access.php

Go to the documentation of this file.

<?php
function elgg_set_ignore_access($ignore = true) {
    $cache = _elgg_get_access_cache();
    $cache->clear();
    $elgg_access = elgg_get_access_object();
    return $elgg_access->setIgnoreAccess($ignore);
}

function elgg_get_ignore_access() {
    return elgg_get_access_object()->getIgnoreAccess();
}

function _elgg_get_access_cache() {
    static $access_cache;

    if (!$access_cache) {
        $access_cache = new ElggStaticVariableCache('access');
    }

    return $access_cache;
}

function get_access_list($user_guid = 0, $site_guid = 0, $flush = false) {
    global $CONFIG, $init_finished;
    $cache = _elgg_get_access_cache();

    if ($flush) {
        $cache->clear();
    }

    if ($user_guid == 0) {
        $user_guid = elgg_get_logged_in_user_guid();
    }

    if (($site_guid == 0) && (isset($CONFIG->site_id))) {
        $site_guid = $CONFIG->site_id;
    }
    $user_guid = (int) $user_guid;
    $site_guid = (int) $site_guid;

    $hash = $user_guid . $site_guid . 'get_access_list';

    if ($cache[$hash]) {
        return $cache[$hash];
    }

    $access_array = get_access_array($user_guid, $site_guid, $flush);
    $access = "(" . implode(",", $access_array) . ")";

    if ($init_finished) {
        $cache[$hash] = $access;
    }

    return $access;
}

function get_access_array($user_guid = 0, $site_guid = 0, $flush = false) {
    global $CONFIG, $init_finished;

    $cache = _elgg_get_access_cache();

    if ($flush) {
        $cache->clear();
    }

    if ($user_guid == 0) {
        $user_guid = elgg_get_logged_in_user_guid();
    }

    if (($site_guid == 0) && (isset($CONFIG->site_guid))) {
        $site_guid = $CONFIG->site_guid;
    }

    $user_guid = (int) $user_guid;
    $site_guid = (int) $site_guid;

    $hash = $user_guid . $site_guid . 'get_access_array';

    if ($cache[$hash]) {
        $access_array = $cache[$hash];
    } else {
        $access_array = array(ACCESS_PUBLIC);

        // The following can only return sensible data for a known user.
        if ($user_guid) {
            $access_array[] = ACCESS_LOGGED_IN;

            // Get ACL memberships
            $query = "SELECT am.access_collection_id"
                . " FROM {$CONFIG->dbprefix}access_collection_membership am"
                . " LEFT JOIN {$CONFIG->dbprefix}access_collections ag ON ag.id = am.access_collection_id"
                . " WHERE am.user_guid = $user_guid AND (ag.site_guid = $site_guid OR ag.site_guid = 0)";

            $collections = get_data($query);
            if ($collections) {
                foreach ($collections as $collection) {
                    if (!empty($collection->access_collection_id)) {
                        $access_array[] = (int)$collection->access_collection_id;
                    }
                }
            }

            // Get ACLs owned.
            $query = "SELECT ag.id FROM {$CONFIG->dbprefix}access_collections ag ";
            $query .= "WHERE ag.owner_guid = $user_guid AND (ag.site_guid = $site_guid OR ag.site_guid = 0)";

            $collections = get_data($query);
            if ($collections) {
                foreach ($collections as $collection) {
                    if (!empty($collection->id)) {
                        $access_array[] = (int)$collection->id;
                    }
                }
            }

            $ignore_access = elgg_check_access_overrides($user_guid);

            if ($ignore_access == true) {
                $access_array[] = ACCESS_PRIVATE;
            }
        }

        if ($init_finished) {
            $cache[$hash] = $access_array;
        }
    }

    $options = array(
        'user_id' => $user_guid,
        'site_id' => $site_guid
    );

    // see the warning in the docs for this function about infinite loop potential
    return elgg_trigger_plugin_hook('access:collections:read', 'user', $options, $access_array);
}

function get_default_access(ElggUser $user = null) {
    global $CONFIG;

    // site default access
    $default_access = $CONFIG->default_access;

    // user default access if enabled
    if ($CONFIG->allow_user_default_access) {
        $user = $user ? $user : elgg_get_logged_in_user_entity();
        if ($user) {
            $user_access = $user->getPrivateSetting('elgg_default_access');
            if ($user_access !== null) {
                $default_access = $user_access;
            }
        }
    }

    $params = array(
        'user' => $user,
        'default_access' => $default_access,
    );
    return elgg_trigger_plugin_hook('default', 'access', $params, $default_access);
}

$ENTITY_SHOW_HIDDEN_OVERRIDE = false;

function access_show_hidden_entities($show_hidden) {
    global $ENTITY_SHOW_HIDDEN_OVERRIDE;
    $current_value = $ENTITY_SHOW_HIDDEN_OVERRIDE;
    $ENTITY_SHOW_HIDDEN_OVERRIDE = $show_hidden;
    return $current_value;
}

function access_get_show_hidden_status() {
    global $ENTITY_SHOW_HIDDEN_OVERRIDE;
    return $ENTITY_SHOW_HIDDEN_OVERRIDE;
}

function _elgg_get_access_where_sql(array $options = array()) {
    global $ENTITY_SHOW_HIDDEN_OVERRIDE, $CONFIG;

    $defaults = array(
        'table_alias' => 'e',
        'user_guid' => elgg_get_logged_in_user_guid(),
        'use_enabled_clause' => !$ENTITY_SHOW_HIDDEN_OVERRIDE,
        'access_column' => 'access_id',
        'owner_guid_column' => 'owner_guid',
        'guid_column' => 'guid',
    );

    $options = array_merge($defaults, $options);

    // just in case someone passes a . at the end
    $options['table_alias'] = rtrim($options['table_alias'], '.');

    foreach (array('table_alias', 'access_column', 'owner_guid_column', 'guid_column') as $key) {
        $options[$key] = sanitize_string($options[$key]);
    }
    $options['user_guid'] = sanitize_int($options['user_guid'], false);

    // only add dot if we have an alias or table name
    $table_alias = $options['table_alias'] ? $options['table_alias'] . '.' : '';

    $options['ignore_access'] = elgg_check_access_overrides($options['user_guid']);

    $clauses = array(
        'ors' => array(),
        'ands' => array()
    );

    if ($options['ignore_access']) {
        $clauses['ors'][] = '1 = 1';
    } else if ($options['user_guid']) {
        // include content of user's friends
        $clauses['ors'][] = "$table_alias{$options['access_column']} = " . ACCESS_FRIENDS . "
            AND $table_alias{$options['owner_guid_column']} IN (
                SELECT guid_one FROM {$CONFIG->dbprefix}entity_relationships
                WHERE relationship = 'friend' AND guid_two = {$options['user_guid']}
            )";

        // include user's content
        $clauses['ors'][] = "$table_alias{$options['owner_guid_column']} = {$options['user_guid']}";
    }

    // include standard accesses (public, logged in, access collections)
    if (!$options['ignore_access']) {
        $access_list = get_access_list($options['user_guid']);
        $clauses['ors'][] = "$table_alias{$options['access_column']} IN {$access_list}";
    }

    if ($options['use_enabled_clause']) {
        $clauses['ands'][] = "{$table_alias}enabled = 'yes'";
    }

    $clauses = elgg_trigger_plugin_hook('get_sql', 'access', $options, $clauses);

    $clauses_str = '';
    if (is_array($clauses['ors']) && $clauses['ors']) {
        $clauses_str = '(' . implode(' OR ', $clauses['ors']) . ')';
    }

    if (is_array($clauses['ands']) && $clauses['ands']) {
        if ($clauses_str) {
            $clauses_str .= ' AND ';
        }
        $clauses_str .= '(' . implode(' AND ', $clauses['ands']) . ')';
    }

    return "($clauses_str)";
}

function has_access_to_entity($entity, $user = null) {
    global $CONFIG;

    // See #7159. Must not allow ignore access to affect query
    $ia = elgg_set_ignore_access(false);

    if (!isset($user)) {
        $access_bit = _elgg_get_access_where_sql();
    } else {
        $access_bit = _elgg_get_access_where_sql(array('user_guid' => $user->getGUID()));
    }

    elgg_set_ignore_access($ia);

    $query = "SELECT guid from {$CONFIG->dbprefix}entities e WHERE e.guid = " . $entity->getGUID();
    // Add access controls
    $query .= " AND " . $access_bit;
    if (get_data($query)) {
        return true;
    } else {
        return false;
    }
}

function get_write_access_array($user_guid = 0, $site_guid = 0, $flush = false) {
    global $CONFIG, $init_finished;
    $cache = _elgg_get_access_cache();

    if ($flush) {
        $cache->clear();
    }

    if ($user_guid == 0) {
        $user_guid = elgg_get_logged_in_user_guid();
    }

    if (($site_guid == 0) && (isset($CONFIG->site_id))) {
        $site_guid = $CONFIG->site_id;
    }

    $user_guid = (int) $user_guid;
    $site_guid = (int) $site_guid;

    $hash = $user_guid . $site_guid . 'get_write_access_array';

    if ($cache[$hash]) {
        $access_array = $cache[$hash];
    } else {
        // @todo is there such a thing as public write access?
        $access_array = array(
            ACCESS_PRIVATE => elgg_echo("PRIVATE"),
            ACCESS_FRIENDS => elgg_echo("access:friends:label"),
            ACCESS_LOGGED_IN => elgg_echo("LOGGED_IN"),
            ACCESS_PUBLIC => elgg_echo("PUBLIC")
        );

        $query = "SELECT ag.* FROM {$CONFIG->dbprefix}access_collections ag ";
        $query .= " WHERE (ag.site_guid = $site_guid OR ag.site_guid = 0)";
        $query .= " AND (ag.owner_guid = $user_guid)";

        $collections = get_data($query);
        if ($collections) {
            foreach ($collections as $collection) {
                $access_array[$collection->id] = $collection->name;
            }
        }

        if ($init_finished) {
            $cache[$hash] = $access_array;
        }
    }

    $options = array(
        'user_id' => $user_guid,
        'site_id' => $site_guid
    );
    return elgg_trigger_plugin_hook('access:collections:write', 'user',
        $options, $access_array);
}

function can_edit_access_collection($collection_id, $user_guid = null) {
    if ($user_guid) {
        $user = get_entity((int) $user_guid);
    } else {
        $user = elgg_get_logged_in_user_entity();
    }

    $collection = get_access_collection($collection_id);

    if (!($user instanceof ElggUser) || !$collection) {
        return false;
    }

    $write_access = get_write_access_array($user->getGUID(), 0, true);

    // don't ignore access when checking users.
    if ($user_guid) {
        return array_key_exists($collection_id, $write_access);
    } else {
        return elgg_get_ignore_access() || array_key_exists($collection_id, $write_access);
    }
}

function create_access_collection($name, $owner_guid = 0, $site_guid = 0) {
    global $CONFIG;

    $name = trim($name);
    if (empty($name)) {
        return false;
    }

    if ($owner_guid == 0) {
        $owner_guid = elgg_get_logged_in_user_guid();
    }
    if (($site_guid == 0) && (isset($CONFIG->site_guid))) {
        $site_guid = $CONFIG->site_guid;
    }
    $name = sanitise_string($name);

    $q = "INSERT INTO {$CONFIG->dbprefix}access_collections
        SET name = '{$name}',
            owner_guid = {$owner_guid},
            site_guid = {$site_guid}";
    $id = insert_data($q);
    if (!$id) {
        return false;
    }

    $params = array(
        'collection_id' => $id
    );

    if (!elgg_trigger_plugin_hook('access:collections:addcollection', 'collection', $params, true)) {
        return false;
    }

    return $id;
}

function update_access_collection($collection_id, $members) {
    $acl = get_access_collection($collection_id);

    if (!$acl) {
        return false;
    }
    $members = (is_array($members)) ? $members : array();

    $cur_members = get_members_of_access_collection($collection_id, true);
    $cur_members = (is_array($cur_members)) ? $cur_members : array();

    $remove_members = array_diff($cur_members, $members);
    $add_members = array_diff($members, $cur_members);

    $result = true;

    foreach ($add_members as $guid) {
        $result = $result && add_user_to_access_collection($guid, $collection_id);
    }

    foreach ($remove_members as $guid) {
        $result = $result && remove_user_from_access_collection($guid, $collection_id);
    }

    return $result;
}

function delete_access_collection($collection_id) {
    global $CONFIG;

    $collection_id = (int) $collection_id;
    $params = array('collection_id' => $collection_id);

    if (!elgg_trigger_plugin_hook('access:collections:deletecollection', 'collection', $params, true)) {
        return false;
    }

    // Deleting membership doesn't affect result of deleting ACL.
    $q = "DELETE FROM {$CONFIG->dbprefix}access_collection_membership
        WHERE access_collection_id = {$collection_id}";
    delete_data($q);

    $q = "DELETE FROM {$CONFIG->dbprefix}access_collections
        WHERE id = {$collection_id}";
    $result = delete_data($q);

    return (bool)$result;
}

function get_access_collection($collection_id) {
    global $CONFIG;
    $collection_id = (int) $collection_id;

    $query = "SELECT * FROM {$CONFIG->dbprefix}access_collections WHERE id = {$collection_id}";
    $get_collection = get_data_row($query);

    return $get_collection;
}

function add_user_to_access_collection($user_guid, $collection_id) {
    global $CONFIG;

    $collection_id = (int) $collection_id;
    $user_guid = (int) $user_guid;
    $user = get_user($user_guid);

    $collection = get_access_collection($collection_id);

    if (!($user instanceof Elgguser) || !$collection) {
        return false;
    }

    $params = array(
        'collection_id' => $collection_id,
        'user_guid' => $user_guid
    );

    $result = elgg_trigger_plugin_hook('access:collections:add_user', 'collection', $params, true);
    if ($result == false) {
        return false;
    }

    // if someone tries to insert the same data twice, we do a no-op on duplicate key
    $q = "INSERT INTO {$CONFIG->dbprefix}access_collection_membership
            SET access_collection_id = $collection_id, user_guid = $user_guid
            ON DUPLICATE KEY UPDATE user_guid = user_guid";
    $result = insert_data($q);

    return $result !== false;
}

function remove_user_from_access_collection($user_guid, $collection_id) {
    global $CONFIG;

    $collection_id = (int) $collection_id;
    $user_guid = (int) $user_guid;
    $user = get_user($user_guid);

    $collection = get_access_collection($collection_id);

    if (!($user instanceof Elgguser) || !$collection) {
        return false;
    }

    $params = array(
        'collection_id' => $collection_id,
        'user_guid' => $user_guid
    );

    if (!elgg_trigger_plugin_hook('access:collections:remove_user', 'collection', $params, true)) {
        return false;
    }

    $q = "DELETE FROM {$CONFIG->dbprefix}access_collection_membership
        WHERE access_collection_id = {$collection_id}
            AND user_guid = {$user_guid}";

    return (bool)delete_data($q);
}

function get_user_access_collections($owner_guid, $site_guid = 0) {
    global $CONFIG;
    $owner_guid = (int) $owner_guid;
    $site_guid = (int) $site_guid;

    if (($site_guid == 0) && (isset($CONFIG->site_guid))) {
        $site_guid = $CONFIG->site_guid;
    }

    $query = "SELECT * FROM {$CONFIG->dbprefix}access_collections
            WHERE owner_guid = {$owner_guid}
            AND site_guid = {$site_guid}
            ORDER BY name ASC";

    $collections = get_data($query);

    return $collections;
}

function get_members_of_access_collection($collection, $idonly = false) {
    global $CONFIG;
    $collection = (int)$collection;

    if (!$idonly) {
        $query = "SELECT e.* FROM {$CONFIG->dbprefix}access_collection_membership m"
            . " JOIN {$CONFIG->dbprefix}entities e ON e.guid = m.user_guid"
            . " WHERE m.access_collection_id = {$collection}";
        $collection_members = get_data($query, "entity_row_to_elggstar");
    } else {
        $query = "SELECT e.guid FROM {$CONFIG->dbprefix}access_collection_membership m"
            . " JOIN {$CONFIG->dbprefix}entities e ON e.guid = m.user_guid"
            . " WHERE m.access_collection_id = {$collection}";
        $collection_members = get_data($query);
        if (!$collection_members) {
            return false;
        }
        foreach ($collection_members as $key => $val) {
            $collection_members[$key] = $val->guid;
        }
    }

    return $collection_members;
}

function elgg_get_entities_from_access_id(array $options = array()) {
    // restrict the resultset to access collection provided
    if (!isset($options['access_id'])) {
        return false;
    }

    // @todo add support for an array of collection_ids
    $where = "e.access_id = '{$options['access_id']}'";
    if (isset($options['wheres'])) {
        if (is_array($options['wheres'])) {
            $options['wheres'][] = $where;
        } else {
            $options['wheres'] = array($options['wheres'], $where);
        }
    } else {
        $options['wheres'] = array($where);
    }

    // return entities with the desired options
    return elgg_get_entities($options);
}

function elgg_list_entities_from_access_id(array $options = array()) {
    return elgg_list_entities($options, 'elgg_get_entities_from_access_id');
}

function get_readable_access_level($entity_access_id) {
    $access = (int) $entity_access_id;

    // Check if entity access id is a defined global constant
    $access_array = array(
        ACCESS_PRIVATE => elgg_echo("PRIVATE"),
        ACCESS_FRIENDS => elgg_echo("access:friends:label"),
        ACCESS_LOGGED_IN => elgg_echo("LOGGED_IN"),
        ACCESS_PUBLIC => elgg_echo("PUBLIC")
    );

    if (array_key_exists($access, $access_array)) {
        return $access_array[$access];
    }

    // Entity access id is a custom access collection
    // Check if the user has write access to it and can see it's label
    $write_access_array = get_write_access_array();

    if (array_key_exists($access, $write_access_array)) {
        return $write_access_array[$access];
    }

    // return 'Limited' if the user does not have access to the access collection
    return elgg_echo('access:limited:label');
}

function elgg_check_access_overrides($user_guid = 0) {
    if (!$user_guid || $user_guid <= 0) {
        $is_admin = false;
    } else {
        $is_admin = elgg_is_admin_user($user_guid);
    }

    return ($is_admin || elgg_get_ignore_access());
}

function elgg_get_access_object() {
    static $elgg_access;

    if (!$elgg_access) {
        $elgg_access = new Elgg_Access();
    }

    return $elgg_access;
}

$init_finished = false;

function access_init() {
    global $init_finished;
    $init_finished = true;
}

function elgg_override_permissions($hook, $type, $value, $params) {
    $user = elgg_extract('user', $params);
    if ($user) {
        $user_guid = $user->getGUID();
    } else {
        $user_guid = elgg_get_logged_in_user_guid();
    }

    // don't do this so ignore access still works with no one logged in
    //if (!$user instanceof ElggUser) {
    //  return false;
    //}

    // check for admin
    if ($user_guid && elgg_is_admin_user($user_guid)) {
        return true;
    }

    // check access overrides
    if ((elgg_check_access_overrides($user_guid))) {
        return true;
    }

    // consult other hooks
    return null;
}

function access_test($hook, $type, $value, $params) {
    global $CONFIG;
    $value[] = $CONFIG->path . 'engine/tests/ElggCoreAccessCollectionsTest.php';
    $value[] = $CONFIG->path . 'engine/tests/ElggCoreAccessSQLTest.php';
    return $value;
}

// Tell the access functions the system has booted, plugins are loaded,
// and the user is logged in so it can start caching
elgg_register_event_handler('ready', 'system', 'access_init');

// For overrided permissions
elgg_register_plugin_hook_handler('permissions_check', 'all', 'elgg_override_permissions');
elgg_register_plugin_hook_handler('container_permissions_check', 'all', 'elgg_override_permissions');

elgg_register_plugin_hook_handler('unit_test', 'system', 'access_test');