34,7 +34,7 @@ {if $smarty.session.suid} {/if} diff --git a/templates/xnet/skin.tpl b/templates/xnet/skin.tpl index f68bf83..fba4654 100644 --- a/templates/xnet/skin.tpl +++ b/templates/xnet/skin.tpl @@ -132,10 +132,10 @@
voir le site en tant que... @@ -211,7 +211,7 @@ {/if} - {if $smarty.session.perms eq admin} + {if $smarty.session.perms->hasFlag('admin')} Gérer les groupes {icon name=wrench title="Administration"} -- 2.1.4