Commit 35f17acb authored by redmatrix's avatar redmatrix

Merge branch '1.10RC' of https://github.com/redmatrix/hubzilla into 1.10RC_merge

parents 58cf5f31 47e1c4e0
<?php
namespace Zotlabs\Access;
use \Zotlabs\Lib as ZLib;
class PermissionLimits {
static public function Std_Limits() {
$perms = Permissions::Perms();
$limits = array();
foreach($perms as $k => $v) {
if(strstr($k,'view'))
$limits[$k] = PERMS_PUBLIC;
else
$limits[$k] = PERMS_SPECIFIC;
}
return $limits;
}
static public function Set($channel_id,$perm,$perm_limit) {
ZLib\PConfig::Set($channel_id,'perm_limits',$perm,$perm_limit);
}
static public function Get($channel_id,$perm = '') {
if($perm) {
return Zlib\PConfig::Get($channel_id,'perm_limits',$perm);
}
else {
Zlib\PConfig::Load($channel_id);
if(array_key_exists($channel_id,\App::$config) && array_key_exists('perm_limits',\App::$config[$channel_id]))
return \App::$config[$channel_id]['perm_limits'];
return false;
}
}
}
\ No newline at end of file
<?php
namespace Zotlabs\Access;
use Zotlabs\Lib as Zlib;
class PermissionRoles {
static function role_perms($role) {
$ret = array();
$ret['role'] = $role;
switch($role) {
case 'social':
$ret['perms_auto'] = false;
$ret['default_collection'] = false;
$ret['directory_publish'] = true;
$ret['online'] = true;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'send_stream', 'post_wall', 'post_comments',
'post_mail', 'chat', 'post_like', 'republish' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'social_restricted':
$ret['perms_auto'] = false;
$ret['default_collection'] = true;
$ret['directory_publish'] = true;
$ret['online'] = true;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'send_stream', 'post_wall', 'post_comments',
'post_mail', 'chat', 'post_like' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'social_private':
$ret['perms_auto'] = false;
$ret['default_collection'] = true;
$ret['directory_publish'] = false;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'send_stream', 'post_wall', 'post_comments',
'post_mail', 'post_like' ];
$ret['limits'] = PermissionLimits::Std_Limits();
$ret['limits']['view_contacts'] = PERMS_SPECIFIC;
$ret['limits']['view_storage'] = PERMS_SPECIFIC;
break;
case 'forum':
$ret['perms_auto'] = true;
$ret['default_collection'] = false;
$ret['directory_publish'] = true;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'post_wall', 'post_comments', 'tag_deliver',
'post_mail', 'post_like' , 'republish', 'chat' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'forum_restricted':
$ret['perms_auto'] = false;
$ret['default_collection'] = true;
$ret['directory_publish'] = true;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'post_wall', 'post_comments', 'tag_deliver',
'post_mail', 'post_like' , 'chat' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'forum_private':
$ret['perms_auto'] = false;
$ret['default_collection'] = true;
$ret['directory_publish'] = false;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'post_wall', 'post_comments',
'post_mail', 'post_like' , 'chat' ];
$ret['limits'] = PermissionLimits::Std_Limits();
$ret['limits']['view_profile'] = PERMS_SPECIFIC;
$ret['limits']['view_contacts'] = PERMS_SPECIFIC;
$ret['limits']['view_storage'] = PERMS_SPECIFIC;
$ret['limits']['view_pages'] = PERMS_SPECIFIC;
break;
case 'feed':
$ret['perms_auto'] = true;
$ret['default_collection'] = false;
$ret['directory_publish'] = true;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'send_stream', 'post_wall', 'post_comments',
'post_mail', 'post_like' , 'republish' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'feed_restricted':
$ret['perms_auto'] = false;
$ret['default_collection'] = true;
$ret['directory_publish'] = false;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'send_stream', 'post_wall', 'post_comments',
'post_mail', 'post_like' , 'republish' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'soapbox':
$ret['perms_auto'] = true;
$ret['default_collection'] = false;
$ret['directory_publish'] = true;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'post_like' , 'republish' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
case 'repository':
$ret['perms_auto'] = true;
$ret['default_collection'] = false;
$ret['directory_publish'] = true;
$ret['online'] = false;
$ret['perms_connect'] = [
'view_stream', 'view_profile', 'view_contacts', 'view_storage',
'view_pages', 'write_storage', 'write_pages', 'post_wall', 'post_comments', 'tag_deliver',
'post_mail', 'post_like' , 'republish', 'chat' ];
$ret['limits'] = PermissionLimits::Std_Limits();
break;
default:
break;
}
$x = get_config('system','role_perms');
// let system settings over-ride any or all
if($x && is_array($x) && array_key_exists($role,$x))
$ret = array_merge($ret,$x[$role]);
call_hooks('get_role_perms',$ret);
return $ret;
}
static public function roles() {
$roles = [
t('Social Networking') => [
'social' => t('Social - Mostly Public'),
'social_restricted' => t('Social - Restricted'),
'social_private' => t('Social - Private')
],
t('Community Forum') => [
'forum' => t('Forum - Mostly Public'),
'forum_restricted' => t('Forum - Restricted'),
'forum_private' => t('Forum - Private')
],
t('Feed Republish') => [
'feed' => t('Feed - Mostly Public'),
'feed_restricted' => t('Feed - Restricted')
],
t('Special Purpose') => [
'soapbox' => t('Special - Celebrity/Soapbox'),
'repository' => t('Special - Group Repository')
],
t('Other') => [
'custom' => t('Custom/Expert Mode')
]
];
return $roles;
}
}
\ No newline at end of file
<?php
namespace Zotlabs\Access;
use Zotlabs\Lib as Zlib;
class Permissions {
/**
* Extensible permissions.
* To add new permissions, add to the list of $perms below, with a simple description.
* Also visit PermissionRoles.php and add to the $ret['perms_connect'] property for any role
* if this permission should be granted to new connections.
*
* Permissions with 'view' in the name are considered read permissions. Anything
* else requires authentication. Read permission limits are PERMS_PUBLIC and anything else
* is given PERMS_SPECIFIC.
*
* PermissionLimits::Std_limits() retrieves the standard limits. A permission role
* MAY alter an individual setting after retrieving the Std_limits if you require
* something different for a specific permission within the given role.
*
*/
static public function Perms($filter = '') {
$perms = [
'view_stream' => t('Can view my channel stream and posts'),
'send_stream' => t('Can send me their channel stream and posts'),
'view_profile' => t('Can view my default channel profile'),
'view_contacts' => t('Can view my connections'),
'view_storage' => t('Can view my file storage and photos'),
'write_storage' => t('Can upload/modify my file storage and photos'),
'view_pages' => t('Can view my channel webpages'),
'write_pages' => t('Can create/edit my channel webpages'),
'post_wall' => t('Can post on my channel (wall) page'),
'post_comments' => t('Can comment on or like my posts'),
'post_mail' => t('Can send me private mail messages'),
'post_like' => t('Can like/dislike profiles and profile things'),
'tag_deliver' => t('Can forward to all my channel connections via @+ mentions in posts'),
'chat' => t('Can chat with me'),
'republish' => t('Can source my public posts in derived channels'),
'delegate' => t('Can administer my channel')
];
$x = array('permissions' => $perms, 'filter' => $filter);
call_hooks('permissions_list',$x);
return($x['permissions']);
}
static public function BlockedAnonPerms() {
// Perms from the above list that are blocked from anonymous observers.
// e.g. you must be authenticated.
$res = array();
$perms = PermissionLimits::Std_limits();
foreach($perms as $perm => $limit) {
if($limit != PERMS_PUBLIC) {
$res[] = $perm;
}
}
$x = array('permissions' => $res);
call_hooks('write_perms',$x);
return($x['permissions']);
}
// converts [ 0 => 'view_stream', ... ]
// to [ 'view_stream' => 1 ]
// for any permissions in $arr;
// Undeclared permissions are set to 0
static public function FilledPerms($arr) {
$everything = self::Perms();
$ret = [];
foreach($everything as $k => $v) {
if(in_array($k,$arr))
$ret[$k] = 1;
else
$ret[$k] = 0;
}
return $ret;
}
static public function FilledAutoperms($channel_id) {
if(! intval(get_pconfig($channel_id,'system','autoperms')))
return false;
$arr = [];
$r = q("select * from pconfig where uid = %d and cat = 'autoperms'",
intval($channel_id)
);
if($r) {
foreach($r as $rr) {
$arr[$rr['k']] = $arr[$rr['v']];
}
}
return $arr;
}
static public function PermsCompare($p1,$p2) {
foreach($p1 as $k => $v) {
if(! array_key_exists($k,$p2))
return false;
if($p1[$k] != $p2[$k])
return false;
}
return true;
}
}
\ No newline at end of file
...@@ -102,7 +102,9 @@ class Onepoll { ...@@ -102,7 +102,9 @@ class Onepoll {
$fetch_feed = true; $fetch_feed = true;
$x = null; $x = null;
if(! ($contact['abook_their_perms'] & PERMS_R_STREAM )) $can_view_stream = intval(get_abconfig($importer_uid,$contact['abook_xchan'],'their_perms','view_stream'));
if(! $can_view_stream)
$fetch_feed = false; $fetch_feed = false;
if($fetch_feed) { if($fetch_feed) {
......
...@@ -7,7 +7,7 @@ class AbConfig { ...@@ -7,7 +7,7 @@ class AbConfig {
static public function Load($chan,$xhash,$family = '') { static public function Load($chan,$xhash,$family = '') {
if($family) if($family)
$where = sprintf(" and family = '%s' ",dbesc($family)); $where = sprintf(" and cat = '%s' ",dbesc($family));
$r = q("select * from abconfig where chan = %d and xchan = '%s' $where", $r = q("select * from abconfig where chan = %d and xchan = '%s' $where",
intval($chan), intval($chan),
dbesc($xhash) dbesc($xhash)
......
...@@ -8,6 +8,9 @@ namespace Zotlabs\Lib; ...@@ -8,6 +8,9 @@ namespace Zotlabs\Lib;
class Cache { class Cache {
public static function get($key) { public static function get($key) {
$key = substr($key,0,254);
$r = q("SELECT v FROM cache WHERE k = '%s' limit 1", $r = q("SELECT v FROM cache WHERE k = '%s' limit 1",
dbesc($key) dbesc($key)
); );
...@@ -19,6 +22,8 @@ class Cache { ...@@ -19,6 +22,8 @@ class Cache {
public static function set($key,$value) { public static function set($key,$value) {
$key = substr($key,0,254);
$r = q("SELECT * FROM cache WHERE k = '%s' limit 1", $r = q("SELECT * FROM cache WHERE k = '%s' limit 1",
dbesc($key) dbesc($key)
); );
......
...@@ -17,12 +17,20 @@ class PConfig { ...@@ -17,12 +17,20 @@ class PConfig {
*/ */
static public function Load($uid) { static public function Load($uid) {
if($uid === false) if(is_null($uid) || $uid === false)
return false; return false;
if(! array_key_exists($uid, \App::$config)) if(! array_key_exists($uid, \App::$config))
\App::$config[$uid] = array(); \App::$config[$uid] = array();
if(! is_array(\App::$config)) {
btlogger('App::$config not an array: ' . $uid);
}
if(! is_array(\App::$config[$uid])) {
btlogger('App::$config[$uid] not an array: ' . $uid);
}
$r = q("SELECT * FROM pconfig WHERE uid = %d", $r = q("SELECT * FROM pconfig WHERE uid = %d",
intval($uid) intval($uid)
); );
...@@ -61,7 +69,7 @@ class PConfig { ...@@ -61,7 +69,7 @@ class PConfig {
static public function Get($uid,$family,$key,$instore = false) { static public function Get($uid,$family,$key,$instore = false) {
if($uid === false) if(is_null($uid) || $uid === false)
return false; return false;
if(! array_key_exists($uid, \App::$config)) if(! array_key_exists($uid, \App::$config))
...@@ -102,7 +110,7 @@ class PConfig { ...@@ -102,7 +110,7 @@ class PConfig {
// we provide a function backtrace in the logs so that we can find // we provide a function backtrace in the logs so that we can find
// and fix the calling function. // and fix the calling function.
if($uid === false) { if(is_null($uid) || $uid === false) {
btlogger('UID is FALSE!', LOGGER_NORMAL, LOG_ERR); btlogger('UID is FALSE!', LOGGER_NORMAL, LOG_ERR);
return; return;
} }
...@@ -172,6 +180,9 @@ class PConfig { ...@@ -172,6 +180,9 @@ class PConfig {
static public function Delete($uid, $family, $key) { static public function Delete($uid, $family, $key) {
if(is_null($uid) || $uid === false)
return false;
$ret = false; $ret = false;
if(array_key_exists($key, \App::$config[$uid][$family])) if(array_key_exists($key, \App::$config[$uid][$family]))
......
...@@ -78,22 +78,13 @@ class PermissionDescription { ...@@ -78,22 +78,13 @@ class PermissionDescription {
$result = null; $result = null;
$global_perms = get_perms(); $global_perms = \Zotlabs\Access\Permissions::Perms();
if (array_key_exists($permname, $global_perms)) { if (array_key_exists($permname, $global_perms)) {
$permDetails = $global_perms[$permname]; $channelPerm = \Zotlabs\Access\PermissionLimits::Get(\App::$channel['channel_id'],$permname);
// It should be OK to always just read the permissions from App::$channel $result = new PermissionDescription('', $channelPerm);
//
// App::$profile is a union of channel and profile fields.
// The distinction is basically that App::$profile is pointing to the resource
// being observed. App::$channel is referring to the current logged-in channel
// member (if this is a local channel) e.g. the observer. We only show the ACL
// widget to the page owner (observer and observed are the same) so in that case
// I believe either may be safely used here.
$channelPerm = \App::$channel[$permDetails[0]];
$result = new PermissionDescription($permDetails[1], $channelPerm);
} else { } else {
// The acl dialog can handle null arguments, but it shouldn't happen // The acl dialog can handle null arguments, but it shouldn't happen
logger('null PermissionDescription from unknown global permission: ' . $permname ,LOGGER_DEBUG, LOG_ERROR); logger('null PermissionDescription from unknown global permission: ' . $permname ,LOGGER_DEBUG, LOG_ERROR);
......
...@@ -58,7 +58,23 @@ class Acl extends \Zotlabs\Web\Controller { ...@@ -58,7 +58,23 @@ class Acl extends \Zotlabs\Web\Controller {
if( (! local_channel()) && (! ($type == 'x' || $type == 'c'))) if( (! local_channel()) && (! ($type == 'x' || $type == 'c')))
killme(); killme();
$permitted = [];
if(in_array($type, [ 'm', 'a', 'c' ])) {
// These queries require permission checking. We'll create a simple array of xchan_hash for those with
// the requisite permissions which we can check against.
$x = q("select xchan from abconfig where chan = %d and cat = 'their_perms' and k = '%s' and v = 1",
intval(local_channel()),
dbesc(($type === 'm') ? 'post_mail' : 'tag_deliver')
);
$permitted = ids_to_array($x,'xchan');
}
if($search) { if($search) {
$sql_extra = " AND `name` LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " "; $sql_extra = " AND `name` LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " ";
$sql_extra2 = "AND ( xchan_name LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " OR xchan_addr LIKE " . protect_sprintf( "'%" . dbesc($search) . ((strpos($search,'@') === false) ? "%@%'" : "%'")) . ") "; $sql_extra2 = "AND ( xchan_name LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " OR xchan_addr LIKE " . protect_sprintf( "'%" . dbesc($search) . ((strpos($search,'@') === false) ? "%@%'" : "%'")) . ") ";
...@@ -87,13 +103,13 @@ class Acl extends \Zotlabs\Web\Controller { ...@@ -87,13 +103,13 @@ class Acl extends \Zotlabs\Web\Controller {
if($type == '' || $type == 'g') { if($type == '' || $type == 'g') {
$r = q("SELECT `groups`.`id`, `groups`.`hash`, `groups`.`gname` $r = q("SELECT groups.id, groups.hash, groups.gname
FROM `groups`,`group_member` FROM groups,group_member
WHERE `groups`.`deleted` = 0 AND `groups`.`uid` = %d WHERE groups.deleted = 0 AND groups.uid = %d
AND `group_member`.`gid`=`groups`.`id` AND group_member.gid=groups.id
$sql_extra $sql_extra
GROUP BY `groups`.`id` GROUP BY groups.id
ORDER BY `groups`.`gname` ORDER BY groups.gname
LIMIT %d OFFSET %d", LIMIT %d OFFSET %d",
intval(local_channel()), intval(local_channel()),
intval($count), intval($count),
...@@ -156,7 +172,7 @@ class Acl extends \Zotlabs\Web\Controller { ...@@ -156,7 +172,7 @@ class Acl extends \Zotlabs\Web\Controller {
} }
$r = q("SELECT abook_id as id, xchan_hash as hash, xchan_name as name, xchan_photo_s as micro, xchan_url as url, xchan_addr as nick, abook_their_perms, abook_flags, abook_self $r = q("SELECT abook_id as id, xchan_hash as hash, xchan_name as name, xchan_photo_s as micro, xchan_url as url, xchan_addr as nick, abook_their_perms, xchan_pubforum, abook_flags, abook_self
FROM abook left join xchan on abook_xchan = xchan_hash FROM abook left join xchan on abook_xchan = xchan_hash
WHERE (abook_channel = %d $extra_channels_sql) AND abook_blocked = 0 and abook_pending = 0 and xchan_deleted = 0 $sql_extra2 order by $order_extra2 xchan_name asc" , WHERE (abook_channel = %d $extra_channels_sql) AND abook_blocked = 0 and abook_pending = 0 and xchan_deleted = 0 $sql_extra2 order by $order_extra2 xchan_name asc" ,
intval(local_channel()) intval(local_channel())
...@@ -221,16 +237,24 @@ class Acl extends \Zotlabs\Web\Controller { ...@@ -221,16 +237,24 @@ class Acl extends \Zotlabs\Web\Controller {
} }
} }
elseif($type == 'm') { elseif($type == 'm') {
$r = q("SELECT xchan_hash as hash, xchan_name as name, xchan_addr as nick, xchan_photo_s as micro, xchan_url as url $r = array();
$z = q("SELECT xchan_hash as hash, xchan_name as name, xchan_addr as nick, xchan_photo_s as micro, xchan_url as url
FROM abook left join xchan on abook_xchan = xchan_hash FROM abook left join xchan on abook_xchan = xchan_hash
WHERE abook_channel = %d and ( (abook_their_perms = null) or (abook_their_perms & %d )>0) WHERE abook_channel = %d
and xchan_deleted = 0 and xchan_deleted = 0
$sql_extra3 $sql_extra3
ORDER BY `xchan_name` ASC ", ORDER BY xchan_name ASC ",
intval(local_channel()), intval(local_channel())
intval(PERMS_W_MAIL)
); );
if($z) {
foreach($z as $zz) {
if(in_array($zz['id'],$permitted)) {
$r[] = $zz;
}
}
}
} }
elseif($type == 'a') { elseif($type == 'a') {
...@@ -274,7 +298,7 @@ class Acl extends \Zotlabs\Web\Controller { ...@@ -274,7 +298,7 @@ class Acl extends \Zotlabs\Web\Controller {
if(strpos($g['hash'],'/') && $type != 'a') if(strpos($g['hash'],'/') && $type != 'a')
continue; continue;
if(($g['abook_their_perms'] & PERMS_W_TAGWALL) && $type == 'c' && (! $noforums)) { if(in_array($g['hash'],$permitted) && $type == 'c' && (! $noforums)) {
$contacts[] = array( $contacts[] = array(
"type" => "c", "type" => "c",
"photo" => "images/twopeople.png", "photo" => "images/twopeople.png",
......
<
...@@ -126,15 +126,30 @@ class Connedit extends \Zotlabs\Web\Controller { ...@@ -126,15 +126,30 @@ class Connedit extends \Zotlabs\Web\Controller {
$rating = 10; $rating = 10;
$rating_text = trim(escape_tags($_REQUEST['rating_text'])); $rating_text = trim(escape_tags($_REQUEST['rating_text']));
$abook_my_perms = 0; $all_perms = \Zotlabs\Access\Permissions::Perms();
foreach($_POST as $k => $v) { if($all_perms) {
if(strpos($k,'perms_') === 0) { foreach($all_perms as $perm => $desc) {
$abook_my_perms += $v; if(array_key_exists('perms_' . $perm, $_POST)) {
set_abconfig($channel['channel_id'],$orig_record[0]['abook_xchan'],'my_perms',$perm,
intval($_POST['perms_' . $perm]));
if($autoperms) {
set_pconfig($channel['channel_id'],'autoperms',$perm,intval($_POST['perms_' . $perm]));
}
}
else {
set_abconfig($channel['channel_id'],$orig_record[0]['abook_xchan'],'my_perms',$perm,0);
if($autoperms) {
set_pconfig($channel['channel_id'],'autoperms',$perm,0);
}
}
} }
} }
if(! is_null($autoperms))
set_pconfig($channel['channel_id'],'system','autoperms',$autoperms);
$new_friend = false; $new_friend = false;
if(! $is_self) { if(! $is_self) {
...@@ -194,19 +209,25 @@ class Connedit extends \Zotlabs\Web\Controller { ...@@ -194,19 +209,25 @@ class Connedit extends \Zotlabs\Web\Controller {
$role = get_pconfig(local_channel(),'system','permissions_role'); $role = get_pconfig(local_channel(),'system','permissions_role');
if($role) { if($role) {
$x = get_role_perms($role); $x = \Zotlabs\Access\PermissionRoles::role_perms($role);