mirror of
https://github.com/phpbb/phpbb.git
synced 2025-02-18 23:14:41 +01:00
368 lines
11 KiB
PHP
368 lines
11 KiB
PHP
<?php
|
|
/***************************************************************************
|
|
* auth.php
|
|
* -------------------
|
|
* begin : Saturday, Feb 13, 2001
|
|
* copyright : (C) 2001 The phpBB Group
|
|
* email : support@phpbb.com
|
|
*
|
|
* $Id$
|
|
*
|
|
*
|
|
***************************************************************************/
|
|
|
|
/***************************************************************************
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
***************************************************************************/
|
|
|
|
/*
|
|
$type's accepted (pre-pend with AUTH_):
|
|
VIEW, READ, POST, REPLY, EDIT, DELETE, STICKY, ANNOUNCE, VOTE, VOTECREATE,
|
|
ATTACH
|
|
|
|
$types pending (for future versions, pre-pend with AUTH_):
|
|
ALLOW_HTML, ALLOW_BBCODE, ALLOW_SMILIES
|
|
|
|
Possible options ($type/forum_id combinations):
|
|
|
|
* If you include a type and forum_id then a specific lookup will be done and
|
|
the single result returned
|
|
|
|
* If you set type to AUTH_ALL and specify a forum_id an array of all auth types
|
|
will be returned
|
|
|
|
* If you provide a forum_id a specific lookup on that forum will be done
|
|
|
|
* If you set forum_id to AUTH_LIST_ALL and specify a type an array listing the
|
|
results for all forums will be returned
|
|
|
|
* If you set forum_id to AUTH_LIST_ALL and type to AUTH_ALL a multidimensional
|
|
array containing the auth permissions for all types and all forums for that
|
|
user is returned
|
|
|
|
All results are returned as associative arrays, even when a single auth type is
|
|
specified.
|
|
|
|
If available you can send an array (either one or two dimensional) containing the
|
|
forum auth levels, this will prevent the auth function having to do its own
|
|
lookup
|
|
*/
|
|
function auth($type, $forum_id, $userdata, $f_access = -1)
|
|
{
|
|
global $db, $lang;
|
|
|
|
switch($type)
|
|
{
|
|
case AUTH_ALL:
|
|
$a_sql = "a.auth_view, a.auth_read, a.auth_post, a.auth_reply, a.auth_edit, a.auth_delete, a.auth_sticky, a.auth_announce, a.auth_vote, a.auth_pollcreate";
|
|
$auth_fields = array("auth_view", "auth_read", "auth_post", "auth_reply", "auth_edit", "auth_delete", "auth_sticky", "auth_announce", "auth_vote", "auth_pollcreate");
|
|
break;
|
|
|
|
case AUTH_VIEW:
|
|
$a_sql = "a.auth_view";
|
|
$auth_fields = array("auth_view");
|
|
break;
|
|
|
|
case AUTH_READ:
|
|
$a_sql = "a.auth_read";
|
|
$auth_fields = array("auth_read");
|
|
break;
|
|
case AUTH_POST:
|
|
$a_sql = "a.auth_post";
|
|
$auth_fields = array("auth_post");
|
|
break;
|
|
case AUTH_REPLY:
|
|
$a_sql = "a.auth_reply";
|
|
$auth_fields = array("auth_reply");
|
|
break;
|
|
case AUTH_EDIT:
|
|
$a_sql = "a.auth_edit";
|
|
$auth_fields = array("auth_edit");
|
|
break;
|
|
case AUTH_DELETE:
|
|
$a_sql = "a.auth_delete";
|
|
$auth_fields = array("auth_delete");
|
|
break;
|
|
|
|
case AUTH_ANNOUNCE:
|
|
$a_sql = "a.auth_announce";
|
|
$auth_fields = array("auth_announce");
|
|
break;
|
|
case AUTH_STICKY:
|
|
$a_sql = "a.auth_sticky";
|
|
$auth_fields = array("auth_sticky");
|
|
break;
|
|
|
|
case AUTH_POLLCREATE:
|
|
$a_sql = "a.auth_pollcreate";
|
|
$auth_fields = array("auth_pollcreate");
|
|
break;
|
|
case AUTH_VOTE:
|
|
$a_sql = "a.auth_vote";
|
|
$auth_fields = array("auth_vote");
|
|
break;
|
|
case AUTH_ATTACH:
|
|
break;
|
|
|
|
case AUTH_ALLOW_HTML:
|
|
break;
|
|
case AUTH_ALLOW_BBCODE:
|
|
break;
|
|
case AUTH_ALLOW_SMILIES:
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
|
|
//
|
|
// If f_access has been passed, or auth is needed to return an array of forums
|
|
// then we need to pull the auth information on the given forum (or all forums)
|
|
//
|
|
if($f_access == -1)
|
|
{
|
|
$forum_match_sql = ($forum_id != AUTH_LIST_ALL) ? "WHERE a.forum_id = $forum_id" : "";
|
|
|
|
$sql = "SELECT a.forum_id, $a_sql
|
|
FROM " . FORUMS_TABLE . " a
|
|
$forum_match_sql";
|
|
$af_result = $db->sql_query($sql);
|
|
|
|
if(!$af_result)
|
|
{
|
|
message_die(GENERAL_ERROR, "Failed obtaining forum access control lists", "", __LINE__, __FILE__, $sql);
|
|
}
|
|
else
|
|
{
|
|
if(!$db->sql_numrows($af_result))
|
|
{
|
|
message_die(GENERAL_ERROR, "No forum access control lists exist!", "", __LINE__, __FILE__, $sql);
|
|
}
|
|
else
|
|
{
|
|
$f_access = ($forum_id != AUTH_LIST_ALL) ? $db->sql_fetchrow($af_result) : $db->sql_fetchrowset($af_result);
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// If the user isn't logged on then all we need do is check if the forum
|
|
// has the type set to ALL, if yes they are good to go, if not then they
|
|
// are denied access
|
|
//
|
|
$auth_user = array();
|
|
|
|
if($userdata['session_logged_in'])
|
|
{
|
|
$forum_match_sql = ($forum_id != AUTH_LIST_ALL) ? "AND a.forum_id = $forum_id" : "";
|
|
|
|
/* $sql = "SELECT au.forum_id, $a_sql, au.auth_mod, g.group_single_user
|
|
FROM " . AUTH_ACCESS_TABLE . " au, " . USER_GROUP_TABLE . " ug, " . GROUPS_TABLE. " g
|
|
WHERE ug.user_id = " . $userdata['user_id'] . "
|
|
AND g.group_id = ug.group_id
|
|
AND (
|
|
( au.user_id = ug.user_id
|
|
AND g.group_id = 0 )
|
|
OR
|
|
( au.group_id = ug.group_id
|
|
AND g.group_id <> 0 )
|
|
)
|
|
$forum_match_sql";*/
|
|
$sql = "SELECT a.forum_id, $a_sql, a.auth_mod, g.group_single_user
|
|
FROM " . AUTH_ACCESS_TABLE . " a, " . USER_GROUP_TABLE . " ug, " . GROUPS_TABLE . " g
|
|
WHERE ug.user_id = ".$userdata['user_id']. "
|
|
AND ug.user_pending = 0
|
|
AND g.group_id = ug.group_id
|
|
AND a.group_id = ug.group_id
|
|
$forum_match_sql";
|
|
$a_result = $db->sql_query($sql);
|
|
if(!$a_result)
|
|
{
|
|
message_die(GENERAL_ERROR, "Failed obtaining forum access control lists", "", __LINE__, __FILE__, $sql);
|
|
}
|
|
|
|
$num_u_access = $db->sql_numrows($a_result);
|
|
if($num_u_access)
|
|
{
|
|
if($forum_id != AUTH_LIST_ALL)
|
|
{
|
|
$u_access = $db->sql_fetchrowset($a_result);
|
|
}
|
|
else
|
|
{
|
|
while($u_row = $db->sql_fetchrow($a_result))
|
|
{
|
|
$u_access[$u_row['forum_id']] = $u_row;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$is_admin = ($userdata['user_level'] == ADMIN && $userdata['session_logged_in']) ? TRUE : 0;
|
|
|
|
$auth_user = array();
|
|
|
|
for($i = 0; $i < count($auth_fields); $i++)
|
|
{
|
|
$key = $auth_fields[$i];
|
|
|
|
//
|
|
// If the user is logged on and the forum type is either ALL or REG then the user has access
|
|
//
|
|
// If the type if ACL, MOD or ADMIN then we need to see if the user has specific permissions
|
|
// to do whatever it is they want to do ... to do this we pull relevant information for the
|
|
// user (and any groups they belong to)
|
|
//
|
|
// Now we compare the users access level against the forums. We assume here that a moderator
|
|
// and admin automatically have access to an ACL forum, similarly we assume admins meet an
|
|
// auth requirement of MOD
|
|
//
|
|
// The access level assigned to a single user automatically takes precedence over any levels
|
|
// granted by that user being a member of a multi-user usergroup, eg. a user who is banned
|
|
// from a forum won't gain access to it even if they belong to a group which has access (and
|
|
// vice versa). This check is done via the single_user check
|
|
//
|
|
// PS : I appologise for the fantastically clear and hugely readable code here ;) Simple gist
|
|
// is, if this row of auth_access doesn't represent a single user then OR the contents of
|
|
// relevant auth_access levels against the current level (allows maximum group privileges to
|
|
// be assigned). If the row does represent a single user then forget any previous group results
|
|
// and instead set the auth to whatever the OR'd contents of the access levels are.
|
|
//
|
|
if($forum_id != AUTH_LIST_ALL)
|
|
{
|
|
$value = $f_access[$key];
|
|
|
|
switch($value)
|
|
{
|
|
case AUTH_ALL:
|
|
$auth_user[$key] = TRUE;
|
|
$auth_user[$key . '_type'] = $lang['Anonymous_users'];
|
|
break;
|
|
|
|
case AUTH_REG:
|
|
$auth_user[$key] = ( $userdata['session_logged_in'] ) ? TRUE : 0;
|
|
$auth_user[$key . '_type'] = $lang['Registered_Users'];
|
|
break;
|
|
|
|
case AUTH_ACL:
|
|
$auth_user[$key] = ( $userdata['session_logged_in'] ) ? auth_check_user(AUTH_ACL, $key, $u_access, $is_admin) : 0;
|
|
$auth_user[$key . '_type'] = $lang['Users_granted_access'];
|
|
break;
|
|
|
|
case AUTH_MOD:
|
|
$auth_user[$key] = ( $userdata['session_logged_in'] ) ? auth_check_user(AUTH_MOD, 'auth_mod', $u_access, $is_admin) : 0;
|
|
$auth_user[$key . '_type'] = $lang['Moderators'];
|
|
break;
|
|
|
|
case AUTH_ADMIN:
|
|
$auth_user[$key] = $is_admin;
|
|
$auth_user[$key . '_type'] = $lang['Administrators'];
|
|
break;
|
|
|
|
default:
|
|
$auth_user[$key] = 0;
|
|
break;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
for($k = 0; $k < count($f_access); $k++)
|
|
{
|
|
$value = $f_access[$k][$key];
|
|
$f_forum_id = $f_access[$k]['forum_id'];
|
|
|
|
switch($value)
|
|
{
|
|
case AUTH_ALL:
|
|
$auth_user[$f_forum_id][$key] = TRUE;
|
|
$auth_user[$f_forum_id][$key . '_type'] = $lang['Anonymous_users'];
|
|
break;
|
|
|
|
case AUTH_REG:
|
|
$auth_user[$f_forum_id][$key] = ( $userdata['session_logged_in'] ) ? TRUE : 0;
|
|
$auth_user[$f_forum_id][$key . '_type'] = $lang['Registered_Users'];
|
|
break;
|
|
|
|
case AUTH_ACL:
|
|
$auth_user[$f_forum_id][$key] = ( $userdata['session_logged_in'] ) ? auth_check_user(AUTH_ACL, $key, $u_access[$f_forum_id], $is_admin) : 0;
|
|
$auth_user[$f_forum_id][$key . '_type'] = $lang['Users_granted_access'];
|
|
break;
|
|
|
|
case AUTH_MOD:
|
|
$auth_user[$f_forum_id][$key] = ( $userdata['session_logged_in'] ) ? auth_check_user(AUTH_MOD, 'auth_mod', $u_access[$f_forum_id], $is_admin) : 0;
|
|
$auth_user[$f_forum_id][$key . '_type'] = $lang['Moderators'];
|
|
break;
|
|
|
|
case AUTH_ADMIN:
|
|
$auth_user[$f_forum_id][$key] = $is_admin;
|
|
$auth_user[$f_forum_id][$key . '_type'] = $lang['Administrators'];
|
|
break;
|
|
|
|
default:
|
|
$auth_user[$f_forum_id][$key] = 0;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// Is user a moderator?
|
|
//
|
|
if($forum_id != AUTH_LIST_ALL)
|
|
{
|
|
$auth_user['auth_mod'] = ($userdata['session_logged_in']) ? auth_check_user(AUTH_MOD, 'auth_mod', $u_access, $is_admin) : 0;
|
|
}
|
|
else
|
|
{
|
|
for($k = 0; $k < count($f_access); $k++)
|
|
{
|
|
$f_forum_id = $f_access[$k]['forum_id'];
|
|
|
|
$auth_user[$f_forum_id]['auth_mod'] = ($userdata['session_logged_in']) ? auth_check_user(AUTH_MOD, 'auth_mod', $u_access[$f_forum_id], $is_admin) : 0;
|
|
}
|
|
}
|
|
|
|
return $auth_user;
|
|
}
|
|
|
|
function auth_check_user($type, $key, $u_access, $is_admin)
|
|
{
|
|
$single_user = 0;
|
|
$auth_user = 0;
|
|
|
|
if(count($u_access))
|
|
{
|
|
for($j = 0; $j < count($u_access); $j++)
|
|
{
|
|
$result = 0;
|
|
switch($type)
|
|
{
|
|
case AUTH_ACL:
|
|
$result = $u_access[$j][$key];
|
|
|
|
case AUTH_MOD:
|
|
$result = $result || $u_access[$j]['auth_mod'];
|
|
|
|
case AUTH_ADMIN:
|
|
$result = $result || $is_admin;
|
|
break;
|
|
}
|
|
|
|
$auth_user = $auth_user || $result;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
$auth_user = $is_admin;
|
|
}
|
|
|
|
return $auth_user;
|
|
}
|
|
|
|
?>
|