AccessCollections.php

Go to the documentation of this file.

<?php

namespace Elgg\Database;

use Elgg\Database\EntityTable\UserFetchFailureException;

class AccessCollections {
    private $site_guid;

    public function __construct($site_guid) {
        $this->site_guid = $site_guid;
    }

    function getAccessList($user_guid = 0, $site_guid = 0, $flush = false) {
        global $init_finished;
        $cache = _elgg_services()->accessCache;
        
        if ($flush) {
            $cache->clear();
        }
    
        if ($user_guid == 0) {
            $user_guid = _elgg_services()->session->getLoggedInUserGuid();
        }
    
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }
        $user_guid = (int) $user_guid;
        $site_guid = (int) $site_guid;
    
        $hash = $user_guid . $site_guid . 'get_access_list';
    
        if ($cache[$hash]) {
            return $cache[$hash];
        }
        
        $access_array = $this->getAccessArray($user_guid, $site_guid, $flush);
        $access = "(" . implode(",", $access_array) . ")";
    
        if ($init_finished) {
            $cache[$hash] = $access;
        }
        
        return $access;
    }
    
    function getAccessArray($user_guid = 0, $site_guid = 0, $flush = false) {
        global $init_finished;
    
        $cache = _elgg_services()->accessCache;
    
        if ($flush) {
            $cache->clear();
        }
    
        if ($user_guid == 0) {
            $user_guid = _elgg_services()->session->getLoggedInUserGuid();
        }
    
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }
    
        $user_guid = (int) $user_guid;
        $site_guid = (int) $site_guid;
    
        $hash = $user_guid . $site_guid . 'get_access_array';
    
        if ($cache[$hash]) {
            $access_array = $cache[$hash];
        } else {
            $access_array = array(ACCESS_PUBLIC);
    
            // The following can only return sensible data for a known user.
            if ($user_guid) {
                $db = _elgg_services()->db;
                $prefix = $db->getTablePrefix();

                $access_array[] = ACCESS_LOGGED_IN;
    
                // Get ACL memberships
                $query = "SELECT am.access_collection_id"
                    . " FROM {$prefix}access_collection_membership am"
                    . " LEFT JOIN {$prefix}access_collections ag ON ag.id = am.access_collection_id"
                    . " WHERE am.user_guid = $user_guid AND (ag.site_guid = $site_guid OR ag.site_guid = 0)";
    
                $collections = $db->getData($query);
                if ($collections) {
                    foreach ($collections as $collection) {
                        if (!empty($collection->access_collection_id)) {
                            $access_array[] = (int)$collection->access_collection_id;
                        }
                    }
                }
    
                // Get ACLs owned.
                $query = "SELECT ag.id FROM {$prefix}access_collections ag ";
                $query .= "WHERE ag.owner_guid = $user_guid AND (ag.site_guid = $site_guid OR ag.site_guid = 0)";
    
                $collections = $db->getData($query);
                if ($collections) {
                    foreach ($collections as $collection) {
                        if (!empty($collection->id)) {
                            $access_array[] = (int)$collection->id;
                        }
                    }
                }
    
                $ignore_access = elgg_check_access_overrides($user_guid);
    
                if ($ignore_access == true) {
                    $access_array[] = ACCESS_PRIVATE;
                }
            }
    
            if ($init_finished) {
                $cache[$hash] = $access_array;
            }
        }
    
        $options = array(
            'user_id' => $user_guid,
            'site_id' => $site_guid
        );
    
        // see the warning in the docs for this function about infinite loop potential
        return _elgg_services()->hooks->trigger('access:collections:read', 'user', $options, $access_array);
    }
    
    function getWhereSql(array $options = array()) {
        global $ENTITY_SHOW_HIDDEN_OVERRIDE;
    
        $defaults = array(
            'table_alias' => 'e',
            'user_guid' => _elgg_services()->session->getLoggedInUserGuid(),
            'use_enabled_clause' => !$ENTITY_SHOW_HIDDEN_OVERRIDE,
            'access_column' => 'access_id',
            'owner_guid_column' => 'owner_guid',
            'guid_column' => 'guid',
        );

        $options = array_merge($defaults, $options);

        // just in case someone passes a . at the end
        $options['table_alias'] = rtrim($options['table_alias'], '.');
    
        foreach (array('table_alias', 'access_column', 'owner_guid_column', 'guid_column') as $key) {
            $options[$key] = sanitize_string($options[$key]);
        }
        $options['user_guid'] = sanitize_int($options['user_guid'], false);
    
        // only add dot if we have an alias or table name
        $table_alias = $options['table_alias'] ? $options['table_alias'] . '.' : '';
    
        $options['ignore_access'] = elgg_check_access_overrides($options['user_guid']);
    
        $clauses = array(
            'ors' => array(),
            'ands' => array()
        );

        $prefix = _elgg_services()->db->getTablePrefix();
    
        if ($options['ignore_access']) {
            $clauses['ors']['ignore_access'] = '1 = 1';
        } else if ($options['user_guid']) {
            // include content of user's friends
            $clauses['ors']['friends_access'] = "$table_alias{$options['access_column']} = " . ACCESS_FRIENDS . "
                AND $table_alias{$options['owner_guid_column']} IN (
                    SELECT guid_one FROM {$prefix}entity_relationships
                    WHERE relationship = 'friend' AND guid_two = {$options['user_guid']}
                )";
    
            // include user's content
            $clauses['ors']['owner_access'] = "$table_alias{$options['owner_guid_column']} = {$options['user_guid']}";
        }
    
        // include standard accesses (public, logged in, access collections)
        if (!$options['ignore_access']) {
            $access_list = $this->getAccessList($options['user_guid']);
            $clauses['ors']['acl_access'] = "$table_alias{$options['access_column']} IN {$access_list}";
        }
    
        if ($options['use_enabled_clause']) {
            $clauses['ands']['use_enabled'] = "{$table_alias}enabled = 'yes'";
        }
    
        $clauses = _elgg_services()->hooks->trigger('get_sql', 'access', $options, $clauses);
    
        $clauses_str = '';
        if (is_array($clauses['ors']) && $clauses['ors']) {
            $clauses_str = '(' . implode(' OR ', $clauses['ors']) . ')';
        }
    
        if (is_array($clauses['ands']) && $clauses['ands']) {
            if ($clauses_str) {
                $clauses_str .= ' AND ';
            }
            $clauses_str .= '(' . implode(' AND ', $clauses['ands']) . ')';
        }
    
        return "($clauses_str)";
    }
    
    function hasAccessToEntity($entity, $user = null) {
        if (!$entity instanceof \ElggEntity) {
            return false;
        }

        // See #7159. Must not allow ignore access to affect query
        $ia = elgg_set_ignore_access(false);
    
        if (!isset($user)) {
            $access_bit = $this->getWhereSql();
        } else {
            $access_bit = $this->getWhereSql(array('user_guid' => $user->guid));
        }
    
        elgg_set_ignore_access($ia);

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        $query = "SELECT guid from {$prefix}entities e WHERE e.guid = {$entity->guid}";
        // Add access controls
        $query .= " AND " . $access_bit;
        if ($db->getData($query)) {
            return true;
        } else {
            return false;
        }
    }
    
    function getWriteAccessArray($user_guid = 0, $site_guid = 0, $flush = false, array $input_params = array()) {
        global $init_finished;
        $cache = _elgg_services()->accessCache;
    
        if ($flush) {
            $cache->clear();
        }
    
        if ($user_guid == 0) {
            $user_guid = _elgg_services()->session->getLoggedInUserGuid();
        }
    
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }
    
        $user_guid = (int) $user_guid;
        $site_guid = (int) $site_guid;
    
        $hash = $user_guid . $site_guid . 'get_write_access_array';
    
        if ($cache[$hash]) {
            $access_array = $cache[$hash];
        } else {
            // @todo is there such a thing as public write access?
            $access_array = array(
                ACCESS_PRIVATE => $this->getReadableAccessLevel(ACCESS_PRIVATE),
                ACCESS_FRIENDS => $this->getReadableAccessLevel(ACCESS_FRIENDS),
                ACCESS_LOGGED_IN => $this->getReadableAccessLevel(ACCESS_LOGGED_IN),
                ACCESS_PUBLIC => $this->getReadableAccessLevel(ACCESS_PUBLIC)
            );

            $collections = $this->getEntityCollections($user_guid, $site_guid);
            if ($collections) {
                foreach ($collections as $collection) {
                    $access_array[$collection->id] = $collection->name;
                }
            }
    
            if ($init_finished) {
                $cache[$hash] = $access_array;
            }
        }
    
        $options = array(
            'user_id' => $user_guid,
            'site_id' => $site_guid,
            'input_params' => $input_params,
        );
        return _elgg_services()->hooks->trigger('access:collections:write', 'user', $options, $access_array);
    }

    function canEdit($collection_id, $user_guid = null) {
        try {
            $user = _elgg_services()->entityTable->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }
    
        $collection = $this->get($collection_id);
    
        if (!$user || !$collection) {
            return false;
        }
    
        $write_access = $this->getWriteAccessArray($user->guid, 0, true);

        // don't ignore access when checking users.
        if ($user_guid) {
            return array_key_exists($collection_id, $write_access);
        } else {
            return elgg_get_ignore_access() || array_key_exists($collection_id, $write_access);
        }
    }
    
    function create($name, $owner_guid = 0, $site_guid = 0) {
        $name = trim($name);
        if (empty($name)) {
            return false;
        }
    
        if ($owner_guid == 0) {
            $owner_guid = _elgg_services()->session->getLoggedInUserGuid();
        }
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();

        $name = $db->sanitizeString($name);
    
        $q = "INSERT INTO {$prefix}access_collections
            SET name = '{$name}',
                owner_guid = {$owner_guid},
                site_guid = {$site_guid}";
        $id = $db->insertData($q);
        if (!$id) {
            return false;
        }
    
        $params = array(
            'collection_id' => $id
        );
    
        if (!_elgg_services()->hooks->trigger('access:collections:addcollection', 'collection', $params, true)) {
            return false;
        }
    
        return $id;
    }
    
    function update($collection_id, $members) {
        $acl = $this->get($collection_id);
    
        if (!$acl) {
            return false;
        }
        $members = (is_array($members)) ? $members : array();
    
        $cur_members = $this->getMembers($collection_id, true);
        $cur_members = (is_array($cur_members)) ? $cur_members : array();
    
        $remove_members = array_diff($cur_members, $members);
        $add_members = array_diff($members, $cur_members);
    
        $result = true;
    
        foreach ($add_members as $guid) {
            $result = $result && $this->addUser($guid, $collection_id);
        }
    
        foreach ($remove_members as $guid) {
            $result = $result && $this->removeUser($guid, $collection_id);
        }
    
        return $result;
    }
    
    function delete($collection_id) {
        $collection_id = (int) $collection_id;
        $params = array('collection_id' => $collection_id);
    
        if (!_elgg_services()->hooks->trigger('access:collections:deletecollection', 'collection', $params, true)) {
            return false;
        }

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        // Deleting membership doesn't affect result of deleting ACL.
        $q = "DELETE FROM {$prefix}access_collection_membership
            WHERE access_collection_id = {$collection_id}";
        $db->deleteData($q);
    
        $q = "DELETE FROM {$prefix}access_collections
            WHERE id = {$collection_id}";
        $result = $db->deleteData($q);
    
        return (bool)$result;
    }
    
    function get($collection_id) {
        
        $collection_id = (int) $collection_id;

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        $query = "SELECT * FROM {$prefix}access_collections WHERE id = {$collection_id}";
        $get_collection = $db->getDataRow($query);
    
        return $get_collection;
    }
    
    function addUser($user_guid, $collection_id) {
        $collection_id = (int) $collection_id;
        $user_guid = (int) $user_guid;
        $user = get_user($user_guid);
    
        $collection = $this->get($collection_id);
    
        if (!($user instanceof \ElggUser) || !$collection) {
            return false;
        }
    
        $params = array(
            'collection_id' => $collection_id,
            'user_guid' => $user_guid
        );
    
        $result = _elgg_services()->hooks->trigger('access:collections:add_user', 'collection', $params, true);
        if ($result == false) {
            return false;
        }

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        // if someone tries to insert the same data twice, we do a no-op on duplicate key
        $q = "INSERT INTO {$prefix}access_collection_membership
                SET access_collection_id = $collection_id, user_guid = $user_guid
                ON DUPLICATE KEY UPDATE user_guid = user_guid";
        $result = $db->insertData($q);
    
        return $result !== false;
    }
    
    function removeUser($user_guid, $collection_id) {
        $collection_id = (int) $collection_id;
        $user_guid = (int) $user_guid;
        $user = get_user($user_guid);
    
        $collection = $this->get($collection_id);
    
        if (!($user instanceof \ElggUser) || !$collection) {
            return false;
        }
    
        $params = array(
            'collection_id' => $collection_id,
            'user_guid' => $user_guid,
        );
    
        if (!_elgg_services()->hooks->trigger('access:collections:remove_user', 'collection', $params, true)) {
            return false;
        }

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        $q = "DELETE FROM {$prefix}access_collection_membership
            WHERE access_collection_id = {$collection_id}
                AND user_guid = {$user_guid}";
    
        return (bool)$db->deleteData($q);
    }
    
    function getEntityCollections($owner_guid, $site_guid = 0) {
        $owner_guid = (int) $owner_guid;
        $site_guid = (int) $site_guid;
    
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
    
        $query = "SELECT * FROM {$prefix}access_collections
                WHERE owner_guid = {$owner_guid}
                AND site_guid = {$site_guid}
                ORDER BY name ASC";
    
        $collections = $db->getData($query);
    
        return $collections;
    }
    
    function getMembers($collection_id, $guids_only = false) {
        $collection_id = (int) $collection_id;

        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();

        if (!$guids_only) {
            $query = "SELECT e.* FROM {$prefix}access_collection_membership m"
                . " JOIN {$prefix}entities e ON e.guid = m.user_guid"
                . " WHERE m.access_collection_id = {$collection_id}";
            $collection_members = $db->getData($query, "entity_row_to_elggstar");
        } else {
            $query = "SELECT e.guid FROM {$prefix}access_collection_membership m"
                . " JOIN {$prefix}entities e ON e.guid = m.user_guid"
                . " WHERE m.access_collection_id = {$collection_id}";
            $collection_members = $db->getData($query);
            if (!$collection_members) {
                return false;
            }
            foreach ($collection_members as $key => $val) {
                $collection_members[$key] = $val->guid;
            }
        }
    
        return $collection_members;
    }
    
    function getCollectionsByMember($member_guid, $site_guid = 0) {
        $member_guid = (int) $member_guid;
        $site_guid = (int) $site_guid;
        
        if (($site_guid == 0) && $this->site_guid) {
            $site_guid = $this->site_guid;
        }
        
        $db = _elgg_services()->db;
        $prefix = $db->getTablePrefix();
        
        $query = "SELECT ac.* FROM {$prefix}access_collections ac
                JOIN {$prefix}access_collection_membership m ON ac.id = m.access_collection_id
                WHERE m.user_guid = {$member_guid}
                AND ac.site_guid = {$site_guid}
                ORDER BY name ASC";
        
        $collections = $db->getData($query);
        
        return $collections;
    }
    
    function getReadableAccessLevel($entity_access_id) {
        $access = (int) $entity_access_id;

        $translator = _elgg_services()->translator;
    
        // Check if entity access id is a defined global constant
        $access_array = array(
            ACCESS_PRIVATE => $translator->translate("PRIVATE"),
            ACCESS_FRIENDS => $translator->translate("access:friends:label"),
            ACCESS_LOGGED_IN => $translator->translate("LOGGED_IN"),
            ACCESS_PUBLIC => $translator->translate("PUBLIC"),
        );
    
        if (array_key_exists($access, $access_array)) {
            return $access_array[$access];
        }
    
        $user_guid = _elgg_services()->session->getLoggedInUserGuid();
        if (!$user_guid) {
            // return 'Limited' if there is no logged in user
            return $translator->translate('access:limited:label');
        }
        
        // Entity access id is probably a custom access collection
        // Check if the user has write access to it and can see it's label
        // Admins should always be able to see the readable version 
        $collection = $this->get($access);
        
        if ($collection) {
            if (($collection->owner_guid == $user_guid) || _elgg_services()->session->isAdminLoggedIn()) {
                return $collection->name;
            }
        }
        
        // return 'Limited' if the user does not have access to the access collection
        return $translator->translate('access:limited:label');
    }
}