1: <?php
  2: /**
  3:  * Acl Shell provides Acl access in the CLI environment
  4:  *
  5:  * PHP 5
  6:  *
  7:  * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
  8:  * Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
  9:  *
 10:  * Licensed under The MIT License
 11:  * Redistributions of files must retain the above copyright notice.
 12:  *
 13:  * @copyright     Copyright 2005-2012, Cake Software Foundation, Inc. (http://cakefoundation.org)
 14:  * @link          http://cakephp.org CakePHP(tm) Project
 15:  * @since         CakePHP(tm) v 1.2.0.5012
 16:  * @license       MIT License (http://www.opensource.org/licenses/mit-license.php)
 17:  */
 18: 
 19: App::uses('AppShell', 'Console/Command');
 20: App::uses('Controller', 'Controller');
 21: App::uses('ComponentCollection', 'Controller');
 22: App::uses('AclComponent', 'Controller/Component');
 23: App::uses('DbAcl', 'Model');
 24: App::uses('Hash', 'Utility');
 25: 
 26: /**
 27:  * Shell for ACL management.  This console is known to have issues with zend.ze1_compatibility_mode
 28:  * being enabled.  Be sure to turn it off when using this shell.
 29:  *
 30:  * @package       Cake.Console.Command
 31:  */
 32: class AclShell extends AppShell {
 33: 
 34: /**
 35:  * Contains instance of AclComponent
 36:  *
 37:  * @var AclComponent
 38:  */
 39:     public $Acl;
 40: 
 41: /**
 42:  * Contains arguments parsed from the command line.
 43:  *
 44:  * @var array
 45:  */
 46:     public $args;
 47: 
 48: /**
 49:  * Contains database source to use
 50:  *
 51:  * @var string
 52:  */
 53:     public $connection = 'default';
 54: 
 55: /**
 56:  * Contains tasks to load and instantiate
 57:  *
 58:  * @var array
 59:  */
 60:     public $tasks = array('DbConfig');
 61: 
 62: /**
 63:  * Override startup of the Shell
 64:  *
 65:  * @return void
 66:  */
 67:     public function startup() {
 68:         parent::startup();
 69:         if (isset($this->params['connection'])) {
 70:             $this->connection = $this->params['connection'];
 71:         }
 72: 
 73:         $class = Configure::read('Acl.classname');
 74:         list($plugin, $class) = pluginSplit($class, true);
 75:         App::uses($class, $plugin . 'Controller/Component/Acl');
 76:         if (!in_array($class, array('DbAcl', 'DB_ACL')) && !is_subclass_of($class, 'DbAcl')) {
 77:             $out = "--------------------------------------------------\n";
 78:             $out .= __d('cake_console', 'Error: Your current Cake configuration is set to an ACL implementation other than DB.') . "\n";
 79:             $out .= __d('cake_console', 'Please change your core config to reflect your decision to use DbAcl before attempting to use this script') . "\n";
 80:             $out .= "--------------------------------------------------\n";
 81:             $out .= __d('cake_console', 'Current ACL Classname: %s', $class) . "\n";
 82:             $out .= "--------------------------------------------------\n";
 83:             $this->err($out);
 84:             $this->_stop();
 85:         }
 86: 
 87:         if ($this->command) {
 88:             if (!config('database')) {
 89:                 $this->out(__d('cake_console', 'Your database configuration was not found. Take a moment to create one.'), true);
 90:                 $this->args = null;
 91:                 return $this->DbConfig->execute();
 92:             }
 93:             require_once (APP . 'Config' . DS . 'database.php');
 94: 
 95:             if (!in_array($this->command, array('initdb'))) {
 96:                 $collection = new ComponentCollection();
 97:                 $this->Acl = new AclComponent($collection);
 98:                 $controller = new Controller();
 99:                 $this->Acl->startup($controller);
100:             }
101:         }
102:     }
103: 
104: /**
105:  * Override main() for help message hook
106:  *
107:  * @return void
108:  */
109:     public function main() {
110:         $this->out($this->OptionParser->help());
111:     }
112: 
113: /**
114:  * Creates an ARO/ACO node
115:  *
116:  * @return void
117:  */
118:     public function create() {
119:         extract($this->_dataVars());
120: 
121:         $class = ucfirst($this->args[0]);
122:         $parent = $this->parseIdentifier($this->args[1]);
123: 
124:         if (!empty($parent) && $parent != '/' && $parent != 'root') {
125:             $parent = $this->_getNodeId($class, $parent);
126:         } else {
127:             $parent = null;
128:         }
129: 
130:         $data = $this->parseIdentifier($this->args[2]);
131:         if (is_string($data) && $data != '/') {
132:             $data = array('alias' => $data);
133:         } elseif (is_string($data)) {
134:             $this->error(__d('cake_console', '/ can not be used as an alias!') . __d('cake_console', "  / is the root, please supply a sub alias"));
135:         }
136: 
137:         $data['parent_id'] = $parent;
138:         $this->Acl->{$class}->create();
139:         if ($this->Acl->{$class}->save($data)) {
140:             $this->out(__d('cake_console', "<success>New %s</success> '%s' created.", $class, $this->args[2]), 2);
141:         } else {
142:             $this->err(__d('cake_console', "There was a problem creating a new %s '%s'.", $class, $this->args[2]));
143:         }
144:     }
145: 
146: /**
147:  * Delete an ARO/ACO node.
148:  *
149:  * @return void
150:  */
151:     public function delete() {
152:         extract($this->_dataVars());
153: 
154:         $identifier = $this->parseIdentifier($this->args[1]);
155:         $nodeId = $this->_getNodeId($class, $identifier);
156: 
157:         if (!$this->Acl->{$class}->delete($nodeId)) {
158:             $this->error(__d('cake_console', 'Node Not Deleted') . __d('cake_console', 'There was an error deleting the %s. Check that the node exists.', $class) . "\n");
159:         }
160:         $this->out(__d('cake_console', '<success>%s deleted.</success>', $class), 2);
161:     }
162: 
163: /**
164:  * Set parent for an ARO/ACO node.
165:  *
166:  * @return void
167:  */
168:     public function setParent() {
169:         extract($this->_dataVars());
170:         $target = $this->parseIdentifier($this->args[1]);
171:         $parent = $this->parseIdentifier($this->args[2]);
172: 
173:         $data = array(
174:             $class => array(
175:                 'id' => $this->_getNodeId($class, $target),
176:                 'parent_id' => $this->_getNodeId($class, $parent)
177:             )
178:         );
179:         $this->Acl->{$class}->create();
180:         if (!$this->Acl->{$class}->save($data)) {
181:             $this->out(__d('cake_console', 'Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.'), true);
182:         } else {
183:             $this->out(__d('cake_console', 'Node parent set to %s', $this->args[2]) . "\n", true);
184:         }
185:     }
186: 
187: /**
188:  * Get path to specified ARO/ACO node.
189:  *
190:  * @return void
191:  */
192:     public function getPath() {
193:         extract($this->_dataVars());
194:         $identifier = $this->parseIdentifier($this->args[1]);
195: 
196:         $id = $this->_getNodeId($class, $identifier);
197:         $nodes = $this->Acl->{$class}->getPath($id);
198: 
199:         if (empty($nodes)) {
200:             $this->error(
201:                 __d('cake_console', "Supplied Node '%s' not found", $this->args[1]),
202:                 __d('cake_console', 'No tree returned.')
203:             );
204:         }
205:         $this->out(__d('cake_console', 'Path:'));
206:         $this->hr();
207:         for ($i = 0, $len = count($nodes); $i < $len; $i++) {
208:             $this->_outputNode($class, $nodes[$i], $i);
209:         }
210:     }
211: 
212: /**
213:  * Outputs a single node, Either using the alias or Model.key
214:  *
215:  * @param string $class Class name that is being used.
216:  * @param array $node Array of node information.
217:  * @param integer $indent indent level.
218:  * @return void
219:  */
220:     protected function _outputNode($class, $node, $indent) {
221:         $indent = str_repeat('  ', $indent);
222:         $data = $node[$class];
223:         if ($data['alias']) {
224:             $this->out($indent . "[" . $data['id'] . "] " . $data['alias']);
225:         } else {
226:             $this->out($indent . "[" . $data['id'] . "] " . $data['model'] . '.' . $data['foreign_key']);
227:         }
228:     }
229: 
230: /**
231:  * Check permission for a given ARO to a given ACO.
232:  *
233:  * @return void
234:  */
235:     public function check() {
236:         extract($this->_getParams());
237: 
238:         if ($this->Acl->check($aro, $aco, $action)) {
239:             $this->out(__d('cake_console', '%s is <success>allowed</success>.', $aroName), true);
240:         } else {
241:             $this->out(__d('cake_console', '%s is <error>not allowed</error>.', $aroName), true);
242:         }
243:     }
244: 
245: /**
246:  * Grant permission for a given ARO to a given ACO.
247:  *
248:  * @return void
249:  */
250:     public function grant() {
251:         extract($this->_getParams());
252: 
253:         if ($this->Acl->allow($aro, $aco, $action)) {
254:             $this->out(__d('cake_console', 'Permission <success>granted</success>.'), true);
255:         } else {
256:             $this->out(__d('cake_console', 'Permission was <error>not granted</error>.'), true);
257:         }
258:     }
259: 
260: /**
261:  * Deny access for an ARO to an ACO.
262:  *
263:  * @return void
264:  */
265:     public function deny() {
266:         extract($this->_getParams());
267: 
268:         if ($this->Acl->deny($aro, $aco, $action)) {
269:             $this->out(__d('cake_console', 'Permission denied.'), true);
270:         } else {
271:             $this->out(__d('cake_console', 'Permission was not denied.'), true);
272:         }
273:     }
274: 
275: /**
276:  * Set an ARO to inherit permission to an ACO.
277:  *
278:  * @return void
279:  */
280:     public function inherit() {
281:         extract($this->_getParams());
282: 
283:         if ($this->Acl->inherit($aro, $aco, $action)) {
284:             $this->out(__d('cake_console', 'Permission inherited.'), true);
285:         } else {
286:             $this->out(__d('cake_console', 'Permission was not inherited.'), true);
287:         }
288:     }
289: 
290: /**
291:  * Show a specific ARO/ACO node.
292:  *
293:  * @return void
294:  */
295:     public function view() {
296:         extract($this->_dataVars());
297: 
298:         if (isset($this->args[1])) {
299:             $identity = $this->parseIdentifier($this->args[1]);
300: 
301:             $topNode = $this->Acl->{$class}->find('first', array(
302:                 'conditions' => array($class . '.id' => $this->_getNodeId($class, $identity))
303:             ));
304: 
305:             $nodes = $this->Acl->{$class}->find('all', array(
306:                 'conditions' => array(
307:                     $class . '.lft >=' => $topNode[$class]['lft'],
308:                     $class . '.lft <=' => $topNode[$class]['rght']
309:                 ),
310:                 'order' => $class . '.lft ASC'
311:             ));
312:         } else {
313:             $nodes = $this->Acl->{$class}->find('all', array('order' => $class . '.lft ASC'));
314:         }
315: 
316:         if (empty($nodes)) {
317:             if (isset($this->args[1])) {
318:                 $this->error(__d('cake_console', '%s not found', $this->args[1]), __d('cake_console', 'No tree returned.'));
319:             } elseif (isset($this->args[0])) {
320:                 $this->error(__d('cake_console', '%s not found', $this->args[0]), __d('cake_console', 'No tree returned.'));
321:             }
322:         }
323:         $this->out($class . ' tree:');
324:         $this->hr();
325: 
326:         $stack = array();
327:         $last  = null;
328: 
329:         foreach ($nodes as $n) {
330:             $stack[] = $n;
331:             if (!empty($last)) {
332:                 $end = end($stack);
333:                 if ($end[$class]['rght'] > $last) {
334:                     foreach ($stack as $k => $v) {
335:                         $end = end($stack);
336:                         if ($v[$class]['rght'] < $end[$class]['rght']) {
337:                             unset($stack[$k]);
338:                         }
339:                     }
340:                 }
341:             }
342:             $last = $n[$class]['rght'];
343:             $count = count($stack);
344: 
345:             $this->_outputNode($class, $n, $count);
346:         }
347:         $this->hr();
348:     }
349: 
350: /**
351:  * Initialize ACL database.
352:  *
353:  * @return mixed
354:  */
355:     public function initdb() {
356:         return $this->dispatchShell('schema create DbAcl');
357:     }
358: 
359: /**
360:  * Get the option parser.
361:  *
362:  * @return void
363:  */
364:     public function getOptionParser() {
365:         $parser = parent::getOptionParser();
366: 
367:         $type = array(
368:             'choices' => array('aro', 'aco'),
369:             'required' => true,
370:             'help' => __d('cake_console', 'Type of node to create.')
371:         );
372: 
373:         $parser->description(
374:             __d('cake_console', 'A console tool for managing the DbAcl')
375:             )->addSubcommand('create', array(
376:                 'help' => __d('cake_console', 'Create a new ACL node'),
377:                 'parser' => array(
378:                     'description' => __d('cake_console', 'Creates a new ACL object <node> under the parent'),
379:                     'arguments' => array(
380:                         'type' => $type,
381:                         'parent' => array(
382:                             'help' => __d('cake_console', 'The node selector for the parent.'),
383:                             'required' => true
384:                         ),
385:                         'alias' => array(
386:                             'help' => __d('cake_console', 'The alias to use for the newly created node.'),
387:                             'required' => true
388:                         )
389:                     )
390:                 )
391:             ))->addSubcommand('delete', array(
392:                 'help' => __d('cake_console', 'Deletes the ACL object with the given <node> reference'),
393:                 'parser' => array(
394:                     'description' => __d('cake_console', 'Delete an ACL node.'),
395:                     'arguments' => array(
396:                         'type' => $type,
397:                         'node' => array(
398:                             'help' => __d('cake_console', 'The node identifier to delete.'),
399:                             'required' => true,
400:                         )
401:                     )
402:                 )
403:             ))->addSubcommand('setparent', array(
404:                 'help' => __d('cake_console', 'Moves the ACL node under a new parent.'),
405:                 'parser' => array(
406:                     'description' => __d('cake_console', 'Moves the ACL object specified by <node> beneath <parent>'),
407:                     'arguments' => array(
408:                         'type' => $type,
409:                         'node' => array(
410:                             'help' => __d('cake_console', 'The node to move'),
411:                             'required' => true,
412:                         ),
413:                         'parent' => array(
414:                             'help' => __d('cake_console', 'The new parent for <node>.'),
415:                             'required' => true
416:                         )
417:                     )
418:                 )
419:             ))->addSubcommand('getpath', array(
420:                 'help' => __d('cake_console', 'Print out the path to an ACL node.'),
421:                 'parser' => array(
422:                     'description' => array(
423:                         __d('cake_console', "Returns the path to the ACL object specified by <node>."),
424:                         __d('cake_console', "This command is useful in determining the inheritance of permissions for a certain object in the tree.")
425:                     ),
426:                     'arguments' => array(
427:                         'type' => $type,
428:                         'node' => array(
429:                             'help' => __d('cake_console', 'The node to get the path of'),
430:                             'required' => true,
431:                         )
432:                     )
433:                 )
434:             ))->addSubcommand('check', array(
435:                 'help' => __d('cake_console', 'Check the permissions between an ACO and ARO.'),
436:                 'parser' => array(
437:                     'description' => array(
438:                         __d('cake_console', 'Use this command to check ACL permissions.')
439:                     ),
440:                     'arguments' => array(
441:                         'aro' => array('help' => __d('cake_console', 'ARO to check.'), 'required' => true),
442:                         'aco' => array('help' => __d('cake_console', 'ACO to check.'), 'required' => true),
443:                         'action' => array('help' => __d('cake_console', 'Action to check'), 'default' => 'all')
444:                     )
445:                 )
446:             ))->addSubcommand('grant', array(
447:                 'help' => __d('cake_console', 'Grant an ARO permissions to an ACO.'),
448:                 'parser' => array(
449:                     'description' => array(
450:                         __d('cake_console', 'Use this command to grant ACL permissions. Once executed, the ARO specified (and its children, if any) will have ALLOW access to the specified ACO action (and the ACO\'s children, if any).')
451:                     ),
452:                     'arguments' => array(
453:                         'aro' => array('help' => __d('cake_console', 'ARO to grant permission to.'), 'required' => true),
454:                         'aco' => array('help' => __d('cake_console', 'ACO to grant access to.'), 'required' => true),
455:                         'action' => array('help' => __d('cake_console', 'Action to grant'), 'default' => 'all')
456:                     )
457:                 )
458:             ))->addSubcommand('deny', array(
459:                 'help' => __d('cake_console', 'Deny an ARO permissions to an ACO.'),
460:                 'parser' => array(
461:                     'description' => array(
462:                         __d('cake_console', 'Use this command to deny ACL permissions. Once executed, the ARO specified (and its children, if any) will have DENY access to the specified ACO action (and the ACO\'s children, if any).')
463:                     ),
464:                     'arguments' => array(
465:                         'aro' => array('help' => __d('cake_console', 'ARO to deny.'), 'required' => true),
466:                         'aco' => array('help' => __d('cake_console', 'ACO to deny.'), 'required' => true),
467:                         'action' => array('help' => __d('cake_console', 'Action to deny'), 'default' => 'all')
468:                     )
469:                 )
470:             ))->addSubcommand('inherit', array(
471:                 'help' => __d('cake_console', 'Inherit an ARO\'s parent permissions.'),
472:                 'parser' => array(
473:                     'description' => array(
474:                         __d('cake_console', "Use this command to force a child ARO object to inherit its permissions settings from its parent.")
475:                     ),
476:                     'arguments' => array(
477:                         'aro' => array('help' => __d('cake_console', 'ARO to have permissions inherit.'), 'required' => true),
478:                         'aco' => array('help' => __d('cake_console', 'ACO to inherit permissions on.'), 'required' => true),
479:                         'action' => array('help' => __d('cake_console', 'Action to inherit'), 'default' => 'all')
480:                     )
481:                 )
482:             ))->addSubcommand('view', array(
483:                 'help' => __d('cake_console', 'View a tree or a single node\'s subtree.'),
484:                 'parser' => array(
485:                     'description' => array(
486:                         __d('cake_console', "The view command will return the ARO or ACO tree."),
487:                         __d('cake_console', "The optional node parameter allows you to return"),
488:                         __d('cake_console', "only a portion of the requested tree.")
489:                     ),
490:                     'arguments' => array(
491:                         'type' => $type,
492:                         'node' => array('help' => __d('cake_console', 'The optional node to view the subtree of.'))
493:                     )
494:                 )
495:             ))->addSubcommand('initdb', array(
496:                 'help' => __d('cake_console', 'Initialize the DbAcl tables. Uses this command : cake schema create DbAcl')
497:             ))->epilog(
498:                 array(
499:                     'Node and parent arguments can be in one of the following formats:',
500:                     '',
501:                     ' - <model>.<id> - The node will be bound to a specific record of the given model.',
502:                     '',
503:                     ' - <alias> - The node will be given a string alias (or path, in the case of <parent>)',
504:                     "   i.e. 'John'.  When used with <parent>, this takes the form of an alias path,",
505:                     "   i.e. <group>/<subgroup>/<parent>.",
506:                     '',
507:                     "To add a node at the root level, enter 'root' or '/' as the <parent> parameter."
508:                 )
509:             );
510:         return $parser;
511:     }
512: 
513: /**
514:  * Checks that given node exists
515:  *
516:  * @return boolean Success
517:  */
518:     public function nodeExists() {
519:         if (!isset($this->args[0]) || !isset($this->args[1])) {
520:             return false;
521:         }
522:         $dataVars = $this->_dataVars($this->args[0]);
523:         extract($dataVars);
524:         $key = is_numeric($this->args[1]) ? $dataVars['secondary_id'] : 'alias';
525:         $conditions = array($class . '.' . $key => $this->args[1]);
526:         $possibility = $this->Acl->{$class}->find('all', compact('conditions'));
527:         if (empty($possibility)) {
528:             $this->error(__d('cake_console', '%s not found', $this->args[1]), __d('cake_console', 'No tree returned.'));
529:         }
530:         return $possibility;
531:     }
532: 
533: /**
534:  * Parse an identifier into Model.foreignKey or an alias.
535:  * Takes an identifier determines its type and returns the result as used by other methods.
536:  *
537:  * @param string $identifier Identifier to parse
538:  * @return mixed a string for aliases, and an array for model.foreignKey
539:  */
540:     public function parseIdentifier($identifier) {
541:         if (preg_match('/^([\w]+)\.(.*)$/', $identifier, $matches)) {
542:             return array(
543:                 'model' => $matches[1],
544:                 'foreign_key' => $matches[2],
545:             );
546:         }
547:         return $identifier;
548:     }
549: 
550: /**
551:  * Get the node for a given identifier. $identifier can either be a string alias
552:  * or an array of properties to use in AcoNode::node()
553:  *
554:  * @param string $class Class type you want (Aro/Aco)
555:  * @param string|array $identifier A mixed identifier for finding the node.
556:  * @return integer Integer of NodeId. Will trigger an error if nothing is found.
557:  */
558:     protected function _getNodeId($class, $identifier) {
559:         $node = $this->Acl->{$class}->node($identifier);
560:         if (empty($node)) {
561:             if (is_array($identifier)) {
562:                 $identifier = var_export($identifier, true);
563:             }
564:             $this->error(__d('cake_console', 'Could not find node using reference "%s"', $identifier));
565:             return;
566:         }
567:         return Hash::get($node, "0.{$class}.id");
568:     }
569: 
570: /**
571:  * get params for standard Acl methods
572:  *
573:  * @return array aro, aco, action
574:  */
575:     protected function _getParams() {
576:         $aro = is_numeric($this->args[0]) ? intval($this->args[0]) : $this->args[0];
577:         $aco = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
578:         $aroName = $aro;
579:         $acoName = $aco;
580: 
581:         if (is_string($aro)) {
582:             $aro = $this->parseIdentifier($aro);
583:         }
584:         if (is_string($aco)) {
585:             $aco = $this->parseIdentifier($aco);
586:         }
587:         $action = '*';
588:         if (isset($this->args[2]) && !in_array($this->args[2], array('', 'all'))) {
589:             $action = $this->args[2];
590:         }
591:         return compact('aro', 'aco', 'action', 'aroName', 'acoName');
592:     }
593: 
594: /**
595:  * Build data parameters based on node type
596:  *
597:  * @param string $type Node type  (ARO/ACO)
598:  * @return array Variables
599:  */
600:     protected function _dataVars($type = null) {
601:         if ($type == null) {
602:             $type = $this->args[0];
603:         }
604:         $vars = array();
605:         $class = ucwords($type);
606:         $vars['secondary_id'] = (strtolower($class) == 'aro') ? 'foreign_key' : 'object_id';
607:         $vars['data_name'] = $type;
608:         $vars['table_name'] = $type . 's';
609:         $vars['class'] = $class;
610:         return $vars;
611:     }
612: 
613: }
614: