/
access_api.php
326 lines (289 loc) · 11 KB
/
access_api.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
<?php
# Mantis - a php based bugtracking system
# Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
# Copyright (C) 2002 - 2003 Mantis Team - mantisbt-dev@lists.sourceforge.net
# This program is distributed under the terms and conditions of the GPL
# See the README and LICENSE files for details
# --------------------------------------------------------
# $Id: access_api.php,v 1.15 2003-02-13 14:04:10 vboctor Exp $
# --------------------------------------------------------
$t_core_dir = dirname( __FILE__ ).DIRECTORY_SEPARATOR;
require_once( $t_core_dir . 'current_user_api.php' );
require_once( $t_core_dir . 'bug_api.php' );
###########################################################################
# Access Control API
###########################################################################
# function to be called when a user is attempting to access a page that
# he/she is not authorised to. This outputs an access denied message then
# re-directs to the mainpage.
#@@@ rename to access_deny()
function access_denied() {
global $MANTIS_ERROR;
print '<center>';
print '<br />'.$MANTIS_ERROR[ERROR_ACCESS_DENIED].'<br />';
print_bracket_link( 'main_page.php', lang_get( 'proceed' ) );
print '</center>';
exit;
}
# --------------------
# check to see if the current user has access to the specified bug. This assume that the bug exists and
# that the user has access to the project (check_bug_exists() and project_access_check()).
#@@@ remove 2nd param (unused)
#@@@ rename to ...
#@@@ use more consistently in user_* pages...?
function access_bug_check( $p_bug_id, $p_view_state='' ) {
global $g_private_bug_threshold;
if ( is_blank( $p_view_state ) ) {
$t_view_state = bug_get_field( $p_bug_id, 'view_state' );
} else {
$t_view_state = (integer)$p_view_state;
}
# Make sure if the bug is private, the logged in user has access to it.
if ( ( $t_view_state == PRIVATE ) && !access_level_check_greater_or_equal( $g_private_bug_threshold ) ) {
access_denied();
}
}
# --------------------
# check to see if the access level is equal or greater
# this checks to see if the user has a higher access level for the current project
#@@@ most common function
function access_level_check_greater_or_equal( $p_access_level, $p_project_id=0 ) {
global $g_string_cookie_val;
if ( NOBODY == $p_access_level ) {
return false;
}
# user isn't logged in
if (( !isset( $g_string_cookie_val ) )||( is_blank( $g_string_cookie_val ) )) {
return false;
}
# Administrators ALWAYS pass.
if ( current_user_get_field( 'access_level' ) >= ADMINISTRATOR ) {
return true;
}
$t_access_level = current_user_get_field( 'access_level' );
$t_access_level2 = get_project_access_level( $p_project_id );
# use the project level access level instead of the global access level
# if the project level is not specified then use the global access level
if ( -1 != $t_access_level2 ) {
$t_access_level = $t_access_level2;
}
if ( $t_access_level >= $p_access_level ) {
return true;
} else {
return false;
}
}
# Checks if the access level is greater than or equal the specified access level
# The return will be true for administrators, will be the project-specific access
# right if found, or the default if project is PUBLIC and no specific access right
# found, otherwise, (private/not found) will return false
#@@@ only used once and I just introduced it
function access_level_ge_no_default_for_private ( $p_access_level, $p_project_id ) {
global $g_string_cookie_val;
if ( NOBODY == $p_access_level ) {
return false;
}
# user isn't logged in
if (( !isset( $g_string_cookie_val ) )||( is_blank( $g_string_cookie_val ) )) {
return false;
}
# Administrators ALWAYS pass.
if ( current_user_get_field( 'access_level' ) >= ADMINISTRATOR ) {
return true;
}
$t_access_level = get_project_access_level( $p_project_id );
$t_project_view_state = project_get_field( $p_project_id, 'view_state' );
# use the project level access level instead of the global access level
# if the project level is not specified then use the global access level
if ( ( -1 == $t_access_level ) && ( PUBLIC == $t_project_view_state ) ) {
$t_access_level = current_user_get_field( 'access_level' );
}
return ( $t_access_level >= $p_access_level );
}
# --------------------
# check to see if the access level is equal or greater
# this checks to see if the user has a higher access level for the current project
#@@@ only used in the few places I just added it (in the manage section)
function absolute_access_level_check_greater_or_equal( $p_access_level ) {
global $g_string_cookie_val;
# user isn't logged in
if (( !isset( $g_string_cookie_val ) ) ||
( is_blank( $g_string_cookie_val ) )) {
return false;
}
$t_access_level = current_user_get_field( 'access_level' );
if ( $t_access_level >= $p_access_level ) {
return true;
} else {
return false;
}
}
# --------------------
# Checks to see if the user should be here. If not then log the user out.
function check_access( $p_access_level ) {
if ( NOBODY == $p_access_level ) {
return false;
}
# Administrators ALWAYS pass.
if ( current_user_get_field( 'access_level' ) >= ADMINISTRATOR ) {
return;
}
if ( !access_level_check_greater_or_equal( $p_access_level ) ) {
access_denied();
}
}
# --------------------
# Checks to see if the user has access to this project
# If not then log the user out
# If not logged into the project it attempts to log you into that project
#@@@ would be nice if this didn't actually set the current project, just
# used the bug's project for permissions
function project_access_check( $p_bug_id, $p_project_id='0' ) {
global $g_mantis_project_user_list_table,
$g_mantis_project_table, $g_mantis_bug_table,
$g_project_cookie_val;
project_check( $p_bug_id );
# Administrators ALWAYS pass.
if ( current_user_get_field( 'access_level' ) >= ADMINISTRATOR ) {
return;
}
# access_level check
$t_project_id = bug_get_field( $p_bug_id, 'project_id' );
$t_project_view_state = project_get_field( $t_project_id, 'view_state' );
# public project accept all users
if ( PUBLIC == $t_project_view_state ) {
return;
} else {
# private projects require users to be assigned
$t_project_access_level = get_project_access_level( $t_project_id );
if ( -1 == $t_project_access_level ) {
print_header_redirect( 'login_select_proj_page.php' );
} else {
return;
}
}
}
# --------------------
# Check to see if the currently logged in project and bug project id match
# If there is no match then the project cookie will be set to the bug project id
# No access check is done. It is expected to be checked afterwards.
#@@@ only called from the function above
#@@@ rename to access_force_current_project() or something
function project_check( $p_bug_id ) {
global $g_project_cookie, $g_project_cookie_val, $g_view_all_cookie,
$g_cookie_time_length, $g_cookie_path;
$t_project_id = bug_get_field( $p_bug_id, 'project_id' );
if ( $t_project_id != $g_project_cookie_val ) {
setcookie( $g_project_cookie, $t_project_id, time()+$g_cookie_time_length, $g_cookie_path );
setcookie( $g_view_all_cookie, '' );
print_header_redirect_view( $p_bug_id );
}
}
# --------------------
# Check to see if the current user has access on the specified project
#@@@ only used once in filter_api
function check_access_to_project( $p_project_id ) {
$t_project_view_state = project_get_field( $p_project_id, 'view_state' );
# Administrators ALWAYS pass.
if ( current_user_get_field( 'access_level' ) >= ADMINISTRATOR ) {
return;
}
# public project accept all users
if ( PUBLIC == $t_project_view_state ) {
return;
} else {
# private projects require users to be assigned
$t_project_access_level = get_project_access_level( $p_project_id );
# -1 means not assigned, kick them out to the project selection screen
if ( -1 == $t_project_access_level ) {
print_header_redirect( 'login_select_proj_page.php' );
} else { # passed
return;
}
}
}
# --------------------
# return the project access level for the current user/project key pair.
# use the project_id if supplied.
#@@@ only called internally, should be able to be replaced with project_api calls
function get_project_access_level( $p_project_id=0 ) {
global $g_mantis_project_user_list_table,
$g_project_cookie_val;
$c_project_id = (integer)$p_project_id;
$t_user_id = current_user_get_field( 'id' );
if ( 0 == $p_project_id ) {
if ( (integer)$g_project_cookie_val == 0 ) {
return -1;
}
$query = "SELECT access_level
FROM $g_mantis_project_user_list_table
WHERE user_id='$t_user_id' AND project_id='$g_project_cookie_val'";
} else {
$query = "SELECT access_level
FROM $g_mantis_project_user_list_table
WHERE user_id='$t_user_id' AND project_id='$c_project_id'";
}
$result = db_query( $query );
if ( db_num_rows( $result ) > 0 ) {
return db_result( $result, 0, 0 );
} else {
return -1;
}
}
# --------------------
# Return the project user list access level for the current user/project key pair if it exists.
# Otherwise return the default user access level.
#@@@ NEVER used
function get_effective_access_level( $p_user_id=0, $p_project_id=-1 ) {
global $g_mantis_project_user_list_table,
$g_project_cookie_val;
$c_project_id = (integer)$p_project_id;
# use the current user unless otherwise specified
if ( 0 == $p_user_id ) {
$t_user_id = current_user_get_field( 'id' );
} else {
$t_user_id = (integer)$p_user_id;
}
# all projects
if ( -1 == $p_project_id ) {
$query = "SELECT access_level
FROM $g_mantis_project_user_list_table
WHERE user_id='$t_user_id' AND project_id='$g_project_cookie_val'";
} else if ( 0 == $p_project_id ) {
$g_project_cookie_val = p_project_id;
$query = "SELECT access_level
FROM $g_mantis_project_user_list_table
WHERE user_id='$t_user_id'";
} else {
$query = "SELECT access_level
FROM $g_mantis_project_user_list_table
WHERE user_id='$t_user_id' AND project_id='$c_project_id'";
}
$result = db_query( $query );
$count = db_num_rows( $result, 0, 0 );
if ( $count>0 ) {
return db_result( $result, 0, 0 );
} else {
return user_get_field( $t_user_id, 'access_level' );
}
}
# --------------------
# Checks if the current user can close the specified bug
# it assumes that the user has access to the project
function access_can_close_bug ( $p_bug_id ) {
// Allow closing defects if reporter of the bug and reporter can close or if above threshold
if ( ON == config_get( 'allow_reporter_close' ) &&
bug_is_user_reporter( $p_bug_id, auth_get_current_user_id() ) ) {
return true;
}
return access_level_check_greater_or_equal( config_get( 'close_bug_threshold' ) );
}
# --------------------
# Make sure that the current user can close the specified bug
# See access_can_close_bug() for details.
function access_ensure_can_close_bug( $p_bug_id ) {
if ( !access_can_close_bug( $p_bug_id ) ) {
access_denied();
}
}
?>