gacl/admin/acl_list.php

   1 <?php
   2 //First make sure user has access
   3 require_once("../../interface/globals.php");
   4 require_once("$srcdir/acl.inc");
   5 //ensure user has proper access
   6 if (!acl_check('admin', 'acl')) {
   7             echo xlt('ACL Administration Not Authorized');
   8             exit;
   9 }
  10 //ensure php is installed
  11 if (!isset($phpgacl_location)) {
  12             echo xlt('php-GACL access controls are turned off');
  13             exit;
  14 }
  15
  16 require_once('gacl_admin.inc.php');
  17
  18 switch ($_GET['action']) {
  19         case 'Delete':
  20                 $gacl_api->debug_text('Delete!');
  21
  22                 if (is_array ($_GET['delete_acl']) AND !empty($_GET['delete_acl'])) {
  23                         foreach($_GET['delete_acl'] as $id) {
  24                                 $gacl_api->del_acl($id);
  25                         }
  26                 }
  27
  28                 //Return page.
  29                 $gacl_api->return_page($_GET['return_page']);
  30                 break;
  31         case 'Submit':
  32                 $gacl_api->debug_text('Submit!!');
  33                 break;
  34         default:
  35                 /*
  36                  * When the user requests to filter the list, run the filter and get just the matching IDs.
  37                  * Use these IDs to get the entire ACL information in the second query.
  38                  *
  39                  * If we just put the LIKE statements in the second query, it will match the correct ACLs
  40                  * but will only return the matching rows, so it won't show the entire ACL information.
  41                  *
  42                  */
  43                 if (isset($_GET['action']) AND $_GET['action'] == 'Filter') {
  44                         $gacl_api->debug_text('Filtering...');
  45
  46                         $query = '
  47                                 SELECT          DISTINCT a.id
  48                                 FROM            '. $gacl_api->_db_table_prefix .'acl a
  49                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aco_map ac ON ac.acl_id=a.id
  50                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aro_map ar ON ar.acl_id=a.id
  51                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'axo_map ax ON ax.acl_id=a.id';
  52
  53                         if ( isset($_GET['filter_aco_section']) AND $_GET['filter_aco_section'] != '-1') {
  54                                 $filter_query[] = 'ac.section_value='. $db->qstr(strtolower($_GET['filter_aco_section']));
  55                         }
  56                         if ( isset($_GET['filter_aco']) AND $_GET['filter_aco'] != '') {
  57                                 $query .= '
  58                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aco c ON (c.section_value=ac.section_value AND c.value=ac.value)';
  59
  60                                 $name = $db->qstr(strtolower($_GET['filter_aco']));
  61                                 $filter_query[] = '(lower(c.value) LIKE '. $name .' OR lower(c.name) LIKE '. $name .')';
  62                         }
  63
  64                         if ( isset($_GET['filter_aro_section']) AND $_GET['filter_aro_section'] != '-1') {
  65                                 $filter_query[] = 'ar.section_value='. $db->qstr(strtolower($_GET['filter_aro_section']));
  66                         }
  67                         if ( isset($_GET['filter_aro']) AND $_GET['filter_aro'] != '') {
  68                                 $query .= '
  69                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aro r ON (r.section_value=ar.section_value AND r.value=ar.value)';
  70
  71                                 $name = $db->qstr(strtolower($_GET['filter_aro']));
  72                                 $filter_query[] = '(lower(r.value) LIKE '. $name .' OR lower(r.name) LIKE '. $name .')';
  73                         }
  74                         if ( isset($_GET['filter_aro_group']) AND $_GET['filter_aro_group'] != '') {
  75                                 $query .= '
  76                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aro_groups_map arg ON arg.acl_id=a.id
  77                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'aro_groups rg ON rg.id=arg.group_id';
  78
  79                                 $filter_query[] = '(lower(rg.name) LIKE '. $db->qstr(strtolower($_GET['filter_aro_group'])) .')';
  80                         }
  81
  82                         if ( isset($_GET['filter_axo_section']) AND $_GET['filter_axo_section'] != '-1') {
  83                                 $filter_query[] = 'ax.section_value='. $db->qstr(strtolower($_GET['filter_axo_section']));
  84                         }
  85                         if ( isset($_GET['filter_axo']) AND $_GET['filter_axo'] != '') {
  86                                 $query .= '
  87                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'axo x ON (x.section_value=ax.section_value AND x.value=ax.value)';
  88
  89                                 $name = $db->qstr(strtolower($_GET['filter_axo']));
  90                                 $filter_query[] = '(lower(x.value) LIKE '. $name .' OR lower(x.name) LIKE '. $name .')';
  91                         }
  92                         if ( isset($_GET['filter_axo_group']) AND $_GET['filter_axo_group'] != '') {
  93                                 $query .= '
  94                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'axo_groups_map axg ON axg.acl_id=a.id
  95                                 LEFT JOIN       '. $gacl_api->_db_table_prefix .'axo_groups xg ON xg.id=axg.group_id';
  96
  97                                 $filter_query[] = '(lower(xg.name) LIKE '. $db->qstr(strtolower($_GET['filter_axo_group'])) .')';
  98                         }
  99
 100                         if ( isset($_GET['filter_acl_section']) AND $_GET['filter_acl_section'] != '-1') {
 101                                 $filter_query[] = 'a.section_value='. $db->qstr(strtolower($_GET['filter_acl_section']));
 102                         }
 103                         if ( isset($_GET['filter_return_value']) AND $_GET['filter_return_value'] != '') {
 104                                 $filter_query[] = '(lower(a.return_value) LIKE '. $db->qstr(strtolower($_GET['filter_return_value'])) .')';
 105                         }
 106                         if ( isset($_GET['filter_allow']) AND $_GET['filter_allow'] != '-1') {
 107                                 $filter_query[] = '(a.allow LIKE '. $db->qstr($_GET['filter_allow']) .')';
 108                         }
 109                         if ( isset($_GET['filter_enabled']) AND $_GET['filter_enabled'] != '-1') {
 110                                 $filter_query[] = '(a.enabled LIKE '. $db->qstr($_GET['filter_enabled']) .')';
 111                         }
 112
 113                         if (isset($filter_query) AND is_array($filter_query)) {
 114                                 $query .= '
 115                                 WHERE '. implode(' AND ', $filter_query);
 116                         }
 117                 } else {
 118                         $query  = '
 119                                 SELECT a.id FROM ' . $gacl_api->_db_table_prefix . 'acl a';
 120                 }
 121
 122                 $query .= '
 123                                 ORDER BY a.id ASC';
 124
 125                 $acl_ids = array();
 126
 127                 $rs = $db->PageExecute($query, $gacl_api->_items_per_page, $_GET['page']);
 128                 if ( is_object($rs) ) {
 129                         $smarty->assign('paging_data', $gacl_api->get_paging_data($rs));
 130
 131                         while ( $row = $rs->FetchRow() ) {
 132                                 $acl_ids[] = $row[0];
 133                         }
 134
 135                         $rs->Close();
 136                 }
 137
 138                 if ( !empty($acl_ids) ) {
 139                         $acl_ids_sql = implode(',', $acl_ids);
 140                 } else {
 141                         //This shouldn't match any ACLs, returning 0 rows.
 142                         $acl_ids_sql = -1;
 143                 }
 144
 145                 $acls = array();
 146
 147                 //If the user is searching, and there are no results, don't run the query at all
 148                 if ( !($_GET['action'] == 'Filter' AND $acl_ids_sql == -1) ) {
 149
 150                         // grab acl details
 151                         $query = '
 152                                 SELECT  a.id,x.name,a.allow,a.enabled,a.return_value,a.note,a.updated_date
 153                                 FROM    '. $gacl_api->_db_table_prefix .'acl a
 154                                 INNER JOIN      '. $gacl_api->_db_table_prefix .'acl_sections x ON x.value=a.section_value
 155                                 WHERE   a.id IN ('. $acl_ids_sql . ')';
 156                         $rs = $db->Execute($query);
 157
 158                         if ( is_object($rs) ) {
 159                                 while ( $row = $rs->FetchRow() ) {
 160                                         $acls[$row[0]] = array(
 161                                                 'id' => $row[0],
 162                                                 // 'section_id' => $section_id,
 163                                                 'section_name' => $row[1],
 164                                                 'allow' => (bool)$row[2],
 165                                                 'enabled' => (bool)$row[3],
 166                                                 'return_value' => $row[4],
 167                                                 'note' => $row[5],
 168                                                 'updated_date' => $row[6],
 169
 170                                                 'aco' => array(),
 171                                                 'aro' => array(),
 172                                                 'aro_groups' => array(),
 173                                                 'axo' => array(),
 174                                                 'axo_groups' => array()
 175                                         );
 176                                 }
 177                         }
 178
 179                         // grab ACO, ARO and AXOs
 180                         foreach ( array('aco', 'aro', 'axo') as $type ) {
 181                                 $query = '
 182                                         SELECT  a.acl_id,o.name,s.name
 183                                         FROM    '. $gacl_api->_db_table_prefix . $type .'_map a
 184                                         INNER JOIN      '. $gacl_api->_db_table_prefix . $type .' o ON (o.section_value=a.section_value AND o.value=a.value)
 185                                         INNER JOIN      '. $gacl_api->_db_table_prefix . $type . '_sections s ON s.value=a.section_value
 186                                         WHERE   a.acl_id IN ('. $acl_ids_sql . ')';
 187                                 $rs = $db->Execute($query);
 188
 189                                 if ( is_object($rs) ) {
 190                                         while ( $row = $rs->FetchRow() ) {
 191                                                 list($acl_id, $name, $section_name) = $row;
 192
 193                                                 if ( isset($acls[$acl_id]) ) {
 194                                                         $acls[$acl_id][$type][$section_name][] = $name;
 195                                                 }
 196                                         }
 197                                 }
 198                         }
 199
 200                         // grab ARO and AXO groups
 201                         foreach ( array('aro', 'axo') as $type )
 202                         {
 203                                 $query = '
 204                                         SELECT  a.acl_id,g.name
 205                                         FROM    '. $gacl_api->_db_table_prefix . $type .'_groups_map a
 206                                         INNER JOIN      '. $gacl_api->_db_table_prefix . $type .'_groups g ON g.id=a.group_id
 207                                         WHERE   a.acl_id IN ('. $acl_ids_sql . ')';
 208                                 $rs = $db->Execute($query);
 209
 210                                 if ( is_object($rs) ) {
 211                                         while ( $row = $rs->FetchRow () ) {
 212                                                 list($acl_id, $name) = $row;
 213
 214                                                 if ( isset($acls[$acl_id]) ) {
 215                                                         $acls[$acl_id][$type .'_groups'][] = $name;
 216                                                 }
 217                                         }
 218                                 }
 219                         }
 220                 }
 221
 222                 $smarty->assign('acls', $acls);
 223
 224                 $smarty->assign('filter_aco', $_GET['filter_aco']);
 225         $smarty->assign('filter_aco_escaped', attr($_GET['filter_aco']));
 226
 227                 $smarty->assign('filter_aro', $_GET['filter_aro']);
 228         $smarty->assign('filter_aro_escaped', attr($_GET['filter_aro']));
 229
 230                 $smarty->assign('filter_aro_group', $_GET['filter_aro_group']);
 231         $smarty->assign('filter_aro_group_escaped', attr($_GET['filter_aro_group']));
 232
 233                 $smarty->assign('filter_axo', $_GET['filter_axo']);
 234         $smarty->assign('filter_axo_escaped', attr($_GET['filter_axo']));
 235
 236                 $smarty->assign('filter_axo_group', $_GET['filter_axo_group']);
 237         $smarty->assign('filter_axo_group_escaped', attr($_GET['filter_axo_group']));
 238
 239                 $smarty->assign('filter_return_value', $_GET['filter_return_value']);
 240         $smarty->assign('filter_return_value_escaped', attr($_GET['filter_return_value']));
 241
 242                 foreach(array('aco','aro','axo','acl') as $type) {
 243                         //
 244                         //Grab all sections for select box
 245                         //
 246                         $options = array (
 247                                 -1 => 'Any'
 248                         );
 249
 250                         $query = '
 251                                 SELECT value,name
 252                                 FROM '. $gacl_api->_db_table_prefix .$type .'_sections
 253                                 WHERE hidden=0
 254                                 ORDER BY order_value,name';
 255                         $rs = $db->Execute($query);
 256
 257                         if ( is_object($rs) ) {
 258                                 while ($row = $rs->FetchRow()) {
 259                                         $options[attr($row[0])] = attr($row[1]);
 260                                 }
 261                         }
 262
 263                         $smarty->assign('options_filter_'. $type . '_sections',  $options);
 264
 265                         if (!isset($_GET['filter_' . $type . '_section']) OR $_GET['filter_' . $type . '_section'] == '') {
 266                                 $_GET['filter_' . $type . '_section'] = '-1';
 267                         }
 268
 269                         $smarty->assign('filter_' . $type . '_section', $_GET['filter_' . $type .'_section']);
 270             $smarty->assign('filter_' . $type . '_section_escaped', attr($_GET['filter_' . $type .'_section']));
 271                 }
 272
 273                 $smarty->assign('options_filter_allow', array('-1' => 'Any', 1 => 'Allow', 0 => 'Deny'));
 274                 $smarty->assign('options_filter_enabled', array('-1' => 'Any', 1 => 'Yes', 0 => 'No'));
 275
 276                 if (!isset($_GET['filter_allow']) OR $_GET['filter_allow'] == '') {
 277                         $_GET['filter_allow'] = '-1';
 278                 }
 279                 if (!isset($_GET['filter_enabled']) OR $_GET['filter_enabled'] == '') {
 280                         $_GET['filter_enabled'] = '-1';
 281                 }
 282
 283                 $smarty->assign('filter_allow', $_GET['filter_allow']);
 284         $smarty->assign('filter_allow_escaped', attr($_GET['filter_allow']));
 285
 286                 $smarty->assign('filter_enabled', $_GET['filter_enabled']);
 287         $smarty->assign('filter_enabled_escaped', attr($_GET['filter_enabled']));
 288 }
 289
 290 $smarty->assign('action', $_GET['action']);
 291 $smarty->assign('action_escaped', attr($_GET['action']));
 292
 293 $smarty->assign('return_page', $_SERVER['PHP_SELF']);
 294
 295 $smarty->assign('current','acl_list');
 296 $smarty->assign('page_title', 'ACL List');
 297
 298 $smarty->assign('phpgacl_version', $gacl_api->get_version());
 299 $smarty->assign('phpgacl_schema_version', $gacl_api->get_schema_version());
 300
 301 $smarty->display('phpgacl/acl_list.tpl');
 302 ?>