gacl/gacl.class.php

   1 <?php
   2 // $Id$
   3
   4 /**
   5  * phpGACL - Generic Access Control List
   6  * Copyright (C) 2002,2003 Mike Benoit
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  *
  22  * For questions, help, comments, discussion, etc., please join the
  23  * phpGACL mailing list. http://sourceforge.net/mail/?group_id=57103
  24  *
  25  * You may contact the author of phpGACL by e-mail at:
  26  * ipso@snappymail.ca
  27  *
  28  * The latest version of phpGACL can be obtained from:
  29  * http://phpgacl.sourceforge.net/
  30  *
  31  * @package phpGACL
  32  */
  33
  34 /*
  35  * Path to ADODB.
  36  */
  37
  38 if ( !defined('ADODB_DIR') ) {
  39         define('ADODB_DIR', dirname(__FILE__).'/../vendor/adodb/adodb-php');
  40 }
  41
  42 //openemr configuration file - bm - 05-2009
  43 // to collect sql database login info and the utf8 flag
  44 // also collect the adodb libraries to support mysqli_mod that is needed for mysql ssl support
  45 require_once(dirname(__FILE__) . "/../library/sqlconf.php");
  46 require_once(dirname(__FILE__) . "/../vendor/adodb/adodb-php/adodb.inc.php");
  47 require_once(dirname(__FILE__) . "/../vendor/adodb/adodb-php/drivers/adodb-mysqli.inc.php");
  48 require_once(dirname(__FILE__) . "/../library/ADODB_mysqli_mod.php");
  49
  50 /**
  51 * phpGACL main class
  52 *
  53 * Class gacl should be used in applications where only querying the phpGACL
  54 * database is required.
  55 *
  56 * @package phpGACL
  57 * @author Mike Benoit <ipso@snappymail.ca>
  58 */
  59 class gacl {
  60         /*
  61         --- phpGACL Configuration path/file ---
  62         */
  63         var $config_file = '';
  64
  65         /*
  66         --- Private properties ---
  67         */
  68         /** @var boolean Enables Debug output if true */
  69         var $_debug = FALSE;
  70
  71         /*
  72         --- Database configuration. ---
  73         */
  74         /** @var string Prefix for all the phpgacl tables in the database */
  75         var $_db_table_prefix = 'gacl_';
  76
  77         /** @var string The database type, based on available ADODB connectors - mysql, postgres7, sybase, oci8po See here for more: http://php.weblogs.com/adodb_manual#driverguide */
  78         var $_db_type = 'mysqli_mod';
  79
  80         /** @var string The database server */
  81         var $_db_host = '';
  82
  83         /** @var string The database user name */
  84         var $_db_user = '';
  85
  86         /** @var string The database user password */
  87         var $_db_password = '';
  88
  89         /** @var string The database name */
  90         var $_db_name = '';
  91
  92         /** @var object An ADODB database connector object */
  93         var $_db = '';
  94
  95         /** @var boolean The utf8 encoding flag - bm 05-2009 */
  96         var $_db_utf8_flag = '';
  97
  98         /*
  99          * NOTE:        This cache must be manually cleaned each time ACL's are modified.
 100          *              Alternatively you could wait for the cache to expire.
 101          */
 102
 103         /** @var boolean Caches queries if true */
 104         var $_caching = FALSE;
 105
 106         /** @var boolean Force cache to expire */
 107         var $_force_cache_expire = TRUE;
 108
 109         /** @var string The directory for cache file to eb written (ensure write permission are set) */
 110         var $_cache_dir = '/tmp/phpgacl_cache'; // NO trailing slash
 111
 112         /** @var int The time for the cache to expire in seconds - 600 == Ten Minutes */
 113         var $_cache_expire_time=600;
 114
 115         /** @var string A switch to put acl_check into '_group_' mode */
 116         var $_group_switch = '_group_';
 117
 118         /**
 119          * Constructor
 120          * @param array An arry of options to oeverride the class defaults
 121          */
 122         function __construct($options = NULL) {
 123
 124                 $available_options = array('db','debug','items_per_page','max_select_box_items','max_search_return_items','db_table_prefix','db_type','db_host','db_user','db_password','db_name','caching','force_cache_expire','cache_dir','cache_expire_time');
 125
 126                 //Values supplied in $options array overwrite those in the config file.
 127                 if ( file_exists($this->config_file) ) {
 128                         $config = parse_ini_file($this->config_file);
 129
 130                         if ( is_array($config) ) {
 131                                 $gacl_options = array_merge($config, $options);
 132                         }
 133
 134                         unset($config);
 135                 }
 136
 137                 if (is_array($options)) {
 138                         foreach ($options as $key => $value) {
 139                                 $this->debug_text("Option: $key");
 140
 141                                 if (in_array($key, $available_options) ) {
 142                                         $this->debug_text("Valid Config options: $key");
 143                                         $property = '_'.$key;
 144                                         $this->$property = $value;
 145                                 } else {
 146                                         $this->debug_text("ERROR: Config option: $key is not a valid option");
 147                                 }
 148                         }
 149                 }
 150
 151                 //collect openemr sql info from include at top of script - bm 05-2009
 152                 global $sqlconf, $disable_utf8_flag;
 153                 $this->_db_host = $sqlconf["host"];
 154                 $this->_db_user = $sqlconf["login"];
 155                 $this->_db_password = $sqlconf["pass"];
 156                 $this->_db_name = $sqlconf["dbase"];
 157                 if (!$disable_utf8_flag) {
 158                 $utf8_flag = true;
 159                 }
 160                 else {
 161                 $utf8_flag = false;
 162                 }
 163                 $this->_db_utf8_flag = $utf8_flag;
 164
 165                 require_once( ADODB_DIR .'/adodb.inc.php');
 166                 require_once( ADODB_DIR .'/adodb-pager.inc.php');
 167
 168                 if (is_object($this->_db)) {
 169                         $this->db = &$this->_db;
 170                 } else {
 171                         $this->db = ADONewConnection($this->_db_type);
 172                         //Use NUM for slight performance/memory reasons.
 173                         $this->db->SetFetchMode(ADODB_FETCH_NUM);
 174
 175             // Set mysql to use ssl, if applicable.
 176             // Can support basic encryption by including just the mysql-ca pem (this is mandatory for ssl)
 177             // Can also support client based certificate if also include mysql-cert and mysql-key (this is optional for ssl)
 178             if (file_exists($GLOBALS['OE_SITE_DIR'] . "/documents/certificates/mysql-ca")) {
 179                 if (defined('MYSQLI_CLIENT_SSL')) {
 180                     $this->db->clientFlags = MYSQLI_CLIENT_SSL;
 181                 }
 182             }
 183
 184                         // Port to be used in connection
 185                         $this->db->port = $sqlconf["port"];
 186
 187                         $this->db->PConnect($this->_db_host, $this->_db_user, $this->_db_password, $this->_db_name);
 188
 189                         // Modified 5/2009 by BM for UTF-8 project
 190                         if ($this->_db_utf8_flag) {
 191                                 $success_flag = $this->db->Execute("SET NAMES 'utf8'");
 192                                 if (!$success_flag) {
 193                                         error_log("PHP custom error: from gacl gacl/gacl.class.php  - Unable to set up UTF8 encoding with mysql database".$this->db->ErrorMsg(), 0);
 194                                 }
 195                         }
 196                         // ---------------------------------------
 197
 198                         //Turn off STRICT SQL
 199                         $sql_strict_set_success = $this->db->Execute("SET sql_mode = ''");
 200                         if (!$sql_strict_set_success) {
 201                                 error_log("Unable to set strict sql setting: ".$this->db->ErrorMsg(), 0);
 202                         }
 203
 204             if ($GLOBALS['debug_ssl_mysql_connection']) {
 205                 error_log("CHECK SSL CIPHER IN GACL ADODB: " . print_r($this->db->Execute("SHOW STATUS LIKE 'Ssl_cipher';")->fields, true));
 206             }
 207
 208                 }
 209                 $this->db->debug = $this->_debug;
 210
 211                 if ( $this->_caching == TRUE ) {
 212                         if (!class_exists('Hashed_Cache_Lite')) {
 213                                 require_once(dirname(__FILE__) .'/Cache_Lite/Hashed_Cache_Lite.php');
 214                         }
 215
 216                         /*
 217                          * Cache options. We default to the highest performance. If you run in to cache corruption problems,
 218                          * Change all the 'false' to 'true', this will slow things down slightly however.
 219                          */
 220
 221                         $cache_options = array(
 222                                 'caching' => $this->_caching,
 223                                 'cacheDir' => $this->_cache_dir.'/',
 224                                 'lifeTime' => $this->_cache_expire_time,
 225                                 'fileLocking' => TRUE,
 226                                 'writeControl' => FALSE,
 227                                 'readControl' => FALSE,
 228                                 'memoryCaching' => TRUE,
 229                                 'automaticSerialization' => FALSE
 230                         );
 231                         $this->Cache_Lite = new Hashed_Cache_Lite($cache_options);
 232                 }
 233
 234                 return true;
 235         }
 236
 237         /**
 238         * Prints debug text if debug is enabled.
 239         * @param string THe text to output
 240         * @return boolean Always returns true
 241         */
 242         function debug_text($text) {
 243
 244                 if ($this->_debug) {
 245                         echo "$text<br>\n";
 246                 }
 247
 248                 return true;
 249         }
 250
 251         /**
 252         * Prints database debug text if debug is enabled.
 253         * @param string The name of the function calling this method
 254         * @return string Returns an error message
 255         */
 256         function debug_db($function_name = '') {
 257                 if ($function_name != '') {
 258                         $function_name .= ' (): ';
 259                 }
 260
 261                 return $this->debug_text ($function_name .'database error: '. $this->db->ErrorMsg() .' ('. $this->db->ErrorNo() .')');
 262         }
 263
 264         /**
 265         *
 266         * Check if the current user has a given type or types of access to an access control object.
 267         *
 268         * Implemented as a wrapper of acl_query().
 269         * This function exists simply to return TRUE/FALSE accordingly.
 270         *
 271         * @param string $aco_section_value The ACO section value
 272         * @param string $aco_value The ACO value
 273         * @param string $aro_section_value The ARO section value
 274         * @param string $aro_value The ARO value
 275         * @param string $axo_section_value The AXO section value (optional)
 276         * @param string $axo_value The AXO section value (optional)
 277         * @param integer $root_aro_group The group id of the ARO (optional)
 278         * @param integer $root_axo_group The group id of the AXO (optional)
 279         * @return boolean true if the check succeeds, false if not.
 280         */
 281         function acl_check($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL) {
 282                 $acl_result = $this->acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value, $axo_value, $root_aro_group, $root_axo_group);
 283
 284                 return $acl_result['allow'];
 285         }
 286
 287         /**
 288         * Wraps the actual acl_query() function.
 289         *
 290         * Quick access to the return value of an ACL.
 291         * @param string The ACO section value
 292         * @param string The ACO value
 293         * @param string The ARO section value
 294         * @param string The ARO section
 295         * @param string The AXO section value (optional)
 296         * @param string The AXO section value (optional)
 297         * @param integer The group id of the ARO (optional)
 298         * @param integer The group id of the AXO (optional)
 299         * @return string The return value of the ACL
 300         */
 301         function acl_return_value($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL) {
 302                 $acl_result = $this->acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value, $axo_value, $root_aro_group, $root_axo_group);
 303
 304                 return $acl_result['return_value'];
 305         }
 306
 307         /**
 308         * Handles ACL lookups over arrays of AROs
 309         * @param string The ACO section value
 310         * @param string The ACO value
 311         * @param array An named array of arrays, each element in the format aro_section_value=>array(aro_value1,aro_value1,...)
 312         * @return mixed The same data format as inputted.
 313         \*======================================================================*/
 314         function acl_check_array($aco_section_value, $aco_value, $aro_array) {
 315                 /*
 316                         Input Array:
 317                                 Section => array(Value, Value, Value),
 318                                 Section => array(Value, Value, Value)
 319
 320                  */
 321
 322                 if (!is_array($aro_array)) {
 323                         $this->debug_text("acl_query_array(): ARO Array must be passed");
 324                         return false;
 325                 }
 326
 327                 foreach($aro_array as $aro_section_value => $aro_value_array) {
 328                         foreach ($aro_value_array as $aro_value) {
 329                                 $this->debug_text("acl_query_array(): ARO Section Value: $aro_section_value ARO VALUE: $aro_value");
 330
 331                                 if( $this->acl_check($aco_section_value, $aco_value, $aro_section_value, $aro_value) ) {
 332                                         $this->debug_text("acl_query_array(): ACL_CHECK True");
 333                                         $retarr[$aro_section_value][] = $aro_value;
 334                                 } else {
 335                                         $this->debug_text("acl_query_array(): ACL_CHECK False");
 336                                 }
 337                         }
 338                 }
 339
 340                 return $retarr;
 341
 342         }
 343
 344         /**
 345         * The Main function that does the actual ACL lookup.
 346         *
 347         * @param string The ACO section value
 348         * @param string The ACO value
 349         * @param string The ARO section value
 350         * @param string The ARO value
 351         * @param string The AXO section value (optional)
 352         * @param string The AXO value (optional)
 353         * @param string The value of the ARO group (optional)
 354         * @param string The value of the AXO group (optional)
 355         * @param boolean Debug the operation if true (optional)
 356         * @param boolean Option to return all applicable ACL's rather than just one. (optional) (Added by OpenEMR)
 357         * @return array Returns as much information as possible about the ACL so other functions can trim it down and omit unwanted data.
 358         */
 359         function acl_query($aco_section_value, $aco_value, $aro_section_value, $aro_value, $axo_section_value=NULL, $axo_value=NULL, $root_aro_group=NULL, $root_axo_group=NULL, $debug=NULL, $return_all=FALSE) {
 360
 361                 $cache_id = 'acl_query_'.$aco_section_value.'-'.$aco_value.'-'.$aro_section_value.'-'.$aro_value.'-'.$axo_section_value.'-'.$axo_value.'-'.$root_aro_group.'-'.$root_axo_group.'-'.$debug.'-'.$return_all;
 362
 363                 $retarr = $this->get_cache($cache_id);
 364
 365                 if (!$retarr) {
 366                         /*
 367                          * Grab all groups mapped to this ARO/AXO
 368                          */
 369                         $aro_group_ids = $this->acl_get_groups($aro_section_value, $aro_value, $root_aro_group, 'ARO');
 370
 371                         if (is_array($aro_group_ids) AND !empty($aro_group_ids)) {
 372                                 $sql_aro_group_ids = implode(',', $aro_group_ids);
 373                         }
 374
 375                         if ($axo_section_value != '' AND $axo_value != '') {
 376                                 $axo_group_ids = $this->acl_get_groups($axo_section_value, $axo_value, $root_axo_group, 'AXO');
 377
 378                                 if (is_array($axo_group_ids) AND !empty($axo_group_ids)) {
 379                                         $sql_axo_group_ids = implode(',', $axo_group_ids);
 380                                 }
 381                         }
 382
 383                         /*
 384                          * This query is where all the magic happens.
 385                          * The ordering is very important here, as well very tricky to get correct.
 386                          * Currently there can be  duplicate ACLs, or ones that step on each other toes. In this case, the ACL that was last updated/created
 387                          * is used; unless the $return_all parameter is set to TRUE, then will return the entire array of applicable ACL information (this
 388                          * option was added by OpenEMR)
 389                          *
 390                          * This is probably where the most optimizations can be made.
 391                          */
 392
 393                         $order_by = array();
 394
 395                         $query = '
 396                                         SELECT          a.id,a.allow,a.return_value
 397                                         FROM            '. $this->_db_table_prefix .'acl a
 398                                         LEFT JOIN       '. $this->_db_table_prefix .'aco_map ac ON ac.acl_id=a.id';
 399
 400                         if ($aro_section_value != $this->_group_switch) {
 401                                 $query .= '
 402                                         LEFT JOIN       '. $this->_db_table_prefix .'aro_map ar ON ar.acl_id=a.id';
 403                         }
 404
 405                         if ($axo_section_value != $this->_group_switch) {
 406                                 $query .= '
 407                                         LEFT JOIN       '. $this->_db_table_prefix .'axo_map ax ON ax.acl_id=a.id';
 408                         }
 409
 410                         /*
 411                          * if there are no aro groups, don't bother doing the join.
 412                          */
 413                         if (isset($sql_aro_group_ids)) {
 414                                 $query .= '
 415                                         LEFT JOIN       '. $this->_db_table_prefix .'aro_groups_map arg ON arg.acl_id=a.id
 416                                         LEFT JOIN       '. $this->_db_table_prefix .'aro_groups rg ON rg.id=arg.group_id';
 417                         }
 418
 419                         // this join is necessary to weed out rules associated with axo groups
 420                         $query .= '
 421                                         LEFT JOIN       '. $this->_db_table_prefix .'axo_groups_map axg ON axg.acl_id=a.id';
 422
 423                         /*
 424                          * if there are no axo groups, don't bother doing the join.
 425                          * it is only used to rank by the level of the group.
 426                          */
 427                         if (isset($sql_axo_group_ids)) {
 428                                 $query .= '
 429                                         LEFT JOIN       '. $this->_db_table_prefix .'axo_groups xg ON xg.id=axg.group_id';
 430                         }
 431
 432                         //Move the below line to the LEFT JOIN above for PostgreSQL's sake.
 433                         //AND   ac.acl_id=a.id
 434                         $query .= '
 435                                         WHERE           a.enabled=1
 436                                                 AND             (ac.section_value='. $this->db->quote($aco_section_value) .' AND ac.value='. $this->db->quote($aco_value) .')';
 437
 438                         // if we are querying an aro group
 439                         if ($aro_section_value == $this->_group_switch) {
 440                                 // if acl_get_groups did not return an array
 441                                 if ( !isset ($sql_aro_group_ids) ) {
 442                                         $this->debug_text ('acl_query(): Invalid ARO Group: '. $aro_value);
 443                                         return FALSE;
 444                                 }
 445
 446                                 $query .= '
 447                                                 AND             rg.id IN ('. $sql_aro_group_ids .')';
 448
 449                                 $order_by[] = '(rg.rgt-rg.lft) ASC';
 450                         } else {
 451                                 $query .= '
 452                                                 AND             ((ar.section_value='. $this->db->quote($aro_section_value) .' AND ar.value='. $this->db->quote($aro_value) .')';
 453
 454                                 if ( isset ($sql_aro_group_ids) ) {
 455                                         $query .= ' OR rg.id IN ('. $sql_aro_group_ids .')';
 456
 457                                         $order_by[] = '(CASE WHEN ar.value IS NULL THEN 0 ELSE 1 END) DESC';
 458                                         $order_by[] = '(rg.rgt-rg.lft) ASC';
 459                                 }
 460
 461                                 $query .= ')';
 462                         }
 463
 464
 465                         // if we are querying an axo group
 466                         if ($axo_section_value == $this->_group_switch) {
 467                                 // if acl_get_groups did not return an array
 468                                 if ( !isset ($sql_axo_group_ids) ) {
 469                                         $this->debug_text ('acl_query(): Invalid AXO Group: '. $axo_value);
 470                                         return FALSE;
 471                                 }
 472
 473                                 $query .= '
 474                                                 AND             xg.id IN ('. $sql_axo_group_ids .')';
 475
 476                                 $order_by[] = '(xg.rgt-xg.lft) ASC';
 477                         } else {
 478                                 $query .= '
 479                                                 AND             (';
 480
 481                                 if ($axo_section_value == '' AND $axo_value == '') {
 482                                         $query .= '(ax.section_value IS NULL AND ax.value IS NULL)';
 483                                 } else {
 484                                         $query .= '(ax.section_value='. $this->db->quote($axo_section_value) .' AND ax.value='. $this->db->quote($axo_value) .')';
 485                                 }
 486
 487                                 if (isset($sql_axo_group_ids)) {
 488                                         $query .= ' OR xg.id IN ('. $sql_axo_group_ids .')';
 489
 490                                         $order_by[] = '(CASE WHEN ax.value IS NULL THEN 0 ELSE 1 END) DESC';
 491                                         $order_by[] = '(xg.rgt-xg.lft) ASC';
 492                                 } else {
 493                                         $query .= ' AND axg.group_id IS NULL';
 494                                 }
 495
 496                                 $query .= ')';
 497                         }
 498
 499                         /*
 500                          * The ordering is always very tricky and makes all the difference in the world.
 501                          * Order (ar.value IS NOT NULL) DESC should put ACLs given to specific AROs
 502                          * ahead of any ACLs given to groups. This works well for exceptions to groups.
 503                          * If the $return_all parameter is set to TRUE, then will return the entire
 504                          * array of applicable ACL information (this option was added by OpenEMR)
 505                          */
 506
 507                         $order_by[] = 'a.updated_date DESC';
 508
 509                         $query .= '
 510                                         ORDER BY        '. implode (',', $order_by) . '
 511                                         ';
 512
 513                         // we are only interested in the first row unless $return_all is set
 514                         if ($return_all) {
 515                                 $rs = $this->db->Execute($query);
 516                         }
 517                         else {
 518                                 $rs = $this->db->SelectLimit($query, 1);
 519                         }
 520
 521                         if (!is_object($rs)) {
 522                                 $this->debug_db('acl_query');
 523                                 return FALSE;
 524                         }
 525
 526                         if ($return_all) {
 527                                 while ($arr = $rs->FetchRow()) {
 528                                         $row[] = $arr;
 529                                 }
 530                         }
 531                         else {
 532                                 $row = $rs->FetchRow();
 533                         }
 534
 535
 536                         /*
 537                          * Return ACL ID. This is the key to "hooking" extras like pricing assigned to ACLs etc... Very useful.
 538                          */
 539                         if (isset($row) && is_array($row)) {
 540
 541                                 if ($return_all) {
 542                                         foreach ($row as $single_row) {
 543                                                 $allow = FALSE;
 544                                                 if ( isset($single_row[1]) AND $single_row[1] == 1 ) {
 545                                                         $allow = TRUE;
 546                                                 }
 547                                                 $retarr[] = array('acl_id' => &$single_row[0], 'return_value' => &$single_row[2], 'allow' => $allow);
 548                                         }
 549                                 }
 550                                 else {
 551                                         $allow = FALSE;
 552                                         if ( isset($row[1]) AND $row[1] == 1 ) {
 553                                                 $allow = TRUE;
 554                                         }
 555                                         $retarr = array('acl_id' => &$row[0], 'return_value' => &$row[2], 'allow' => $allow);
 556                                 }
 557                         } else {
 558                                 if ($return_all) {
 559                                         // Permission denied.
 560                                         $retarr[] = array('acl_id' => NULL, 'return_value' => NULL, 'allow' => FALSE);
 561                                 }
 562                                 else {
 563                                         // Permission denied.
 564                                         $retarr = array('acl_id' => NULL, 'return_value' => NULL, 'allow' => FALSE);
 565                                 }
 566                         }
 567
 568                         /*
 569                          * Return the query that we ran if in debug mode.
 570                          */
 571                         if ($debug == TRUE) {
 572                                 $retarr['query'] = &$query;
 573                         }
 574
 575                         //Cache data.
 576                         $this->put_cache($retarr, $cache_id);
 577                 }
 578
 579                 if ($return_all)
 580                 {
 581                         $this->debug_text("<b>acl_query():</b> ACO Section: $aco_section_value ACO Value: $aco_value ARO Section: $aro_section_value ARO Value $aro_value ACL ID: OMITTED due to return_all");
 582                 }
 583                 else
 584                 {
 585                         $this->debug_text("<b>acl_query():</b> ACO Section: $aco_section_value ACO Value: $aco_value ARO Section: $aro_section_value ARO Value $aro_value ACL ID: ". $retarr['acl_id'] .' Result: '. $retarr['allow']);
 586                 }
 587
 588                 return $retarr;
 589         }
 590
 591         /**
 592         * Grabs all groups mapped to an ARO. You can also specify a root_group for subtree'ing.
 593         * @param string The section value or the ARO or ACO
 594         * @param string The value of the ARO or ACO
 595         * @param integer The group id of the group to start at (optional)
 596         * @param string The type of group, either ARO or AXO (optional)
 597         */
 598         function acl_get_groups($section_value, $value, $root_group=NULL, $group_type='ARO') {
 599
 600                 switch(strtolower($group_type)) {
 601                         case 'axo':
 602                                 $group_type = 'axo';
 603                                 $object_table = $this->_db_table_prefix .'axo';
 604                                 $group_table = $this->_db_table_prefix .'axo_groups';
 605                                 $group_map_table = $this->_db_table_prefix .'groups_axo_map';
 606                                 break;
 607                         default:
 608                                 $group_type = 'aro';
 609                                 $object_table = $this->_db_table_prefix .'aro';
 610                                 $group_table = $this->_db_table_prefix .'aro_groups';
 611                                 $group_map_table = $this->_db_table_prefix .'groups_aro_map';
 612                                 break;
 613                 }
 614
 615                 //$profiler->startTimer( "acl_get_groups()");
 616
 617                 //Generate unique cache id.
 618                 $cache_id = 'acl_get_groups_'.$section_value.'-'.$value.'-'.$root_group.'-'.$group_type;
 619
 620                 $retarr = $this->get_cache($cache_id);
 621
 622                 if (!$retarr) {
 623
 624                         // Make sure we get the groups
 625                         $query = '
 626                                         SELECT          DISTINCT g2.id';
 627
 628                         if ($section_value == $this->_group_switch) {
 629                                 $query .= '
 630                                         FROM            ' . $group_table . ' g1,' . $group_table . ' g2';
 631
 632                                 $where = '
 633                                         WHERE           g1.value=' . $this->db->quote( $value );
 634                         } else {
 635                                 $query .= '
 636                                         FROM            '. $object_table .' o,'. $group_map_table .' gm,'. $group_table .' g1,'. $group_table .' g2';
 637
 638                                 $where = '
 639                                         WHERE           (o.section_value='. $this->db->quote($section_value) .' AND o.value='. $this->db->quote($value) .')
 640                                                 AND             gm.'. $group_type .'_id=o.id
 641                                                 AND             g1.id=gm.group_id';
 642                         }
 643
 644                         /*
 645                          * If root_group_id is specified, we have to narrow this query down
 646                          * to just groups deeper in the tree then what is specified.
 647                          * This essentially creates a virtual "subtree" and ignores all outside groups.
 648                          * Useful for sites like sourceforge where you may seperate groups by "project".
 649                          */
 650                         if ( $root_group != '') {
 651                                 //It is important to note the below line modifies the tables being selected.
 652                                 //This is the reason for the WHERE variable.
 653                                 $query .= ','. $group_table .' g3';
 654
 655                                 $where .= '
 656                                                 AND             g3.value='. $this->db->quote( $root_group ) .'
 657                                                 AND             ((g2.lft BETWEEN g3.lft AND g1.lft) AND (g2.rgt BETWEEN g1.rgt AND g3.rgt))';
 658                         } else {
 659                                 $where .= '
 660                                                 AND             (g2.lft <= g1.lft AND g2.rgt >= g1.rgt)';
 661                         }
 662
 663                         $query .= $where;
 664
 665                         // $this->debug_text($query);
 666                         $rs = $this->db->Execute($query);
 667
 668                         if (!is_object($rs)) {
 669                                 $this->debug_db('acl_get_groups');
 670                                 return FALSE;
 671                         }
 672
 673                         $retarr = array();
 674
 675                         //Unbuffered query?
 676                         while (!$rs->EOF) {
 677                                 $retarr[] = reset($rs->fields);
 678                                 $rs->MoveNext();
 679                         }
 680
 681                         //Cache data.
 682                         $this->put_cache($retarr, $cache_id);
 683                 }
 684
 685                 return $retarr;
 686         }
 687
 688         /**
 689         * Uses PEAR's Cache_Lite package to grab cached arrays, objects, variables etc...
 690         * using unserialize() so it can handle more then just text string.
 691         * @param string The id of the cached object
 692         * @return mixed The cached object, otherwise FALSE if the object identifier was not found
 693         */
 694         function get_cache($cache_id) {
 695
 696                 if ( $this->_caching == TRUE ) {
 697                         $this->debug_text("get_cache(): on ID: $cache_id");
 698
 699                         if ( is_string($this->Cache_Lite->get($cache_id) ) ) {
 700                                 return unserialize($this->Cache_Lite->get($cache_id) );
 701                         }
 702                 }
 703
 704                 return false;
 705         }
 706
 707         /**
 708         * Uses PEAR's Cache_Lite package to write cached arrays, objects, variables etc...
 709         * using serialize() so it can handle more then just text string.
 710         * @param mixed A variable to cache
 711         * @param string The id of the cached variable
 712         */
 713         function put_cache($data, $cache_id) {
 714
 715                 if ( $this->_caching == TRUE ) {
 716                         $this->debug_text("put_cache(): Cache MISS on ID: $cache_id");
 717
 718                         return $this->Cache_Lite->save(serialize($data), $cache_id);
 719                 }
 720
 721                 return false;
 722         }
 723 }
 724 ?>