1: <?php
  2: /**
  3:  * Acl Shell provides Acl access in the CLI environment
  4:  *
  5:  * PHP 5
  6:  *
  7:  * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
  8:  * Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
  9:  *
 10:  * Licensed under The MIT License
 11:  * For full copyright and license information, please see the LICENSE.txt
 12:  * Redistributions of files must retain the above copyright notice.
 13:  *
 14:  * @copyright     Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
 15:  * @link          http://cakephp.org CakePHP(tm) Project
 16:  * @since         CakePHP(tm) v 1.2.0.5012
 17:  * @license       http://www.opensource.org/licenses/mit-license.php MIT License
 18:  */
 19: 
 20: App::uses('AppShell', 'Console/Command');
 21: App::uses('Controller', 'Controller');
 22: App::uses('ComponentCollection', 'Controller');
 23: App::uses('AclComponent', 'Controller/Component');
 24: App::uses('DbAcl', 'Model');
 25: App::uses('Hash', 'Utility');
 26: 
 27: /**
 28:  * Shell for ACL management. This console is known to have issues with zend.ze1_compatibility_mode
 29:  * being enabled. Be sure to turn it off when using this shell.
 30:  *
 31:  * @package       Cake.Console.Command
 32:  */
 33: class AclShell extends AppShell {
 34: 
 35: /**
 36:  * Contains instance of AclComponent
 37:  *
 38:  * @var AclComponent
 39:  */
 40:     public $Acl;
 41: 
 42: /**
 43:  * Contains arguments parsed from the command line.
 44:  *
 45:  * @var array
 46:  */
 47:     public $args;
 48: 
 49: /**
 50:  * Contains database source to use
 51:  *
 52:  * @var string
 53:  */
 54:     public $connection = 'default';
 55: 
 56: /**
 57:  * Contains tasks to load and instantiate
 58:  *
 59:  * @var array
 60:  */
 61:     public $tasks = array('DbConfig');
 62: 
 63: /**
 64:  * Override startup of the Shell
 65:  *
 66:  * @return void
 67:  */
 68:     public function startup() {
 69:         parent::startup();
 70:         if (isset($this->params['connection'])) {
 71:             $this->connection = $this->params['connection'];
 72:         }
 73: 
 74:         $class = Configure::read('Acl.classname');
 75:         list($plugin, $class) = pluginSplit($class, true);
 76:         App::uses($class, $plugin . 'Controller/Component/Acl');
 77:         if (!in_array($class, array('DbAcl', 'DB_ACL')) && !is_subclass_of($class, 'DbAcl')) {
 78:             $out = "--------------------------------------------------\n";
 79:             $out .= __d('cake_console', 'Error: Your current Cake configuration is set to an ACL implementation other than DB.') . "\n";
 80:             $out .= __d('cake_console', 'Please change your core config to reflect your decision to use DbAcl before attempting to use this script') . "\n";
 81:             $out .= "--------------------------------------------------\n";
 82:             $out .= __d('cake_console', 'Current ACL Classname: %s', $class) . "\n";
 83:             $out .= "--------------------------------------------------\n";
 84:             $this->err($out);
 85:             return $this->_stop();
 86:         }
 87: 
 88:         if ($this->command) {
 89:             if (!config('database')) {
 90:                 $this->out(__d('cake_console', 'Your database configuration was not found. Take a moment to create one.'));
 91:                 $this->args = null;
 92:                 return $this->DbConfig->execute();
 93:             }
 94:             require_once (APP . 'Config' . DS . 'database.php');
 95: 
 96:             if (!in_array($this->command, array('initdb'))) {
 97:                 $collection = new ComponentCollection();
 98:                 $this->Acl = new AclComponent($collection);
 99:                 $controller = new Controller();
100:                 $this->Acl->startup($controller);
101:             }
102:         }
103:     }
104: 
105: /**
106:  * Override main() for help message hook
107:  *
108:  * @return void
109:  */
110:     public function main() {
111:         $this->out($this->OptionParser->help());
112:     }
113: 
114: /**
115:  * Creates an ARO/ACO node
116:  *
117:  * @return void
118:  */
119:     public function create() {
120:         extract($this->_dataVars());
121: 
122:         $class = ucfirst($this->args[0]);
123:         $parent = $this->parseIdentifier($this->args[1]);
124: 
125:         if (!empty($parent) && $parent !== '/' && $parent !== 'root') {
126:             $parent = $this->_getNodeId($class, $parent);
127:         } else {
128:             $parent = null;
129:         }
130: 
131:         $data = $this->parseIdentifier($this->args[2]);
132:         if (is_string($data) && $data !== '/') {
133:             $data = array('alias' => $data);
134:         } elseif (is_string($data)) {
135:             $this->error(__d('cake_console', '/ can not be used as an alias!') . __d('cake_console', "  / is the root, please supply a sub alias"));
136:         }
137: 
138:         $data['parent_id'] = $parent;
139:         $this->Acl->{$class}->create();
140:         if ($this->Acl->{$class}->save($data)) {
141:             $this->out(__d('cake_console', "<success>New %s</success> '%s' created.", $class, $this->args[2]), 2);
142:         } else {
143:             $this->err(__d('cake_console', "There was a problem creating a new %s '%s'.", $class, $this->args[2]));
144:         }
145:     }
146: 
147: /**
148:  * Delete an ARO/ACO node.
149:  *
150:  * @return void
151:  */
152:     public function delete() {
153:         extract($this->_dataVars());
154: 
155:         $identifier = $this->parseIdentifier($this->args[1]);
156:         $nodeId = $this->_getNodeId($class, $identifier);
157: 
158:         if (!$this->Acl->{$class}->delete($nodeId)) {
159:             $this->error(__d('cake_console', 'Node Not Deleted') . __d('cake_console', 'There was an error deleting the %s. Check that the node exists.', $class) . "\n");
160:         }
161:         $this->out(__d('cake_console', '<success>%s deleted.</success>', $class), 2);
162:     }
163: 
164: /**
165:  * Set parent for an ARO/ACO node.
166:  *
167:  * @return void
168:  */
169:     public function setParent() {
170:         extract($this->_dataVars());
171:         $target = $this->parseIdentifier($this->args[1]);
172:         $parent = $this->parseIdentifier($this->args[2]);
173: 
174:         $data = array(
175:             $class => array(
176:                 'id' => $this->_getNodeId($class, $target),
177:                 'parent_id' => $this->_getNodeId($class, $parent)
178:             )
179:         );
180:         $this->Acl->{$class}->create();
181:         if (!$this->Acl->{$class}->save($data)) {
182:             $this->out(__d('cake_console', 'Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.'));
183:         } else {
184:             $this->out(__d('cake_console', 'Node parent set to %s', $this->args[2]) . "\n");
185:         }
186:     }
187: 
188: /**
189:  * Get path to specified ARO/ACO node.
190:  *
191:  * @return void
192:  */
193:     public function getPath() {
194:         extract($this->_dataVars());
195:         $identifier = $this->parseIdentifier($this->args[1]);
196: 
197:         $id = $this->_getNodeId($class, $identifier);
198:         $nodes = $this->Acl->{$class}->getPath($id);
199: 
200:         if (empty($nodes)) {
201:             $this->error(
202:                 __d('cake_console', "Supplied Node '%s' not found", $this->args[1]),
203:                 __d('cake_console', 'No tree returned.')
204:             );
205:         }
206:         $this->out(__d('cake_console', 'Path:'));
207:         $this->hr();
208:         for ($i = 0, $len = count($nodes); $i < $len; $i++) {
209:             $this->_outputNode($class, $nodes[$i], $i);
210:         }
211:     }
212: 
213: /**
214:  * Outputs a single node, Either using the alias or Model.key
215:  *
216:  * @param string $class Class name that is being used.
217:  * @param array $node Array of node information.
218:  * @param integer $indent indent level.
219:  * @return void
220:  */
221:     protected function _outputNode($class, $node, $indent) {
222:         $indent = str_repeat('  ', $indent);
223:         $data = $node[$class];
224:         if ($data['alias']) {
225:             $this->out($indent . "[" . $data['id'] . "] " . $data['alias']);
226:         } else {
227:             $this->out($indent . "[" . $data['id'] . "] " . $data['model'] . '.' . $data['foreign_key']);
228:         }
229:     }
230: 
231: /**
232:  * Check permission for a given ARO to a given ACO.
233:  *
234:  * @return void
235:  */
236:     public function check() {
237:         extract($this->_getParams());
238: 
239:         if ($this->Acl->check($aro, $aco, $action)) {
240:             $this->out(__d('cake_console', '%s is <success>allowed</success>.', $aroName));
241:         } else {
242:             $this->out(__d('cake_console', '%s is <error>not allowed</error>.', $aroName));
243:         }
244:     }
245: 
246: /**
247:  * Grant permission for a given ARO to a given ACO.
248:  *
249:  * @return void
250:  */
251:     public function grant() {
252:         extract($this->_getParams());
253: 
254:         if ($this->Acl->allow($aro, $aco, $action)) {
255:             $this->out(__d('cake_console', 'Permission <success>granted</success>.'));
256:         } else {
257:             $this->out(__d('cake_console', 'Permission was <error>not granted</error>.'));
258:         }
259:     }
260: 
261: /**
262:  * Deny access for an ARO to an ACO.
263:  *
264:  * @return void
265:  */
266:     public function deny() {
267:         extract($this->_getParams());
268: 
269:         if ($this->Acl->deny($aro, $aco, $action)) {
270:             $this->out(__d('cake_console', 'Permission denied.'));
271:         } else {
272:             $this->out(__d('cake_console', 'Permission was not denied.'));
273:         }
274:     }
275: 
276: /**
277:  * Set an ARO to inherit permission to an ACO.
278:  *
279:  * @return void
280:  */
281:     public function inherit() {
282:         extract($this->_getParams());
283: 
284:         if ($this->Acl->inherit($aro, $aco, $action)) {
285:             $this->out(__d('cake_console', 'Permission inherited.'));
286:         } else {
287:             $this->out(__d('cake_console', 'Permission was not inherited.'));
288:         }
289:     }
290: 
291: /**
292:  * Show a specific ARO/ACO node.
293:  *
294:  * @return void
295:  */
296:     public function view() {
297:         extract($this->_dataVars());
298: 
299:         if (isset($this->args[1])) {
300:             $identity = $this->parseIdentifier($this->args[1]);
301: 
302:             $topNode = $this->Acl->{$class}->find('first', array(
303:                 'conditions' => array($class . '.id' => $this->_getNodeId($class, $identity))
304:             ));
305: 
306:             $nodes = $this->Acl->{$class}->find('all', array(
307:                 'conditions' => array(
308:                     $class . '.lft >=' => $topNode[$class]['lft'],
309:                     $class . '.lft <=' => $topNode[$class]['rght']
310:                 ),
311:                 'order' => $class . '.lft ASC'
312:             ));
313:         } else {
314:             $nodes = $this->Acl->{$class}->find('all', array('order' => $class . '.lft ASC'));
315:         }
316: 
317:         if (empty($nodes)) {
318:             if (isset($this->args[1])) {
319:                 $this->error(__d('cake_console', '%s not found', $this->args[1]), __d('cake_console', 'No tree returned.'));
320:             } elseif (isset($this->args[0])) {
321:                 $this->error(__d('cake_console', '%s not found', $this->args[0]), __d('cake_console', 'No tree returned.'));
322:             }
323:         }
324:         $this->out($class . ' tree:');
325:         $this->hr();
326: 
327:         $stack = array();
328:         $last = null;
329: 
330:         foreach ($nodes as $n) {
331:             $stack[] = $n;
332:             if (!empty($last)) {
333:                 $end = end($stack);
334:                 if ($end[$class]['rght'] > $last) {
335:                     foreach ($stack as $k => $v) {
336:                         $end = end($stack);
337:                         if ($v[$class]['rght'] < $end[$class]['rght']) {
338:                             unset($stack[$k]);
339:                         }
340:                     }
341:                 }
342:             }
343:             $last = $n[$class]['rght'];
344:             $count = count($stack);
345: 
346:             $this->_outputNode($class, $n, $count);
347:         }
348:         $this->hr();
349:     }
350: 
351: /**
352:  * Initialize ACL database.
353:  *
354:  * @return mixed
355:  */
356:     public function initdb() {
357:         return $this->dispatchShell('schema create DbAcl');
358:     }
359: 
360: /**
361:  * Get the option parser.
362:  *
363:  * @return void
364:  */
365:     public function getOptionParser() {
366:         $parser = parent::getOptionParser();
367: 
368:         $type = array(
369:             'choices' => array('aro', 'aco'),
370:             'required' => true,
371:             'help' => __d('cake_console', 'Type of node to create.')
372:         );
373: 
374:         $parser->description(
375:             __d('cake_console', 'A console tool for managing the DbAcl')
376:             )->addSubcommand('create', array(
377:                 'help' => __d('cake_console', 'Create a new ACL node'),
378:                 'parser' => array(
379:                     'description' => __d('cake_console', 'Creates a new ACL object <node> under the parent'),
380:                     'epilog' => __d('cake_console', 'You can use `root` as the parent when creating nodes to create top level nodes.'),
381:                     'arguments' => array(
382:                         'type' => $type,
383:                         'parent' => array(
384:                             'help' => __d('cake_console', 'The node selector for the parent.'),
385:                             'required' => true
386:                         ),
387:                         'alias' => array(
388:                             'help' => __d('cake_console', 'The alias to use for the newly created node.'),
389:                             'required' => true
390:                         )
391:                     )
392:                 )
393:             ))->addSubcommand('delete', array(
394:                 'help' => __d('cake_console', 'Deletes the ACL object with the given <node> reference'),
395:                 'parser' => array(
396:                     'description' => __d('cake_console', 'Delete an ACL node.'),
397:                     'arguments' => array(
398:                         'type' => $type,
399:                         'node' => array(
400:                             'help' => __d('cake_console', 'The node identifier to delete.'),
401:                             'required' => true,
402:                         )
403:                     )
404:                 )
405:             ))->addSubcommand('setparent', array(
406:                 'help' => __d('cake_console', 'Moves the ACL node under a new parent.'),
407:                 'parser' => array(
408:                     'description' => __d('cake_console', 'Moves the ACL object specified by <node> beneath <parent>'),
409:                     'arguments' => array(
410:                         'type' => $type,
411:                         'node' => array(
412:                             'help' => __d('cake_console', 'The node to move'),
413:                             'required' => true,
414:                         ),
415:                         'parent' => array(
416:                             'help' => __d('cake_console', 'The new parent for <node>.'),
417:                             'required' => true
418:                         )
419:                     )
420:                 )
421:             ))->addSubcommand('getpath', array(
422:                 'help' => __d('cake_console', 'Print out the path to an ACL node.'),
423:                 'parser' => array(
424:                     'description' => array(
425:                         __d('cake_console', "Returns the path to the ACL object specified by <node>."),
426:                         __d('cake_console', "This command is useful in determining the inheritance of permissions for a certain object in the tree.")
427:                     ),
428:                     'arguments' => array(
429:                         'type' => $type,
430:                         'node' => array(
431:                             'help' => __d('cake_console', 'The node to get the path of'),
432:                             'required' => true,
433:                         )
434:                     )
435:                 )
436:             ))->addSubcommand('check', array(
437:                 'help' => __d('cake_console', 'Check the permissions between an ACO and ARO.'),
438:                 'parser' => array(
439:                     'description' => array(
440:                         __d('cake_console', 'Use this command to check ACL permissions.')
441:                     ),
442:                     'arguments' => array(
443:                         'aro' => array('help' => __d('cake_console', 'ARO to check.'), 'required' => true),
444:                         'aco' => array('help' => __d('cake_console', 'ACO to check.'), 'required' => true),
445:                         'action' => array('help' => __d('cake_console', 'Action to check'), 'default' => 'all')
446:                     )
447:                 )
448:             ))->addSubcommand('grant', array(
449:                 'help' => __d('cake_console', 'Grant an ARO permissions to an ACO.'),
450:                 'parser' => array(
451:                     'description' => array(
452:                         __d('cake_console', 'Use this command to grant ACL permissions. Once executed, the ARO specified (and its children, if any) will have ALLOW access to the specified ACO action (and the ACO\'s children, if any).')
453:                     ),
454:                     'arguments' => array(
455:                         'aro' => array('help' => __d('cake_console', 'ARO to grant permission to.'), 'required' => true),
456:                         'aco' => array('help' => __d('cake_console', 'ACO to grant access to.'), 'required' => true),
457:                         'action' => array('help' => __d('cake_console', 'Action to grant'), 'default' => 'all')
458:                     )
459:                 )
460:             ))->addSubcommand('deny', array(
461:                 'help' => __d('cake_console', 'Deny an ARO permissions to an ACO.'),
462:                 'parser' => array(
463:                     'description' => array(
464:                         __d('cake_console', 'Use this command to deny ACL permissions. Once executed, the ARO specified (and its children, if any) will have DENY access to the specified ACO action (and the ACO\'s children, if any).')
465:                     ),
466:                     'arguments' => array(
467:                         'aro' => array('help' => __d('cake_console', 'ARO to deny.'), 'required' => true),
468:                         'aco' => array('help' => __d('cake_console', 'ACO to deny.'), 'required' => true),
469:                         'action' => array('help' => __d('cake_console', 'Action to deny'), 'default' => 'all')
470:                     )
471:                 )
472:             ))->addSubcommand('inherit', array(
473:                 'help' => __d('cake_console', 'Inherit an ARO\'s parent permissions.'),
474:                 'parser' => array(
475:                     'description' => array(
476:                         __d('cake_console', "Use this command to force a child ARO object to inherit its permissions settings from its parent.")
477:                     ),
478:                     'arguments' => array(
479:                         'aro' => array('help' => __d('cake_console', 'ARO to have permissions inherit.'), 'required' => true),
480:                         'aco' => array('help' => __d('cake_console', 'ACO to inherit permissions on.'), 'required' => true),
481:                         'action' => array('help' => __d('cake_console', 'Action to inherit'), 'default' => 'all')
482:                     )
483:                 )
484:             ))->addSubcommand('view', array(
485:                 'help' => __d('cake_console', 'View a tree or a single node\'s subtree.'),
486:                 'parser' => array(
487:                     'description' => array(
488:                         __d('cake_console', "The view command will return the ARO or ACO tree."),
489:                         __d('cake_console', "The optional node parameter allows you to return"),
490:                         __d('cake_console', "only a portion of the requested tree.")
491:                     ),
492:                     'arguments' => array(
493:                         'type' => $type,
494:                         'node' => array('help' => __d('cake_console', 'The optional node to view the subtree of.'))
495:                     )
496:                 )
497:             ))->addSubcommand('initdb', array(
498:                 'help' => __d('cake_console', 'Initialize the DbAcl tables. Uses this command : cake schema create DbAcl')
499:             ))->epilog(
500:                 array(
501:                     'Node and parent arguments can be in one of the following formats:',
502:                     '',
503:                     ' - <model>.<id> - The node will be bound to a specific record of the given model.',
504:                     '',
505:                     ' - <alias> - The node will be given a string alias (or path, in the case of <parent>)',
506:                     "   i.e. 'John'. When used with <parent>, this takes the form of an alias path,",
507:                     "   i.e. <group>/<subgroup>/<parent>.",
508:                     '',
509:                     "To add a node at the root level, enter 'root' or '/' as the <parent> parameter."
510:                 )
511:             );
512:         return $parser;
513:     }
514: 
515: /**
516:  * Checks that given node exists
517:  *
518:  * @return boolean Success
519:  */
520:     public function nodeExists() {
521:         if (!isset($this->args[0]) || !isset($this->args[1])) {
522:             return false;
523:         }
524:         $dataVars = $this->_dataVars($this->args[0]);
525:         extract($dataVars);
526:         $key = is_numeric($this->args[1]) ? $dataVars['secondary_id'] : 'alias';
527:         $conditions = array($class . '.' . $key => $this->args[1]);
528:         $possibility = $this->Acl->{$class}->find('all', compact('conditions'));
529:         if (empty($possibility)) {
530:             $this->error(__d('cake_console', '%s not found', $this->args[1]), __d('cake_console', 'No tree returned.'));
531:         }
532:         return $possibility;
533:     }
534: 
535: /**
536:  * Parse an identifier into Model.foreignKey or an alias.
537:  * Takes an identifier determines its type and returns the result as used by other methods.
538:  *
539:  * @param string $identifier Identifier to parse
540:  * @return mixed a string for aliases, and an array for model.foreignKey
541:  */
542:     public function parseIdentifier($identifier) {
543:         if (preg_match('/^([\w]+)\.(.*)$/', $identifier, $matches)) {
544:             return array(
545:                 'model' => $matches[1],
546:                 'foreign_key' => $matches[2],
547:             );
548:         }
549:         return $identifier;
550:     }
551: 
552: /**
553:  * Get the node for a given identifier. $identifier can either be a string alias
554:  * or an array of properties to use in AcoNode::node()
555:  *
556:  * @param string $class Class type you want (Aro/Aco)
557:  * @param string|array $identifier A mixed identifier for finding the node.
558:  * @return integer Integer of NodeId. Will trigger an error if nothing is found.
559:  */
560:     protected function _getNodeId($class, $identifier) {
561:         $node = $this->Acl->{$class}->node($identifier);
562:         if (empty($node)) {
563:             if (is_array($identifier)) {
564:                 $identifier = var_export($identifier, true);
565:             }
566:             $this->error(__d('cake_console', 'Could not find node using reference "%s"', $identifier));
567:             return;
568:         }
569:         return Hash::get($node, "0.{$class}.id");
570:     }
571: 
572: /**
573:  * get params for standard Acl methods
574:  *
575:  * @return array aro, aco, action
576:  */
577:     protected function _getParams() {
578:         $aro = is_numeric($this->args[0]) ? intval($this->args[0]) : $this->args[0];
579:         $aco = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
580:         $aroName = $aro;
581:         $acoName = $aco;
582: 
583:         if (is_string($aro)) {
584:             $aro = $this->parseIdentifier($aro);
585:         }
586:         if (is_string($aco)) {
587:             $aco = $this->parseIdentifier($aco);
588:         }
589:         $action = '*';
590:         if (isset($this->args[2]) && !in_array($this->args[2], array('', 'all'))) {
591:             $action = $this->args[2];
592:         }
593:         return compact('aro', 'aco', 'action', 'aroName', 'acoName');
594:     }
595: 
596: /**
597:  * Build data parameters based on node type
598:  *
599:  * @param string $type Node type  (ARO/ACO)
600:  * @return array Variables
601:  */
602:     protected function _dataVars($type = null) {
603:         if (!$type) {
604:             $type = $this->args[0];
605:         }
606:         $vars = array();
607:         $class = ucwords($type);
608:         $vars['secondary_id'] = (strtolower($class) === 'aro') ? 'foreign_key' : 'object_id';
609:         $vars['data_name'] = $type;
610:         $vars['table_name'] = $type . 's';
611:         $vars['class'] = $class;
612:         return $vars;
613:     }
614: 
615: }
616: