| blob | 4b5e9c9a176581b72c337ff24f69d7306332736f |
1 <?php
2 /**
3 * library/acl.inc
4 *
5 * Functions wrapping php-GACL's functionality, to create a generic OpenEMR access control system.
6 *
7 * LICENSE: This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 3
10 * of the License, or (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see
17 * http://www.gnu.org/licenses/licenses.html#GPL .
18 *
19 * @package OpenEMR
20 * @license http://www.gnu.org/licenses/licenses.html#GPL GNU GPL V3+
21 * @author Brady Miller <brady@sparmy.com>
22 * @author Rod Roark <rod@sunsetsystems.com>
23 * @link http://www.open-emr.org
24 */
26 // php-GACL access controls are included in OpenEMR. The below
27 // function will automatically create the path where gacl.class.php
28 // can be found. Note that this path can be manually set below
29 // for users who are using an external version of php-GACL.
30 // Also note that php-GACL access controls can be turned off
31 // below.
33 $phpgacl_location = dirname(__FILE__).'/../gacl';
35 // If using an external version of phpGACL, then uncomment the following
36 // line and manually place the path below. IN THIS CASE YOU MUST ALSO
37 // COMMENT OUT ABOVE $phpgacl_location ASSIGNMENT ABOVE, OR BACKUPS WILL
38 // NOT RESTORE PROPERLY!
39 //
40 //$phpgacl_location = "/var/www/gacl";
41 //
42 // If you want to turn off php-GACL, then uncomment the following line.
43 // IN THIS CASE YOU MUST ALSO COMMENT OUT ABOVE $phpgacl_location ASSIGNMENT(S)
44 // ABOVE, OR BACKUPS WILL NOT RESTORE PROPERLY!
45 //
46 //unset($phpgacl_location);
47 //
49 // The following Access Control Objects (ACO) are currently supported.
50 // These are the "things to be protected":
51 //
52 // Section "admin" (Administration):
53 // super Superuser - can delete patients, encounters, issues
54 // calendar Calendar Settings
55 // database Database Reporting
56 // forms Forms Administration
57 // practice Practice Settings
58 // superbill Superbill Codes Administration
59 // users Users/Groups/Logs Administration
60 // batchcom Batch Communication Tool
61 // language Language Interface Tool
62 // drugs Pharmacy Dispensary
63 // acl ACL Administration
64 //
65 // Section "acct" (Accounting):
66 // bill Billing (write optional)
67 // disc Allowed to discount prices (in Fee Sheet or Checkout form)
68 // eob EOB Data Entry
69 // rep Financial Reporting - my encounters
70 // rep_a Financial Reporting - anything
71 //
72 // Section "patients" (Patient Information):
73 // appt Appointments (write,wsome optional)
74 // demo Demographics (write,addonly optional)
75 // med Medical Records and History (write,addonly optional)
76 // trans Transactions, e.g. referrals (write optional)
77 // docs Documents (write,addonly optional)
78 // notes Patient Notes (write,addonly optional)
79 // sign Sign Lab Results (write,addonly optional)
80 //
81 // Section "encounters" (Encounter Information):
82 // auth Authorize - my encounters
83 // auth_a Authorize - any encounters
84 // coding Coding - my encounters (write,wsome optional)
85 // coding_a Coding - any encounters (write,wsome optional)
86 // notes Notes - my encounters (write,addonly optional)
87 // notes_a Notes - any encounters (write,addonly optional)
88 // date_a Fix encounter dates - any encounters
89 // relaxed Less-private information (write,addonly optional)
90 // (e.g. the Sports Fitness encounter form)
91 //
92 // Section "squads" applies to sports team use only:
93 // acos in this section define the user-specified list of squads
94 //
95 // Section "sensitivities" (Sensitivities):
96 // normal Normal
97 // high High
98 //
99 // Section "lists" (Lists):
100 // default Default List (write,addonly optional)
101 // state State List (write,addonly optional)
102 // country Country List (write,addonly optional)
103 // language Language List (write,addonly optional)
104 // ethrace Ethnicity-Race List (write,addonly optional)
105 //
106 // Section "placeholder" (Placeholder):
107 // filler Placeholder (Maintains empty ACLs)
108 //
109 // Section "nationnotes" (Nation Notes):
110 // nn_configure Nation Notes
111 //
112 // Section "patientportal" (Patient Portal):
113 // portal Patient Portal
115 if (isset ($phpgacl_location)) {
116 include_once("$phpgacl_location/gacl.class.php");
117 $gacl_object = new gacl();
118 //DO NOT CHANGE BELOW VARIABLE
119 $section_aro_value = 'users';
120 }
122 /**
123 * Check if a user has a given type or types of access to an access control object.
124 *
125 * This function will check for access to the given ACO.
126 * view - The user may view but not add or modify entries
127 * write - The user may add or modify the ACO
128 * wsome - The user has limited add/modify access to the ACO
129 * addonly - The user may view and add but not modify entries
130 *
131 * @param string $section Category of ACO
132 * @param string $value Subcategory of ACO
133 * @param string $user Optional user being checked for access.
134 * @param string|array $return_value Type or types of access being requested.
135 * @return bool|array FALSE if access is denied, TRUE if allowed. An
136 * array() of bools is returned if $return_value is an
137 * array, representing results for each type of access
138 * requested.
139 */
140 function acl_check($section, $value, $user = '', $return_value = '') {
141 global $gacl_object, $phpgacl_location, $section_aro_value;
142 if (! $user) $user = $_SESSION['authUser'];
144 if ($phpgacl_location) {
145 // This will return all pertinent ACL's (including return_values and whether allow/deny)
146 // Walk through them to assess for access
147 $acl_results = $gacl_object->acl_query($section, $value, $section_aro_value, $user,NULL,NULL,NULL,NULL,NULL,TRUE);
148 if (empty($acl_results)) {
149 return FALSE; //deny access
150 }
151 $access=FALSE; //flag
152 $deny=FALSE; //flag
153 foreach ($acl_results as $acl_result) {
154 if (empty($acl_result['acl_id'])) return FALSE; //deny access, since this happens if no pertinent ACL's are returned
155 if (is_array($return_value)) {
156 foreach ($return_value as $single_return_value) {
157 if (empty($single_return_value)) {
158 // deal with case if not looking for specific return value
159 if ($acl_result['allow']) {
160 $access=TRUE;
161 }
162 else {
163 $deny=TRUE;
164 }
165 }
166 else { //!empty($single_return_value)
167 // deal with case if looking for specific return value
168 if ($acl_result['return_value'] == $single_return_value) {
169 if ($acl_result['allow']) {
170 $access=TRUE;
171 }
172 else{
173 $deny=TRUE;
174 }
175 }
176 }
177 }
178 }
179 else { // $return_value is not an array (either empty or with one value)
180 if (empty($return_value)) {
181 // deal with case if not looking for specific return value
182 if ($acl_result['allow']) {
183 $access=TRUE;
184 }
185 else {
186 $deny=TRUE;
187 }
188 }
189 else { //!empty($return_value)
190 // deal with case if looking for specific return value
191 if ($acl_result['return_value'] == $return_value) {
192 if ($acl_result['allow']) {
193 $access=TRUE;
194 }
195 else{
196 $deny=TRUE;
197 }
198 }
199 }
200 }
201 }
203 // Now decide whether user has access
204 // (Note a denial takes precedence)
205 if ($deny) return FALSE;
206 if ($access) return TRUE;
207 return FALSE;
208 }
211 // If no phpgacl, then apply the old static rules whereby "authorized"
212 // users (providers) can do anything, and other users can do most things.
213 // If you want custom access control but don't want to mess with phpGACL,
214 // then you could customize the code below instead.
216 if ($user == 'admin') return 'write';
217 if ($section == 'admin' && $value == 'super') return 0;
218 if ($_SESSION['userauthorized']) return 'write';
220 if ($section == 'patients') {
221 if ($value == 'med') return 1;
222 return 'write';
223 }
224 else if ($section == 'encounters') {
225 if (strpos($value, 'coding' ) === 0) return 'write';
226 if (strpos($value, 'notes' ) === 0) return 'write';
227 if ($value == 'relaxed') return 'write';
228 }
229 else if ($section != 'admin') {
230 return 'write';
231 }
233 return 0;
234 }
236 // Get the ACO name/value pairs for a designated section. Each value
237 // is an array (section_value, value, order_value, name, hidden).
238 //
239 function acl_get_section_acos($section) {
240 global $phpgacl_location;
241 if ($phpgacl_location) {
242 include_once("$phpgacl_location/gacl_api.class.php");
243 $gacl = new gacl_api();
244 $arr1 = $gacl->get_objects($section, 1, 'ACO');
245 $arr = array();
246 if (!empty($arr1[$section])) {
247 foreach ($arr1[$section] as $value) {
248 $odata = $gacl->get_object_data($gacl->get_object_id($section, $value, 'ACO'), 'ACO');
249 $arr[$value] = $odata[0];
250 }
251 }
252 return $arr;
253 }
254 return 0;
255 }
257 // Sort squads by their order value. Used only by acl_get_squads().
258 function _acl_squad_compare($a, $b) {
259 if ($a[2] == $b[2]) {
260 // If order value is the same, sort by squad name.
261 if ($a[3] == $b[3]) return 0;
262 return ($a[3] < $b[3]) ? -1 : 1;
263 }
264 return ($a[2] < $b[2]) ? -1 : 1;
265 }
267 // Return an array keyed on squad ACO names.
268 // This is only applicable for sports team use.
269 //
270 function acl_get_squads() {
271 $squads = acl_get_section_acos('squads');
272 uasort($squads, "_acl_squad_compare");
273 return $squads;
274 }
276 // Return an array keyed on encounter sensitivity level ACO names.
277 // Sensitivities are useful when some encounter notes are not
278 // medically sensitive (e.g. a physical fitness test), and/or if
279 // some will be "for doctor's eyes only" (e.g. STD treatment).
280 //
281 // When a non-blank sensitivity value exists in the new encounter
282 // form, it names an additional ACO required for access to all forms
283 // in the encounter. If you want some encounters to be non-sensitive,
284 // then you also need some default nonblank sensitivity for normal
285 // encounters, as well as greater encounter notes permissions for
286 // those allowed to view non-sensitive encounters.
287 //
288 function acl_get_sensitivities() {
289 return acl_get_section_acos('sensitivities');
290 }
292 //
293 // Returns true if aco exist
294 // Returns false if aco doesn't exist
295 // $section_name = name of section (string)
296 // $aco_name = name of aco (string)
297 //
298 function aco_exist($section_name, $aco_name) {
299 global $phpgacl_location;
300 if (isset ($phpgacl_location)) {
301 include_once("$phpgacl_location/gacl_api.class.php");
302 $gacl = new gacl_api();
303 $aco_id = $gacl->get_object_id($section_name, $aco_name, 'ACO');
304 if ($aco_id) {
305 return true;
306 }
307 }
308 return false;
309 }
311 //
312 // Returns a sorted array of all available Group Titles.
313 //
314 function acl_get_group_title_list() {
315 global $phpgacl_location;
316 if (isset ($phpgacl_location)) {
317 include_once("$phpgacl_location/gacl_api.class.php");
318 $gacl = new gacl_api();
319 $parent_id = $gacl->get_root_group_id();
320 $arr_group_ids = $gacl->get_group_children($parent_id, 'ARO', 'RECURSE');
321 $arr_group_titles = array();
322 foreach ($arr_group_ids as $value) {
323 $arr_group_data = $gacl->get_group_data($value, 'ARO');
324 $arr_group_titles[$value] = $arr_group_data[3];
325 }
326 sort($arr_group_titles);
327 return $arr_group_titles;
328 }
329 return 0;
330 }
332 //
333 // Returns a sorted array of group Titles that a user belongs to.
334 // Returns 0 if does not belong to any group yet.
335 // $user_name = Username, which is login name.
336 //
337 function acl_get_group_titles($user_name) {
338 global $phpgacl_location, $section_aro_value;
339 if (isset ($phpgacl_location)) {
340 include_once("$phpgacl_location/gacl_api.class.php");
341 $gacl = new gacl_api();
342 $user_aro_id = $gacl->get_object_id($section_aro_value, $user_name, 'ARO');
343 if ($user_aro_id) {
344 $arr_group_id = $gacl->get_object_groups($user_aro_id, 'ARO', 'NO_RECURSE');
345 if ($arr_group_id) {
346 foreach ($arr_group_id as $key => $value) {
347 $arr_group_data = $gacl->get_group_data($value, 'ARO');
348 $arr_group_titles[$key] = $arr_group_data[3];
349 }
350 sort($arr_group_titles);
351 return $arr_group_titles;
352 }
353 }
354 }
355 return 0;
356 }
358 //
359 // This will place the user aro object into selected group(s)
360 // It uses the set_user_aro() function
361 // $username = username (string)
362 // $group = title of group(s) (string or array)
363 //
364 function add_user_aros($username, $group) {
365 $current_user_groups = acl_get_group_titles($username);
366 if (!$current_user_groups) {
367 $current_user_groups = array();
368 }
369 if (is_array($group)){
370 foreach ($group as $value) {
371 if (!in_array($value, $current_user_groups)) {
372 array_push($current_user_groups, $value);
373 }
374 }
375 }
376 else {
377 if (!in_array($group, $current_user_groups)) {
378 array_push($current_user_groups, $group);
379 }
380 }
381 $user_data = mysql_fetch_array(sqlStatement("select * from users where username='" .
382 $username . "'"));
383 set_user_aro($current_user_groups, $username, $user_data["fname"],
384 $user_data["mname"], $user_data["lname"]);
385 return;
386 }
388 //
389 // This will remove the user aro object from the selected group(s)
390 // It uses the set_user_aro() function
391 // $username = username (string)
392 // $group = title of group(s) (string or array)
393 //
394 function remove_user_aros($username, $group) {
395 $current_user_groups = acl_get_group_titles($username);
396 $new_user_groups = array();
397 if (is_array($group)){
398 foreach ($current_user_groups as $value) {
399 if (!in_array($value, $group)) {
400 array_push($new_user_groups, $value);
401 }
402 }
403 }
404 else {
405 foreach ($current_user_groups as $value) {
406 if ($value != $group) {
407 array_push($new_user_groups, $value);
408 }
409 }
410 }
411 $user_data = mysql_fetch_array(sqlStatement("select * from users where username='" .
412 $username . "'"));
413 set_user_aro($new_user_groups, $username, $user_data["fname"],
414 $user_data["mname"], $user_data["lname"]);
415 return;
416 }
418 //
419 // This will either create or edit a user aro object, and then place it
420 // in the requested groups. It will not allow removal of the 'admin'
421 // user or gacl_protected users from the 'admin' group.
422 // $arr_group_titles = titles of the groups that user will be added to.
423 // $user_name = username, which is login name.
424 // $first_name = first name
425 // $middle_name = middle name
426 // $last_name = last name
427 //
428 function set_user_aro($arr_group_titles, $user_name, $first_name, $middle_name, $last_name) {
429 global $phpgacl_location, $section_aro_value;
431 if (isset ($phpgacl_location)) {
432 include_once("$phpgacl_location/gacl_api.class.php");
433 $gacl = new gacl_api();
435 //see if this user is gacl protected (ie. do not allow
436 //removal from the Administrators group)
437 require_once(dirname(__FILE__).'/user.inc');
438 require_once(dirname(__FILE__).'/calendar.inc');
439 $userNametoID = getIDfromUser($user_name);
440 if (checkUserSetting("gacl_protect","1",$userNametoID) || $user_name == "admin") {
441 $gacl_protect = true;
442 }
443 else {
444 $gacl_protect = false;
445 }
447 //get array of all available group ID numbers
448 $parent_id = $gacl->get_root_group_id();
449 $arr_all_group_ids = $gacl->get_group_children($parent_id, 'ARO', 'RECURSE');
451 //Cycle through ID array to find and process each selected group
452 //Create a counter since processing of first hit is unique
453 $counter = 0;
454 foreach ($arr_all_group_ids as $value) {
455 $arr_group_data = $gacl->get_group_data($value, 'ARO');
456 if ((empty($arr_group_titles)) ||
457 (in_array($arr_group_data[3], $arr_group_titles))) {
458 //We have a hit, so need to add group and increment counter
459 // because processing of first hit is unique
460 //This will also deal with an empty $arr_group_titles array
461 // removing user from all groups unless 'admin'
462 $counter = $counter + 1;
463 //create user full name field
464 if ($middle_name) {
465 $full_name = $first_name . " " . $middle_name . " " . $last_name;
466 }
467 else {
468 if ($last_name) {
469 $full_name = $first_name . " " . $last_name;
470 }
471 else {
472 $full_name = $first_name;
473 }
474 }
476 //If this is not the first group to be added, then will skip below
477 // and will be added. If this is the first group, then need to
478 // go thru several steps before adding the group.
479 if ($counter == 1) {
480 //get ID of user ARO object, if it exist
481 $user_aro_id = $gacl->get_object_id($section_aro_value, $user_name, 'ARO');
482 if ($user_aro_id) {
483 //user ARO object already exist, so will edit it
484 $gacl->edit_object($user_aro_id, $section_aro_value, $full_name, $user_name, 10, 0, 'ARO');
486 //remove all current user ARO object group associations
487 $arr_remove_group_ids = $gacl->get_object_groups($user_aro_id, 'ARO', 'NO_RECURSE');
488 foreach ($arr_remove_group_ids as $value2) {
489 $gacl->del_group_object($value2, $section_aro_value, $user_name, 'ARO');
490 }
491 }
492 else {
493 //user ARO object does not exist, so will create it
494 $gacl->add_object($section_aro_value, $full_name, $user_name, 10, 0, 'ARO');
495 }
496 }
498 //place the user ARO object in the selected group (if group(s) is selected)
499 if (!empty($arr_group_titles)) {
500 $gacl->add_group_object($value, $section_aro_value, $user_name, 'ARO');
501 }
503 //
504 //Below will not allow 'admin' or gacl_protected user to be removed from 'admin' group
505 //
506 if ($gacl_protect) {
507 $boolean_admin=0;
508 $admin_id = $gacl->get_object_id($section_aro_value, $user_name, 'ARO');
509 $arr_admin = $gacl->get_object_groups($admin_id, 'ARO', 'NO_RECURSE');
510 foreach ($arr_admin as $value3) {
511 $arr_admin_data = $gacl->get_group_data($value3, 'ARO');
512 if (strcmp($arr_admin_data[2], 'admin') == 0) {
513 $boolean_admin=1;
514 }
515 }
516 if (!$boolean_admin) {
517 foreach ($arr_all_group_ids as $value4) {
518 $arr_temp = $gacl->get_group_data($value4, 'ARO');
519 if ($arr_temp[2] == 'admin') {
520 $gacl->add_group_object($value4, $section_aro_value, $user_name, 'ARO');
521 }
522 }
523 }
524 }
525 }
526 //if array of groups was empty, then we are done, and can break from loop
527 if (empty($arr_group_titles)) break;
528 }
529 return true;
530 }
531 return false;
532 }
534 //
535 // Returns true if acl exist
536 // Returns false if acl doesn't exist
537 // EITHER $title or $name is required(send FALSE in variable
538 // not being used). If both are sent, then only $title will be
539 // used.
540 // $return_value is required
541 // $title = title of acl (string)
542 // $name = name of acl (string)
543 // $return_value = return value of acl (string)
544 //
545 function acl_exist($title, $name, $return_value) {
546 global $phpgacl_location;
547 if (isset ($phpgacl_location)) {
548 include_once("$phpgacl_location/gacl_api.class.php");
549 $gacl = new gacl_api();
550 if (!$name) {
551 $acl = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $title, FALSE, FALSE, FALSE, $return_value);
552 }
553 else if (!$title) {
554 $group_id = $gacl->get_group_id($name, NULL, 'ARO');
555 if ($group_id) {
556 $group_data = $gacl->get_group_data($group_id, 'ARO');
557 $acl = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $group_data[3], FALSE, FALSE, FALSE, $return_value);
558 }
559 else {
560 return false;
561 }
562 }
563 else {
564 $acl = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $title, FALSE, FALSE, FALSE, $return_value);
565 }
566 if (!empty($acl)) {
567 return true;
568 }
569 else {
570 return false;
571 }
572 }
573 }
575 //
576 // This will add a new acl and group(if group doesn't yet exist)
577 // with one aco in it.
578 // $acl_title = title of acl (string)
579 // $acl_name = name of acl (string)
580 // $return_value = return value of acl (string)
581 // $note = description of acl (array)
582 //
583 function acl_add($acl_title, $acl_name, $return_value, $note) {
584 global $phpgacl_location;
585 if (isset ($phpgacl_location)) {
586 include_once("$phpgacl_location/gacl_api.class.php");
587 $gacl = new gacl_api();
588 $group_id = $gacl->get_group_id($acl_name, $acl_title, 'ARO');
589 if ($group_id) {
590 //group already exist, so just create acl
591 $gacl->add_acl(array("placeholder"=>array("filler")),
592 NULL, array($group_id), NULL, NULL, 1, 1, $return_value, $note);
593 }
594 else {
595 //create group, then create acl
596 $parent_id = $gacl->get_root_group_id();
597 $aro_id = $gacl->add_group($acl_name, $acl_title, $parent_id, 'ARO');
598 $gacl->add_acl(array("placeholder"=>array("filler")),
599 NULL, array($aro_id), NULL, NULL, 1, 1, $return_value, $note);
600 }
601 return;
602 }
603 return 0;
604 }
606 //
607 // This will remove acl. It will also remove group(if the group
608 // is no longer associated with any acl's).
609 // $acl_title = title of acl (string)
610 // $acl_name = name of acl (string)
611 // $return_value = return value of acl (string)
612 // $note = description of acl (array)
613 //
614 function acl_remove($acl_title, $return_value) {
615 global $phpgacl_location;
616 if (isset ($phpgacl_location)) {
617 include_once("$phpgacl_location/gacl_api.class.php");
618 $gacl = new gacl_api();
619 //First, delete the acl
620 $acl_id=$gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $acl_title, FALSE, FALSE, FALSE, $return_value);
621 $gacl->del_acl($acl_id[0]);
622 //Then, remove the group(if no more acl's are remaining)
623 $acl_search=$gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $acl_title, FALSE, FALSE, FALSE, FALSE);
624 if (empty($acl_search)){
625 $group_id=$gacl-> get_group_id(NULL, $acl_title, 'ARO');
626 $gacl->del_group($group_id, TRUE, 'ARO');
627 }
628 return;
629 }
630 return 0;
631 }
633 //
634 // This will place the aco(s) into the selected acl
635 // $acl_title = title of acl (string)
636 // $return_value = return value of acl (string)
637 // $aco_id = id of aco (array)
638 //
639 function acl_add_acos($acl_title, $return_value, $aco_id) {
640 global $phpgacl_location;
641 if (isset ($phpgacl_location)) {
642 include_once("$phpgacl_location/gacl_api.class.php");
643 $gacl = new gacl_api();
644 $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $acl_title, FALSE, FALSE, FALSE, $return_value);
645 foreach ($aco_id as $value) {
646 $aco_data = $gacl->get_object_data($value, 'ACO');
647 $aco_section = $aco_data[0][0];
648 $aco_name = $aco_data[0][1];
649 $gacl->append_acl($acl_id[0], NULL, NULL, NULL, NULL, array($aco_section=>array($aco_name)));
650 }
651 return;
652 }
653 return 0;
654 }
656 //
657 // This will remove the aco(s) from the selected acl
658 // Note if all aco's are removed, then will place the filler-placeholder
659 // into the acl to avoid complete removal of the acl.
660 // $acl_title = title of acl (string)
661 // $return_value = return value of acl (string)
662 // $aco_id = id of aco (array)
663 //
664 function acl_remove_acos($acl_title, $return_value, $aco_id) {
665 global $phpgacl_location;
666 if (isset ($phpgacl_location)) {
667 include_once("$phpgacl_location/gacl_api.class.php");
668 $gacl = new gacl_api();
669 $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $acl_title, FALSE, FALSE, FALSE, $return_value);
671 // Check to see if removing all acos. If removing all acos then will
672 // ensure the filler-placeholder aco in acl to avoid complete
673 // removal of the acl.
674 if (count($aco_id) == acl_count_acos($acl_title, $return_value)) {
675 //1-get the filler-placeholder aco id
676 $filler_aco_id = $gacl->get_object_id('placeholder','filler','ACO');
677 //2-add filler-placeholder aco
678 acl_add_acos($acl_title, $return_value, array($filler_aco_id));
679 //3-ensure filler-placeholder aco is not to be deleted
680 $safeListaco = remove_element($_POST["selection"],$filler_aco_id);
681 //4-prepare to safely delete the acos
682 $aco_id = $safeListaco;
683 }
685 foreach ($aco_id as $value) {
686 $aco_data = $gacl->get_object_data($value, 'ACO');
687 $aco_section = $aco_data[0][0];
688 $aco_name = $aco_data[0][1];
689 $gacl->shift_acl($acl_id[0], NULL, NULL, NULL, NULL, array($aco_section=>array($aco_name)));
690 }
691 return;
692 }
693 return 0;
694 }
696 //
697 // This will return the number of aco objects
698 // in a specified acl.
699 // $acl_title = title of acl (string)
700 // $return_value = return value of acl (string)
701 //
702 function acl_count_acos($acl_title, $return_value) {
703 global $phpgacl_location;
704 if (isset ($phpgacl_location)) {
705 include_once("$phpgacl_location/gacl_api.class.php");
706 $gacl = new gacl_api();
707 $acl_id = $gacl->search_acl(FALSE, FALSE, FALSE, FALSE, $acl_title, FALSE, FALSE, FALSE, $return_value);
708 $acl_data = $gacl->get_acl($acl_id[0]);
709 $aco_count = 0;
710 foreach ($acl_data['aco'] as $key => $value) {
711 $aco_count = $aco_count + count($acl_data['aco'][$key]);
712 }
713 return $aco_count;
714 }
715 return 0;
716 }
718 //
719 // Function to remove an element from an array
720 //
721 function remove_element($arr, $val){
722 $arr2 = array();
723 foreach ($arr as $value){
724 if ($value != $val) {
725 array_push($arr2,$value);
726 }
727 }
728 return $arr2;
729 }
730 ?>