?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add icd9 and minor fixes to the following:
[openemr.git] / gacl / gacl.class.php
bloba1db3a790678760e2a61482fe865af708131a0ec
1 <?php
2 // $Id$
3
4 /**
5 * phpGACL - Generic Access Control List
6 * Copyright (C) 2002,2003 Mike Benoit
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 * For questions, help, comments, discussion, etc., please join the
23 * phpGACL mailing list. http://sourceforge.net/mail/?group_id=57103
24 *
25 * You may contact the author of phpGACL by e-mail at:
26 * ipso@snappymail.ca
27 *
28 * The latest version of phpGACL can be obtained from:
29 * http://phpgacl.sourceforge.net/
30 *
31 * @package phpGACL
32 */
33
34 /*
35 * Path to ADODB.
36 */
37 if ( !defined('ADODB_DIR') ) {
38 define('ADODB_DIR', dirname(__FILE__).'/adodb');
39 }
40
41 //openemr configuration file - bm - 05-2009
42 // to collect sql database login info and the utf8 flag
43 include_once(dirname(__FILE__).'/../library/sqlconf.php');
44
45 /**
46 * phpGACL main class
47 *
48 * Class gacl should be used in applications where only querying the phpGACL
49 * database is required.
50 *
51 * @package phpGACL
52 * @author Mike Benoit <ipso@snappymail.ca>
53 */
54 class gacl {
55 /*
56 --- phpGACL Configuration path/file ---
57 */
58 var $config_file = '';
59
60 /*
61 --- Private properties ---
62 */
63 /** @var boolean Enables Debug output if true */
64 var $_debug = FALSE;
65
66 /*
67 --- Database configuration. ---
68 */
69 /** @var string Prefix for all the phpgacl tables in the database */
70 var $_db_table_prefix = 'gacl_';
71
72 /** @var string The database type, based on available ADODB connectors - mysql, postgres7, sybase, oci8po See here for more: http://php.weblogs.com/adodb_manual#driverguide */
73 var $_db_type = 'mysql';
74
75 /** @var string The database server */
76 var $_db_host = '';
77
78 /** @var string The database user name */
79 var $_db_user = '';
80
81 /** @var string The database user password */
82 var $_db_password = '';
83
84 /** @var string The database name */
85 var $_db_name = '';
86
87 /** @var object An ADODB database connector object */
88 var $_db = '';
89
90 /** @var boolean The utf8 encoding flag - bm 05-2009 */
91 var $_db_utf8_flag = '';
92
93 /*
94 * NOTE: This cache must be manually cleaned each time ACL's are modified.
95 * Alternatively you could wait for the cache to expire.
96 */
97
98 /** @var boolean Caches queries if true */
99 var $_caching = FALSE;
100
101 /** @var boolean Force cache to expire */
102 var $_force_cache_expire = TRUE;
103
104 /** @var string The directory for cache file to eb written (ensure write permission are set) */
105 var $_cache_dir = '/tmp/phpgacl_cache'; // NO trailing slash
106
107 /** @var int The time for the cache to expire in seconds - 600 == Ten Minutes */
108 var $_cache_expire_time=600;
109
110 /** @var string A switch to put acl_check into '_group_' mode */
111 var $_group_switch = '_group_';
112
113 /**
114 * Constructor
115 * @param array An arry of options to oeverride the class defaults
116 */
117 function gacl($options = NULL) {
118
119 $available_options = array('db','debug','items_per_page','max_select_box_items','max_search_return_items','db_table_prefix','db_type','db_host','db_user','db_password','db_name','caching','force_cache_expire','cache_dir','cache_expire_time');
120
121 //Values supplied in $options array overwrite those in the config file.
122 if ( file_exists($this->config_file) ) {
123 $config = parse_ini_file($this->config_file);
124
125 if ( is_array($config) ) {
126 $gacl_options = array_merge($config, $options);
127 }
128
129 unset($config);
130 }
131
132 if (is_array($options)) {
133 foreach ($options as $key => $value) {
134 $this->debug_text("Option: $key");
135
136 if (in_array($key, $available_options) ) {
137 $this->debug_text("Valid Config options: $key");
138 $property = '_'.$key;
139 $this->$property = $value;
140 } else {
141 $this->debug_text("ERROR: Config option: $key is not a valid option");
142 }
143 }
144 }
145
146 //collect openemr sql info from include at top of script - bm 05-2009
147 global $sqlconf, $disable_utf8_flag;
148 $this->_db_host = $sqlconf["host"];
149 $this->_db_user = $sqlconf["login"];
150 $this->_db_password = $sqlconf["pass"];
151 $this->_db_name = $sqlconf["dbase"];
152 if (!$disable_utf8_flag) {
153 $utf8_flag = true;
154 }
155 else {
156 $utf8_flag = false;
157 }
158 $this->_db_utf8_flag = $utf8_flag;
159
160 require_once( ADODB_DIR .'/adodb.inc.php');
161 require_once( ADODB_DIR .'/adodb-pager.inc.php');
162
163 if (is_object($this->_db)) {
164 $this->db = &$this->_db;
165 } else {
166 $this->db = ADONewConnection($this->_db_type);
167 //Use NUM for slight performance/memory reasons.
168 $this->db->SetFetchMode(ADODB_FETCH_NUM);
169 $this->db->PConnect($this->_db_host, $this->_db_user, $this->_db_password, $this->_db_name);
170
171 // Modified 5/2009 by BM for UTF-8 project
172 if ($this->_db_utf8_flag) {
173 $success_flag = $this->db->Execute("SET NAMES 'utf8'");
174 if (!$success_flag) {
175 error_log("PHP custom error: from gacl gacl/gacl.class.php - Unable to set up UTF8 encoding with mysql database".$this->db->ErrorMsg(), 0);
176 }
177 }
178 // ---------------------------------------
179
180 }
181 $this->db->debug = $this->_debug;
182
183 if ( $this->_caching == TRUE ) {
184 if (!class_exists('Hashed_Cache_Lite')) {
185 require_once(dirname(__FILE__) .'/Cache_Lite/Hashed_Cache_Lite.php');
186 }
187
188 /*
189 * Cache options. We default to the highest performance. If you run in to cache corruption problems,
190 * Change all the 'false' to 'true', this will slow things down slightly however.
191 */
192
193 $cache_options = array(
194 'caching' => $this->_caching,
195 'cacheDir' => $this->_cache_dir.'/',
196 'lifeTime' => $this->_cache_expire_time,
197 'fileLocking' => TRUE,
198 'writeControl' => FALSE,
199 'readControl' => FALSE,
200 'memoryCaching' => TRUE,
201 'automaticSerialization' => FALSE
202 );
203 $this->Cache_Lite = new Hashed_Cache_Lite($cache_options);
204 }
205
206 return true;
207 }
208
209 /**
210 * Prints debug text if debug is enabled.
211 * @param string THe text to output
212 * @return boolean Always returns true
213 */
214 function debug_text($text) {
215
216 if ($this->_debug) {
217 echo "$text<br>\n";
218 }
219
220 return true;
221 }
222
223 /**
224 * Prints database debug text if debug is enabled.
225 * @param string The name of the function calling this method
226 * @return string Returns an error message
227 */
228 function debug_db($function_name = '') {
229 if ($function_name != '') {
230 $function_name .= ' (): ';
231 }
232
233 return $this->debug_text ($function_name .'database error: '. $this->db->ErrorMsg() .' ('. $this->db->ErrorNo() .')');
234 }
235
236 /**
237 * Wraps the actual acl_query() function.
238 *
239 * It is simply here to return TRUE/FALSE accordingly.
240 * @param string The ACO section value
241 * @param string The ACO value
242 * @param string The ARO section value
243 * @param string The ARO section
244 * @param string The AXO section value (optional)
245 * @param string The AXO section value (optional)
246 * @param integer The group id of the ARO ??Mike?? (optional)
247 * @param integer The group id of the AXO ??Mike?? (optional)
248 * @return boolean TRUE if the check succeeds, false if not.
249 */
250 function acl_check($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL) {
251 $acl_result = $this->acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value, $axo_value, $root_aro_group, $root_axo_group);
252
253 return $acl_result['allow'];
254 }
255
256 /**
257 * Wraps the actual acl_query() function.
258 *
259 * Quick access to the return value of an ACL.
260 * @param string The ACO section value
261 * @param string The ACO value
262 * @param string The ARO section value
263 * @param string The ARO section
264 * @param string The AXO section value (optional)
265 * @param string The AXO section value (optional)
266 * @param integer The group id of the ARO (optional)
267 * @param integer The group id of the AXO (optional)
268 * @return string The return value of the ACL
269 */
270 function acl_return_value($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL) {
271 $acl_result = $this->acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value, $axo_value, $root_aro_group, $root_axo_group);
272
273 return $acl_result['return_value'];
274 }
275
276 /**
277 * Handles ACL lookups over arrays of AROs
278 * @param string The ACO section value
279 * @param string The ACO value
280 * @param array An named array of arrays, each element in the format aro_section_value=>array(aro_value1,aro_value1,...)
281 * @return mixed The same data format as inputted.
282 \*======================================================================*/
283 function acl_check_array($aco_section_value, $aco_value, $aro_array) {
284 /*
285 Input Array:
286 Section => array(Value, Value, Value),
287 Section => array(Value, Value, Value)
288
289 */
290
291 if (!is_array($aro_array)) {
292 $this->debug_text("acl_query_array(): ARO Array must be passed");
293 return false;
294 }
295
296 foreach($aro_array as $aro_section_value => $aro_value_array) {
297 foreach ($aro_value_array as $aro_value) {
298 $this->debug_text("acl_query_array(): ARO Section Value: $aro_section_value ARO VALUE: $aro_value");
299
300 if( $this->acl_check($aco_section_value, $aco_value, $aro_section_value, $aro_value) ) {
301 $this->debug_text("acl_query_array(): ACL_CHECK True");
302 $retarr[$aro_section_value][] = $aro_value;
303 } else {
304 $this->debug_text("acl_query_array(): ACL_CHECK False");
305 }
306 }
307 }
308
309 return $retarr;
310
311 }
312
313 /**
314 * The Main function that does the actual ACL lookup.
315 * @param string The ACO section value
316 * @param string The ACO value
317 * @param string The ARO section value
318 * @param string The ARO section
319 * @param string The AXO section value (optional)
320 * @param string The AXO section value (optional)
321 * @param string The value of the ARO group (optional)
322 * @param string The value of the AXO group (optional)
323 * @param boolean Debug the operation if true (optional)
324 * @return array Returns as much information as possible about the ACL so other functions can trim it down and omit unwanted data.
325 */
326 function acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL, $debug=NULL) {
327
328 $cache_id = 'acl_query_'.$aco_section_value.'-'.$aco_value.'-'.$aro_section_value.'-'.$aro_value.'-'.$axo_section_value.'-'.$axo_value.'-'.$root_aro_group.'-'.$root_axo_group.'-'.$debug;
329
330 $retarr = $this->get_cache($cache_id);
331
332 if (!$retarr) {
333 /*
334 * Grab all groups mapped to this ARO/AXO
335 */
336 $aro_group_ids = $this->acl_get_groups($aro_section_value, $aro_value, $root_aro_group, 'ARO');
337
338 if (is_array($aro_group_ids) AND !empty($aro_group_ids)) {
339 $sql_aro_group_ids = implode(',', $aro_group_ids);
340 }
341
342 if ($axo_section_value != '' AND $axo_value != '') {
343 $axo_group_ids = $this->acl_get_groups($axo_section_value, $axo_value, $root_axo_group, 'AXO');
344
345 if (is_array($axo_group_ids) AND !empty($axo_group_ids)) {
346 $sql_axo_group_ids = implode(',', $axo_group_ids);
347 }
348 }
349
350 /*
351 * This query is where all the magic happens.
352 * The ordering is very important here, as well very tricky to get correct.
353 * Currently there can be duplicate ACLs, or ones that step on each other toes. In this case, the ACL that was last updated/created
354 * is used.
355 *
356 * This is probably where the most optimizations can be made.
357 */
358
359 $order_by = array();
360
361 $query = '
362 SELECT a.id,a.allow,a.return_value
363 FROM '. $this->_db_table_prefix .'acl a
364 LEFT JOIN '. $this->_db_table_prefix .'aco_map ac ON ac.acl_id=a.id';
365
366 if ($aro_section_value != $this->_group_switch) {
367 $query .= '
368 LEFT JOIN '. $this->_db_table_prefix .'aro_map ar ON ar.acl_id=a.id';
369 }
370
371 if ($axo_section_value != $this->_group_switch) {
372 $query .= '
373 LEFT JOIN '. $this->_db_table_prefix .'axo_map ax ON ax.acl_id=a.id';
374 }
375
376 /*
377 * if there are no aro groups, don't bother doing the join.
378 */
379 if (isset($sql_aro_group_ids)) {
380 $query .= '
381 LEFT JOIN '. $this->_db_table_prefix .'aro_groups_map arg ON arg.acl_id=a.id
382 LEFT JOIN '. $this->_db_table_prefix .'aro_groups rg ON rg.id=arg.group_id';
383 }
384
385 // this join is necessary to weed out rules associated with axo groups
386 $query .= '
387 LEFT JOIN '. $this->_db_table_prefix .'axo_groups_map axg ON axg.acl_id=a.id';
388
389 /*
390 * if there are no axo groups, don't bother doing the join.
391 * it is only used to rank by the level of the group.
392 */
393 if (isset($sql_axo_group_ids)) {
394 $query .= '
395 LEFT JOIN '. $this->_db_table_prefix .'axo_groups xg ON xg.id=axg.group_id';
396 }
397
398 //Move the below line to the LEFT JOIN above for PostgreSQL's sake.
399 //AND ac.acl_id=a.id
400 $query .= '
401 WHERE a.enabled=1
402 AND (ac.section_value='. $this->db->quote($aco_section_value) .' AND ac.value='. $this->db->quote($aco_value) .')';
403
404 // if we are querying an aro group
405 if ($aro_section_value == $this->_group_switch) {
406 // if acl_get_groups did not return an array
407 if ( !isset ($sql_aro_group_ids) ) {
408 $this->debug_text ('acl_query(): Invalid ARO Group: '. $aro_value);
409 return FALSE;
410 }
411
412 $query .= '
413 AND rg.id IN ('. $sql_aro_group_ids .')';
414
415 $order_by[] = '(rg.rgt-rg.lft) ASC';
416 } else {
417 $query .= '
418 AND ((ar.section_value='. $this->db->quote($aro_section_value) .' AND ar.value='. $this->db->quote($aro_value) .')';
419
420 if ( isset ($sql_aro_group_ids) ) {
421 $query .= ' OR rg.id IN ('. $sql_aro_group_ids .')';
422
423 $order_by[] = '(CASE WHEN ar.value IS NULL THEN 0 ELSE 1 END) DESC';
424 $order_by[] = '(rg.rgt-rg.lft) ASC';
425 }
426
427 $query .= ')';
428 }
429
430
431 // if we are querying an axo group
432 if ($axo_section_value == $this->_group_switch) {
433 // if acl_get_groups did not return an array
434 if ( !isset ($sql_axo_group_ids) ) {
435 $this->debug_text ('acl_query(): Invalid AXO Group: '. $axo_value);
436 return FALSE;
437 }
438
439 $query .= '
440 AND xg.id IN ('. $sql_axo_group_ids .')';
441
442 $order_by[] = '(xg.rgt-xg.lft) ASC';
443 } else {
444 $query .= '
445 AND (';
446
447 if ($axo_section_value == '' AND $axo_value == '') {
448 $query .= '(ax.section_value IS NULL AND ax.value IS NULL)';
449 } else {
450 $query .= '(ax.section_value='. $this->db->quote($axo_section_value) .' AND ax.value='. $this->db->quote($axo_value) .')';
451 }
452
453 if (isset($sql_axo_group_ids)) {
454 $query .= ' OR xg.id IN ('. $sql_axo_group_ids .')';
455
456 $order_by[] = '(CASE WHEN ax.value IS NULL THEN 0 ELSE 1 END) DESC';
457 $order_by[] = '(xg.rgt-xg.lft) ASC';
458 } else {
459 $query .= ' AND axg.group_id IS NULL';
460 }
461
462 $query .= ')';
463 }
464
465 /*
466 * The ordering is always very tricky and makes all the difference in the world.
467 * Order (ar.value IS NOT NULL) DESC should put ACLs given to specific AROs
468 * ahead of any ACLs given to groups. This works well for exceptions to groups.
469 */
470
471 $order_by[] = 'a.updated_date DESC';
472
473 $query .= '
474 ORDER BY '. implode (',', $order_by) . '
475 ';
476
477 // we are only interested in the first row
478 $rs = $this->db->SelectLimit($query, 1);
479
480 if (!is_object($rs)) {
481 $this->debug_db('acl_query');
482 return FALSE;
483 }
484
485 $row =& $rs->FetchRow();
486
487 /*
488 * Return ACL ID. This is the key to "hooking" extras like pricing assigned to ACLs etc... Very useful.
489 */
490 if (is_array($row)) {
491 // Permission granted?
492 // This below oneliner is very confusing.
493 //$allow = (isset($row[1]) AND $row[1] == 1);
494
495 //Prefer this.
496 if ( isset($row[1]) AND $row[1] == 1 ) {
497 $allow = TRUE;
498 } else {
499 $allow = FALSE;
500 }
501
502 $retarr = array('acl_id' => &$row[0], 'return_value' => &$row[2], 'allow' => $allow);
503 } else {
504 // Permission denied.
505 $retarr = array('acl_id' => NULL, 'return_value' => NULL, 'allow' => FALSE);
506 }
507
508 /*
509 * Return the query that we ran if in debug mode.
510 */
511 if ($debug == TRUE) {
512 $retarr['query'] = &$query;
513 }
514
515 //Cache data.
516 $this->put_cache($retarr, $cache_id);
517 }
518
519 $this->debug_text("<b>acl_query():</b> ACO Section: $aco_section_value ACO Value: $aco_value ARO Section: $aro_section_value ARO Value $aro_value ACL ID: ". $retarr['acl_id'] .' Result: '. $retarr['allow']);
520 return $retarr;
521 }
522
523 /**
524 * Grabs all groups mapped to an ARO. You can also specify a root_group for subtree'ing.
525 * @param string The section value or the ARO or ACO
526 * @param string The value of the ARO or ACO
527 * @param integer The group id of the group to start at (optional)
528 * @param string The type of group, either ARO or AXO (optional)
529 */
530 function acl_get_groups($section_value, $value, $root_group=NULL, $group_type='ARO') {
531
532 switch(strtolower($group_type)) {
533 case 'axo':
534 $group_type = 'axo';
535 $object_table = $this->_db_table_prefix .'axo';
536 $group_table = $this->_db_table_prefix .'axo_groups';
537 $group_map_table = $this->_db_table_prefix .'groups_axo_map';
538 break;
539 default:
540 $group_type = 'aro';
541 $object_table = $this->_db_table_prefix .'aro';
542 $group_table = $this->_db_table_prefix .'aro_groups';
543 $group_map_table = $this->_db_table_prefix .'groups_aro_map';
544 break;
545 }
546
547 //$profiler->startTimer( "acl_get_groups()");
548
549 //Generate unique cache id.
550 $cache_id = 'acl_get_groups_'.$section_value.'-'.$value.'-'.$root_group.'-'.$group_type;
551
552 $retarr = $this->get_cache($cache_id);
553
554 if (!$retarr) {
555
556 // Make sure we get the groups
557 $query = '
558 SELECT DISTINCT g2.id';
559
560 if ($section_value == $this->_group_switch) {
561 $query .= '
562 FROM ' . $group_table . ' g1,' . $group_table . ' g2';
563
564 $where = '
565 WHERE g1.value=' . $this->db->quote( $value );
566 } else {
567 $query .= '
568 FROM '. $object_table .' o,'. $group_map_table .' gm,'. $group_table .' g1,'. $group_table .' g2';
569
570 $where = '
571 WHERE (o.section_value='. $this->db->quote($section_value) .' AND o.value='. $this->db->quote($value) .')
572 AND gm.'. $group_type .'_id=o.id
573 AND g1.id=gm.group_id';
574 }
575
576 /*
577 * If root_group_id is specified, we have to narrow this query down
578 * to just groups deeper in the tree then what is specified.
579 * This essentially creates a virtual "subtree" and ignores all outside groups.
580 * Useful for sites like sourceforge where you may seperate groups by "project".
581 */
582 if ( $root_group != '') {
583 //It is important to note the below line modifies the tables being selected.
584 //This is the reason for the WHERE variable.
585 $query .= ','. $group_table .' g3';
586
587 $where .= '
588 AND g3.value='. $this->db->quote( $root_group ) .'
589 AND ((g2.lft BETWEEN g3.lft AND g1.lft) AND (g2.rgt BETWEEN g1.rgt AND g3.rgt))';
590 } else {
591 $where .= '
592 AND (g2.lft <= g1.lft AND g2.rgt >= g1.rgt)';
593 }
594
595 $query .= $where;
596
597 // $this->debug_text($query);
598 $rs = $this->db->Execute($query);
599
600 if (!is_object($rs)) {
601 $this->debug_db('acl_get_groups');
602 return FALSE;
603 }
604
605 $retarr = array();
606
607 //Unbuffered query?
608 while (!$rs->EOF) {
609 $retarr[] = reset($rs->fields);
610 $rs->MoveNext();
611 }
612
613 //Cache data.
614 $this->put_cache($retarr, $cache_id);
615 }
616
617 return $retarr;
618 }
619
620 /**
621 * Uses PEAR's Cache_Lite package to grab cached arrays, objects, variables etc...
622 * using unserialize() so it can handle more then just text string.
623 * @param string The id of the cached object
624 * @return mixed The cached object, otherwise FALSE if the object identifier was not found
625 */
626 function get_cache($cache_id) {
627
628 if ( $this->_caching == TRUE ) {
629 $this->debug_text("get_cache(): on ID: $cache_id");
630
631 if ( is_string($this->Cache_Lite->get($cache_id) ) ) {
632 return unserialize($this->Cache_Lite->get($cache_id) );
633 }
634 }
635
636 return false;
637 }
638
639 /**
640 * Uses PEAR's Cache_Lite package to write cached arrays, objects, variables etc...
641 * using serialize() so it can handle more then just text string.
642 * @param mixed A variable to cache
643 * @param string The id of the cached variable
644 */
645 function put_cache($data, $cache_id) {
646
647 if ( $this->_caching == TRUE ) {
648 $this->debug_text("put_cache(): Cache MISS on ID: $cache_id");
649
650 return $this->Cache_Lite->save(serialize($data), $cache_id);
651 }
652
653 return false;
654 }
655 }
656 ?>
Mirror of official OpenEMR Sourceforge repository