Zurmo: /home/apizurmo/zurmo/app/protected/modules/zurmo/utils/security/ControllerSecurityUtil.php Source File

00001 <?php
00002     /*********************************************************************************
00003      * Zurmo is a customer relationship management program developed by
00004      * Zurmo, Inc. Copyright (C) 2017 Zurmo Inc.
00005      *
00006      * Zurmo is free software; you can redistribute it and/or modify it under
00007      * the terms of the GNU Affero General Public License version 3 as published by the
00008      * Free Software Foundation with the addition of the following permission added
00009      * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
00010      * IN WHICH THE COPYRIGHT IS OWNED BY ZURMO, ZURMO DISCLAIMS THE WARRANTY
00011      * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
00012      *
00013      * Zurmo is distributed in the hope that it will be useful, but WITHOUT
00014      * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
00015      * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
00016      * details.
00017      *
00018      * You should have received a copy of the GNU Affero General Public License along with
00019      * this program; if not, see http://www.gnu.org/licenses or write to the Free
00020      * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
00021      * 02110-1301 USA.
00022      *
00023      * You can contact Zurmo, Inc. with a mailing address at 27 North Wacker Drive
00024      * Suite 370 Chicago, IL 60606. or at email address contact@zurmo.com.
00025      *
00026      * The interactive user interfaces in original and modified versions
00027      * of this program must display Appropriate Legal Notices, as required under
00028      * Section 5 of the GNU Affero General Public License version 3.
00029      *
00030      * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
00031      * these Appropriate Legal Notices must retain the display of the Zurmo
00032      * logo and Zurmo copyright notice. If the display of the logo is not reasonably
00033      * feasible for technical reasons, the Appropriate Legal Notices must display the words
00034      * "Copyright Zurmo Inc. 2017. All rights reserved".
00035      ********************************************************************************/
00036 
00040     class ControllerSecurityUtil
00041     {
00047         public static function doesCurrentUserHavePermissionOnSecurableItem($securableItem, $permissionToCheck)
00048         {
00049             assert('$permissionToCheck == Permission::READ || $permissionToCheck == Permission::WRITE ||
00050                     $permissionToCheck == Permission::DELETE');
00051             if (!$securableItem instanceof SecurableItem)
00052             {
00053                 return true;
00054             }
00055             try
00056             {
00057                 $securableItem->checkPermissionsHasAnyOf($permissionToCheck);
00058                 return true;
00059             }
00060             catch (AccessDeniedSecurityException $e)
00061             {
00062                 return false;
00063             }
00064         }
00065 
00078         public static function resolveAccessCanCurrentUserReadModel(RedBeanModel $model, $fromAjax = false)
00079         {
00080             if (ControllerSecurityUtil::doesCurrentUserHavePermissionOnSecurableItem($model, Permission::READ))
00081             {
00082                 return;
00083             }
00084             static::processAccessFailure($fromAjax);
00085             Yii::app()->end(0, false);
00086         }
00087 
00094         public static function resolveAccessCanCurrentUserWriteModel(RedBeanModel $model, $fromAjax = false)
00095         {
00096             if (ControllerSecurityUtil::doesCurrentUserHavePermissionOnSecurableItem($model, Permission::WRITE))
00097             {
00098                 return;
00099             }
00100             static::processAccessFailure($fromAjax);
00101             Yii::app()->end(0, false);
00102         }
00103 
00110         public static function resolveAccessCanCurrentUserDeleteModel(RedBeanModel $model, $fromAjax = false)
00111         {
00112             if (ControllerSecurityUtil::doesCurrentUserHavePermissionOnSecurableItem($model, Permission::DELETE))
00113             {
00114                 return;
00115             }
00116             static::processAccessFailure($fromAjax);
00117             Yii::app()->end(0, false);
00118         }
00119 
00126         public static function resolveAccessCanCurrentUserWriteModule($moduleClassName, $fromAjax = false)
00127         {
00128             assert('is_string($moduleClassName)');
00129             $item       = NamedSecurableItem::getByName($moduleClassName);
00130             if (ControllerSecurityUtil::doesCurrentUserHavePermissionOnSecurableItem($item, Permission::WRITE))
00131             {
00132                 return;
00133             }
00134             static::processAccessFailure($fromAjax);
00135             Yii::app()->end(0, false);
00136         }
00137 
00142         public static function resolveCanCurrentUserAccessModule($moduleClassName, $fromAjax = false)
00143         {
00144             assert('is_string($moduleClassName)');
00145             if (RightsUtil::canUserAccessModule($moduleClassName, Yii::app()->user->userModel))
00146             {
00147                 return;
00148             }
00149             static::processAccessFailure($fromAjax);
00150             Yii::app()->end(0, false);
00151         }
00152 
00153         protected static function processAccessFailure($fromAjax = false, $nonAjaxFailureMessageContent = null)
00154         {
00155             static::renderAccessFailureContent($fromAjax, $nonAjaxFailureMessageContent);
00156         }
00157 
00158         protected static function renderAccessFailureContent($fromAjax = false, $nonAjaxFailureMessageContent = null)
00159         {
00160             if ($fromAjax)
00161             {
00162                 $messageView = new AccessFailureAjaxView();
00163                 $view        = new AjaxPageView($messageView);
00164             }
00165             else
00166             {
00167                 $messageView = new AccessFailureView($nonAjaxFailureMessageContent);
00168                 $view        = new AccessFailurePageView($messageView);
00169             }
00170             echo $view->render();
00171         }
00172     }
00173 ?>