powerdlz23 1.1.7 → 1.1.9

package/pto/yaamp/web/framework-1.0.8/web/auth/CAccessControlFilter.php

@@ -0,0 +1,295 @@
+<?php
+/**
+ * CAccessControlFilter class file.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.yiiframework.com/
+ * @copyright Copyright &copy; 2008-2009 Yii Software LLC
+ * @license http://www.yiiframework.com/license/
+ */
+
+/**
+ * CAccessControlFilter performs authorization checks for the specified actions.
+ *
+ * By enabling this filter, controller actions can be checked for access permissions.
+ * Only when the user is allowed by one of the security rules, will he be able
+ * to access the action.
+ *
+ * To specify the access rules, set the {@link setRules rules} property, which should
+ * be an array of the rules. Each rule is specified as an array of the following structure:
+ * <pre>
+ * array(
+ *   'allow',  // or 'deny'
+ *   // optional, list of action IDs (case insensitive) that this rule applies to
+ *   'actions'=>array('edit', 'delete'),
+ *   // optional, list of controller IDs (case insensitive) that this rule applies to
+ *   // This option is available since version 1.0.3.
+ *   'controllers'=>array('post', 'admin/user'),
+ *   // optional, list of usernames (case insensitive) that this rule applies to
+ *   // Use * to represent all users, ? guest users, and @ authenticated users
+ *   'users'=>array('thomas', 'kevin'),
+ *   // optional, list of roles (case sensitive!) that this rule applies to.
+ *   'roles'=>array('admin', 'editor'),
+ *   // optional, list of IP address/patterns that this rule applies to
+ *   // e.g. 127.0.0.1, 127.0.0.*
+ *   'ips'=>array('127.0.0.1'),
+ *   // optional, list of request types (case insensitive) that this rule applies to
+ *   'verbs'=>array('GET', 'POST'),
+ *   // optional, a PHP expression whose value indicates whether this rule applies
+ *   // This option is available since version 1.0.3.
+ *   'expression'=>'!$user->isGuest && $user->level==2',
+ * )
+ * </pre>
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @version $Id: CAccessControlFilter.php 1280 2009-07-25 11:16:36Z qiang.xue $
+ * @package system.web.auth
+ * @since 1.0
+ */
+class CAccessControlFilter extends CFilter
+{
+	private $_rules=array();
+
+	/**
+	 * @return array list of access rules.
+	 */
+	public function getRules()
+	{
+		return $this->_rules;
+	}
+
+	/**
+	 * @param array list of access rules.
+	 */
+	public function setRules($rules)
+	{
+		foreach($rules as $rule)
+		{
+			if(is_array($rule) && isset($rule[0]))
+			{
+				$r=new CAccessRule;
+				$r->allow=$rule[0]==='allow';
+				foreach(array_slice($rule,1) as $name=>$value)
+				{
+					if($name==='expression' || $name==='roles')
+						$r->$name=$value;
+					else
+						$r->$name=array_map('strtolower',$value);
+				}
+				$this->_rules[]=$r;
+			}
+		}
+	}
+
+	/**
+	 * Performs the pre-action filtering.
+	 * @param CFilterChain the filter chain that the filter is on.
+	 * @return boolean whether the filtering process should continue and the action
+	 * should be executed.
+	 */
+	protected function preFilter($filterChain)
+	{
+		$app=Yii::app();
+		$request=$app->getRequest();
+		$user=$app->getUser();
+		$verb=$request->getRequestType();
+		$ip=$request->getUserHostAddress();
+
+		foreach($this->getRules() as $rule)
+		{
+			if(($allow=$rule->isUserAllowed($user,$filterChain->controller,$filterChain->action,$ip,$verb))>0) // allowed
+				break;
+			else if($allow<0) // denied
+			{
+				$this->accessDenied($user);
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Denies the access of the user.
+	 * This method is invoked when access check fails.
+	 * @param IWebUser the current user
+	 * @since 1.0.5
+	 */
+	protected function accessDenied($user)
+	{
+		if($user->getIsGuest())
+			$user->loginRequired();
+		else
+			throw new CHttpException(403,Yii::t('yii','You are not authorized to perform this action.'));
+	}
+}
+
+
+/**
+ * CAccessRule represents an access rule that is managed by {@link CAccessControlFilter}.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @version $Id: CAccessControlFilter.php 1280 2009-07-25 11:16:36Z qiang.xue $
+ * @package system.web.auth
+ * @since 1.0
+ */
+class CAccessRule extends CComponent
+{
+	/**
+	 * @var boolean whether this is an 'allow' rule or 'deny' rule.
+	 */
+	public $allow;
+	/**
+	 * @var array list of action IDs that this rule applies to. The comparison is case-insensitive.
+	 */
+	public $actions;
+	/**
+	 * @var array list of controler IDs that this rule applies to. The comparison is case-insensitive.
+	 * @since 1.0.4
+	 */
+	public $controllers;
+	/**
+	 * @var array list of user names that this rule applies to. The comparison is case-insensitive.
+	 */
+	public $users;
+	/**
+	 * @var array list of roles this rule applies to. For each role, the current user's
+	 * {@link CWebUser::checkAccess} method will be invoked. If one of the invocations
+	 * returns true, the rule will be applied.
+	 * Note, you should mainly use roles in an "allow" rule because by definition,
+	 * a role represents a permission collection.
+	 * @see CAuthManager
+	 */
+	public $roles;
+	/**
+	 * @var array IP patterns.
+	 */
+	public $ips;
+	/**
+	 * @var array list of request types (e.g. GET, POST) that this rule applies to.
+	 */
+	public $verbs;
+	/**
+	 * @var string a PHP expression whose value indicates whether this rule should be applied.
+	 * In this expression, you can use <code>$user</code> which refers to <code>Yii::app()->user</code>.
+	 * @since 1.0.3
+	 */
+	public $expression;
+
+
+	/**
+	 * Checks whether the Web user is allowed to perform the specified action.
+	 * @param CWebUser the user object
+	 * @param CController the controller currently being executed
+	 * @param CAction the action to be performed
+	 * @param string the request IP address
+	 * @param string the request verb (GET, POST, etc.)
+	 * @return integer 1 if the user is allowed, -1 if the user is denied, 0 if the rule does not apply to the user
+	 */
+	public function isUserAllowed($user,$controller,$action,$ip,$verb)
+	{
+		if($this->isActionMatched($action)
+			&& $this->isUserMatched($user)
+			&& $this->isRoleMatched($user)
+			&& $this->isIpMatched($ip)
+			&& $this->isVerbMatched($verb)
+			&& $this->isControllerMatched($controller)
+			&& $this->isExpressionMatched($user))
+			return $this->allow ? 1 : -1;
+		else
+			return 0;
+	}
+
+	/**
+	 * @param CAction the action
+	 * @return boolean whether the rule applies to the action
+	 */
+	protected function isActionMatched($action)
+	{
+		return empty($this->actions) || in_array(strtolower($action->getId()),$this->actions);
+	}
+
+	/**
+	 * @param CAction the action
+	 * @return boolean whether the rule applies to the action
+	 */
+	protected function isControllerMatched($controller)
+	{
+		return empty($this->controllers) || in_array(strtolower($controller->getId()),$this->controllers);
+	}
+
+	/**
+	 * @param IWebUser the user
+	 * @return boolean whether the rule applies to the user
+	 */
+	protected function isUserMatched($user)
+	{
+		if(empty($this->users))
+			return true;
+		foreach($this->users as $u)
+		{
+			if($u==='*')
+				return true;
+			else if($u==='?' && $user->getIsGuest())
+				return true;
+			else if($u==='@' && !$user->getIsGuest())
+				return true;
+			else if(!strcasecmp($u,$user->getName()))
+				return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string the role name
+	 * @return boolean whether the rule applies to the role
+	 */
+	protected function isRoleMatched($user)
+	{
+		if(empty($this->roles))
+			return true;
+		foreach($this->roles as $role)
+		{
+			if($user->checkAccess($role))
+				return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string the IP address
+	 * @return boolean whether the rule applies to the IP address
+	 */
+	protected function isIpMatched($ip)
+	{
+		if(empty($this->ips))
+			return true;
+		foreach($this->ips as $rule)
+		{
+			if($rule==='*' || $rule===$ip || (($pos=strpos($rule,'*'))!==false && !strncmp($ip,$rule,$pos)))
+				return true;
+		}
+		return false;
+	}
+
+	/**
+	 * @param string the request method
+	 * @return boolean whether the rule applies to the request
+	 */
+	protected function isVerbMatched($verb)
+	{
+		return empty($this->verbs) || in_array(strtolower($verb),$this->verbs);
+	}
+
+	/**
+	 * @param IWebUser the user
+	 * @return boolean the expression value. True if the expression is not specified.
+	 * @since 1.0.3
+	 */
+	protected function isExpressionMatched($user)
+	{
+		if($this->expression===null)
+			return true;
+		return @eval('return '.$this->expression.';');
+	}
+}

package/pto/yaamp/web/framework-1.0.8/web/auth/CAuthAssignment.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * CAuthAssignment class file.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.yiiframework.com/
+ * @copyright Copyright &copy; 2008-2009 Yii Software LLC
+ * @license http://www.yiiframework.com/license/
+ */
+
+/**
+ * CAuthAssignment represents an assignment of a role to a user.
+ * It includes additional assignment information such as {@link bizRule} and {@link data}.
+ * Do not create a CAuthAssignment instance using the 'new' operator.
+ * Instead, call {@link IAuthManager::assign}.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @version $Id: CAuthAssignment.php 433 2008-12-30 22:59:17Z qiang.xue $
+ * @package system.web.auth
+ * @since 1.0
+ */
+class CAuthAssignment extends CComponent
+{
+	private $_auth;
+	private $_itemName;
+	private $_userId;
+	private $_bizRule;
+	private $_data;
+
+	/**
+	 * Constructor.
+	 * @param IAuthManager the authorization manager
+	 * @param string authorization item name
+	 * @param mixed user ID (see {@link IWebUser::getId})
+	 * @param string the business rule associated with this assignment
+	 * @param mixed additional data for this assignment
+	 */
+	public function __construct($auth,$itemName,$userId,$bizRule=null,$data=null)
+	{
+		$this->_auth=$auth;
+		$this->_itemName=$itemName;
+		$this->_userId=$userId;
+		$this->_bizRule=$bizRule;
+		$this->_data=$data;
+	}
+
+	/**
+	 * @return mixed user ID (see {@link IWebUser::getId})
+	 */
+	public function getUserId()
+	{
+		return $this->_userId;
+	}
+
+	/**
+	 * @return string the authorization item name
+	 */
+	public function getItemName()
+	{
+		return $this->_itemName;
+	}
+
+	/**
+	 * @return string the business rule associated with this assignment
+	 */
+	public function getBizRule()
+	{
+		return $this->_bizRule;
+	}
+
+	/**
+	 * @param string the business rule associated with this assignment
+	 */
+	public function setBizRule($value)
+	{
+		if($this->_bizRule!==$value)
+		{
+			$this->_bizRule=$value;
+			$this->_auth->saveAuthAssignment($this);
+		}
+	}
+
+	/**
+	 * @return mixed additional data for this assignment
+	 */
+	public function getData()
+	{
+		return $this->_data;
+	}
+
+	/**
+	 * @param mixed additional data for this assignment
+	 */
+	public function setData($value)
+	{
+		if($this->_data!==$value)
+		{
+			$this->_data=$value;
+			$this->_auth->saveAuthAssignment($this);
+		}
+	}
+}

package/pto/yaamp/web/framework-1.0.8/web/auth/CAuthItem.php

@@ -0,0 +1,269 @@
+<?php
+/**
+ * CAuthItem class file.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.yiiframework.com/
+ * @copyright Copyright &copy; 2008-2009 Yii Software LLC
+ * @license http://www.yiiframework.com/license/
+ */
+
+/**
+ * CAuthItem represents an authorization item.
+ * An authorization item can be an operation, a task or a role.
+ * They form an authorization hierarchy. Items on higher levels of the hierarchy
+ * inherit the permissions represented by items on lower levels.
+ * A user may be assigned one or several authorization items (called {@link CAuthAssignment assignments}.
+ * He can perform an operation only when it is among his assigned items.
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @version $Id: CAuthItem.php 971 2009-04-30 03:00:43Z qiang.xue $
+ * @package system.web.auth
+ * @since 1.0
+ */
+class CAuthItem extends CComponent
+{
+	const TYPE_OPERATION=0;
+	const TYPE_TASK=1;
+	const TYPE_ROLE=2;
+
+	private $_auth;
+	private $_type;
+	private $_name;
+	private $_description;
+	private $_bizRule;
+	private $_data;
+
+	/**
+	 * Constructor.
+	 * @param IAuthManager authorization manager
+	 * @param string authorization item name
+	 * @param integer authorization item type. This can be 0 (operation), 1 (task) or 2 (role).
+	 * @param description the description
+	 * @param string the business rule associated with this item
+	 * @param mixed additional data for this item
+	 */
+	public function __construct($auth,$name,$type,$description='',$bizRule=null,$data=null)
+	{
+		$this->_type=$type;
+		$this->_auth=$auth;
+		$this->_name=$name;
+		$this->_description=$description;
+		$this->_bizRule=$bizRule;
+		$this->_data=$data;
+	}
+
+	/**
+	 * Checks to see if the specified item is within the hierarchy starting from this item.
+	 * This method is internally used by {@link IAuthManager::checkAccess}.
+	 * @param string the name of the item to be checked
+	 * @param array the parameters to be passed to business rule evaluation
+	 * @return boolean whether the specified item is within the hierarchy starting from this item.
+	 */
+	public function checkAccess($itemName,$params=array())
+	{
+		Yii::trace('Checking permission "'.$this->_name.'"','system.web.auth.CAuthItem');
+		if($this->_auth->executeBizRule($this->_bizRule,$params,$this->_data))
+		{
+			if($this->_name==$itemName)
+				return true;
+			foreach($this->_auth->getItemChildren($this->_name) as $item)
+			{
+				if($item->checkAccess($itemName,$params))
+					return true;
+			}
+		}
+		return false;
+	}
+
+	/**
+	 * @return IAuthManager the authorization manager
+	 */
+	public function getAuthManager()
+	{
+		return $this->_auth;
+	}
+
+	/**
+	 * @return integer the authorization item type. This could be 0 (operation), 1 (task) or 2 (role).
+	 */
+	public function getType()
+	{
+		return $this->_type;
+	}
+
+	/**
+	 * @return string the item name
+	 */
+	public function getName()
+	{
+		return $this->_name;
+	}
+
+	/**
+	 * @param string the item name
+	 */
+	public function setName($value)
+	{
+		if($this->_name!==$value)
+		{
+			$oldName=$this->_name;
+			$this->_name=$value;
+			$this->_auth->saveAuthItem($this,$oldName);
+		}
+	}
+
+	/**
+	 * @return string the item description
+	 */
+	public function getDescription()
+	{
+		return $this->_description;
+	}
+
+	/**
+	 * @param string the item description
+	 */
+	public function setDescription($value)
+	{
+		if($this->_description!==$value)
+		{
+			$this->_description=$value;
+			$this->_auth->saveAuthItem($this);
+		}
+	}
+
+	/**
+	 * @return string the business rule associated with this item
+	 */
+	public function getBizRule()
+	{
+		return $this->_bizRule;
+	}
+
+	/**
+	 * @param string the business rule associated with this item
+	 */
+	public function setBizRule($value)
+	{
+		if($this->_bizRule!==$value)
+		{
+			$this->_bizRule=$value;
+			$this->_auth->saveAuthItem($this);
+		}
+	}
+
+	/**
+	 * @return string the additional data associated with this item
+	 */
+	public function getData()
+	{
+		return $this->_data;
+	}
+
+	/**
+	 * @param string the business rule associated with this item
+	 */
+	public function setData($value)
+	{
+		if($this->_data!==$value)
+		{
+			$this->_data=$value;
+			$this->_auth->saveAuthItem($this);
+		}
+	}
+
+	/**
+	 * Adds a child item.
+	 * @param string the name of the child item
+	 * @return boolean whether the item is added successfully
+	 * @throws CException if either parent or child doesn't exist or if a loop has been detected.
+	 * @see IAuthManager::addItemChild
+	 */
+	public function addChild($name)
+	{
+		return $this->_auth->addItemChild($this->_name,$name);
+	}
+
+	/**
+	 * Removes a child item.
+	 * Note, the child item is not deleted. Only the parent-child relationship is removed.
+	 * @param string the child item name
+	 * @return boolean whether the removal is successful
+	 * @see IAuthManager::removeItemChild
+	 */
+	public function removeChild($name)
+	{
+		$this->_auth->removeItemChild($this->_name,$name);
+	}
+
+	/**
+	 * Returns a value indicating whether a child exists
+	 * @param string the child item name
+	 * @return boolean whether the child exists
+	 * @see IAuthManager::hasItemChild
+	 */
+	public function hasChild($name)
+	{
+		return $this->_auth->hasItemChild($this->_name,$name);
+	}
+
+	/**
+	 * Returns the children of this item.
+	 * @return array all child items of this item.
+	 * @see IAuthManager::getItemChildren
+	 */
+	public function getChildren()
+	{
+		return $this->_auth->getItemChildren($this->_name);
+	}
+
+	/**
+	 * Assigns this item to a user.
+	 * @param mixed the user ID (see {@link IWebUser::getId})
+	 * @param string the business rule to be executed when {@link checkAccess} is called
+	 * for this particular authorization item.
+	 * @param mixed additional data associated with this assignment
+	 * @return CAuthAssignment the authorization assignment information.
+	 * @throws CException if the item has already been assigned to the user
+	 * @see IAuthManager::assign
+	 */
+	public function assign($userId,$bizRule=null,$data=null)
+	{
+		return $this->_auth->assign($this->_name,$userId,$bizRule,$data);
+	}
+
+	/**
+	 * Revokes an authorization assignment from a user.
+	 * @param mixed the user ID (see {@link IWebUser::getId})
+	 * @return boolean whether removal is successful
+	 * @see IAuthManager::revoke
+	 */
+	public function revoke($userId)
+	{
+		$this->_auth->revoke($this->_name,$userId);
+	}
+
+	/**
+	 * Returns a value indicating whether this item has been assigned to the user.
+	 * @param mixed the user ID (see {@link IWebUser::getId})
+	 * @return boolean whether the item has been assigned to the user.
+	 * @see IAuthManager::isAssigned
+	 */
+	public function isAssigned($userId)
+	{
+		return $this->_auth->isAssigned($this->_name,$userId);
+	}
+
+	/**
+	 * Returns the item assignment information.
+	 * @param mixed the user ID (see {@link IWebUser::getId})
+	 * @return CAuthAssignment the item assignment information. Null is returned if
+	 * this item is not assigned to the user.
+	 * @see IAuthManager::getAuthAssignment
+	 */
+	public function getAssignment($userId)
+	{
+		return $this->_auth->getAuthAssignment($this->_name,$userId);
+	}
+}