Stuff

<?php/**  * Access Control List class *   * The default Habari ACL class implements groups, and group permissions * Users are assigned to one or more groups. * Groups are assigned one or more permissions. * Membership in any group that grants a permission * means you have that permission.  Membership in any group that denies * that permission denies the user that permission, even if another group * grants that permission. *      * @package Habari **/ class ACL {        /**	 * How to handle a permission request for a permission that is not in the permission list.	 * For example, if you request $user->can('some non-existant permission') then this value is returned.	 * It's true at the moment because that allows access to all features for upgrading users.	 * @todo Decide if this is a setting we need or want to change, or perhaps it should be an option.	 **/	 	 	 	 		const ACCESS_NONEXISTANT_PERMISSION = true;	/**	 * Determine whether the specified user is a member of the specified group	 * @param mixed A user  ID or name	 * @param mixed A group ID or name	 * @return bool True if the user is in the group, otherwise false	**/	public static function user_in_group( $user_id, $group_id )	{		if ( ! is_int( $user_id ) ) {			$user= User::get( $user_id );			$user_id= $user->id;		}		if ( ! is_int( $group_id ) ) {			$group_id= UserGroup::id( $group_id );		}		$group= DB::get_value( 'SELECT id FROM {users_groups} WHERE user_id=? AND group_id=?', array( $user_id, $group_id ) );		if ( $group ) {			return true;		}		return false;	}	/**	 * Determine whether a group can perform a specific action	 * @param mixed A group ID or name	 * @param mixed An action ID or name	 * @return bool Whether the group can perform the action	**/	public static function group_can( $group, $permission )	{		if ( ! is_int( $ group ) ) {			$group= UserGroup::id( $group );		}		if ( ! is_int( $permission ) ) {			$permission= Permission::id( $permission );		}		$permission= DB::get_value( 'SELECT denied FROM {groups_permissions} WHERE permission_id=? AND group_id=?', array( $permission, $group ) );		if ( 0 === $permission ) {			// the permission has been granted to this group			return true;		}		// either the permission hasn't been granted, or it's been		// explicitly denied.		return false;	}		/**	 * Determine whether a user can perform a specific action	 * @param mixed A user object, user ID or a username	 * @param mixed A permission ID or name	 * @return bool Whether the user can perform the action	**/	public static function user_can( $user, $action )	{		if ( ! is_int( $action ) ) {			$action= Permission::id( $action );		}		if ( ! $user instanceof User ) {			$user= User::get( $user );		}		$groups= implode( ',', $user->groups );				// we select the "denied" value from all the permissions 		// assigned to all the groups to which this user is a member.		// array_unique() should consolidate this down to, at most,		// two values: 0 and 1.		$permissions= array_unique( DB::get_column( "SELECT denied FROM {groups_permissions} WHERE group_id IN ($groups)" ) );		// if any group is explicitly denied access to this permission,		// this user is denied access to that permission		if ( in_array( 1, $permissions ) ) {			return false;		}		// if the permission is not explicitly denied, make sure it's		// explicitly granted.  If it is, the user can do this.		if ( in_array( 0, $permissions, true ) ) {			return true;		}		// if the permission is neither denied nor granted, they're not		// allowed to do it.		return false;	}}?>