80 application/helpers/admin.php
View file
@@ -66,17 +66,17 @@ public static function main_right_tabs($user = FALSE)
if ($user)
{
// Check permissions for settings panel
$main_right_tabs = (self::permissions('settings', $user))
$main_right_tabs = (Auth::instance()->has_permission('settings', $user))
? arr::merge($main_right_tabs, array('settings/site' => Kohana::lang('ui_admin.settings')))
: $main_right_tabs;

// Check permissions for the manage panel
$main_right_tabs = (self::permissions('manage', $user))
$main_right_tabs = (Auth::instance()->has_permission('manage', $user))
? arr::merge($main_right_tabs, array('manage' => Kohana::lang('ui_admin.manage')))
: $main_right_tabs;

// Check permissions for users panel
$main_right_tabs = (self::permissions('users', $user))
$main_right_tabs = (Auth::instance()->has_permission('users', $user))
? arr::merge($main_right_tabs, array('users' => Kohana::lang('ui_admin.users')))
: $main_right_tabs;
}
@@ -277,72 +277,22 @@ public static function user_subtabs($this_sub_page = FALSE, $display_roles = FAL
// Action::nav_admin_users - Add items to the admin manage navigation tabs
Event::run('ushahidi_action.nav_admin_users', $this_sub_page);
}

/*
* Check if user has specified permission
* @param $user User_Model
* @param $permission String permission name
**/
public static function permissions($permission = FALSE, $user = FALSE)

/**
* Legacy permissions check
* Use Auth::has_permission() instead.
*/
public function permissions($user = FALSE, $permission = FALSE)
{
// Get current user if none passed
if (!$user)
{
$user = Auth::instance()->get_user();
}

if ($user AND $permission)
{
// Special case - superadmin ALWAYS has all permissions
if ($user->has(ORM::factory('role','superadmin')))
{
return TRUE;
}

foreach ($user->roles as $user_role)
{
if ($user_role->has(ORM::factory('permission',$permission)))
{
return TRUE;
}
}
}

return FALSE;
return Auth::instance()->has_permission($permission, $user);
}

/**
* Check if user has admin_access
*
* If any of the users roles allows them to access anything, put them on the admin page,
* otherwise send them to the front end.
*
* @param object $user
* @return bool TRUE if has any permission to access anything. FALSE if not (essentially login only level)
* Legacy admin access check
* Use Auth::admin_access() instead.
*/
public static function admin_access($user = FALSE)
public function admin_access($user = FALSE)
{
// Get current user if none passed
if (!$user)
{
$user = Auth::instance()->get_user();
}

if($user) {
// Special case - superadmin ALWAYS has admin access
if ($user->has(ORM::factory('role','superadmin')))
{
return TRUE;
}

foreach ($user->roles as $user_role)
{
if ( $user_role->allow_admin() )
return TRUE;
//if ( $user_role->has(ORM::Factory('permission','admin_pages')) ) return TRUE;
}
}

return FALSE;
return Auth::instance()->admin_access($user);
}
}
12 application/libraries/Api_Service.php
View file
@@ -214,13 +214,13 @@ public function _login($admin = FALSE)
if ($auth->logged_in())
{
// Check if admin privileges are required
if ($admin == TRUE AND $auth->logged_in('member'))
if ($admin == FALSE OR $auth->has_permission('admin_ui'))
{
return FALSE;
return $auth->get_user()->id;
}
else
{
return $auth->get_user()->id;
return FALSE;
}
}
else
@@ -242,13 +242,13 @@ public function _login($admin = FALSE)
if ($auth->login($username, $password))
{
// Check if admin privileges are required
if ($admin == TRUE AND $auth->logged_in('member'))
if ($admin == FALSE OR $auth->has_permission('admin_ui'))
{
return FALSE;
return $auth->get_user()->id;
}
else
{
return $auth->get_user()->id;
return FALSE;
}
}
else
44 application/libraries/MY_Auth.php
View file
@@ -0,0 +1,44 @@
<?php defined('SYSPATH') OR die('No direct access allowed.');
/**
* Custom extensions to the User authorization library.
*
* @package Auth
* @author Ushahidi Team
* @copyright (c) 2008 Ushahidi Team
* @license http://www.ushahidi.com/license.html
*/
class Auth extends Auth_Core {

/**
* Check if user has specified permission
* @param $user User_Model
* @param $permission String permission name
**/
public function has_permission($permission = FALSE, $user = FALSE)
{
// Get current user if none passed
if (!$user)
{
$user = $this->get_user();
}

if ($user AND $user instanceof User_Model AND $permission)
{
return $user->has_permission($permission);
}

return FALSE;
}

/**
* Check if user has admin_access
*
* @param object $user
* @return bool TRUE if has any permission to access anything. FALSE if not (essentially login only level)
*/
public function admin_access($user = FALSE)
{
return $this->has_permission('admin_ui', $user);
}

}
24 application/models/role.php
View file
@@ -4,30 +4,6 @@ class Role_Model extends Auth_Role_Model {

protected $has_and_belongs_to_many = array('permissions', 'users');

/**
* Returns true if any of the roles in the roles table are marked as 1,
* essentially saying there's a good chance that there are features
* in the admin panel they could access.
*/
public function allow_admin()
{
foreach($this->permissions as $permission)
{
// Ignore these fields because they contain data that doesn't involve access
if($permission->name == 'checkin')
{
// Checkin is a special case because they are allowed access to the front end
// but not necessarily the back end so we will continue looping
continue;
}

return TRUE;
}

// None of the fields allowed access to anything specific. This is just a login account.
return FALSE;
}

public function delete()
{
// Remove assigned users
42 application/models/user.php
View file
@@ -312,5 +312,47 @@ public function delete()

parent::delete();
}

/**
* Check if user has specified permission
* @param $permission String permission name
**/
public function has_permission($permission)
{
// Special case - superadmin ALWAYS has all permissions
if ($this->has(ORM::factory('role','superadmin')))
{
return TRUE;
}

foreach ($this->roles as $user_role)
{
if ($user_role->has(ORM::factory('permission',$permission)))
{
return TRUE;
}
}

return FALSE;
}

/**
* Get user's dashboard
*/
public function dashboard()
{
if ($this->has_permission('admin_ui'))
return 'admin';

if ($this->has_permission('member_ui'))
return 'members';

// Just in case someone has a login only role
if ($this->has(ORM::factory('role','login')))
return '';

// Send anyone else to login
return 'login';
}

} // End User_Model
6 application/views/header_nav.php
View file
@@ -21,11 +21,11 @@
<a href="<?php echo url::site().$loggedin_role;?>"><span class="header_nav_label"><?php echo $loggedin_user->username; ?></span> <img src="<?php echo members::gravatar($loggedin_user->email,20); ?>" width="20" /></a>

<ul class="header_nav_dropdown" style="display:none;">

<?php if($loggedin_role != ""){ ?>
<li><a href="<?php echo url::site().$loggedin_role;?>/profile"><?php echo Kohana::lang('ui_main.manage_your_account'); ?></a></li>

<li><a href="<?php echo url::site().$loggedin_role;?>"><?php echo Kohana::lang('ui_main.your_dashboard'); ?></a></li>

<?php } ?>
<li><a href="<?php echo url::site();?>profile/user/<?php echo $loggedin_user->username; ?>"><?php echo Kohana::lang('ui_main.view_public_profile'); ?></a></li>

<li><a href="<?php echo url::site();?>logout"><em><?php echo Kohana::lang('ui_admin.logout');?></em></a></li>
@@ -34,7 +34,7 @@

<?php } else { ?>

<a href="<?php echo url::site()."members/";?>" style="float:right;padding-top:8px;"><span class="header_nav_label"><strong><?php echo Kohana::lang('ui_main.login'); ?></strong></span></a>
<a href="<?php echo url::site('login');?>" style="float:right;padding-top:8px;"><span class="header_nav_label"><strong><?php echo Kohana::lang('ui_main.login'); ?></strong></span></a>

<ul class="header_nav_dropdown" style="display:none;">

2 plugins/sharing/controllers/admin/manage/sharing.php
View file
@@ -23,7 +23,7 @@ function __construct()
$this->template->this_page = 'settings';

// If user doesn't have access, redirect to dashboard
if ( ! admin::permissions("manage"))
if ( ! $this->auth->has_permission("manage"))
{
url::redirect(url::site().'admin/dashboard');
}