1: <?php
  2: /* SVN FILE: $Id$ */
  3: /**
  4:  * Short description for file.
  5:  *
  6:  * Long description for file
  7:  *
  8:  * PHP versions 4 and 5
  9:  *
 10:  * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
 11:  * Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
 12:  *
 13:  * Licensed under The MIT License
 14:  * Redistributions of files must retain the above copyright notice.
 15:  *
 16:  * @copyright     Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
 17:  * @link          http://cakephp.org CakePHP(tm) Project
 18:  * @package       cake
 19:  * @subpackage    cake.cake.console.libs
 20:  * @since         CakePHP(tm) v 1.2.0.5012
 21:  * @version       $Revision$
 22:  * @modifiedby    $LastChangedBy$
 23:  * @lastmodified  $Date$
 24:  * @license       http://www.opensource.org/licenses/mit-license.php The MIT License
 25:  */
 26: App::import('Component', 'Acl');
 27: App::import('Model', 'DbAcl');
 28: /**
 29:  * Shell for ACL management.
 30:  *
 31:  * @package       cake
 32:  * @subpackage    cake.cake.console.libs
 33:  */
 34: class AclShell extends Shell {
 35: /**
 36:  * Contains instance of AclComponent
 37:  *
 38:  * @var AclComponent
 39:  * @access public
 40:  */
 41:     var $Acl;
 42: /**
 43:  * Contains arguments parsed from the command line.
 44:  *
 45:  * @var array
 46:  * @access public
 47:  */
 48:     var $args;
 49: /**
 50:  * Contains database source to use
 51:  *
 52:  * @var string
 53:  * @access public
 54:  */
 55:     var $dataSource = 'default';
 56: /**
 57:  * Contains tasks to load and instantiate
 58:  *
 59:  * @var array
 60:  * @access public
 61:  */
 62:     var $tasks = array('DbConfig');
 63: /**
 64:  * Override startup of the Shell
 65:  *
 66:  * @access public
 67:  */
 68:     function startup() {
 69:         $this->dataSource = 'default';
 70: 
 71:         if (isset($this->params['datasource'])) {
 72:             $this->dataSource = $this->params['datasource'];
 73:         }
 74: 
 75:         if (!in_array(Configure::read('Acl.classname'), array('DbAcl', 'DB_ACL'))) {
 76:             $out = "--------------------------------------------------\n";
 77:             $out .= __("Error: Your current Cake configuration is set to", true) . "\n";
 78:             $out .= __("an ACL implementation other than DB. Please change", true) . "\n";
 79:             $out .= __("your core config to reflect your decision to use", true) . "\n";
 80:             $out .= __("DbAcl before attempting to use this script", true) . ".\n";
 81:             $out .= "--------------------------------------------------\n";
 82:             $out .= sprintf(__("Current ACL Classname: %s", true), Configure::read('Acl.classname')) . "\n";
 83:             $out .= "--------------------------------------------------\n";
 84:             $this->err($out);
 85:             $this->_stop();
 86:         }
 87: 
 88:         if ($this->command && !in_array($this->command, array('help'))) {
 89:             if (!config('database')) {
 90:                 $this->out(__("Your database configuration was not found. Take a moment to create one.", true), true);
 91:                 $this->args = null;
 92:                 return $this->DbConfig->execute();
 93:             }
 94:             require_once (CONFIGS.'database.php');
 95: 
 96:             if (!in_array($this->command, array('initdb'))) {
 97:                 $this->Acl = new AclComponent();
 98:                 $controller = null;
 99:                 $this->Acl->startup($controller);
100:             }
101:         }
102:     }
103: /**
104:  * Override main() for help message hook
105:  *
106:  * @access public
107:  */
108:     function main() {
109:         $out  = __("Available ACL commands:", true) . "\n";
110:         $out .= "\t - create\n";
111:         $out .= "\t - delete\n";
112:         $out .= "\t - setParent\n";
113:         $out .= "\t - getPath\n";
114:         $out .= "\t - check\n";
115:         $out .= "\t - grant\n";
116:         $out .= "\t - deny\n";
117:         $out .= "\t - inherit\n";
118:         $out .= "\t - view\n";
119:         $out .= "\t - initdb\n";
120:         $out .= "\t - help\n\n";
121:         $out .= __("For help, run the 'help' command.  For help on a specific command, run 'help <command>'", true);
122:         $this->out($out);
123:     }
124: /**
125:  * Creates an ARO/ACO node
126:  *
127:  * @access public
128:  */
129:     function create() {
130: 
131:         $this->_checkArgs(3, 'create');
132:         $this->checkNodeType();
133:         extract($this->__dataVars());
134: 
135:         $class = ucfirst($this->args[0]);
136:         $object = new $class();
137: 
138:         if (preg_match('/^([\w]+)\.(.*)$/', $this->args[1], $matches) && count($matches) == 3) {
139:             $parent = array(
140:                 'model' => $matches[1],
141:                 'foreign_key' => $matches[2],
142:             );
143:         } else {
144:             $parent = $this->args[1];
145:         }
146: 
147:         if (!empty($parent) && $parent != '/' && $parent != 'root') {
148:             @$parent = $object->node($parent);
149:             if (empty($parent)) {
150:                 $this->err(sprintf(__('Could not find parent node using reference "%s"', true), $this->args[1]));
151:                 return;
152:             } else {
153:                 $parent = Set::extract($parent, "0.{$class}.id");
154:             }
155:         } else {
156:             $parent = null;
157:         }
158: 
159:         if (preg_match('/^([\w]+)\.(.*)$/', $this->args[2], $matches) && count($matches) == 3) {
160:             $data = array(
161:                 'model' => $matches[1],
162:                 'foreign_key' => $matches[2],
163:             );
164:         } else {
165:             if (!($this->args[2] == '/')) {
166:                 $data = array('alias' => $this->args[2]);
167:             } else {
168:                 $this->error(__('/ can not be used as an alias!', true), __('\t/ is the root, please supply a sub alias', true));
169:             }
170:         }
171: 
172:         $data['parent_id'] = $parent;
173:         $object->create();
174: 
175:         if ($object->save($data)) {
176:             $this->out(sprintf(__("New %s '%s' created.\n", true), $class, $this->args[2]), true);
177:         } else {
178:             $this->err(sprintf(__("There was a problem creating a new %s '%s'.", true), $class, $this->args[2]));
179:         }
180:     }
181: /**
182:  * Delete an ARO/ACO node.
183:  *
184:  * @access public
185:  */
186:     function delete() {
187:         $this->_checkArgs(2, 'delete');
188:         $this->checkNodeType();
189:         extract($this->__dataVars());
190:         if (!$this->Acl->{$class}->delete($this->args[1])) {
191:             $this->error(__("Node Not Deleted", true), sprintf(__("There was an error deleting the %s. Check that the node exists", true), $class) . ".\n");
192:         }
193:         $this->out(sprintf(__("%s deleted", true), $class) . ".\n", true);
194:     }
195: 
196: /**
197:  * Set parent for an ARO/ACO node.
198:  *
199:  * @access public
200:  */
201:     function setParent() {
202:         $this->_checkArgs(3, 'setParent');
203:         $this->checkNodeType();
204:         extract($this->__dataVars());
205:         $data = array(
206:             $class => array(
207:                 'id' => $this->args[1],
208:                 'parent_id' => $this->args[2]
209:             )
210:         );
211:         $this->Acl->{$class}->create();
212:         if (!$this->Acl->{$class}->save($data)) {
213:             $this->out(__("Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.", true), true);
214:         } else {
215:             $this->out(sprintf(__("Node parent set to %s", true), $this->args[2]) . "\n", true);
216:         }
217:     }
218: /**
219:  * Get path to specified ARO/ACO node.
220:  *
221:  * @access public
222:  */
223:     function getPath() {
224:         $this->_checkArgs(2, 'getPath');
225:         $this->checkNodeType();
226:         extract($this->__dataVars());
227:         $id = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
228:         $nodes = $this->Acl->{$class}->getPath($id);
229:         if (empty($nodes)) {
230:             $this->error(sprintf(__("Supplied Node '%s' not found", true), $this->args[1]), __("No tree returned.", true));
231:         }
232:         for ($i = 0; $i < count($nodes); $i++) {
233:             $this->out(str_repeat('  ', $i) . "[" . $nodes[$i][$class]['id'] . "]" . $nodes[$i][$class]['alias'] . "\n");
234:         }
235:     }
236: /**
237:  * Check permission for a given ARO to a given ACO.
238:  *
239:  * @access public
240:  */
241:     function check() {
242:         $this->_checkArgs(3, 'check');
243:         extract($this->__getParams());
244: 
245:         if ($this->Acl->check($aro, $aco, $action)) {
246:             $this->out(sprintf(__("%s is allowed.", true), $aro), true);
247:         } else {
248:             $this->out(sprintf(__("%s is not allowed.", true), $aro), true);
249:         }
250:     }
251: /**
252:  * Grant permission for a given ARO to a given ACO.
253:  *
254:  * @access public
255:  */
256:     function grant() {
257:         $this->_checkArgs(3, 'grant');
258:         extract($this->__getParams());
259: 
260:         if ($this->Acl->allow($aro, $aco, $action)) {
261:             $this->out(__("Permission granted.", true), true);
262:         } else {
263:             $this->out(__("Permission was not granted.", true), true);
264:         }
265:     }
266: /**
267:  * Deny access for an ARO to an ACO.
268:  *
269:  * @access public
270:  */
271:     function deny() {
272:         $this->_checkArgs(3, 'deny');
273:         extract($this->__getParams());
274: 
275:         if ($this->Acl->deny($aro, $aco, $action)) {
276:             $this->out(__("Permission denied.", true), true);
277:         } else {
278:             $this->out(__("Permission was not denied.", true), true);
279:         }
280:     }
281: /**
282:  * Set an ARO to inhermit permission to an ACO.
283:  *
284:  * @access public
285:  */
286:     function inherit() {
287:         $this->_checkArgs(3, 'inherit');
288:         extract($this->__getParams());
289: 
290:         if ($this->Acl->inherit($aro, $aco, $action)) {
291:             $this->out(__("Permission inherited.", true), true);
292:         } else {
293:             $this->out(__("Permission was not inherited.", true), true);
294:         }
295:     }
296: /**
297:  * Show a specific ARO/ACO node.
298:  *
299:  * @access public
300:  */
301:     function view() {
302:         $this->_checkArgs(1, 'view');
303:         $this->checkNodeType();
304:         extract($this->__dataVars());
305:         if (isset($this->args[1]) && !is_null($this->args[1])) {
306:             $key = is_numeric($this->args[1]) ? $secondary_id : 'alias';
307:             $conditions = array($class . '.' . $key => $this->args[1]);
308:         } else {
309:             $conditions = null;
310:         }
311:         $nodes = $this->Acl->{$class}->find('all', array('conditions' => $conditions, 'order' => 'lft ASC'));
312:         if (empty($nodes)) {
313:             if (isset($this->args[1])) {
314:                 $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
315:             } elseif (isset($this->args[0])) {
316:                 $this->error(sprintf(__("%s not found", true), $this->args[0]), __("No tree returned.", true));
317:             }
318:         }
319:         $this->out($class . " tree:");
320:         $this->hr();
321:         $stack = array();
322:         $last  = null;
323:         foreach ($nodes as $n) {
324:             $stack[] = $n;
325:             if (!empty($last)) {
326:                 $end = end($stack);
327:                 if ($end[$class]['rght'] > $last) {
328:                     foreach ($stack as $k => $v) {
329:                         $end = end($stack);
330:                         if ($v[$class]['rght'] < $end[$class]['rght']) {
331:                             unset($stack[$k]);
332:                         }
333:                     }
334:                 }
335:             }
336:             $last   = $n[$class]['rght'];
337:             $count  = count($stack);
338:             $indent = str_repeat('  ', $count);
339:             if ($n[$class]['alias']) {
340:                 $this->out($indent . "[" . $n[$class]['id'] . "]" . $n[$class]['alias']."\n");
341:              } else {
342:                 $this->out($indent . "[" . $n[$class]['id'] . "]" . $n[$class]['model'] . '.' . $n[$class]['foreign_key'] . "\n");
343:             }
344:         }
345:         $this->hr();
346:     }
347: /**
348:  * Initialize ACL database.
349:  *
350:  * @access public
351:  */
352:     function initdb() {
353:         $this->Dispatch->args = array('schema', 'run', 'create', 'DbAcl');
354:         $this->Dispatch->dispatch();
355:     }
356: /**
357:  * Show help screen.
358:  *
359:  * @access public
360:  */
361:     function help() {
362:         $head  = __("Usage: cake acl <command> <arg1> <arg2>...", true) . "\n";
363:         $head .= "-----------------------------------------------\n";
364:         $head .= __("Commands:", true) . "\n\n";
365: 
366:         $commands = array(
367:             'create' => "\tcreate aro|aco <parent> <node>\n" .
368:                         "\t\t" . __("Creates a new ACL object <node> under the parent specified by <parent>, an id/alias.", true) . "\n" .
369:                         "\t\t" . __("The <parent> and <node> references can be in one of the following formats:", true) . "\n" .
370:                         "\t\t\t- " . __("<model>.<id> - The node will be bound to a specific record of the given model", true) . "\n" .
371:                         "\t\t\t- " . __("<alias> - The node will be given a string alias (or path, in the case of <parent>),", true) . "\n" .
372:                         "\t\t\t  " . __("i.e. 'John'.  When used with <parent>, this takes the form of an alias path,", true) . "\n" .
373:                         "\t\t\t  " . __("i.e. <group>/<subgroup>/<parent>.", true) . "\n" .
374:                         "\t\t" . __("To add a node at the root level, enter 'root' or '/' as the <parent> parameter.", true) . "\n",
375: 
376:             'delete' => "\tdelete aro|aco <node>\n" .
377:                         "\t\t" . __("Deletes the ACL object with the given <node> reference (see 'create' for info on node references).", true) . "\n",
378: 
379:             'setparent' => "\tsetParent aro|aco <node> <parent>\n" .
380:                             "\t\t" . __("Moves the ACL object specified by <node> beneath the parent ACL object specified by <parent>.", true) . "\n" .
381:                             "\t\t" . __("To identify the node and parent, use the row id.", true) . "\n",
382: 
383:             'getpath' => "\tgetPath aro|aco <node>\n" .
384:                         "\t\t" . __("Returns the path to the ACL object specified by <node>. This command", true) . "\n" .
385:                         "\t\t" . __("is useful in determining the inhertiance of permissions for a certain", true) . "\n" .
386:                         "\t\t" . __("object in the tree.", true) . "\n" .
387:                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
388: 
389:             'check' =>  "\tcheck <aro_id> <aco_id> [<aco_action>] " . __("or", true) . " all\n" .
390:                         "\t\t" . __("Use this command to check ACL permissions.", true) . "\n" .
391:                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
392: 
393:             'grant' =>  "\tgrant <aro_id> <aco_id> [<aco_action>] " . __("or", true) . " all\n" .
394:                         "\t\t" . __("Use this command to grant ACL permissions. Once executed, the ARO", true) . "\n" .
395:                         "\t\t" . __("specified (and its children, if any) will have ALLOW access to the", true) . "\n" .
396:                         "\t\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
397:                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
398: 
399:             'deny' =>   "\tdeny <aro_id> <aco_id> [<aco_action>]" . __("or", true) . " all\n" .
400:                         "\t\t" . __("Use this command to deny ACL permissions. Once executed, the ARO", true) . "\n" .
401:                         "\t\t" . __("specified (and its children, if any) will have DENY access to the", true) . "\n" .
402:                         "\t\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
403:                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
404: 
405:             'inherit' =>    "\tinherit <aro_id> <aco_id> [<aco_action>]" . __("or", true) . " all\n" .
406:                             "\t\t" . __("Use this command to force a child ARO object to inherit its", true) . "\n" .
407:                             "\t\t" . __("permissions settings from its parent.", true) . "\n" .
408:                             "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
409: 
410:             'view' =>   "\tview aro|aco [<node>]\n" .
411:                         "\t\t" . __("The view command will return the ARO or ACO tree. The optional", true) . "\n" .
412:                         "\t\t" . __("id/alias parameter allows you to return only a portion of the requested tree.", true) . "\n" .
413:                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
414: 
415:             'initdb' => "\tinitdb\n".
416:                         "\t\t" . __("Uses this command : cake schema run create DbAcl", true) . "\n",
417: 
418:             'help' =>   "\thelp [<command>]\n" .
419:                         "\t\t" . __("Displays this help message, or a message on a specific command.", true) . "\n"
420:         );
421: 
422:         $this->out($head);
423:         if (!isset($this->args[0])) {
424:             foreach ($commands as $cmd) {
425:                 $this->out("{$cmd}\n\n");
426:             }
427:         } elseif (isset($commands[strtolower($this->args[0])])) {
428:             $this->out($commands[strtolower($this->args[0])] . "\n\n");
429:         } else {
430:             $this->out(sprintf(__("Command '%s' not found", true), $this->args[0]));
431:         }
432:     }
433: /**
434:  * Check that first argument specifies a valid Node type (ARO/ACO)
435:  *
436:  * @access public
437:  */
438:     function checkNodeType() {
439:         if (!isset($this->args[0])) {
440:             return false;
441:         }
442:         if ($this->args[0] != 'aco' && $this->args[0] != 'aro') {
443:             $this->error(sprintf(__("Missing/Unknown node type: '%s'", true), $this->args[1]), __('Please specify which ACL object type you wish to create.', true));
444:         }
445:     }
446: /**
447:  * Checks that given node exists
448:  *
449:  * @param string $type Node type (ARO/ACO)
450:  * @param integer $id Node id
451:  * @return boolean Success
452:  * @access public
453:  */
454:     function nodeExists() {
455:         if (!$this->checkNodeType() && !isset($this->args[1])) {
456:             return false;
457:         }
458:         extract($this->__dataVars($this->args[0]));
459:         $key = is_numeric($this->args[1]) ? $secondary_id : 'alias';
460:         $conditions = array($class . '.' . $key => $this->args[1]);
461:         $possibility = $this->Acl->{$class}->find('all', compact('conditions'));
462:         if (empty($possibility)) {
463:             $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
464:         }
465:         return $possibility;
466:     }
467: /**
468:  * get params for standard Acl methods
469:  *
470:  * @return array aro, aco, action
471:  * @access private
472:  */
473:     function __getParams() {
474:         $aro = is_numeric($this->args[0]) ? intval($this->args[0]) : $this->args[0];
475:         $aco = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
476: 
477:         if (is_string($aro) && preg_match('/^([\w]+)\.(.*)$/', $aro, $matches)) {
478:             $aro = array(
479:                 'model' => $matches[1],
480:                 'foreign_key' => $matches[2],
481:             );
482:         }
483: 
484:         if (is_string($aco) && preg_match('/^([\w]+)\.(.*)$/', $aco, $matches)) {
485:             $aco = array(
486:                 'model' => $matches[1],
487:                 'foreign_key' => $matches[2],
488:             );
489:         }
490: 
491:         $action = null;
492:         if (isset($this->args[2])) {
493:             $action = $this->args[2];
494:             if ($action == '' || $action == 'all') {
495:                 $action = '*';
496:             }
497:         }
498:         return compact('aro', 'aco', 'action');
499:     }
500: 
501: /**
502:  * Build data parameters based on node type
503:  *
504:  * @param string $type Node type  (ARO/ACO)
505:  * @return array Variables
506:  * @access private
507:  */
508:     function __dataVars($type = null) {
509:         if ($type == null) {
510:             $type = $this->args[0];
511:         }
512:         $vars = array();
513:         $class = ucwords($type);
514:         $vars['secondary_id'] = strtolower($class) == 'aro' ? 'foreign_key' : 'object_id';
515:         $vars['data_name'] = $type;
516:         $vars['table_name'] = $type . 's';
517:         $vars['class'] = $class;
518:         return $vars;
519:     }
520: }
521: ?>