') || ($sExpr == ''))
{
$aRes = null;
}
elseif (strtolower(substr($sExpr, 0, 6)) == 'select')
{
$sColumn = $this->Get('attribute');
// SELECT...
$oValueSetDef = new ValueSetObjects($sExpr, $sColumn, array(), true /*allow all data*/);
$aRes = $oValueSetDef->GetValues(array('this' => $oObject), '');
}
else
{
// Constant value(s)
$aRes = explode(';', trim($sExpr));
}
return $aRes;
}
}
class URP_ActionGrant extends UserRightsBaseClass
{
public static function Init()
{
$aParams = array
(
"category" => "addon/userrights",
"key_type" => "autoincrement",
"name_attcode" => "profileid",
"state_attcode" => "",
"reconc_keys" => array(),
"db_table" => "priv_urp_grant_actions",
"db_key_field" => "id",
"db_finalclass_field" => "",
"display_template" => "",
);
MetaModel::Init_Params($aParams);
//MetaModel::Init_InheritAttributes();
// Common to all grant classes (could be factorized by class inheritence, but this has to be benchmarked)
MetaModel::Init_AddAttribute(new AttributeExternalKey("profileid", array("targetclass"=>"URP_Profiles", "jointype"=> "", "allowed_values"=>null, "sql"=>"profileid", "is_null_allowed"=>false, "on_target_delete"=>DEL_MANUAL, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeExternalField("profile", array("allowed_values"=>null, "extkey_attcode"=> 'profileid', "target_attcode"=>"name")));
MetaModel::Init_AddAttribute(new AttributeClass("class", array("class_category"=>"", "more_values"=>"", "sql"=>"class", "default_value"=>null, "is_null_allowed"=>false, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeEnum("permission", array("allowed_values"=>new ValueSetEnum('yes,no'), "sql"=>"permission", "default_value"=>"yes", "is_null_allowed"=>false, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeString("action", array("allowed_values"=>null, "sql"=>"action", "default_value"=>"", "is_null_allowed"=>false, "depends_on"=>array())));
// Display lists
MetaModel::Init_SetZListItems('details', array('profileid', 'class', 'permission', 'action')); // Attributes to be displayed for the complete details
MetaModel::Init_SetZListItems('list', array('class', 'permission', 'action')); // Attributes to be displayed for a list
// Search criteria
MetaModel::Init_SetZListItems('standard_search', array('profileid', 'class', 'permission', 'action')); // Criteria of the std search form
MetaModel::Init_SetZListItems('advanced_search', array('profileid', 'class', 'permission', 'action')); // Criteria of the advanced search form
}
}
class URP_StimulusGrant extends UserRightsBaseClass
{
public static function Init()
{
$aParams = array
(
"category" => "addon/userrights",
"key_type" => "autoincrement",
"name_attcode" => "profileid",
"state_attcode" => "",
"reconc_keys" => array(),
"db_table" => "priv_urp_grant_stimulus",
"db_key_field" => "id",
"db_finalclass_field" => "",
"display_template" => "",
);
MetaModel::Init_Params($aParams);
//MetaModel::Init_InheritAttributes();
// Common to all grant classes (could be factorized by class inheritence, but this has to be benchmarked)
MetaModel::Init_AddAttribute(new AttributeExternalKey("profileid", array("targetclass"=>"URP_Profiles", "jointype"=> "", "allowed_values"=>null, "sql"=>"profileid", "is_null_allowed"=>false, "on_target_delete"=>DEL_MANUAL, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeExternalField("profile", array("allowed_values"=>null, "extkey_attcode"=> 'profileid', "target_attcode"=>"name")));
MetaModel::Init_AddAttribute(new AttributeClass("class", array("class_category"=>"", "more_values"=>"", "sql"=>"class", "default_value"=>null, "is_null_allowed"=>false, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeEnum("permission", array("allowed_values"=>new ValueSetEnum('yes,no'), "sql"=>"permission", "default_value"=>"yes", "is_null_allowed"=>false, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeString("stimulus", array("allowed_values"=>null, "sql"=>"action", "default_value"=>"", "is_null_allowed"=>false, "depends_on"=>array())));
// Display lists
MetaModel::Init_SetZListItems('details', array('profileid', 'class', 'permission', 'stimulus')); // Attributes to be displayed for the complete details
MetaModel::Init_SetZListItems('list', array('class', 'permission', 'stimulus')); // Attributes to be displayed for a list
// Search criteria
MetaModel::Init_SetZListItems('standard_search', array('profileid', 'class', 'permission', 'stimulus')); // Criteria of the std search form
MetaModel::Init_SetZListItems('advanced_search', array('profileid', 'class', 'permission', 'stimulus')); // Criteria of the advanced search form
}
}
class URP_AttributeGrant extends UserRightsBaseClass
{
public static function Init()
{
$aParams = array
(
"category" => "addon/userrights",
"key_type" => "autoincrement",
"name_attcode" => "actiongrantid",
"state_attcode" => "",
"reconc_keys" => array(),
"db_table" => "priv_urp_grant_attributes",
"db_key_field" => "id",
"db_finalclass_field" => "",
"display_template" => "",
);
MetaModel::Init_Params($aParams);
//MetaModel::Init_InheritAttributes();
MetaModel::Init_AddAttribute(new AttributeExternalKey("actiongrantid", array("targetclass"=>"URP_ActionGrant", "jointype"=> "", "allowed_values"=>null, "sql"=>"actiongrantid", "is_null_allowed"=>false, "on_target_delete"=>DEL_MANUAL, "depends_on"=>array())));
MetaModel::Init_AddAttribute(new AttributeString("attcode", array("allowed_values"=>null, "sql"=>"attcode", "default_value"=>null, "is_null_allowed"=>false, "depends_on"=>array())));
// Display lists
MetaModel::Init_SetZListItems('details', array('actiongrantid', 'attcode')); // Attributes to be displayed for the complete details
MetaModel::Init_SetZListItems('list', array('attcode')); // Attributes to be displayed for a list
// Search criteria
MetaModel::Init_SetZListItems('standard_search', array('actiongrantid', 'attcode')); // Criteria of the std search form
MetaModel::Init_SetZListItems('advanced_search', array('actiongrantid', 'attcode')); // Criteria of the advanced search form
}
}
class UserRightsProjection extends UserRightsAddOnAPI
{
static public $m_aActionCodes = array(
UR_ACTION_READ => 'read',
UR_ACTION_MODIFY => 'modify',
UR_ACTION_DELETE => 'delete',
UR_ACTION_BULK_READ => 'bulk read',
UR_ACTION_BULK_MODIFY => 'bulk modify',
UR_ACTION_BULK_DELETE => 'bulk delete',
);
// Installation: create the very first user
public function CreateAdministrator($sAdminUser, $sAdminPwd, $sLanguage = 'EN US')
{
// Create a change to record the history of the User object
$oChange = MetaModel::NewObject("CMDBChange");
$oChange->Set("date", time());
$oChange->Set("userinfo", "Initialization");
$iChangeId = $oChange->DBInsert();
$oOrg = new Organization();
$oOrg->Set('name', 'My Company/Department');
$oOrg->Set('code', 'SOMECODE');
// $oOrg->Set('status', 'implementation');
//$oOrg->Set('parent_id', xxx);
$iOrgId = $oOrg->DBInsertTrackedNoReload($oChange, true /* skip strong security */);
// Location : optional
//$oLocation = new bizLocation();
//$oLocation->Set('name', 'MyOffice');
//$oLocation->Set('status', 'implementation');
//$oLocation->Set('org_id', $iOrgId);
//$oLocation->Set('severity', 'high');
//$oLocation->Set('address', 'my building in my city');
//$oLocation->Set('country', 'my country');
//$oLocation->Set('parent_location_id', xxx);
//$iLocationId = $oLocation->DBInsertNoReload();
$oContact = new Person();
$oContact->Set('name', 'My last name');
$oContact->Set('first_name', 'My first name');
//$oContact->Set('status', 'available');
$oContact->Set('org_id', $iOrgId);
$oContact->Set('email', 'my.email@foo.org');
//$oContact->Set('phone', '');
//$oContact->Set('location_id', $iLocationId);
//$oContact->Set('employee_number', '');
$iContactId = $oContact->DBInsertTrackedNoReload($oChange, true /* skip security */);
$oUser = new UserLocal();
$oUser->Set('login', $sAdminUser);
$oUser->Set('password', $sAdminPwd);
$oUser->Set('contactid', $iContactId);
$oUser->Set('language', $sLanguage); // Language was chosen during the installation
$iUserId = $oUser->DBInsertTrackedNoReload($oChange, true /* skip security */);
// Add this user to the very specific 'admin' profile
$oUserProfile = new URP_UserProfile();
$oUserProfile->Set('userid', $iUserId);
$oUserProfile->Set('profileid', ADMIN_PROFILE_ID);
$oUserProfile->Set('reason', 'By definition, the administrator must have the administrator profile');
$oUserProfile->DBInsertTrackedNoReload($oChange, true /* skip security */);
return true;
}
public function IsAdministrator($oUser)
{
if (in_array($oUser->GetKey(), $this->m_aAdmins))
{
return true;
}
else
{
return false;
}
}
public function IsPortalUser($oUser)
{
return true;
// See implementation of userrightsprofile
}
public function Init()
{
// CacheData to be invoked in a module extension
//MetaModel::RegisterPlugin('userrights', 'ACbyProfile', array($this, 'CacheData'));
}
protected $m_aDimensions = array(); // id -> object
protected $m_aClassProj = array(); // class,dimensionid -> object
protected $m_aProfiles = array(); // id -> object
protected $m_aUserProfiles = array(); // userid,profileid -> object
protected $m_aProPro = array(); // profileid,dimensionid -> object
protected $m_aAdmins = array(); // id of users being linked to the well-known admin profile
protected $m_aClassActionGrants = array(); // profile, class, action -> permission
protected $m_aClassStimulusGrants = array(); // profile, class, stimulus -> permission
protected $m_aObjectActionGrants = array(); // userid, class, id, action -> permission, list of attributes
public function CacheData()
{
// Could be loaded in a shared memory (?)
$oDimensionSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData("SELECT URP_Dimensions"));
$this->m_aDimensions = array();
while ($oDimension = $oDimensionSet->Fetch())
{
$this->m_aDimensions[$oDimension->GetKey()] = $oDimension;
}
$oClassProjSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData("SELECT URP_ClassProjection"));
$this->m_aClassProjs = array();
while ($oClassProj = $oClassProjSet->Fetch())
{
$this->m_aClassProjs[$oClassProj->Get('class')][$oClassProj->Get('dimensionid')] = $oClassProj;
}
$oProfileSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData("SELECT URP_Profiles"));
$this->m_aProfiles = array();
while ($oProfile = $oProfileSet->Fetch())
{
$this->m_aProfiles[$oProfile->GetKey()] = $oProfile;
}
$oUserProfileSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData("SELECT URP_UserProfile"));
$this->m_aUserProfiles = array();
$this->m_aAdmins = array();
while ($oUserProfile = $oUserProfileSet->Fetch())
{
$this->m_aUserProfiles[$oUserProfile->Get('userid')][$oUserProfile->Get('profileid')] = $oUserProfile;
if ($oUserProfile->Get('profileid') == ADMIN_PROFILE_ID)
{
$this->m_aAdmins[] = $oUserProfile->Get('userid');
}
}
$oProProSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData("SELECT URP_ProfileProjection"));
$this->m_aProPros = array();
while ($oProPro = $oProProSet->Fetch())
{
$this->m_aProPros[$oProPro->Get('profileid')][$oProPro->Get('dimensionid')] = $oProPro;
}
/*
echo "\n";
print_r($this->m_aDimensions);
print_r($this->m_aClassProjs);
print_r($this->m_aProfiles);
print_r($this->m_aUserProfiles);
print_r($this->m_aProPros);
echo "
\n";
exit;
*/
return true;
}
public function GetSelectFilter($oUser, $sClass, $aSettings = array())
{
$aConditions = array();
foreach ($this->m_aDimensions as $iDimension => $oDimension)
{
$oClassProj = @$this->m_aClassProjs[$sClass][$iDimension];
if (is_null($oClassProj))
{
// Authorize any for this dimension, then no additional criteria is required
continue;
}
// 1 - Get class projection info
//
$oExpression = null;
$sExpr = $oClassProj->Get('value');
if ($sExpr == '')
{
$sColumn = $oClassProj->Get('attribute');
if (empty($sColumn))
{
$oExpression = new FieldExpression('id', $sClass);
}
else
{
$oExpression = new FieldExpression($sColumn, $sClass);
}
}
elseif (($sExpr == '') || ($sExpr == ''))
{
// Authorize any for this dimension, then no additional criteria is required
continue;
}
elseif (strtolower(substr($sExpr, 0, 6)) == 'select')
{
throw new CoreException('Sorry, projections by the mean of OQL are not supported currently, please specify an attribute instead', array('class' => $sClass, 'expression' => $sExpr));
}
else
{
// Constant value(s)
// unsupported
throw new CoreException('Sorry, constant projections are not supported currently, please specify an attribute instead', array('class' => $sClass, 'expression' => $sExpr));
// $aRes = explode(';', trim($sExpr));
}
// 2 - Get profile projection info and use it if needed
//
$aProjections = self::GetReadableProjectionsByDim($oUser, $sClass, $oDimension);
if (is_null($aProjections))
{
// Authorize any for this dimension, then no additional criteria is required
continue;
}
elseif (count($aProjections) == 0)
{
// Authorize none, then exit as quickly as possible
return false;
}
else
{
// Authorize the given set of values
$oListExpr = ListExpression::FromScalars($aProjections);
$oCondition = new BinaryExpression($oExpression, 'IN', $oListExpr);
$aConditions[] = $oCondition;
}
}
if (count($aConditions) == 0)
{
// allow all
return true;
}
else
{
$oFilter = new DBObjectSearch($sClass);
foreach($aConditions as $oCondition)
{
$oFilter->AddConditionExpression($oCondition);
}
//return true;
return $oFilter;
}
}
// This verb has been made public to allow the development of an accurate feedback for the current configuration
public function GetClassActionGrant($iProfile, $sClass, $sAction)
{
if (isset($this->m_aClassActionGrants[$iProfile][$sClass][$sAction]))
{
return $this->m_aClassActionGrants[$iProfile][$sClass][$sAction];
}
// Get the permission for this profile/class/action
$oSearch = DBObjectSearch::FromOQL_AllData("SELECT URP_ActionGrant WHERE class = :class AND action = :action AND profileid = :profile AND permission = 'yes'");
$oSet = new DBObjectSet($oSearch, array(), array('class'=>$sClass, 'action'=>$sAction, 'profile'=>$iProfile));
if ($oSet->Count() >= 1)
{
$oGrantRecord = $oSet->Fetch();
}
else
{
$sParentClass = MetaModel::GetParentPersistentClass($sClass);
if (empty($sParentClass))
{
$oGrantRecord = null;
}
else
{
$oGrantRecord = $this->GetClassActionGrant($iProfile, $sParentClass, $sAction);
}
}
$this->m_aClassActionGrants[$iProfile][$sClass][$sAction] = $oGrantRecord;
return $oGrantRecord;
}
protected function GetObjectActionGrant($oUser, $sClass, $iActionCode, /*DBObject*/ $oObject = null)
{
if(is_null($oObject))
{
$iObjectRef = -999;
}
else
{
$iObjectRef = $oObject->GetKey();
}
// load and cache permissions for the current user on the given object
//
$aTest = @$this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iObjectRef][$iActionCode];
if (is_array($aTest)) return $aTest;
$sAction = self::$m_aActionCodes[$iActionCode];
$iInstancePermission = UR_ALLOWED_NO;
$aAttributes = array();
foreach($this->GetMatchingProfiles($oUser, $sClass, $oObject) as $iProfile)
{
$oGrantRecord = $this->GetClassActionGrant($iProfile, $sClass, $sAction);
if (is_null($oGrantRecord))
{
continue; // loop to the next profile
}
else
{
$iInstancePermission = UR_ALLOWED_YES;
// update the list of attributes with those allowed for this profile
//
$oSearch = DBObjectSearch::FromOQL_AllData("SELECT URP_AttributeGrant WHERE actiongrantid = :actiongrantid");
$oSet = new DBObjectSet($oSearch, array(), array('actiongrantid' => $oGrantRecord->GetKey()));
$aProfileAttributes = $oSet->GetColumnAsArray('attcode', false);
if (count($aProfileAttributes) == 0)
{
$aAllAttributes = array_keys(MetaModel::ListAttributeDefs($sClass));
$aAttributes = array_merge($aAttributes, $aAllAttributes);
}
else
{
$aAttributes = array_merge($aAttributes, $aProfileAttributes);
}
}
}
$aRes = array(
'permission' => $iInstancePermission,
'attributes' => $aAttributes,
);
$this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iObjectRef][$iActionCode] = $aRes;
return $aRes;
}
public function IsActionAllowed($oUser, $sClass, $iActionCode, $oInstanceSet = null)
{
if (is_null($oInstanceSet))
{
$aObjectPermissions = $this->GetObjectActionGrant($oUser, $sClass, $iActionCode);
return $aObjectPermissions['permission'];
}
$oInstanceSet->Rewind();
while($oObject = $oInstanceSet->Fetch())
{
$aObjectPermissions = $this->GetObjectActionGrant($oUser, $sClass, $iActionCode, $oObject);
$iInstancePermission = $aObjectPermissions['permission'];
if (isset($iGlobalPermission))
{
if ($iInstancePermission != $iGlobalPermission)
{
$iGlobalPermission = UR_ALLOWED_DEPENDS;
break;
}
}
else
{
$iGlobalPermission = $iInstancePermission;
}
}
$oInstanceSet->Rewind();
if (isset($iGlobalPermission))
{
return $iGlobalPermission;
}
else
{
return UR_ALLOWED_NO;
}
}
public function IsActionAllowedOnAttribute($oUser, $sClass, $sAttCode, $iActionCode, $oInstanceSet = null)
{
if (is_null($oInstanceSet))
{
$aObjectPermissions = $this->GetObjectActionGrant($oUser, $sClass, $iActionCode);
$aAttributes = $aObjectPermissions['attributes'];
if (in_array($sAttCode, $aAttributes))
{
return $aObjectPermissions['permission'];
}
else
{
return UR_ALLOWED_NO;
}
}
$oInstanceSet->Rewind();
while($oObject = $oInstanceSet->Fetch())
{
$aObjectPermissions = $this->GetObjectActionGrant($oUser, $sClass, $iActionCode, $oObject);
$aAttributes = $aObjectPermissions['attributes'];
if (in_array($sAttCode, $aAttributes))
{
$iInstancePermission = $aObjectPermissions['permission'];
}
else
{
$iInstancePermission = UR_ALLOWED_NO;
}
if (isset($iGlobalPermission))
{
if ($iInstancePermission != $iGlobalPermission)
{
$iGlobalPermission = UR_ALLOWED_DEPENDS;
}
}
else
{
$iGlobalPermission = $iInstancePermission;
}
}
$oInstanceSet->Rewind();
if (isset($iGlobalPermission))
{
return $iGlobalPermission;
}
else
{
return UR_ALLOWED_NO;
}
}
// This verb has been made public to allow the development of an accurate feedback for the current configuration
public function GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode)
{
if (isset($this->m_aClassStimulusGrants[$iProfile][$sClass][$sStimulusCode]))
{
return $this->m_aClassStimulusGrants[$iProfile][$sClass][$sStimulusCode];
}
// Get the permission for this profile/class/stimulus
$oSearch = DBObjectSearch::FromOQL_AllData("SELECT URP_StimulusGrant WHERE class = :class AND stimulus = :stimulus AND profileid = :profile AND permission = 'yes'");
$oSet = new DBObjectSet($oSearch, array(), array('class'=>$sClass, 'stimulus'=>$sStimulusCode, 'profile'=>$iProfile));
if ($oSet->Count() >= 1)
{
$oGrantRecord = $oSet->Fetch();
}
else
{
$oGrantRecord = null;
}
$this->m_aClassStimulusGrants[$iProfile][$sClass][$sStimulusCode] = $oGrantRecord;
return $oGrantRecord;
}
public function IsStimulusAllowed($oUser, $sClass, $sStimulusCode, $oInstanceSet = null)
{
// Note: this code is VERY close to the code of IsActionAllowed()
if (is_null($oInstanceSet))
{
$iInstancePermission = UR_ALLOWED_NO;
foreach($this->GetMatchingProfiles($oUser, $sClass) as $iProfile)
{
$oGrantRecord = $this->GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode);
if (!is_null($oGrantRecord))
{
// no need to fetch the record, we've requested the records having permission = 'yes'
$iInstancePermission = UR_ALLOWED_YES;
}
}
return $iInstancePermission;
}
$oInstanceSet->Rewind();
while($oObject = $oInstanceSet->Fetch())
{
$iInstancePermission = UR_ALLOWED_NO;
foreach($this->GetMatchingProfiles($oUser, $sClass, $oObject) as $iProfile)
{
$oGrantRecord = $this->GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode);
if (!is_null($oGrantRecord))
{
// no need to fetch the record, we've requested the records having permission = 'yes'
$iInstancePermission = UR_ALLOWED_YES;
}
}
if (isset($iGlobalPermission))
{
if ($iInstancePermission != $iGlobalPermission)
{
$iGlobalPermission = UR_ALLOWED_DEPENDS;
}
}
else
{
$iGlobalPermission = $iInstancePermission;
}
}
$oInstanceSet->Rewind();
if (isset($iGlobalPermission))
{
return $iGlobalPermission;
}
else
{
return UR_ALLOWED_NO;
}
}
// Copied from GetMatchingProfilesByDim()
// adapted to the optimized implementation of GetSelectFilter()
// Note: shares the cache m_aProPros with GetMatchingProfilesByDim()
// Returns null if any object is readable
// an array of allowed projections otherwise (could be an empty array if none is allowed)
protected function GetReadableProjectionsByDim($oUser, $sClass, $oDimension)
{
//
// Given a dimension, lists the values for which the user will be allowed to read the objects
//
$iUser = $oUser->GetKey();
$iDimension = $oDimension->GetKey();
$aRes = array();
if (array_key_exists($iUser, $this->m_aUserProfiles))
{
foreach ($this->m_aUserProfiles[$iUser] as $iProfile => $oProfile)
{
// user projection to be cached on a given page !
if (!isset($this->m_aProPros[$iProfile][$iDimension]))
{
// No projection for a given profile: default to 'any'
return null;
}
$aUserProjection = $this->m_aProPros[$iProfile][$iDimension]->ProjectUser($oUser);
if (is_null($aUserProjection))
{
// No projection for a given profile: default to 'any'
return null;
}
$aRes = array_unique(array_merge($aRes, $aUserProjection));
}
}
return $aRes;
}
// Note: shares the cache m_aProPros with GetReadableProjectionsByDim()
protected function GetMatchingProfilesByDim($oUser, $oObject, $oDimension)
{
//
// List profiles for which the user projection overlaps the object projection in the given dimension
//
$iUser = $oUser->GetKey();
$sClass = get_class($oObject);
$iPKey = $oObject->GetKey();
$iDimension = $oDimension->GetKey();
if (isset($this->m_aClassProjs[$sClass][$iDimension]))
{
$aObjectProjection = $this->m_aClassProjs[$sClass][$iDimension]->ProjectObject($oObject);
}
else
{
// No projection for a given class: default to 'any'
$aObjectProjection = null;
}
$aRes = array();
if (array_key_exists($iUser, $this->m_aUserProfiles))
{
foreach ($this->m_aUserProfiles[$iUser] as $iProfile => $oProfile)
{
if (is_null($aObjectProjection))
{
$aRes[] = $iProfile;
}
else
{
// user projection to be cached on a given page !
if (isset($this->m_aProPros[$iProfile][$iDimension]))
{
$aUserProjection = $this->m_aProPros[$iProfile][$iDimension]->ProjectUser($oUser);
}
else
{
// No projection for a given profile: default to 'any'
$aUserProjection = null;
}
if (is_null($aUserProjection))
{
$aRes[] = $iProfile;
}
else
{
$aMatchingValues = array_intersect($aObjectProjection, $aUserProjection);
if (count($aMatchingValues) > 0)
{
$aRes[] = $iProfile;
}
}
}
}
}
return $aRes;
}
protected $m_aMatchingProfiles = array(); // cache of the matching profiles for a given user/object
protected function GetMatchingProfiles($oUser, $sClass, /*DBObject*/ $oObject = null)
{
$iUser = $oUser->GetKey();
if(is_null($oObject))
{
$iObjectRef = -999;
}
else
{
$iObjectRef = $oObject->GetKey();
}
//
// List profiles for which the user projection overlaps the object projection in each and every dimension
// Caches the result
//
$aTest = @$this->m_aMatchingProfiles[$iUser][$sClass][$iObjectRef];
if (is_array($aTest))
{
return $aTest;
}
if (is_null($oObject))
{
if (array_key_exists($iUser, $this->m_aUserProfiles))
{
$aRes = array_keys($this->m_aUserProfiles[$iUser]);
}
else
{
// no profile has been defined for this user
$aRes = array();
}
}
else
{
$aProfileRes = array();
foreach ($this->m_aDimensions as $iDimension => $oDimension)
{
foreach ($this->GetMatchingProfilesByDim($oUser, $oObject, $oDimension) as $iProfile)
{
@$aProfileRes[$iProfile] += 1;
}
}
$aRes = array();
$iDimCount = count($this->m_aDimensions);
foreach ($aProfileRes as $iProfile => $iMatches)
{
if ($iMatches == $iDimCount)
{
$aRes[] = $iProfile;
}
}
}
// store into the cache
$this->m_aMatchingProfiles[$iUser][$sClass][$iObjectRef] = $aRes;
return $aRes;
}
public function FlushPrivileges()
{
$this->CacheData();
}
}
UserRights::SelectModule('UserRightsProjection');
?>