From 4546f7aaa16e7da417d53ab6522ed88ffa45acbe Mon Sep 17 00:00:00 2001 From: skeeter Date: Mon, 18 Jun 2001 03:03:48 +0000 Subject: [PATCH] Applying a patch from ralfbecker. This gives the admin the ability to grant ACL rights at the group level. --- admin/editgroup.php | 88 ++++++++++++++++--------- admin/templates/default/images/dot.gif | Bin 0 -> 215 bytes phpgwapi/inc/class.acl.inc.php | 47 +++++++++---- preferences/acl_preferences.php | 79 +++++++++++++++++----- 4 files changed, 156 insertions(+), 58 deletions(-) create mode 100755 admin/templates/default/images/dot.gif diff --git a/admin/editgroup.php b/admin/editgroup.php index 180fb8c8fb..a817fc4be0 100755 --- a/admin/editgroup.php +++ b/admin/editgroup.php @@ -14,10 +14,32 @@ $phpgw_info = array(); if ($submit) { - $phpgw_info["flags"] = array("noheader" => True, "nonavbar" => True); + $phpgw_flags = Array( + 'currentapp' => 'admin', + 'enable_nextmatchs_class' => True, + 'noheader' => True, + 'nonavbar' => True + ); } - $phpgw_info["flags"]["currentapp"] = "admin"; - include("../header.inc.php"); + else + { + $phpgw_flags = Array( + 'currentapp' => 'admin', + 'enable_nextmatchs_class' => True + ); + } + $phpgw_info['flags'] = $phpgw_flags; + include('../header.inc.php'); + + $apps_with_acl = Array( + 'addressbook' => True, + 'todo' => True, + 'calendar' => True, + 'notes' => True, + 'projects' => True, + 'phonelog' => True, + 'infolog' => True + ); function is_odd($n) { @@ -34,7 +56,7 @@ if (! $group_id) { - Header("Location: " . $phpgw->link("/admin/groups.php")); + Header('Location: ' . $phpgw->link('/admin/groups.php')); } if ($submit) @@ -47,7 +69,7 @@ { if ($group->exists($n_group)) { - $error = lang("Sorry, that group name has already been taken."); + $error = lang('Sorry, that group name has already been taken.'); } } @@ -229,11 +251,11 @@ . ''."\n"; } $p->set_var('user_list',$user_list); - $p->set_var("lang_permissions",lang("Permissions this group has")); + $p->set_var('lang_permissions',lang('Permissions this group has')); $i = 0; - reset($phpgw_info["apps"]); - $sorted_apps = $phpgw_info["apps"]; + reset($phpgw_info['apps']); + $sorted_apps = $phpgw_info['apps']; @asort($sorted_apps); @reset($sorted_apps); while ($permission = each($sorted_apps)) @@ -246,35 +268,41 @@ } } - $perm_html = ""; - for ($i=0;$i<200;) - { // The $i<200 is only used for a brake - if (! $perm_display[$i][1]) break; - $perm_html .= '' . lang($perm_display[$i][1]) . '' - . ''; + } + $perm_html .= '' . lang($perm_display[$i][1]) . '' + . 'link('/preferences/acl_preferences.php','acl_app='.$app.'&owner='.$group_id).'" target="_blank">'.lang('Grant Access').''; } - - if (! $perm_display[$i][1]) break; - $perm_html .= '' . lang($perm_display[$i][1]) . '' - . 'set_var("permissions_list",$perm_html); diff --git a/admin/templates/default/images/dot.gif b/admin/templates/default/images/dot.gif new file mode 100755 index 0000000000000000000000000000000000000000..c3cf24b4797c239fb947499bfacaef2a2b6d487e GIT binary patch literal 215 zcmZ?wbhEHb6krfwI3mPw^4i1jyr#POyNf2T+kWQWg?ld_z5aCT>AQ!oKBl!UxcmJ5 z!7Gn%Jbrum!RzWd+ubA5S01|l`1Pm%|Nk=(2NZv@FfuR*G3bDlgY0x*4OyVlmtx7~ z;2^`1B;xF~$UotJXAM)$dv?{v0uP>L96g5}883GRG`c26WgKZ(wx%rmOXbG%A}tPT jI_owopT5fCy?~|lpg`tw;pRQ}9*W%kXC4!+$Y2cs@~uaccount_id.', 0'; -// $equalto = $phpgw->accounts->security_equals($this->account_id); -// if (is_array($equalto) && count($equalto) > 0){ -// for ($idx = 0; $idx < count($equalto); ++$idx){ -// $sql .= ",".$equalto[$idx][0]; -// } -// } + + $groups = $this->get_location_list_for_id('phpgw_group', 1, $this->account_id); + while($groups && list($key,$value) = each($groups)) + { + $sql .= ','.$value; + } $sql .= '))'; $this->db->query($sql ,__LINE__,__FILE__); $count = $this->db->num_rows(); @@ -565,9 +565,10 @@ $sql = "select acl_account, acl_rights from phpgw_acl where acl_appname = '$app' and " . "acl_location in "; - $security = "('". $phpgw_info['user']['account_id'] ."'"; +// $security = "('". $phpgw_info['user']['account_id'] ."'"; + $security = "('". $this->account_id ."'"; $myaccounts = CreateObject('phpgwapi.accounts'); - $my_memberships = $myaccounts->memberships(); + $my_memberships = $myaccounts->memberships($this->account_id); @reset($my_memberships); while($my_memberships && list($key,$group) = each($my_memberships)) { @@ -589,12 +590,36 @@ // } if(!isset($accounts[$grantor])) + // cache the group-members for performance { - $accounts[$grantor] = 0; + // if $grantor is a group, get its members + $members = $this->get_ids_for_location($grantor,1,'phpgw_group'); + if(!$members) + { + $accounts[$grantor] = Array($grantor); + $is_group[$grantor] = False; + } + else + { + $accounts[$grantor] = $members; + $is_group[$grantor] = True; + } + } + if(@$is_group[$grantor]) + { + // Don't allow to override private! + $rights &= (~ PHPGW_ACL_PRIVATE); + } + while(list($nul,$grantors) = each($accounts[$grantor])) + { + if(!isset($grants[$grantors])) + { + $grants[$grantors] = 0; + } + $grants[$grantors] |= $rights; } - $accounts[$grantor] |= $rights; } - return $accounts; + return $grants; } } //end of acl class ?> diff --git a/preferences/acl_preferences.php b/preferences/acl_preferences.php index f9e9f59d61..78c532c6a7 100644 --- a/preferences/acl_preferences.php +++ b/preferences/acl_preferences.php @@ -18,38 +18,66 @@ 'noappfooter' => True ); + // header from calendar-app resets $owner + if(isset($owner)) + { + $save_my_owner = $owner; + } + $phpgw_info['flags'] = $phpgw_flags; include('../header.inc.php'); - function check_acl($label,$id,$acl,$rights,$right) + if(isset($save_my_owner) && $phpgw_info['user']['apps']['admin']) + { + $owner = $save_my_owner; + unset($save_my_owner); + } + else + { + echo '
'.lang('You do not have permission to set ACL\'s in this mode!').'
'; + $phpgw->common->phpgw_footer(); + } + + function check_acl($label,$id,$acl,$rights,$right,$is_group=False) { global $phpgw_info, $p; $p->set_var($acl,$label.$phpgw_info['flags']['currentapp'].'['.$id.']['.$right.']'); - if ($rights & $right) + if ($is_group) { - $p->set_var($acl.'_selected',' checked'); + // This is so you can't select it in the GUI + $p->set_var($acl.'_selected',' disabled'); } else { - $p->set_var($acl.'_selected',''); + $p->set_var($acl.'_selected',(($rights & $right)?' checked':'')); } } - - function display_row($bg_color,$label,$id,$name) + function display_row($bg_color,$label,$id,$name,$is_group) { - global $phpgw_info, $acl, $p; + global $phpgw, $phpgw_info, $acl, $p; $p->set_var('row_color',$bg_color); $p->set_var('user',$name); $rights = $acl->get_rights($id,$phpgw_info['flags']['currentapp']); +// vv This is new + $grantors = $acl->get_ids_for_location($id,$rights,$phpgw_info['flags']['currentapp']); + $is_group_set = False; + while(list($key,$grantor) = each($grantors)) + { + if($phpgw->accounts->get_type($grantor) == 'g') + { + $is_group_set = True; + } + } +// ^^ This is new - check_acl($label,$id,'read',$rights,PHPGW_ACL_READ); - check_acl($label,$id,'add',$rights,PHPGW_ACL_ADD); - check_acl($label,$id,'edit',$rights,PHPGW_ACL_EDIT); - check_acl($label,$id,'delete',$rights,PHPGW_ACL_DELETE); - check_acl($label,$id,'private',$rights,PHPGW_ACL_PRIVATE); + check_acl($label,$id,'read',$rights,PHPGW_ACL_READ,($is_group_set && ($rights & PHPGW_ACL_READ) && !$is_group?$is_group_set:False)); + check_acl($label,$id,'add',$rights,PHPGW_ACL_ADD,($is_group_set && ($rights & PHPGW_ACL_ADD && !$is_group)?$is_group_set:False)); + check_acl($label,$id,'edit',$rights,PHPGW_ACL_EDIT,($is_group_set && ($rights & PHPGW_ACL_EDIT && !$is_group)?$is_group_set:False)); + check_acl($label,$id,'delete',$rights,PHPGW_ACL_DELETE,($is_group_set && ($rights & PHPGW_ACL_DELETE && !$is_group)?$is_group_set:False)); + check_acl($label,$id,'private',$rights,PHPGW_ACL_PRIVATE,$is_group); $p->parse('row','acl_row',True); } @@ -62,6 +90,11 @@ $acct = CreateObject('phpgwapi.accounts',$owner); $groups = $acct->get_list('groups'); $users = $acct->get_list('accounts'); + $owner_name = $acct->id2name($owner); // get owner name for title + if($is_group = $acct->get_type($owner) == 'g') + { + $owner_name = lang('Group').' ('.$owner_name.')'; + } unset($acct); $acl = CreateObject('phpgwapi.acl',intval($owner)); $acl->read_repository(); @@ -90,6 +123,12 @@ { $totalacl += $right; } + + if($is_group) + { + $totalacl &= ~PHPGW_ACL_PRIVATE; // Don't allow group-grants to grant private + } + $acl->add($phpgw_info['flags']['currentapp'],$group_id,$totalacl); } @@ -108,6 +147,12 @@ { $totalacl += $right; } + + if($is_group) + { + $totalacl &= ~ PHPGW_ACL_PRIVATE; // Don't allow group-grants to grant private + } + $acl->add($phpgw_info['flags']['currentapp'],$user_id,$totalacl); } $acl->save_repository(); @@ -176,7 +221,7 @@ $var = Array( 'errors' => '', - 'title' => '

'.lang($phpgw_info['flags']['currentapp'].' preferences').' - '.lang('acl').':

', + 'title' => '

'.lang($phpgw_info['flags']['currentapp'].' preferences').' - '.lang('acl').': '.$owner_name.'

', 'action_url' => $phpgw->link('/preferences/acl_preferences.php','acl_app=' . $acl_app), 'bg_color' => $phpgw_info['theme']['th_bg'], 'submit_lang' => lang('submit'), @@ -224,7 +269,7 @@ if($go) { $tr_color = $phpgw->nextmatchs->alternate_row_color($tr_color); - display_row($tr_color,'g_',$group['account_id'],$group['account_lid']); + display_row($tr_color,'g_',$group['account_id'],$group['account_lid'],$is_group); $s_groups++; $processed[] = $group['account_id']; $total++; @@ -264,10 +309,10 @@ } } - if($go && $user['account_id'] != $phpgw_info['user']['account_id']) - { + if($go && $user['account_id'] != $owner) // Need to be $owner not $phpgw_info['user']['account_id'] + { // or the admin can't get special grants from a group $tr_color = $phpgw->nextmatchs->alternate_row_color($tr_color); - display_row($tr_color,'u_',$user['account_id'],$phpgw->common->display_fullname($user['account_lid'],$user['account_firstname'],$user['account_lastname'])); + display_row($tr_color,'u_',$user['account_id'],$phpgw->common->display_fullname($user['account_lid'],$user['account_firstname'],$user['account_lastname']),$is_group); $s_users++; $processed[] = $user['account_id']; $total++;