|
1 | | -<?php |
2 | | - |
3 | | -# Copyright (c) 2018 Grigoriy Ermolaev (igflocal@gmail.com) |
4 | | -# Calendar for MantisBT is free software: |
5 | | -# you can redistribute it and/or modify it under the terms of the GNU |
6 | | -# General Public License as published by the Free Software Foundation, |
7 | | -# either version 2 of the License, or (at your option) any later version. |
8 | | -# |
9 | | -# Calendar plugin for for MantisBT is distributed in the hope |
10 | | -# that it will be useful, but WITHOUT ANY WARRANTY; without even the |
11 | | -# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
12 | | -# See the GNU General Public License for more details. |
13 | | -# |
14 | | -# You should have received a copy of the GNU General Public License |
15 | | -# along with Customer management plugin for MantisBT. |
16 | | -# If not, see <http://www.gnu.org/licenses/>. |
17 | | - |
18 | | -/** |
19 | | - * Check if the user has the specified access level for the given bug |
20 | | - * and deny access to the page if not |
21 | | - * @see access_has_bug_level |
22 | | - * @param integer $p_access_level Integer representing access level. |
23 | | - * @param integer $p_event_id Integer representing bug id to check access against. |
24 | | - * @param integer|null $p_user_id Integer representing user id, defaults to null to use current user. |
25 | | - * @return void |
26 | | - * @access public |
27 | | - */ |
28 | | -function access_ensure_event_level( $p_access_level, $p_event_id, $p_user_id = null ) { |
29 | | - if( !access_has_event_level( $p_access_level, $p_event_id, $p_user_id ) ) { |
30 | | - access_denied(); |
31 | | - } |
32 | | -} |
33 | | - |
34 | | -/** |
35 | | - * Check the current user's access against the given value and return true |
36 | | - * if the user's access is equal to or higher, false otherwise. |
37 | | - * This function looks up the bug's project and performs an access check |
38 | | - * against that project |
39 | | - * @param integer $p_access_level Integer representing access level. |
40 | | - * @param integer $p_event_id Integer representing bug id to check access against. |
41 | | - * @param integer|null $p_user_id Integer representing user id, defaults to null to use current user. |
42 | | - * @return boolean whether user has access level specified |
43 | | - * @access public |
44 | | - */ |
45 | | -function access_has_event_level( $p_access_level, $p_event_id, $p_user_id = null ) { |
46 | | - if( $p_user_id === null ) { |
47 | | - $p_user_id = auth_get_current_user_id(); |
48 | | - } |
49 | | - |
50 | | - # Deal with not logged in silently in this case |
51 | | - # @@@ we may be able to remove this and just error |
52 | | - # and once we default to anon login, we can remove it for sure |
53 | | - if( empty( $p_user_id ) && !auth_is_user_authenticated() ) { |
54 | | - return false; |
55 | | - } |
56 | | - |
57 | | - $t_project_id = event_get_field( $p_event_id, 'project_id' ); |
58 | | - $t_event_is_user_reporter = event_is_user_reporter( $p_event_id, $p_user_id ); |
59 | | - $t_access_level = access_get_project_level( $t_project_id, $p_user_id ); |
60 | | - |
61 | | - # check limit_Reporter (Issue #4769) |
62 | | - # reporters can view just issues they reported |
63 | | - $t_limit_reporters = config_get( 'limit_reporters', null, $p_user_id, $t_project_id ); |
64 | | - if( $t_limit_reporters && !$t_event_is_user_reporter ) { |
65 | | - # Here we only need to check that the current user has an access level |
66 | | - # higher than the lowest needed to report issues (report_bug_threshold). |
67 | | - # To improve performance, esp. when processing for several projects, we |
68 | | - # build a static array holding that threshold for each project |
69 | | - static $s_thresholds = array(); |
70 | | - if( !isset( $s_thresholds[$t_project_id] ) ) { |
71 | | - $t_report_event_threshold = plugin_config_get( 'report_event_threshold', null, $p_user_id, $t_project_id ); |
72 | | - if( empty( $t_report_event_threshold ) ) { |
73 | | - $s_thresholds[$t_project_id] = NOBODY; |
74 | | - } else { |
75 | | - $s_thresholds[$t_project_id] = access_threshold_min_level( $t_report_event_threshold ) + 1; |
76 | | - } |
77 | | - } |
78 | | - if( !access_compare_level( $t_access_level, $s_thresholds[$t_project_id] ) ) { |
79 | | - return false; |
80 | | - } |
81 | | - } |
82 | | - |
83 | | - return access_compare_level( $t_access_level, $p_access_level ); |
84 | | -} |
| 1 | +<?php |
| 2 | + |
| 3 | +# Copyright (c) 2018 Grigoriy Ermolaev (igflocal@gmail.com) |
| 4 | +# Calendar for MantisBT is free software: |
| 5 | +# you can redistribute it and/or modify it under the terms of the GNU |
| 6 | +# General Public License as published by the Free Software Foundation, |
| 7 | +# either version 2 of the License, or (at your option) any later version. |
| 8 | +# |
| 9 | +# Calendar plugin for for MantisBT is distributed in the hope |
| 10 | +# that it will be useful, but WITHOUT ANY WARRANTY; without even the |
| 11 | +# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
| 12 | +# See the GNU General Public License for more details. |
| 13 | +# |
| 14 | +# You should have received a copy of the GNU General Public License |
| 15 | +# along with Customer management plugin for MantisBT. |
| 16 | +# If not, see <http://www.gnu.org/licenses/>. |
| 17 | + |
| 18 | +/** |
| 19 | + * Check if the user has the specified access level for the given bug |
| 20 | + * and deny access to the page if not |
| 21 | + * @see access_has_bug_level |
| 22 | + * @param integer $p_access_level Integer representing access level. |
| 23 | + * @param integer $p_event_id Integer representing bug id to check access against. |
| 24 | + * @param integer|null $p_user_id Integer representing user id, defaults to null to use current user. |
| 25 | + * @return void |
| 26 | + * @access public |
| 27 | + */ |
| 28 | +function access_ensure_event_level( $p_access_level, $p_event_id, $p_user_id = null ) { |
| 29 | + if( !access_has_event_level( $p_access_level, $p_event_id, $p_user_id ) ) { |
| 30 | + access_denied(); |
| 31 | + } |
| 32 | +} |
| 33 | + |
| 34 | +/** |
| 35 | + * Check the current user's access against the given value and return true |
| 36 | + * if the user's access is equal to or higher, false otherwise. |
| 37 | + * This function looks up the bug's project and performs an access check |
| 38 | + * against that project |
| 39 | + * @param integer $p_access_level Integer representing access level. |
| 40 | + * @param integer $p_event_id Integer representing bug id to check access against. |
| 41 | + * @param integer|null $p_user_id Integer representing user id, defaults to null to use current user. |
| 42 | + * @return boolean whether user has access level specified |
| 43 | + * @access public |
| 44 | + */ |
| 45 | +function access_has_event_level( $p_access_level, $p_event_id, $p_user_id = null ) { |
| 46 | + if( $p_user_id === null ) { |
| 47 | + $p_user_id = auth_get_current_user_id(); |
| 48 | + } |
| 49 | + |
| 50 | + # Deal with not logged in silently in this case |
| 51 | + # @@@ we may be able to remove this and just error |
| 52 | + # and once we default to anon login, we can remove it for sure |
| 53 | + if( empty( $p_user_id ) && !auth_is_user_authenticated() ) { |
| 54 | + return false; |
| 55 | + } |
| 56 | + |
| 57 | + $t_project_id = event_get_field( $p_event_id, 'project_id' ); |
| 58 | + $t_event_is_user_reporter = event_is_user_reporter( $p_event_id, $p_user_id ); |
| 59 | + $t_access_level = access_get_project_level( $t_project_id, $p_user_id ); |
| 60 | + |
| 61 | + # check limit_Reporter (Issue #4769) |
| 62 | + # reporters can view just issues they reported |
| 63 | + $t_limit_reporters = config_get( 'limit_reporters', null, $p_user_id, $t_project_id ); |
| 64 | + if( $t_limit_reporters && !$t_event_is_user_reporter ) { |
| 65 | + # Here we only need to check that the current user has an access level |
| 66 | + # higher than the lowest needed to report issues (report_bug_threshold). |
| 67 | + # To improve performance, esp. when processing for several projects, we |
| 68 | + # build a static array holding that threshold for each project |
| 69 | + static $s_thresholds = array(); |
| 70 | + if( !isset( $s_thresholds[$t_project_id] ) ) { |
| 71 | + $t_report_event_threshold = plugin_config_get( 'report_event_threshold', null, $p_user_id, $t_project_id ); |
| 72 | + if( empty( $t_report_event_threshold ) ) { |
| 73 | + $s_thresholds[$t_project_id] = NOBODY; |
| 74 | + } else { |
| 75 | + $s_thresholds[$t_project_id] = access_threshold_min_level( $t_report_event_threshold ) + 1; |
| 76 | + } |
| 77 | + } |
| 78 | + if( !access_compare_level( $t_access_level, $s_thresholds[$t_project_id] ) ) { |
| 79 | + return false; |
| 80 | + } |
| 81 | + } |
| 82 | + |
| 83 | + return access_compare_level( $t_access_level, $p_access_level ); |
| 84 | +} |
0 commit comments