Changeset 2862

Timestamp:

11/24/08 04:23:30 (7 weeks ago)

Author:

ringmaster

Message:

User::identify() now always returns a User object. If a user is not logged in, an anonymouse User instance is created. This User instance will house default permissions used to fetch posts to which an anonymous visitor should have access.

Location:

trunk/htdocs/system

Files:

• admin/db_profiling.php (modified) (2 diffs)
• classes/acl.php (modified) (9 diffs)
• classes/adminhandler.php (modified) (1 diff)
• classes/ajaxhandler.php (modified) (4 diffs)
• classes/atomhandler.php (modified) (2 diffs)
• classes/bitmask.php (modified) (3 diffs)
• classes/comment.php (modified) (2 diffs)
• classes/eventlog.php (modified) (2 diffs)
• classes/feedbackhandler.php (modified) (4 diffs)
• classes/logentry.php (modified) (2 diffs)
• classes/post.php (modified) (1 diff)
• classes/posts.php (modified) (1 diff)
• classes/theme.php (modified) (3 diffs)
• classes/user.php (modified) (4 diffs)
• classes/userhandler.php (modified) (4 diffs)
• plugins/undelete/undelete.plugin.php (modified) (9 diffs)
• themes/charcoal/header.php (modified) (1 diff)
• themes/k2/loginform.php (modified) (1 diff)
• themes/k2/theme.php (modified) (1 diff)
• themes/mzingi/loginform.php (modified) (1 diff)

trunk/htdocs/system/admin/db_profiling.php

@@ -1 +1 @@
 <?php
-if (! isset($_GET['db_profile']) ||  ( User::identify() == FALSE ) )
+if (! isset($_GET['db_profile']) ||  ( !User::identify()->loggedin ) )
 {
     return;
@@ -50 +50 @@
 <?php }?>
 </div>
-<?php  
+<?php
   $total_time_querying+= $profile->total_time;
 }

trunk/htdocs/system/classes/acl.php

@@ -24 +24 @@
     const ACCESS_NONEXISTANT_PERMISSION = true;
 
-    private static $access_names = array( 'read', 'write' );
+    private static $access_names = array( 'read', 'write', 'delete' );
 
     /**
@@ -33 +33 @@
      */
     public static function access_check( $permission, $access )
-    {       
+    {
         $bitmask = new Bitmask( self::$access_names, $permission );
-        
+
         if ( $access == 'full' ) {
             return $bitmask->read && $bitmask->write;
@@ -223 +223 @@
      * Determine whether a user can perform a specific action
      * @param mixed $user A user object, user ID or a username
-     * @param mixed $permission A permission ID or name
+     * @param mixed $token A permission ID or name
      * @param string $access Check for 'read', 'write', or 'delete' access
      * @return bool Whether the user can perform the action
     **/
-    public static function user_can( $user, $permission, $access = 'write' )
+    public static function user_can( $user, $token, $access = 'read' )
+    {
+
+        $result = self::get_user_token_permissions( $user, $token );
+
+        if ( isset( $result ) && self::access_check( $result, $access ) ) {
+            return true;
+        }
+
+        // either the permission hasn't been granted, or it's been
+        // explicitly denied.
+        return false;
+    }
+
+    /**
+     * Determine whether a user is denied permission to perform a specific action
+     * @param mixed $user A user object, user ID or a username
+     * @param mixed $token A permission ID or name
+     * @return bool Whether the user can perform the action
+     **/
+    public static function user_cannot( $user, $token )
+    {
+
+        $result = self::get_user_token_permissions( $user, $token );
+
+        if ( isset( $result ) && $result == 0 ) {
+            return true;
+        }
+
+        // either the permission hasn't been granted, or it's been
+        // explicitly denied.
+        return false;
+    }
+
+
+    /**
+     * Return the permission to a specific token for a specific user
+     *
+     * @param mixed $user A User object instance or user id
+     * @param mixed $token A token string or if
+     * @return integer A permission bitmask integer
+     */
+    public static function get_user_token_permissions( $user, $token )
     {
         // Use only numeric ids internally
-        $permission = self::token_id( $permission );
+        $token = self::token_id( $token );
 
         /**
@@ -236 +278 @@
          * When ACL is functional ACCESS_NONEXISTANT_PERMISSION should be false by default.
          */
-        if ( is_null( $permission) ) {
+        if ( is_null( $token) ) {
             return self::ACCESS_NONEXISTANT_PERMISSION;
         }
@@ -283 +325 @@
   LIMIT 1;
 SQL;
-        $result = DB::get_value( $sql, array( ':user_id' => $user_id, ':token_id' => $permission ) );
-
-        if ( isset( $result ) && self::access_check( $result, $access ) ) {
-            return true;
-        }
-
-        // either the permission hasn't been granted, or it's been
-        // explicitly denied.
-        return false;
+        $result = DB::get_value( $sql, array( ':user_id' => $user_id, ':token_id' => $token ) );
+
+        return $result;
     }
 
@@ -305 +341 @@
         if ( is_numeric( $user ) ) {
             $user_id = $user;
-        } else {
+        }
+        else {
             if ( ! $user instanceof User ) {
                 $user = User::get( $user );
@@ -311 +348 @@
             $user_id = $user->id;
         }
-        
-        $result = DB::get_results( 'SELECT token_id, permission_id FROM {user_token_permissions} WHERE user_id = ?', array( $user_id ) );
-        $bitmask = new Bitmask ( self::$access_names );
+
+        $sql = <<<SQL
+SELECT token_id, permission_id
+  FROM user_token_permissions
+  WHERE user_id = :user_id
+UNION ALL
+SELECT gp.token_id, gp.permission_id
+  FROM users_groups ug
+  INNER JOIN group_token_permissions gp
+  ON ug.group_id = gp.group_id
+  AND ug.user_id = :user_id
+  ORDER BY token_id ASC
+SQL;
+        $result = DB::get_results( $sql, array( ':user_id' => $user_id ) );
+
+        $bitmask = new Bitmask ( self::$access_names, $access );
         $tokens = array();
 
@@ -339 +389 @@
             $permission_id = 0; // default is 'deny' (bitmask 0)
         }
-        
+
         $bitmask = new Bitmask( self::$access_names, $permission_id );
-        
+
         if ( $access == 'full' || $access == 'deny' ) {
             if ( $access == 'full' ) {
@@ -384 +434 @@
             $permission_id = 0; // default is 'deny' (bitmask 0)
         }
-        
+
         $bitmask = new Bitmask( self::$access_names, $permission_id );
-        
+
         if ( $access == 'full' || $access == 'deny' ) {
             if ( $access == 'full' ) {

trunk/htdocs/system/classes/adminhandler.php

@@ -21 +21 @@
     {
         $user = User::identify();
-        if ( !$user ) {
+        if ( !$user->loggedin ) {
             Session::add_to_set( 'login', $_SERVER['REQUEST_URI'], 'original' );
             if( URL::get_matched_rule()->name == 'admin_ajax' ) {

trunk/htdocs/system/classes/ajaxhandler.php

@@ -15 +15 @@
      * The following example would set the context of 'foo' and trigger
      * the plugin action 'ajax_foo'.
-     * 
+     *
      * <code>URL::get( 'ajax', 'context=foo' );</code>
-     * 
+     *
      */
     public function act_ajax()
@@ -23 +23 @@
         /**
          * Triggers the ajax plugin action for the context.
-         * 
+         *
          * @see AjaxHandler::act_ajax()
          * @action ajax_{$context}
@@ -33 +33 @@
      * Handles incoming ajax requests for which the user must be authenticated.
      * Forwards the request to plugin actions for the "context" portion of the URL.
-     * 
+     *
      * @see act_ajax()
      */
@@ -39 +39 @@
     {
         $user = User::identify();
-        if ($user !== FALSE) {
+        if ($user->loggedin) {
             /**
              * Triggers the ajax plugin action for the context if user is authenticated.
-             * 
+             *
              * @see act_auth_ajax()
              * @action ajax_auth_{$context}

trunk/htdocs/system/classes/atomhandler.php

@@ -52 +52 @@
             }
 
-            if ( ( $force != FALSE ) && ( !$this->user = User::identify() ) ) {
+            $this->user = User::identify();
+            if ( ( $force != FALSE ) && ( !$this->user->loggedin ) ) {
                 header( 'HTTP/1.1 401 Unauthorized' );
                 header( 'Status: 401 Unauthorized' );
@@ -489 +490 @@
             $self = URL::get( 'atom_entry' );
             $id = isset( $params['slug'] ) ? $params['slug'] : 'atom_entry';
-            
+
             $user = User::get_by_id( $post->user_id );
             $title = ( $this->is_auth() ) ? htmlspecialchars( $post->title ) : htmlspecialchars( $post->title_atom );
             $content = ( $this->is_auth() ) ? htmlspecialchars( $post->content ) : htmlspecialchars( $post->content_atom );
-            
+
             $xml = $this->create_atom_wrapper( $alternate, $self, $id );
-            
+
             $entry = $xml->addChild('entry');
             $entry->addAttribute( 'xmlns', 'http://www.w3.org/2005/Atom' );

trunk/htdocs/system/classes/bitmask.php

@@ -14 +14 @@
      * @param integer $value (optional) a combined bitmask value
      */
-    public function __construct( $flags = null, $value = null ) {
+    public function __construct( $flags = null, $value = null )
+    {
         if ( ! is_array( $flags ) ) {
             throw new InvalidArgumentException(_t('Bitmask constructor expects either no arguments or an array as a first argument'));
@@ -32 +33 @@
      * @param on    on or off?
      */
-    public function __set( $bit, $on ) {
+    public function __set( $bit, $on )
+    {
         switch( $bit ) {
             case 'value':
@@ -63 +65 @@
      * @return boolean
      */
-    public function __get( $bit ) {
+    public function __get( $bit )
+    {
         if ( is_string( $bit ) ) {
             $bit = array_search( $bit, $this->flags );

trunk/htdocs/system/classes/comment.php

@@ -273 +273 @@
     private function get_post( $use_cache = TRUE )
     {
-        if ( ! isset( $this->post_object ) || ( ! $use_cache)  )
-        {
+        if ( ! isset( $this->post_object ) || ( ! $use_cache)  ) {
             $this->post_object = Posts::get( array('id' => $this->post_id, 'fetch_fn' => 'get_row') );
         }
@@ -388 +387 @@
             return self::$comment_status_actions[$statuses[$name]];
         }
-        
+
         return '';
     }

trunk/htdocs/system/classes/eventlog.php

@@ -86 +86 @@
             'ip' => sprintf("%u", ip2long( $_SERVER['REMOTE_ADDR'] ) ),
         ) );
-        if ( $user = User::identify() ) {
+        $user = User::identify();
+        if ( $user->loggedin ) {
             $log->user_id = $user->id;
         }
@@ -134 +135 @@
         // Put incoming parameters into the local scope
         $paramarray = Utils::get_params( $paramarray );
-         
+
         // Get any full-query parameters
         extract( $paramarray );

trunk/htdocs/system/classes/feedbackhandler.php

@@ -16 +16 @@
     public function act_add_comment()
     {
-        
+
         $defaults = array(
             'name' => '',
@@ -23 +23 @@
             'content' => ''
         );
-        
+
         // We need to get the post anyway to redirect back to the post page.
         $post = Post::get( array( 'id'=>$this->handler_vars['id'] ) );
@@ -31 +31 @@
             die();
         }
-        
+
         // make sure all our default values are set so we don't throw undefined index errors
         foreach ( $defaults as $k => $v ) {
@@ -116 +116 @@
         // Should this really be here or in a default filter?
         // In any case, we should let plugins modify the status after we set it here.
-        if( ( $user = User::identify() ) && ( $comment->email == $user->email ) ) {
+        $user = User::identify();
+        if( ( $user->loggedin ) && ( $comment->email == $user->email ) ) {
             $comment->status = Comment::STATUS_APPROVED;
         }

trunk/htdocs/system/classes/logentry.php

@@ -216 +216 @@
             'fetch_fn' => 'get_row',
         );
-        if ( $user = User::identify() ) {
+        $user = User::identify();
+        if ( $user->loggedin ) {
             $defaults['where'][]= array(
                 'user_id' => $user->id,
@@ -273 +274 @@
         $allow = true;
         $allow = Plugins::filter( 'logentry_delete_allow', $allow, $this );
-        if ( ! $allow ) { 
+        if ( ! $allow ) {
             return;
         }

trunk/htdocs/system/classes/post.php

@@ -319 +319 @@
             'fetch_fn' => 'get_row',
         );
-        if ( $user = User::identify() ) {
+        $user = User::identify();
+        if ( $user->loggedin ) {
             $defaults['where'][]= array(
                 'user_id' => $user->id,

trunk/htdocs/system/classes/posts.php

@@ -369 +369 @@
 
                 // Only show posts to which the current user has permission
-                /*
-                if( !isset( $paramset['ignore_permissions'] ) ) {
-                    $token_id_list = User::identify();
-                    $joins['post_tokens__posts']= ' JOIN {post_tokens} ON {posts}.id= {post_tokens}.post_id AND {post_tokens}.token_id IN ()';
-                }
-                */
+                $paramset['ignore_permissions'] = true;
+                if(!isset($paramset['ignore_permissions'])) {
+                    $permission_token_ids = isset($paramset['override_permissions']) ? $paramset['override_permissions'] : ACL::user_tokens(User::identify(), 'read');
+                    if(User::identify()->can('own_posts', 'read')) {
+
+                    }
+                    foreach(Post::list_active_post_types() as $name => $posttype) {
+                        if(User::identify()->can(Utils::slugify($name) . '_post_type', 'read')) {
+
+                        }
+                    }
+                    $joins['post_tokens__posts']= ' JOIN {post_tokens} ON {posts}.id= {post_tokens}.post_id AND ({post_tokens}.token_id IN ('.implode(',', $permission_token_ids).'))';
+                }
 
                 // Concatenate the WHERE clauses

trunk/htdocs/system/classes/theme.php

@@ -107 +107 @@
         }
 
+        if( !$this->template_engine->assigned( 'loggedin' ) ) {
+            $this->assign('loggedin', User::identify()->loggedin );
+        }
+
         if( !$this->template_engine->assigned( 'page' ) ) {
             $this->assign('page', isset( $this->page ) ? $this->page : 1 );
@@ -165 +169 @@
             unset( $where_filters['tag'] );
         }
-        if ( User::identify() ) {
+        if ( User::identify()->loggedin ) {
             $where_filters['status']= isset( $_GET['preview'] ) ? Post::status( 'any' ) : Post::status( 'published' );
         }
@@ -221 +225 @@
             $$key = $value;
         }
-        
+
         $this->assign( 'page', isset($page)? $page:1 );
 

trunk/htdocs/system/classes/user.php

@@ -30 +30 @@
 
     private $group_list = null;
-    
+
     protected $url_args;
 
@@ -87 +87 @@
             }
         }
-        return false;
+        $anonymous = new User();
+        Plugins::act('create_anonymous_user', $anonymous);
+        return $anonymous;
     }
 
@@ -412 +414 @@
     {
         return ACL::user_can( $this, $permission, $access );
+    }
+
+    /**
+     * Determine if a user has been denied a specific permission
+     *
+     * @param string $permission The name of the permission to detect
+     * @return boolean True if this user has the requested permission, false if not
+     */
+    public function cannot( $permission )
+    {
+        return ACL::user_cannot( $this, $permission );
     }
 
@@ -527 +540 @@
             case 'displayname':
                 return ( empty($this->info->displayname) ) ? $this->username : $this->info->displayname;
+            case 'loggedin':
+                return $this->id != 0;
             default:
                 return parent::__get( $name );

trunk/htdocs/system/classes/userhandler.php

@@ -18 +18 @@
         $name = InputFilter::filter( Controller::get_var( 'habari_username' ) );
         $pass = InputFilter::filter( Controller::get_var( 'habari_password' ) );
-        
-        
+
+
         if ( ( NULL != $name ) || ( NULL != $pass ) ) {
             $user = User::authenticate( $name, $pass );
@@ -28 +28 @@
                 $user->info->authenticate_time = date( 'Y-m-d H:i:s' );
                 $user->update();
-                
+
                 // Remove left over expired session error message.
                 if ( Session::has_errors( 'expired_session' ) ) {
@@ -43 +43 @@
                         Session::add_to_set( 'last_form_data', $last_form_data['get'], 'get' );
                     }
-                    
+
                     /* Redirect to the correct admin page */
                     $dest = explode( '/', substr( $login_session['original'], strpos( $login_session['original'], 'admin/' ) ) );
@@ -93 +93 @@
     {
         // get the user from their cookie
-        if ( $user = User::identify() ) {
+        $user = User::identify();
+        if ( $user->loggedin ) {
             Plugins::act( 'user_logout', $user );
             // delete the cookie, and destroy the object

trunk/htdocs/system/plugins/undelete/undelete.plugin.php

@@ -3 +3 @@
 /**
  * Undelete Class
- * 
+ *
  * This class provides undelete functionality for posts and comments, and
  * provides a trashcan interface for restoring items.
@@ -41 +41 @@
         }
     }
-    
+
     /**
      * function actions_plugins_loaded
@@ -53 +53 @@
     /**
      * function filter_allow_post_delete
-     * This function is executed when the filter "before_post_delete" is 
+     * This function is executed when the filter "before_post_delete" is
      * called just before a post is to be deleted.
      * This filter should return a boolean value to indicate whether
@@ -79 +79 @@
         }
     }
-    
+
     function filter_post_actions($actions, $post) {
         if($post->status == Post::status('deleted')) {
@@ -85 +85 @@
             $actions['remove']['title']= _t('Permanently delete this post');
         }
-        
+
         return $actions;
     }
@@ -128 +128 @@
                 $ui->out();
                 break;
-    &