Index: trunk/kernel/units/users/users_event_handler.php
===================================================================
diff -u -r5431 -r5514
--- trunk/kernel/units/users/users_event_handler.php (.../users_event_handler.php) (revision 5431)
+++ trunk/kernel/units/users/users_event_handler.php (.../users_event_handler.php) (revision 5514)
@@ -12,22 +12,22 @@
$permissions = Array(
// admin
'OnSetPersistantVariable' => Array('self' => 'view'), // because setting to logged in user only
-
+
// front
'OnRefreshForm' => Array('self' => true),
-
+
'OnForgotPassword' => Array('self' => true),
'OnResetPassword' => Array('self' => true),
'OnResetPasswordConfirmed' => Array('self' => true),
-
+
'OnSubscribeQuery' => Array('self' => true),
'OnSubscribeUser' => Array('self' => true),
-
+
'OnRecommend' => Array('self' => true),
);
$this->permMapping = array_merge($this->permMapping, $permissions);
}
-
+
/**
* Checks permissions of user
*
@@ -39,49 +39,49 @@
// permission is checked in OnLogin event directly
return true;
}
-
+
if (!$this->Application->IsAdmin()) {
$user_id = $this->Application->GetVar('u_id');
$items_info = $this->Application->GetVar($event->getPrefixSpecial(true));
-
+
if ($event->Name == 'OnCreate' && $user_id == -2) {
// "Guest" can create new users
return true;
}
-
+
if ($event->Name == 'OnUpdate' && $user_id > 0) {
$user_dummy =& $this->Application->recallObject($event->Prefix.'.-item', null, Array('skip_autoload' => true));
foreach ($items_info as $id => $field_values) {
if ($id != $user_id) {
// registered users can update their record only
return false;
}
-
+
$user_dummy->Load($id);
$status_field = array_shift($this->Application->getUnitOption($event->Prefix, 'StatusField'));
-
+
if ($user_dummy->GetDBField($status_field) != STATUS_ACTIVE) {
// not active user is not allowed to update his record (he could not activate himself manually)
return false;
}
-
+
if (isset($field_values[$status_field]) && $user_dummy->GetDBField($status_field) != $field_values[$status_field]) {
// user can't change status by himself
return false;
}
}
return true;
}
-
+
if ($event->Name == 'OnUpdate' && $user_id <= 0) {
// guests are not allowed to update their record, because they don't have it :)
return false;
}
}
-
+
return parent::CheckPermission($event);
}
-
+
function OnSessionExpire()
{
if( $this->Application->IsAdmin() ) {
@@ -117,7 +117,7 @@
$email_as_login = $this->Application->ConfigValue('Email_As_Login');
list($login_field, $submit_field) = $email_as_login ? Array('Email', 'email') : Array('Login', 'login');
$login_value = $this->Application->GetVar($submit_field);
-
+
if ($this->Application->IsAdmin() && ($login_value == 'root')) {
// logging in "root" (admin only)
$root_password = $this->Application->ConfigValue('RootPass');
@@ -130,13 +130,13 @@
$user_id = -1;
$object->Load($user_id);
$object->SetDBField('Login', $login_value);
-
+
$session =& $this->Application->recallObject('Session');
$session->SetField('PortalUserId', $user_id);
// $session->SetField('GroupList', implode(',', $groups) );
$this->Application->SetVar('u_id', $user_id);
$this->Application->StoreVar('user_id', $user_id);
-
+
$this->processLoginRedirect($event, $password);
return true;
}
@@ -146,7 +146,7 @@
return false;
}
}
-
+
/*$sql = 'SELECT PortalUserId FROM '.$object->TableName.' WHERE (%s = %s) AND (Password = MD5(%s))';
$user_id = $this->Conn->GetOne( sprintf($sql, $login_field, $this->Conn->qstr($login_value), $this->Conn->qstr($password) ) );*/
@@ -187,6 +187,7 @@
}
else
{
+ $object->SetID(-2);
$object->SetError('ValidateLogin', 'invalid_password', 'lu_invalid_password');
$event->status = erFAIL;
}
@@ -214,7 +215,7 @@
}
return $ret;
}
-
+
/**
* Process all required data and redirect logged-in user
*
@@ -223,7 +224,7 @@
function processLoginRedirect(&$event, $password)
{
$object =& $event->getObject();
-
+
$next_template = $this->Application->GetVar('next_template');
if ($next_template == '_ses_redirect') {
$location = $this->Application->BaseURL().$this->Application->RecallVar($next_template);
@@ -235,7 +236,7 @@
else {
header('Location: '.$location);
}
-
+
$session =& $this->Application->recallObject('Session');
$session->SaveData();
exit;
@@ -244,15 +245,15 @@
if ($next_template) {
$event->redirect = $next_template;
}
-
+
if ($this->Application->ConfigValue('UseJSRedirect')) {
$event->SetRedirectParam('js_redirect', 1);
}
-
+
$sync_manager =& $this->Application->recallObjectP('UsersSyncronizeManager', null, Array(), 'InPortalSyncronize');
$sync_manager->performAction('LoginUser', $object->GetDBField('Login'), $password);
}
-
+
/**
* Called when user logs in using old in-portal
*
@@ -262,7 +263,7 @@
{
$sync_manager =& $this->Application->recallObjectP('UsersSyncronizeManager', null, Array(), 'InPortalSyncronize');
$sync_manager->performAction('LoginUser', $event->getEventParam('user'), $event->getEventParam('pass') );
-
+
if ($event->redirect && is_string($event->redirect)) {
// some real template specified instead of true
$this->Application->Redirect($event->redirect, $event->redirect_params);
@@ -368,7 +369,7 @@
/**
- * When creating user & user with such email exists then force to use OnUpdate insted of OnCreate
+ * When creating user & user with such email exists then force to use OnUpdate insted of ?
*
* @param kEvent $event
*/
@@ -603,7 +604,7 @@
$user_email = $this->Application->GetVar('subscriber_email');
if ( preg_match("/^[_a-zA-Z0-9-\.]+@[a-zA-Z0-9-\.]+\.[a-z]{2,4}$/", $user_email) ){
-
+
$object = &$this->Application->recallObject($this->Prefix.'.subscriber', null, Array('skip_autoload' => true));
$this->Application->StoreVar('SubscriberEmail', $user_email);
@@ -997,7 +998,7 @@
$object->IgnoreValidation = true;
$object->SetFieldsFromHash($fields);
}
-
+
/**
* Sets persistant variable
*
@@ -1006,11 +1007,11 @@
function OnSetPersistantVariable(&$event)
{
$object =& $event->getObject();
-
+
$field = $this->Application->GetVar('field');
$value = $this->Application->GetVar('value');
$object->setPersistantVar($field, $value);
-
+
$force_tab = $this->Application->GetVar('SetTab');
if ($force_tab) {
$this->Application->StoreVar('force_tab', $force_tab);
Index: trunk/admin/install/upgrades/readme_1_2_0.txt
===================================================================
diff -u -r5431 -r5514
--- trunk/admin/install/upgrades/readme_1_2_0.txt (.../readme_1_2_0.txt) (revision 5431)
+++ trunk/admin/install/upgrades/readme_1_2_0.txt (.../readme_1_2_0.txt) (revision 5514)
@@ -2,10 +2,10 @@
Intechnic Corporation, Jul 4, 2006
New features:
- - Administrative Console Section Permissions - allows controlling view, add, edit and delete permissions individually for every section of the Administrative Console, as weel as section-specific advanced permissions, such as approve, decline, etc.
+ - Administrative Console Section Permissions - allows controlling view, add, edit and delete permissions individually for every section of the Administrative Console, as well as section-specific advanced permissions, such as approve, decline, etc.
- Navigation tree dynamic categories loading - the categories of the catalog are now accessible directly via the navigation tree
- Custom e-mail footer implemented, allowing to add a common footer to every e-mail sent out by the system
- Overall performance improvement due to several levels of caching
IMPORTANT NOTE:
-During the implementation of Administrative Console Section permissions a number of issues have been identified with potential ability for the attacker to gain access to some of In-portal stored data. The issues have been resolved with the implementation of new permissions system. Customers are strongly encouraged to upgrade to the latest version of In-portal platform and corresponding module versions to ensure the reliability and security of their websites!
+A number of security issues have been identified in the previous versions, giving an attacker a potential ability to gain access to some of the In-portal data. The issues have been resolved with the implementation of the new permission system. All customers are strongly encouraged to upgrade to the latest version of In-portal platform and corresponding module versions!
Index: trunk/core/units/users/users_event_handler.php
===================================================================
diff -u -r5431 -r5514
--- trunk/core/units/users/users_event_handler.php (.../users_event_handler.php) (revision 5431)
+++ trunk/core/units/users/users_event_handler.php (.../users_event_handler.php) (revision 5514)
@@ -12,22 +12,22 @@
$permissions = Array(
// admin
'OnSetPersistantVariable' => Array('self' => 'view'), // because setting to logged in user only
-
+
// front
'OnRefreshForm' => Array('self' => true),
-
+
'OnForgotPassword' => Array('self' => true),
'OnResetPassword' => Array('self' => true),
'OnResetPasswordConfirmed' => Array('self' => true),
-
+
'OnSubscribeQuery' => Array('self' => true),
'OnSubscribeUser' => Array('self' => true),
-
+
'OnRecommend' => Array('self' => true),
);
$this->permMapping = array_merge($this->permMapping, $permissions);
}
-
+
/**
* Checks permissions of user
*
@@ -39,49 +39,49 @@
// permission is checked in OnLogin event directly
return true;
}
-
+
if (!$this->Application->IsAdmin()) {
$user_id = $this->Application->GetVar('u_id');
$items_info = $this->Application->GetVar($event->getPrefixSpecial(true));
-
+
if ($event->Name == 'OnCreate' && $user_id == -2) {
// "Guest" can create new users
return true;
}
-
+
if ($event->Name == 'OnUpdate' && $user_id > 0) {
$user_dummy =& $this->Application->recallObject($event->Prefix.'.-item', null, Array('skip_autoload' => true));
foreach ($items_info as $id => $field_values) {
if ($id != $user_id) {
// registered users can update their record only
return false;
}
-
+
$user_dummy->Load($id);
$status_field = array_shift($this->Application->getUnitOption($event->Prefix, 'StatusField'));
-
+
if ($user_dummy->GetDBField($status_field) != STATUS_ACTIVE) {
// not active user is not allowed to update his record (he could not activate himself manually)
return false;
}
-
+
if (isset($field_values[$status_field]) && $user_dummy->GetDBField($status_field) != $field_values[$status_field]) {
// user can't change status by himself
return false;
}
}
return true;
}
-
+
if ($event->Name == 'OnUpdate' && $user_id <= 0) {
// guests are not allowed to update their record, because they don't have it :)
return false;
}
}
-
+
return parent::CheckPermission($event);
}
-
+
function OnSessionExpire()
{
if( $this->Application->IsAdmin() ) {
@@ -117,7 +117,7 @@
$email_as_login = $this->Application->ConfigValue('Email_As_Login');
list($login_field, $submit_field) = $email_as_login ? Array('Email', 'email') : Array('Login', 'login');
$login_value = $this->Application->GetVar($submit_field);
-
+
if ($this->Application->IsAdmin() && ($login_value == 'root')) {
// logging in "root" (admin only)
$root_password = $this->Application->ConfigValue('RootPass');
@@ -130,13 +130,13 @@
$user_id = -1;
$object->Load($user_id);
$object->SetDBField('Login', $login_value);
-
+
$session =& $this->Application->recallObject('Session');
$session->SetField('PortalUserId', $user_id);
// $session->SetField('GroupList', implode(',', $groups) );
$this->Application->SetVar('u_id', $user_id);
$this->Application->StoreVar('user_id', $user_id);
-
+
$this->processLoginRedirect($event, $password);
return true;
}
@@ -146,7 +146,7 @@
return false;
}
}
-
+
/*$sql = 'SELECT PortalUserId FROM '.$object->TableName.' WHERE (%s = %s) AND (Password = MD5(%s))';
$user_id = $this->Conn->GetOne( sprintf($sql, $login_field, $this->Conn->qstr($login_value), $this->Conn->qstr($password) ) );*/
@@ -187,6 +187,7 @@
}
else
{
+ $object->SetID(-2);
$object->SetError('ValidateLogin', 'invalid_password', 'lu_invalid_password');
$event->status = erFAIL;
}
@@ -214,7 +215,7 @@
}
return $ret;
}
-
+
/**
* Process all required data and redirect logged-in user
*
@@ -223,7 +224,7 @@
function processLoginRedirect(&$event, $password)
{
$object =& $event->getObject();
-
+
$next_template = $this->Application->GetVar('next_template');
if ($next_template == '_ses_redirect') {
$location = $this->Application->BaseURL().$this->Application->RecallVar($next_template);
@@ -235,7 +236,7 @@
else {
header('Location: '.$location);
}
-
+
$session =& $this->Application->recallObject('Session');
$session->SaveData();
exit;
@@ -244,15 +245,15 @@
if ($next_template) {
$event->redirect = $next_template;
}
-
+
if ($this->Application->ConfigValue('UseJSRedirect')) {
$event->SetRedirectParam('js_redirect', 1);
}
-
+
$sync_manager =& $this->Application->recallObjectP('UsersSyncronizeManager', null, Array(), 'InPortalSyncronize');
$sync_manager->performAction('LoginUser', $object->GetDBField('Login'), $password);
}
-
+
/**
* Called when user logs in using old in-portal
*
@@ -262,7 +263,7 @@
{
$sync_manager =& $this->Application->recallObjectP('UsersSyncronizeManager', null, Array(), 'InPortalSyncronize');
$sync_manager->performAction('LoginUser', $event->getEventParam('user'), $event->getEventParam('pass') );
-
+
if ($event->redirect && is_string($event->redirect)) {
// some real template specified instead of true
$this->Application->Redirect($event->redirect, $event->redirect_params);
@@ -368,7 +369,7 @@
/**
- * When creating user & user with such email exists then force to use OnUpdate insted of OnCreate
+ * When creating user & user with such email exists then force to use OnUpdate insted of ?
*
* @param kEvent $event
*/
@@ -603,7 +604,7 @@
$user_email = $this->Application->GetVar('subscriber_email');
if ( preg_match("/^[_a-zA-Z0-9-\.]+@[a-zA-Z0-9-\.]+\.[a-z]{2,4}$/", $user_email) ){
-
+
$object = &$this->Application->recallObject($this->Prefix.'.subscriber', null, Array('skip_autoload' => true));
$this->Application->StoreVar('SubscriberEmail', $user_email);
@@ -997,7 +998,7 @@
$object->IgnoreValidation = true;
$object->SetFieldsFromHash($fields);
}
-
+
/**
* Sets persistant variable
*
@@ -1006,11 +1007,11 @@
function OnSetPersistantVariable(&$event)
{
$object =& $event->getObject();
-
+
$field = $this->Application->GetVar('field');
$value = $this->Application->GetVar('value');
$object->setPersistantVar($field, $value);
-
+
$force_tab = $this->Application->GetVar('SetTab');
if ($force_tab) {
$this->Application->StoreVar('force_tab', $force_tab);
Index: trunk/core/admin_templates/categories/cache_updater.tpl
===================================================================
diff -u -r5496 -r5514
--- trunk/core/admin_templates/categories/cache_updater.tpl (.../cache_updater.tpl) (revision 5496)
+++ trunk/core/admin_templates/categories/cache_updater.tpl (.../cache_updater.tpl) (revision 5514)
@@ -33,8 +33,12 @@
';
}
-
+
function TagPermissionCheck($params, $tag_name)
{
$perm_event = getArrayValue($params, 'perm_event');
$permission_groups = getArrayValue($params, 'permissions');
-
+
if ($permission_groups) {
$this->showDebug('Tag '.$tag_name.' permission(-s): '.$permission_groups.'', $params);
$permission_groups = explode('|', $permission_groups);
@@ -231,7 +231,7 @@
$has_permission = $has_permission && $this->CheckPermission($permission, isset($params['system']) && $params['system'] ? 1 : 0);
}
$group_has_permission = $group_has_permission || $has_permission;
-
+
if ($group_has_permission) {
return true;
}
@@ -244,10 +244,10 @@
$event_handler =& $this->Application->recallObject($prefix.'_EventHandler');
return $event_handler->CheckPermission( new kEvent($perm_event) );
}
-
+
return true;
}
-
+
/**
* Returns no permission template to redirect to
*
@@ -260,7 +260,7 @@
if ($next_t = getArrayValue($params, 'next_template')) {
$t = $next_t;
}
-
+
if (!$this->Application->LoggedIn()) {
$redirect_template = $params['login_template'];
$redirect_params = Array('next_template' => $t);
@@ -272,17 +272,17 @@
else {
$redirect_template = $this->Application->IsAdmin() ? 'no_permission' : $this->Application->ConfigValue('NoPermissionTemplate');
}
-
+
$redirect_params = $this->Application->isDebugMode() ? Array('from_template' => 1, 'perms' => $params[ isset($params['permissions']) ? 'permissions' : 'perm_event'], 'next_template' => $t) : Array();
}
-
+
if (isset($params['index_file']) && $params['index_file']) {
$redirect_params['index_file'] = $params['index_file'];
}
-
+
return Array($redirect_template, $redirect_params);
}
-
+
/**
* Check current user permissions based on it's group permissions in specified category (for non-system permissions) or just checks if system permission is set
*
@@ -297,26 +297,26 @@
// "root" is allowed anywhere
return $name == 'SYSTEM_ACCESS.READONLY' ? 0 : 1;
}
-
+
if ($type == 1) {
// "system" permission are always checked per "Home" category (ID = 0)
$cat_id = 0;
}
-
+
if (!isset($cat_id)) {
$cat_id = $this->Application->GetVar('m_cat_id');
}
-
+
$cache_key = $name.'|'.$type.'|'.$cat_id;
$perm_value = $this->Application->getCache('permissions', $cache_key);
if ($perm_value !== false) {
return $perm_value;
}
-
+
// perm cache is build only based on records in db, that's why if permission is not explicitly denied, then
// that (perm cache creator) code thinks that it is allowed & adds corresponding record and code below will
// return incorrect results
-
+
if (preg_match('/(.*)\.VIEW$/', $name) && ($type == 0)) {
// cached view permission of category: begin
$sql = 'SELECT PermissionConfigId
@@ -327,20 +327,20 @@
$sql = 'SELECT PermId
FROM '.TABLE_PREFIX.'PermCache
WHERE (PermId = '.$perm_id.') AND (CategoryId = '.$cat_id.')';
-
+
$view_filters = Array();
$groups = explode(',', $this->Application->RecallVar('UserGroups'));
foreach ($groups as $group) {
$view_filters[] = 'FIND_IN_SET('.$group.', ACL)';
}
$sql .= ' AND ('.implode(' OR ', $view_filters).')';
- $perm_value = $this->Conn->GetOne($sql) ? 1 : 0;
-
+ $perm_value = $this->Conn->GetOne($sql) ? 1 : 0;
+
$this->Application->setCache('permissions', $cache_key, $perm_value);
- return $perm_value;
+ return $perm_value;
// cached view permission of category: end
}
-
+
if ($cat_id == 0) {
$cat_hierarchy = Array(0);
}
@@ -355,20 +355,20 @@
$cat_hierarchy = array_reverse($cat_hierarchy);
array_push($cat_hierarchy, 0);
}
-
- $perm_value = 0;
+
+ $perm_value = 0;
$groups = $this->Application->RecallVar('UserGroups');
foreach ($cat_hierarchy as $category_id) {
$sql = 'SELECT SUM(PermissionValue)
FROM '.TABLE_PREFIX.'Permissions
WHERE Permission = "'.$name.'" AND CatId = '.$category_id.' AND GroupId IN ('.$groups.') AND Type = '.$type;
$res = $this->Conn->GetOne($sql);
- if ($res !== false) {
+ if ($res !== false && !is_null($res)) {
$perm_value = $res ? 1 : 0;
break;
}
}
-
+
$this->Application->setCache('permissions', $cache_key, $perm_value);
return $perm_value;
}
Index: trunk/kernel/units/general/cat_dbitem_export.php
===================================================================
diff -u -r5431 -r5514
--- trunk/kernel/units/general/cat_dbitem_export.php (.../cat_dbitem_export.php) (revision 5431)
+++ trunk/kernel/units/general/cat_dbitem_export.php (.../cat_dbitem_export.php) (revision 5514)
@@ -783,6 +783,10 @@
$item_id = $this->Conn->GetOne($sql);
}
$save_method = $item_id && $this->curItem->Load($item_id) ? 'Update' : 'Create';
+ if ($save_method == 'Update') {
+ // replace id from csv file with found id
+ $record_data[ array_search($this->curItem->IDField, $this->exportFields) ] = $item_id;
+ }
}
$this->setImportData($record_data);
@@ -818,9 +822,13 @@
/*function saveLog($msg)
{
- $fp = fopen(FULL_PATH.'/sqls.log', 'a');
+ static $first_time = true;
+
+ $fp = fopen(FULL_PATH.'/sqls.log', $first_time ? 'w' : 'a');
fwrite($fp, $msg."\n");
fclose($fp);
+
+ $first_time = false;
}*/
/**
Index: trunk/core/units/general/cat_dbitem_export.php
===================================================================
diff -u -r5431 -r5514
--- trunk/core/units/general/cat_dbitem_export.php (.../cat_dbitem_export.php) (revision 5431)
+++ trunk/core/units/general/cat_dbitem_export.php (.../cat_dbitem_export.php) (revision 5514)
@@ -783,6 +783,10 @@
$item_id = $this->Conn->GetOne($sql);
}
$save_method = $item_id && $this->curItem->Load($item_id) ? 'Update' : 'Create';
+ if ($save_method == 'Update') {
+ // replace id from csv file with found id
+ $record_data[ array_search($this->curItem->IDField, $this->exportFields) ] = $item_id;
+ }
}
$this->setImportData($record_data);
@@ -818,9 +822,13 @@
/*function saveLog($msg)
{
- $fp = fopen(FULL_PATH.'/sqls.log', 'a');
+ static $first_time = true;
+
+ $fp = fopen(FULL_PATH.'/sqls.log', $first_time ? 'w' : 'a');
fwrite($fp, $msg."\n");
fclose($fp);
+
+ $first_time = false;
}*/
/**
Index: trunk/kernel/units/general/helpers/permissions_helper.php
===================================================================
diff -u -r5431 -r5514
--- trunk/kernel/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 5431)
+++ trunk/kernel/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 5514)
@@ -1,14 +1,14 @@
Application->getUnitOption('perm', 'TableName');
@@ -19,25 +19,25 @@
FROM '.$perm_table.'
WHERE (GroupId = '.$group_id.') AND (CatId = '.$cat_id.') AND (Type = '.$type.')';
$permissions = $this->Conn->Query($sql, 'Permission');
-
+
$this->Permissions = Array();
foreach ($permissions as $perm_name => $perm_options) {
$perm_record['value'] = $perm_options['PermissionValue'];
$perm_record['id'] = $perm_options['PermissionId'];
$this->Permissions[$perm_name] = $perm_record;
}
}
-
+
function getPermissionValue($perm_name)
{
return isset($this->Permissions[$perm_name]) ? $this->Permissions[$perm_name]['value'] : 0;
}
-
+
function getPermissionID($perm_name)
{
return isset($this->Permissions[$perm_name]) ? $this->Permissions[$perm_name]['id'] : 0;
}
-
+
/**
* This is old permission like ADMIN or LOGIN
*
@@ -49,7 +49,7 @@
{
return $section_name == 'in-portal:root' && $perm_name != 'view';
}
-
+
/**
* Returns permission names to check based on event name and item prefix (main item or subitem)
*
@@ -59,22 +59,22 @@
function getPermissionByEvent(&$event, $perm_mapping)
{
$top_prefix = $event->getEventParam('top_prefix');
-
+
$pefix_type = ($top_prefix == $event->Prefix) ? 'self' : 'subitem';
$perm_mapping = getArrayValue($perm_mapping, $event->Name);
-
+
if (!$perm_mapping[$pefix_type]) {
trigger_error('Permission mappings not defined for event '.$top_prefix.' <- '.$event->Prefix.':'.$event->Name.'', E_USER_ERROR);
}
-
+
if ($perm_mapping[$pefix_type] === true) {
// event is defined in mapping but is not checked by permissions
return true;
}
-
+
return explode('|', $perm_mapping[$pefix_type]);
}
-
+
/**
* Common event permission checking method
*
@@ -86,15 +86,15 @@
if (preg_match('/^CATEGORY:(.*)/', $section)) {
return $this->CheckEventCategoryPermission($event, $perm_mapping);
}
-
+
$top_prefix = $event->getEventParam('top_prefix');
$check_perms = $this->getPermissionByEvent($event, $perm_mapping);
-
+
if ($check_perms === true) {
// event is defined in mapping but is not checked by permissions
return true;
}
-
+
$perm_status = false;
foreach ($check_perms as $perm_name) {
// check if at least one of required permissions is set
@@ -108,7 +108,7 @@
return $perm_status;
}
}
-
+
if (!$perm_status) {
if ($this->Application->isDebugMode()) {
// for debugging purposes
@@ -121,7 +121,7 @@
}
return $perm_status;
}
-
+
/**
* Checks non-system permission on event per category basis
*
@@ -141,14 +141,14 @@
else {
$id = $event_handler->getPassedID($event);
}
-
+
$item_prefix = $this->Application->getUnitOption($top_prefix, 'PermItemPrefix');
-
+
// 1. get primary category of category item
$id_field = $this->Application->getUnitOption($top_prefix, 'IDField');
$table_name = $this->Application->getUnitOption($top_prefix, 'TableName');
$ci_table = $this->Application->getUnitOption('ci', 'TableName');
-
+
if (!$id) {
// item being created -> check by current (before editing started, saved in OnPreCreate event) category permissions
$category_id = $this->Application->RecallVar('m_cat_id');
@@ -161,7 +161,7 @@
WHERE (main_table.'.$id_field.' = '.$id.') AND (ci.PrimaryCat = 1)';
$category_id = $this->Conn->GetOne($sql);
}
-
+
if ((substr($event->Name, 0, 9) == 'OnPreSave') || ($event->Name == 'OnSave')) {
if ($event_handler->isNewItemCreate($event)) {
return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id);
@@ -170,15 +170,15 @@
return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || $this->CheckPermission($item_prefix.'.MODIFY', 0, $category_id);
}
}
-
+
$perm_status = false;
$check_perms = $this->getPermissionByEvent($event, $event_perm_mapping);
-
+
if ($check_perms === true) {
// event is defined in mapping but is not checked by permissions
return true;
}
-
+
foreach ($check_perms as $perm_name) {
// check if at least one of required permissions is set
if (!isset($perm_mapping[$perm_name])) {
@@ -188,12 +188,12 @@
$perm_name = $item_prefix.'.'.$perm_mapping[$perm_name];
$this->showDebug('Event '.$event->Name.' permission(-s): '.$perm_name.'', Array());
$perm_status = $this->CheckPermission($perm_name, 0, $category_id);
-
+
if ($perm_status) {
return $perm_status;
}
}
-
+
if (!$perm_status) {
$event->SetRedirectParam('index_file', 'index.php'); // because called from browse.php
if ($this->Application->isDebugMode()) {
@@ -207,19 +207,19 @@
}
return $perm_status;
}
-
+
function showDebug($text, $params)
{
$is_ajax = $this->Application->GetVar('ajax') == 'yes' || isset($params['ajax']) || isset($params['tab_init']);
if (!$this->Application->isDebugMode() || $is_ajax) return true;
echo $text.'
';
}
-
+
function TagPermissionCheck($params, $tag_name)
{
$perm_event = getArrayValue($params, 'perm_event');
$permission_groups = getArrayValue($params, 'permissions');
-
+
if ($permission_groups) {
$this->showDebug('Tag '.$tag_name.' permission(-s): '.$permission_groups.'', $params);
$permission_groups = explode('|', $permission_groups);
@@ -231,7 +231,7 @@
$has_permission = $has_permission && $this->CheckPermission($permission, isset($params['system']) && $params['system'] ? 1 : 0);
}
$group_has_permission = $group_has_permission || $has_permission;
-
+
if ($group_has_permission) {
return true;
}
@@ -244,10 +244,10 @@
$event_handler =& $this->Application->recallObject($prefix.'_EventHandler');
return $event_handler->CheckPermission( new kEvent($perm_event) );
}
-
+
return true;
}
-
+
/**
* Returns no permission template to redirect to
*
@@ -260,7 +260,7 @@
if ($next_t = getArrayValue($params, 'next_template')) {
$t = $next_t;
}
-
+
if (!$this->Application->LoggedIn()) {
$redirect_template = $params['login_template'];
$redirect_params = Array('next_template' => $t);
@@ -272,17 +272,17 @@
else {
$redirect_template = $this->Application->IsAdmin() ? 'no_permission' : $this->Application->ConfigValue('NoPermissionTemplate');
}
-
+
$redirect_params = $this->Application->isDebugMode() ? Array('from_template' => 1, 'perms' => $params[ isset($params['permissions']) ? 'permissions' : 'perm_event'], 'next_template' => $t) : Array();
}
-
+
if (isset($params['index_file']) && $params['index_file']) {
$redirect_params['index_file'] = $params['index_file'];
}
-
+
return Array($redirect_template, $redirect_params);
}
-
+
/**
* Check current user permissions based on it's group permissions in specified category (for non-system permissions) or just checks if system permission is set
*
@@ -297,26 +297,26 @@
// "root" is allowed anywhere
return $name == 'SYSTEM_ACCESS.READONLY' ? 0 : 1;
}
-
+
if ($type == 1) {
// "system" permission are always checked per "Home" category (ID = 0)
$cat_id = 0;
}
-
+
if (!isset($cat_id)) {
$cat_id = $this->Application->GetVar('m_cat_id');
}
-
+
$cache_key = $name.'|'.$type.'|'.$cat_id;
$perm_value = $this->Application->getCache('permissions', $cache_key);
if ($perm_value !== false) {
return $perm_value;
}
-
+
// perm cache is build only based on records in db, that's why if permission is not explicitly denied, then
// that (perm cache creator) code thinks that it is allowed & adds corresponding record and code below will
// return incorrect results
-
+
if (preg_match('/(.*)\.VIEW$/', $name) && ($type == 0)) {
// cached view permission of category: begin
$sql = 'SELECT PermissionConfigId
@@ -327,20 +327,20 @@
$sql = 'SELECT PermId
FROM '.TABLE_PREFIX.'PermCache
WHERE (PermId = '.$perm_id.') AND (CategoryId = '.$cat_id.')';
-
+
$view_filters = Array();
$groups = explode(',', $this->Application->RecallVar('UserGroups'));
foreach ($groups as $group) {
$view_filters[] = 'FIND_IN_SET('.$group.', ACL)';
}
$sql .= ' AND ('.implode(' OR ', $view_filters).')';
- $perm_value = $this->Conn->GetOne($sql) ? 1 : 0;
-
+ $perm_value = $this->Conn->GetOne($sql) ? 1 : 0;
+
$this->Application->setCache('permissions', $cache_key, $perm_value);
- return $perm_value;
+ return $perm_value;
// cached view permission of category: end
}
-
+
if ($cat_id == 0) {
$cat_hierarchy = Array(0);
}
@@ -355,20 +355,20 @@
$cat_hierarchy = array_reverse($cat_hierarchy);
array_push($cat_hierarchy, 0);
}
-
- $perm_value = 0;
+
+ $perm_value = 0;
$groups = $this->Application->RecallVar('UserGroups');
foreach ($cat_hierarchy as $category_id) {
$sql = 'SELECT SUM(PermissionValue)
FROM '.TABLE_PREFIX.'Permissions
WHERE Permission = "'.$name.'" AND CatId = '.$category_id.' AND GroupId IN ('.$groups.') AND Type = '.$type;
$res = $this->Conn->GetOne($sql);
- if ($res !== false) {
+ if ($res !== false && !is_null($res)) {
$perm_value = $res ? 1 : 0;
break;
}
}
-
+
$this->Application->setCache('permissions', $cache_key, $perm_value);
return $perm_value;
}
Index: trunk/core/units/general/xml_helper.php
===================================================================
diff -u -r4934 -r5514
--- trunk/core/units/general/xml_helper.php (.../xml_helper.php) (revision 4934)
+++ trunk/core/units/general/xml_helper.php (.../xml_helper.php) (revision 5514)
@@ -18,6 +18,7 @@
*/
function &Parse($xml = null)
{
+ $this->Clear(); // in case if Parse method is called more then one time
$xml_parser = xml_parser_create();
xml_set_element_handler( $xml_parser, Array(&$this, 'startElement'), Array(&$this, 'endElement') );
xml_set_character_data_handler( $xml_parser, Array(&$this, 'characterData') );
Index: trunk/kernel/units/categories/categories_event_handler.php
===================================================================
diff -u -r5326 -r5514
--- trunk/kernel/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 5326)
+++ trunk/kernel/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 5514)
@@ -253,7 +253,7 @@
$id = $event->getEventParam('id');
if ($id == 0) {
// new category -> update chache
- $this->Application->SetVar('require_cache_update', 1);
+ $this->Application->StoreVar('PermCache_UpdateRequired', 1);
return ;
}
Index: trunk/core/units/categories/categories_event_handler.php
===================================================================
diff -u -r5326 -r5514
--- trunk/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 5326)
+++ trunk/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 5514)
@@ -253,7 +253,7 @@
$id = $event->getEventParam('id');
if ($id == 0) {
// new category -> update chache
- $this->Application->SetVar('require_cache_update', 1);
+ $this->Application->StoreVar('PermCache_UpdateRequired', 1);
return ;
}
Index: trunk/kernel/units/general/xml_helper.php
===================================================================
diff -u -r4934 -r5514
--- trunk/kernel/units/general/xml_helper.php (.../xml_helper.php) (revision 4934)
+++ trunk/kernel/units/general/xml_helper.php (.../xml_helper.php) (revision 5514)
@@ -18,6 +18,7 @@
*/
function &Parse($xml = null)
{
+ $this->Clear(); // in case if Parse method is called more then one time
$xml_parser = xml_parser_create();
xml_set_element_handler( $xml_parser, Array(&$this, 'startElement'), Array(&$this, 'endElement') );
xml_set_character_data_handler( $xml_parser, Array(&$this, 'characterData') );
Index: trunk/globals.php
===================================================================
diff -u -r5431 -r5514
--- trunk/globals.php (.../globals.php) (revision 5431)
+++ trunk/globals.php (.../globals.php) (revision 5514)
@@ -1571,6 +1571,7 @@
$sql = 'SELECT imp.* , m.LoadOrder
FROM '.TABLE_PREFIX.'ImportScripts imp
LEFT JOIN '.TABLE_PREFIX.'Modules m ON m.Name = imp.is_Module
+ WHERE m.Loaded = 1
ORDER BY m.LoadOrder';
$db =& GetADODBConnection();
Index: trunk/core/units/general/cat_dbitem.php
===================================================================
diff -u -r5505 -r5514
--- trunk/core/units/general/cat_dbitem.php (.../cat_dbitem.php) (revision 5505)
+++ trunk/core/units/general/cat_dbitem.php (.../cat_dbitem.php) (revision 5514)
@@ -16,6 +16,12 @@
*/
var $useFilenames = true;
+ function Clear()
+ {
+ parent::Clear();
+ $this->CategoryPath = Array();
+ }
+
function Create($force_id=false, $system_create=false)
{
if (!$this->Validate()) return false;
Index: trunk/kernel/units/general/cat_dbitem.php
===================================================================
diff -u -r5505 -r5514
--- trunk/kernel/units/general/cat_dbitem.php (.../cat_dbitem.php) (revision 5505)
+++ trunk/kernel/units/general/cat_dbitem.php (.../cat_dbitem.php) (revision 5514)
@@ -16,6 +16,12 @@
*/
var $useFilenames = true;
+ function Clear()
+ {
+ parent::Clear();
+ $this->CategoryPath = Array();
+ }
+
function Create($force_id=false, $system_create=false)
{
if (!$this->Validate()) return false;
Index: trunk/kernel/admin_templates/incs/form_blocks.tpl
===================================================================
diff -u -r5496 -r5514
--- trunk/kernel/admin_templates/incs/form_blocks.tpl (.../form_blocks.tpl) (revision 5496)
+++ trunk/kernel/admin_templates/incs/form_blocks.tpl (.../form_blocks.tpl) (revision 5514)
@@ -370,5 +370,10 @@