1: <?php
  2: /**
  3:  * Acl Shell provides Acl access in the CLI environment
  4:  *
  5:  * PHP versions 4 and 5
  6:  *
  7:  * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
  8:  * Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
  9:  *
 10:  * Licensed under The MIT License
 11:  * Redistributions of files must retain the above copyright notice.
 12:  *
 13:  * @copyright     Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
 14:  * @link          http://cakephp.org CakePHP(tm) Project
 15:  * @package       cake
 16:  * @subpackage    cake.cake.console.libs
 17:  * @since         CakePHP(tm) v 1.2.0.5012
 18:  * @license       MIT License (http://www.opensource.org/licenses/mit-license.php)
 19:  */
 20: App::import('Component', 'Acl');
 21: App::import('Model', 'DbAcl');
 22: 
 23: /**
 24:  * Shell for ACL management.  This console is known to have issues with zend.ze1_compatibility_mode 
 25:  * being enabled.  Be sure to turn it off when using this shell.
 26:  *
 27:  * @package       cake
 28:  * @subpackage    cake.cake.console.libs
 29:  */
 30: class AclShell extends Shell {
 31: 
 32: /**
 33:  * Contains instance of AclComponent
 34:  *
 35:  * @var AclComponent
 36:  * @access public
 37:  */
 38:     var $Acl;
 39: 
 40: /**
 41:  * Contains arguments parsed from the command line.
 42:  *
 43:  * @var array
 44:  * @access public
 45:  */
 46:     var $args;
 47: 
 48: /**
 49:  * Contains database source to use
 50:  *
 51:  * @var string
 52:  * @access public
 53:  */
 54:     var $connection = 'default';
 55: 
 56: /**
 57:  * Contains tasks to load and instantiate
 58:  *
 59:  * @var array
 60:  * @access public
 61:  */
 62:     var $tasks = array('DbConfig');
 63: 
 64: /**
 65:  * Override startup of the Shell
 66:  *
 67:  * @access public
 68:  */
 69:     function startup() {
 70:         if (isset($this->params['connection'])) {
 71:             $this->connection = $this->params['connection'];
 72:         }
 73: 
 74:         if (!in_array(Configure::read('Acl.classname'), array('DbAcl', 'DB_ACL'))) {
 75:             $out = "--------------------------------------------------\n";
 76:             $out .= __("Error: Your current Cake configuration is set to", true) . "\n";
 77:             $out .= __("an ACL implementation other than DB. Please change", true) . "\n";
 78:             $out .= __("your core config to reflect your decision to use", true) . "\n";
 79:             $out .= __("DbAcl before attempting to use this script", true) . ".\n";
 80:             $out .= "--------------------------------------------------\n";
 81:             $out .= sprintf(__("Current ACL Classname: %s", true), Configure::read('Acl.classname')) . "\n";
 82:             $out .= "--------------------------------------------------\n";
 83:             $this->err($out);
 84:             $this->_stop();
 85:         }
 86: 
 87:         if ($this->command && !in_array($this->command, array('help'))) {
 88:             if (!config('database')) {
 89:                 $this->out(__("Your database configuration was not found. Take a moment to create one.", true), true);
 90:                 $this->args = null;
 91:                 return $this->DbConfig->execute();
 92:             }
 93:             require_once (CONFIGS.'database.php');
 94: 
 95:             if (!in_array($this->command, array('initdb'))) {
 96:                 $this->Acl =& new AclComponent();
 97:                 $controller = null;
 98:                 $this->Acl->startup($controller);
 99:             }
100:         }
101:     }
102: 
103: /**
104:  * Override main() for help message hook
105:  *
106:  * @access public
107:  */
108:     function main() {
109:         $out  = __("Available ACL commands:", true) . "\n";
110:         $out .= "\t - create\n";
111:         $out .= "\t - delete\n";
112:         $out .= "\t - setParent\n";
113:         $out .= "\t - getPath\n";
114:         $out .= "\t - check\n";
115:         $out .= "\t - grant\n";
116:         $out .= "\t - deny\n";
117:         $out .= "\t - inherit\n";
118:         $out .= "\t - view\n";
119:         $out .= "\t - initdb\n";
120:         $out .= "\t - help\n\n";
121:         $out .= __("For help, run the 'help' command.  For help on a specific command, run 'help <command>'", true);
122:         $this->out($out);
123:     }
124: 
125: /**
126:  * Creates an ARO/ACO node
127:  *
128:  * @access public
129:  */
130:     function create() {
131:         $this->_checkArgs(3, 'create');
132:         $this->checkNodeType();
133:         extract($this->__dataVars());
134: 
135:         $class = ucfirst($this->args[0]);
136:         $parent = $this->parseIdentifier($this->args[1]);
137: 
138:         if (!empty($parent) && $parent != '/' && $parent != 'root') {
139:             $parent = $this->_getNodeId($class, $parent);
140:         } else {
141:             $parent = null;
142:         }
143: 
144:         $data = $this->parseIdentifier($this->args[2]);
145:         if (is_string($data) && $data != '/') {
146:             $data = array('alias' => $data);
147:         } elseif (is_string($data)) {
148:             $this->error(__('/ can not be used as an alias!', true), __("\t/ is the root, please supply a sub alias", true));
149:         }
150: 
151:         $data['parent_id'] = $parent;
152:         $this->Acl->{$class}->create();
153:         if ($this->Acl->{$class}->save($data)) {
154:             $this->out(sprintf(__("New %s '%s' created.\n", true), $class, $this->args[2]), true);
155:         } else {
156:             $this->err(sprintf(__("There was a problem creating a new %s '%s'.", true), $class, $this->args[2]));
157:         }
158:     }
159: 
160: /**
161:  * Delete an ARO/ACO node.
162:  *
163:  * @access public
164:  */
165:     function delete() {
166:         $this->_checkArgs(2, 'delete');
167:         $this->checkNodeType();
168:         extract($this->__dataVars());
169: 
170:         $identifier = $this->parseIdentifier($this->args[1]);
171:         $nodeId = $this->_getNodeId($class, $identifier);
172: 
173:         if (!$this->Acl->{$class}->delete($nodeId)) {
174:             $this->error(__("Node Not Deleted", true), sprintf(__("There was an error deleting the %s. Check that the node exists", true), $class) . ".\n");
175:         }
176:         $this->out(sprintf(__("%s deleted", true), $class) . ".\n", true);
177:     }
178: 
179: /**
180:  * Set parent for an ARO/ACO node.
181:  *
182:  * @access public
183:  */
184:     function setParent() {
185:         $this->_checkArgs(3, 'setParent');
186:         $this->checkNodeType();
187:         extract($this->__dataVars());
188:         $target = $this->parseIdentifier($this->args[1]);
189:         $parent = $this->parseIdentifier($this->args[2]);
190: 
191:         $data = array(
192:             $class => array(
193:                 'id' => $this->_getNodeId($class, $target),
194:                 'parent_id' => $this->_getNodeId($class, $parent)
195:             )
196:         );
197:         $this->Acl->{$class}->create();
198:         if (!$this->Acl->{$class}->save($data)) {
199:             $this->out(__("Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.", true), true);
200:         } else {
201:             $this->out(sprintf(__("Node parent set to %s", true), $this->args[2]) . "\n", true);
202:         }
203:     }
204: 
205: /**
206:  * Get path to specified ARO/ACO node.
207:  *
208:  * @access public
209:  */
210:     function getPath() {
211:         $this->_checkArgs(2, 'getPath');
212:         $this->checkNodeType();
213:         extract($this->__dataVars());
214:         $identifier = $this->parseIdentifier($this->args[1]);
215: 
216:         $id = $this->_getNodeId($class, $identifier);
217:         $nodes = $this->Acl->{$class}->getPath($id);
218: 
219:         if (empty($nodes)) {
220:             $this->error(
221:                 sprintf(__("Supplied Node '%s' not found", true), $this->args[1]),
222:                 __("No tree returned.", true)
223:             );
224:         }
225:         $this->out(__('Path:', true));
226:         $this->hr();
227:         for ($i = 0; $i < count($nodes); $i++) {
228:             $this->_outputNode($class, $nodes[$i], $i);
229:         }
230:     }
231: 
232: /**
233:  * Outputs a single node, Either using the alias or Model.key
234:  *
235:  * @param string $class Class name that is being used.
236:  * @param array $node Array of node information.
237:  * @param integer $indent indent level.
238:  * @return void
239:  * @access protected
240:  */
241:     function _outputNode($class, $node, $indent) {
242:         $indent = str_repeat('  ', $indent);
243:         $data = $node[$class];
244:         if ($data['alias']) {
245:             $this->out($indent . "[" . $data['id'] . "] " . $data['alias']);
246:          } else {
247:             $this->out($indent . "[" . $data['id'] . "] " . $data['model'] . '.' . $data['foreign_key']);
248:         }
249:     }
250: 
251: /**
252:  * Check permission for a given ARO to a given ACO.
253:  *
254:  * @access public
255:  */
256:     function check() {
257:         $this->_checkArgs(3, 'check');
258:         extract($this->__getParams());
259: 
260:         if ($this->Acl->check($aro, $aco, $action)) {
261:             $this->out(sprintf(__("%s is allowed.", true), $aroName), true);
262:         } else {
263:             $this->out(sprintf(__("%s is not allowed.", true), $aroName), true);
264:         }
265:     }
266: 
267: /**
268:  * Grant permission for a given ARO to a given ACO.
269:  *
270:  * @access public
271:  */
272:     function grant() {
273:         $this->_checkArgs(3, 'grant');
274:         extract($this->__getParams());
275: 
276:         if ($this->Acl->allow($aro, $aco, $action)) {
277:             $this->out(__("Permission granted.", true), true);
278:         } else {
279:             $this->out(__("Permission was not granted.", true), true);
280:         }
281:     }
282: 
283: /**
284:  * Deny access for an ARO to an ACO.
285:  *
286:  * @access public
287:  */
288:     function deny() {
289:         $this->_checkArgs(3, 'deny');
290:         extract($this->__getParams());
291: 
292:         if ($this->Acl->deny($aro, $aco, $action)) {
293:             $this->out(__("Permission denied.", true), true);
294:         } else {
295:             $this->out(__("Permission was not denied.", true), true);
296:         }
297:     }
298: 
299: /**
300:  * Set an ARO to inhermit permission to an ACO.
301:  *
302:  * @access public
303:  */
304:     function inherit() {
305:         $this->_checkArgs(3, 'inherit');
306:         extract($this->__getParams());
307: 
308:         if ($this->Acl->inherit($aro, $aco, $action)) {
309:             $this->out(__("Permission inherited.", true), true);
310:         } else {
311:             $this->out(__("Permission was not inherited.", true), true);
312:         }
313:     }
314: 
315: /**
316:  * Show a specific ARO/ACO node.
317:  *
318:  * @access public
319:  */
320:     function view() {
321:         $this->_checkArgs(1, 'view');
322:         $this->checkNodeType();
323:         extract($this->__dataVars());
324: 
325:         if (isset($this->args[1])) {
326:             $identity = $this->parseIdentifier($this->args[1]);
327: 
328:             $topNode = $this->Acl->{$class}->find('first', array(
329:                 'conditions' => array($class . '.id' => $this->_getNodeId($class, $identity))
330:             ));
331: 
332:             $nodes = $this->Acl->{$class}->find('all', array(
333:                 'conditions' => array(
334:                     $class . '.lft >=' => $topNode[$class]['lft'],
335:                     $class . '.lft <=' => $topNode[$class]['rght']
336:                 ),
337:                 'order' => $class . '.lft ASC'
338:             ));
339:         } else {
340:             $nodes = $this->Acl->{$class}->find('all', array('order' => $class . '.lft ASC'));
341:         }
342: 
343:         if (empty($nodes)) {
344:             if (isset($this->args[1])) {
345:                 $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
346:             } elseif (isset($this->args[0])) {
347:                 $this->error(sprintf(__("%s not found", true), $this->args[0]), __("No tree returned.", true));
348:             }
349:         }
350:         $this->out($class . " tree:");
351:         $this->hr();
352: 
353:         $stack = array();
354:         $last  = null;
355: 
356:         foreach ($nodes as $n) {
357:             $stack[] = $n;
358:             if (!empty($last)) {
359:                 $end = end($stack);
360:                 if ($end[$class]['rght'] > $last) {
361:                     foreach ($stack as $k => $v) {
362:                         $end = end($stack);
363:                         if ($v[$class]['rght'] < $end[$class]['rght']) {
364:                             unset($stack[$k]);
365:                         }
366:                     }
367:                 }
368:             }
369:             $last = $n[$class]['rght'];
370:             $count = count($stack);
371: 
372:             $this->_outputNode($class, $n, $count);
373:         }
374:         $this->hr();
375:     }
376: 
377: /**
378:  * Initialize ACL database.
379:  *
380:  * @access public
381:  */
382:     function initdb() {
383:         $this->Dispatch->args = array('schema', 'create', 'DbAcl');
384:         $this->Dispatch->dispatch();
385:     }
386: 
387: /**
388:  * Show help screen.
389:  *
390:  * @access public
391:  */
392:     function help() {
393:         $head = "-----------------------------------------------\n";
394:         $head .= __("Usage: cake acl <command> <arg1> <arg2>...", true) . "\n";
395:         $head .= "-----------------------------------------------\n";
396:         $head .= __("Commands:", true) . "\n";
397: 
398:         $commands = array(
399:             'create' => "create aro|aco <parent> <node>\n" .
400:                 "\t" . __("Creates a new ACL object <node> under the parent", true) . "\n" .
401:                 "\t" . __("specified by <parent>, an id/alias.", true) . "\n" .
402:                 "\t" . __("The <parent> and <node> references can be", true) . "\n" .
403:                 "\t" . __("in one of the following formats:", true) . "\n\n" .
404:                 "\t\t- " . __("<model>.<id> - The node will be bound to a", true) . "\n" .
405:                 "\t\t" . __("specific record of the given model.", true) . "\n\n" .
406:                 "\t\t- " . __("<alias> - The node will be given a string alias,", true) . "\n" .
407:                 "\t\t" . __(" (or path, in the case of <parent>)", true) . "\n" .
408:                 "\t\t  " . __("i.e. 'John'.  When used with <parent>,", true) . "\n" .
409:                 "\t\t" . __("this takes the form of an alias path,", true) . "\n" .
410:                 "\t\t  " . __("i.e. <group>/<subgroup>/<parent>.", true) . "\n\n" .
411:                 "\t" . __("To add a node at the root level,", true) . "\n" .
412:                 "\t" . __("enter 'root' or '/' as the <parent> parameter.", true) . "\n",
413: 
414:             'delete' => "delete aro|aco <node>\n" .
415:                 "\t" . __("Deletes the ACL object with the given <node> reference", true) . "\n" .
416:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
417:                 "\t" . __("see help for the 'create' command.", true),
418: 
419:             'setparent' => "setParent aro|aco <node> <parent node>\n" .
420:                 "\t" . __("Moves the ACL object specified by <node> beneath", true) . "\n" .
421:                 "\t" . __("the parent ACL object specified by <parent>.", true) . "\n" .
422:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
423:                 "\t" . __("see help for the 'create' command.", true),
424: 
425:             'getpath' => "getPath aro|aco <node>\n" .
426:                 "\t" . __("Returns the path to the ACL object specified by <node>. This command", true) . "\n" .
427:                 "\t" . __("is useful in determining the inhertiance of permissions for a certain", true) . "\n" .
428:                 "\t" . __("object in the tree.", true) . "\n" .
429:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
430:                 "\t" . __("see help for the 'create' command.", true),
431: 
432:             'check' => "check <node> <node> [<aco_action>] " . __("or", true) . " all\n" .
433:                 "\t" . __("Use this command to check ACL permissions.", true) . "\n" .
434:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
435:                 "\t" . __("see help for the 'create' command.", true),
436: 
437:             'grant' => "grant <aronode> <aconode> [<aco_action>] " . __("or", true) . " all\n" .
438:                 "\t" . __("Use this command to grant ACL permissions. Once executed, the ARO", true) . "\n" .
439:                 "\t" . __("specified (and its children, if any) will have ALLOW access to the", true) . "\n" .
440:                 "\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
441:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
442:                 "\t" . __("see help for the 'create' command.", true),
443: 
444:             'deny' => "deny <aronode> <aconode> [<aco_action>]" . __("or", true) . " all\n" .
445:                 "\t" . __("Use this command to deny ACL permissions. Once executed, the ARO", true) . "\n" .
446:                 "\t" . __("specified (and its children, if any) will have DENY access to the", true) . "\n" .
447:                 "\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
448:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
449:                 "\t" . __("see help for the 'create' command.", true),
450: 
451:             'inherit' => "inherit <aronode> <aconode> [<aco_action>]" . __("or", true) . " all\n" .
452:                 "\t" . __("Use this command to force a child ARO object to inherit its", true) . "\n" .
453:                 "\t" . __("permissions settings from its parent.", true) . "\n" .
454:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
455:                 "\t" . __("see help for the 'create' command.", true),
456: 
457:             'view' => "view aro|aco [<node>]\n" .
458:                 "\t" . __("The view command will return the ARO or ACO tree.", true) . "\n" .
459:                 "\t" . __("The optional node parameter allows you to return", true) . "\n" .
460:                 "\t" . __("only a portion of the requested tree.", true) . "\n" .
461:                 "\t" . __("For more detailed parameter usage info,", true) . "\n" .
462:                 "\t" . __("see help for the 'create' command.", true),
463: 
464:             'initdb' => "initdb\n".
465:                 "\t" . __("Uses this command : cake schema run create DbAcl", true),
466: 
467:             'help' => "help [<command>]\n" .
468:                 "\t" . __("Displays this help message, or a message on a specific command.", true)
469:         );
470: 
471:         $this->out($head);
472:         if (!isset($this->args[0])) {
473:             foreach ($commands as $cmd) {
474:                 $this->out("{$cmd}\n\n");
475:             }
476:         } elseif (isset($commands[strtolower($this->args[0])])) {
477:             $this->out($commands[strtolower($this->args[0])] . "\n\n");
478:         } else {
479:             $this->out(sprintf(__("Command '%s' not found", true), $this->args[0]));
480:         }
481:     }
482: 
483: /**
484:  * Check that first argument specifies a valid Node type (ARO/ACO)
485:  *
486:  * @access public
487:  */
488:     function checkNodeType() {
489:         if (!isset($this->args[0])) {
490:             return false;
491:         }
492:         if ($this->args[0] != 'aco' && $this->args[0] != 'aro') {
493:             $this->error(sprintf(__("Missing/Unknown node type: '%s'", true), $this->args[0]), __('Please specify which ACL object type you wish to create. Either "aro" or "aco"', true));
494:         }
495:     }
496: 
497: /**
498:  * Checks that given node exists
499:  *
500:  * @param string $type Node type (ARO/ACO)
501:  * @param integer $id Node id
502:  * @return boolean Success
503:  * @access public
504:  */
505:     function nodeExists() {
506:         if (!$this->checkNodeType() && !isset($this->args[1])) {
507:             return false;
508:         }
509:         extract($this->__dataVars($this->args[0]));
510:         $key = is_numeric($this->args[1]) ? $secondary_id : 'alias';
511:         $conditions = array($class . '.' . $key => $this->args[1]);
512:         $possibility = $this->Acl->{$class}->find('all', compact('conditions'));
513:         if (empty($possibility)) {
514:             $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
515:         }
516:         return $possibility;
517:     }
518: 
519: /**
520:  * Parse an identifier into Model.foriegnKey or an alias.
521:  * Takes an identifier determines its type and returns the result as used by other methods.
522:  *
523:  * @param string $identifier Identifier to parse
524:  * @return mixed a string for aliases, and an array for model.foreignKey
525:  */
526:     function parseIdentifier($identifier) {
527:         if (preg_match('/^([\w]+)\.(.*)$/', $identifier, $matches)) {
528:             return array(
529:                 'model' => $matches[1],
530:                 'foreign_key' => $matches[2],
531:             );
532:         }
533:         return $identifier;
534:     }
535: 
536: /**
537:  * Get the node for a given identifier. $identifier can either be a string alias
538:  * or an array of properties to use in AcoNode::node()
539:  *
540:  * @param string $class Class type you want (Aro/Aco)
541:  * @param mixed $identifier A mixed identifier for finding the node.
542:  * @return int Integer of NodeId. Will trigger an error if nothing is found.
543:  */
544:     function _getNodeId($class, $identifier) {
545:         $node = $this->Acl->{$class}->node($identifier);
546:         if (empty($node)) {
547:             if (is_array($identifier)) {
548:                 $identifier = var_export($identifier, true);
549:             }
550:             $this->error(sprintf(__('Could not find node using reference "%s"', true), $identifier));
551:         }
552:         return Set::extract($node, "0.{$class}.id");
553:     }
554: 
555: /**
556:  * get params for standard Acl methods
557:  *
558:  * @return array aro, aco, action
559:  * @access private
560:  */
561:     function __getParams() {
562:         $aro = is_numeric($this->args[0]) ? intval($this->args[0]) : $this->args[0];
563:         $aco = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
564:         $aroName = $aro;
565:         $acoName = $aco;
566: 
567:         if (is_string($aro)) {
568:             $aro = $this->parseIdentifier($aro);
569:         }
570:         if (is_string($aco)) {
571:             $aco = $this->parseIdentifier($aco);
572:         }
573:         $action = null;
574:         if (isset($this->args[2])) {
575:             $action = $this->args[2];
576:             if ($action == '' || $action == 'all') {
577:                 $action = '*';
578:             }
579:         }
580:         return compact('aro', 'aco', 'action', 'aroName', 'acoName');
581:     }
582: 
583: /**
584:  * Build data parameters based on node type
585:  *
586:  * @param string $type Node type  (ARO/ACO)
587:  * @return array Variables
588:  * @access private
589:  */
590:     function __dataVars($type = null) {
591:         if ($type == null) {
592:             $type = $this->args[0];
593:         }
594:         $vars = array();
595:         $class = ucwords($type);
596:         $vars['secondary_id'] = (strtolower($class) == 'aro') ? 'foreign_key' : 'object_id';
597:         $vars['data_name'] = $type;
598:         $vars['table_name'] = $type . 's';
599:         $vars['class'] = $class;
600:         return $vars;
601:     }
602: }
603: