AclProvider.php 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\Security\Acl\Dbal;
  11. use Doctrine\DBAL\Connection;
  12. use Doctrine\DBAL\Driver\Statement;
  13. use Symfony\Component\Security\Acl\Model\AclInterface;
  14. use Symfony\Component\Security\Acl\Domain\Acl;
  15. use Symfony\Component\Security\Acl\Domain\Entry;
  16. use Symfony\Component\Security\Acl\Domain\FieldEntry;
  17. use Symfony\Component\Security\Acl\Domain\ObjectIdentity;
  18. use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;
  19. use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;
  20. use Symfony\Component\Security\Acl\Exception\AclNotFoundException;
  21. use Symfony\Component\Security\Acl\Exception\NotAllAclsFoundException;
  22. use Symfony\Component\Security\Acl\Model\AclCacheInterface;
  23. use Symfony\Component\Security\Acl\Model\AclProviderInterface;
  24. use Symfony\Component\Security\Acl\Model\ObjectIdentityInterface;
  25. use Symfony\Component\Security\Acl\Model\PermissionGrantingStrategyInterface;
  26. /**
  27. * An ACL provider implementation.
  28. *
  29. * This provider assumes that all ACLs share the same PermissionGrantingStrategy.
  30. *
  31. * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  32. */
  33. class AclProvider implements AclProviderInterface
  34. {
  35. const MAX_BATCH_SIZE = 30;
  36. /**
  37. * @var AclCacheInterface|null
  38. */
  39. protected $cache;
  40. /**
  41. * @var Connection
  42. */
  43. protected $connection;
  44. protected $loadedAces = array();
  45. protected $loadedAcls = array();
  46. protected $options;
  47. /**
  48. * @var PermissionGrantingStrategyInterface
  49. */
  50. private $permissionGrantingStrategy;
  51. /**
  52. * Constructor.
  53. *
  54. * @param Connection $connection
  55. * @param PermissionGrantingStrategyInterface $permissionGrantingStrategy
  56. * @param array $options
  57. * @param AclCacheInterface $cache
  58. */
  59. public function __construct(Connection $connection, PermissionGrantingStrategyInterface $permissionGrantingStrategy, array $options, AclCacheInterface $cache = null)
  60. {
  61. $this->cache = $cache;
  62. $this->connection = $connection;
  63. $this->options = $options;
  64. $this->permissionGrantingStrategy = $permissionGrantingStrategy;
  65. }
  66. /**
  67. * {@inheritdoc}
  68. */
  69. public function findChildren(ObjectIdentityInterface $parentOid, $directChildrenOnly = false)
  70. {
  71. $sql = $this->getFindChildrenSql($parentOid, $directChildrenOnly);
  72. $children = array();
  73. foreach ($this->connection->executeQuery($sql)->fetchAll() as $data) {
  74. $children[] = new ObjectIdentity($data['object_identifier'], $data['class_type']);
  75. }
  76. return $children;
  77. }
  78. /**
  79. * {@inheritdoc}
  80. */
  81. public function findAcl(ObjectIdentityInterface $oid, array $sids = array())
  82. {
  83. return $this->findAcls(array($oid), $sids)->offsetGet($oid);
  84. }
  85. /**
  86. * {@inheritdoc}
  87. */
  88. public function findAcls(array $oids, array $sids = array())
  89. {
  90. $result = new \SplObjectStorage();
  91. $currentBatch = array();
  92. $oidLookup = array();
  93. for ($i = 0, $c = count($oids); $i < $c; ++$i) {
  94. $oid = $oids[$i];
  95. $oidLookupKey = $oid->getIdentifier().$oid->getType();
  96. $oidLookup[$oidLookupKey] = $oid;
  97. $aclFound = false;
  98. // check if result already contains an ACL
  99. if ($result->contains($oid)) {
  100. $aclFound = true;
  101. }
  102. // check if this ACL has already been hydrated
  103. if (!$aclFound && isset($this->loadedAcls[$oid->getType()][$oid->getIdentifier()])) {
  104. $acl = $this->loadedAcls[$oid->getType()][$oid->getIdentifier()];
  105. if (!$acl->isSidLoaded($sids)) {
  106. // FIXME: we need to load ACEs for the missing SIDs. This is never
  107. // reached by the default implementation, since we do not
  108. // filter by SID
  109. throw new \RuntimeException('This is not supported by the default implementation.');
  110. } else {
  111. $result->attach($oid, $acl);
  112. $aclFound = true;
  113. }
  114. }
  115. // check if we can locate the ACL in the cache
  116. if (!$aclFound && null !== $this->cache) {
  117. $acl = $this->cache->getFromCacheByIdentity($oid);
  118. if (null !== $acl) {
  119. if ($acl->isSidLoaded($sids)) {
  120. // check if any of the parents has been loaded since we need to
  121. // ensure that there is only ever one ACL per object identity
  122. $parentAcl = $acl->getParentAcl();
  123. while (null !== $parentAcl) {
  124. $parentOid = $parentAcl->getObjectIdentity();
  125. if (isset($this->loadedAcls[$parentOid->getType()][$parentOid->getIdentifier()])) {
  126. $acl->setParentAcl($this->loadedAcls[$parentOid->getType()][$parentOid->getIdentifier()]);
  127. break;
  128. } else {
  129. $this->loadedAcls[$parentOid->getType()][$parentOid->getIdentifier()] = $parentAcl;
  130. $this->updateAceIdentityMap($parentAcl);
  131. }
  132. $parentAcl = $parentAcl->getParentAcl();
  133. }
  134. $this->loadedAcls[$oid->getType()][$oid->getIdentifier()] = $acl;
  135. $this->updateAceIdentityMap($acl);
  136. $result->attach($oid, $acl);
  137. $aclFound = true;
  138. } else {
  139. $this->cache->evictFromCacheByIdentity($oid);
  140. foreach ($this->findChildren($oid) as $childOid) {
  141. $this->cache->evictFromCacheByIdentity($childOid);
  142. }
  143. }
  144. }
  145. }
  146. // looks like we have to load the ACL from the database
  147. if (!$aclFound) {
  148. $currentBatch[] = $oid;
  149. }
  150. // Is it time to load the current batch?
  151. $currentBatchesCount = count($currentBatch);
  152. if ($currentBatchesCount > 0 && (self::MAX_BATCH_SIZE === $currentBatchesCount || ($i + 1) === $c)) {
  153. try {
  154. $loadedBatch = $this->lookupObjectIdentities($currentBatch, $sids, $oidLookup);
  155. } catch (AclNotFoundException $e) {
  156. if ($result->count()) {
  157. $partialResultException = new NotAllAclsFoundException('The provider could not find ACLs for all object identities.');
  158. $partialResultException->setPartialResult($result);
  159. throw $partialResultException;
  160. } else {
  161. throw $e;
  162. }
  163. }
  164. foreach ($loadedBatch as $loadedOid) {
  165. $loadedAcl = $loadedBatch->offsetGet($loadedOid);
  166. if (null !== $this->cache) {
  167. $this->cache->putInCache($loadedAcl);
  168. }
  169. if (isset($oidLookup[$loadedOid->getIdentifier().$loadedOid->getType()])) {
  170. $result->attach($loadedOid, $loadedAcl);
  171. }
  172. }
  173. $currentBatch = array();
  174. }
  175. }
  176. // check that we got ACLs for all the identities
  177. foreach ($oids as $oid) {
  178. if (!$result->contains($oid)) {
  179. if (1 === count($oids)) {
  180. $objectName = method_exists($oid, '__toString') ? $oid : get_class($oid);
  181. throw new AclNotFoundException(sprintf('No ACL found for %s.', $objectName));
  182. }
  183. $partialResultException = new NotAllAclsFoundException('The provider could not find ACLs for all object identities.');
  184. $partialResultException->setPartialResult($result);
  185. throw $partialResultException;
  186. }
  187. }
  188. return $result;
  189. }
  190. /**
  191. * Constructs the query used for looking up object identities and associated
  192. * ACEs, and security identities.
  193. *
  194. * @param array $ancestorIds
  195. *
  196. * @return string
  197. */
  198. protected function getLookupSql(array $ancestorIds)
  199. {
  200. // FIXME: add support for filtering by sids (right now we select all sids)
  201. $sql = <<<SELECTCLAUSE
  202. SELECT
  203. o.id as acl_id,
  204. o.object_identifier,
  205. o.parent_object_identity_id,
  206. o.entries_inheriting,
  207. c.class_type,
  208. e.id as ace_id,
  209. e.object_identity_id,
  210. e.field_name,
  211. e.ace_order,
  212. e.mask,
  213. e.granting,
  214. e.granting_strategy,
  215. e.audit_success,
  216. e.audit_failure,
  217. s.username,
  218. s.identifier as security_identifier
  219. FROM
  220. {$this->options['oid_table_name']} o
  221. INNER JOIN {$this->options['class_table_name']} c ON c.id = o.class_id
  222. LEFT JOIN {$this->options['entry_table_name']} e ON (
  223. e.class_id = o.class_id AND (e.object_identity_id = o.id OR {$this->connection->getDatabasePlatform()->getIsNullExpression('e.object_identity_id')})
  224. )
  225. LEFT JOIN {$this->options['sid_table_name']} s ON (
  226. s.id = e.security_identity_id
  227. )
  228. WHERE (o.id =
  229. SELECTCLAUSE;
  230. $sql .= implode(' OR o.id = ', $ancestorIds).')';
  231. return $sql;
  232. }
  233. protected function getAncestorLookupSql(array $batch)
  234. {
  235. $sql = <<<SELECTCLAUSE
  236. SELECT a.ancestor_id
  237. FROM
  238. {$this->options['oid_table_name']} o
  239. INNER JOIN {$this->options['class_table_name']} c ON c.id = o.class_id
  240. INNER JOIN {$this->options['oid_ancestors_table_name']} a ON a.object_identity_id = o.id
  241. WHERE (
  242. SELECTCLAUSE;
  243. $types = array();
  244. $count = count($batch);
  245. for ($i = 0; $i < $count; ++$i) {
  246. if (!isset($types[$batch[$i]->getType()])) {
  247. $types[$batch[$i]->getType()] = true;
  248. // if there is more than one type we can safely break out of the
  249. // loop, because it is the differentiator factor on whether to
  250. // query for only one or more class types
  251. if (count($types) > 1) {
  252. break;
  253. }
  254. }
  255. }
  256. if (1 === count($types)) {
  257. $ids = array();
  258. for ($i = 0; $i < $count; ++$i) {
  259. $identifier = (string) $batch[$i]->getIdentifier();
  260. $ids[] = $this->connection->quote($identifier);
  261. }
  262. $sql .= sprintf(
  263. '(o.object_identifier IN (%s) AND c.class_type = %s)',
  264. implode(',', $ids),
  265. $this->connection->quote($batch[0]->getType())
  266. );
  267. } else {
  268. $where = '(o.object_identifier = %s AND c.class_type = %s)';
  269. for ($i = 0; $i < $count; ++$i) {
  270. $sql .= sprintf(
  271. $where,
  272. $this->connection->quote($batch[$i]->getIdentifier()),
  273. $this->connection->quote($batch[$i]->getType())
  274. );
  275. if ($i + 1 < $count) {
  276. $sql .= ' OR ';
  277. }
  278. }
  279. }
  280. $sql .= ')';
  281. return $sql;
  282. }
  283. /**
  284. * Constructs the SQL for retrieving child object identities for the given
  285. * object identities.
  286. *
  287. * @param ObjectIdentityInterface $oid
  288. * @param bool $directChildrenOnly
  289. *
  290. * @return string
  291. */
  292. protected function getFindChildrenSql(ObjectIdentityInterface $oid, $directChildrenOnly)
  293. {
  294. if (false === $directChildrenOnly) {
  295. $query = <<<FINDCHILDREN
  296. SELECT o.object_identifier, c.class_type
  297. FROM
  298. {$this->options['oid_table_name']} o
  299. INNER JOIN {$this->options['class_table_name']} c ON c.id = o.class_id
  300. INNER JOIN {$this->options['oid_ancestors_table_name']} a ON a.object_identity_id = o.id
  301. WHERE
  302. a.ancestor_id = %d AND a.object_identity_id != a.ancestor_id
  303. FINDCHILDREN;
  304. } else {
  305. $query = <<<FINDCHILDREN
  306. SELECT o.object_identifier, c.class_type
  307. FROM {$this->options['oid_table_name']} o
  308. INNER JOIN {$this->options['class_table_name']} c ON c.id = o.class_id
  309. WHERE o.parent_object_identity_id = %d
  310. FINDCHILDREN;
  311. }
  312. return sprintf($query, $this->retrieveObjectIdentityPrimaryKey($oid));
  313. }
  314. /**
  315. * Constructs the SQL for retrieving the primary key of the given object
  316. * identity.
  317. *
  318. * @param ObjectIdentityInterface $oid
  319. *
  320. * @return string
  321. */
  322. protected function getSelectObjectIdentityIdSql(ObjectIdentityInterface $oid)
  323. {
  324. $query = <<<QUERY
  325. SELECT o.id
  326. FROM %s o
  327. INNER JOIN %s c ON c.id = o.class_id
  328. WHERE o.object_identifier = %s AND c.class_type = %s
  329. QUERY;
  330. return sprintf(
  331. $query,
  332. $this->options['oid_table_name'],
  333. $this->options['class_table_name'],
  334. $this->connection->quote((string) $oid->getIdentifier()),
  335. $this->connection->quote((string) $oid->getType())
  336. );
  337. }
  338. /**
  339. * Returns the primary key of the passed object identity.
  340. *
  341. * @param ObjectIdentityInterface $oid
  342. *
  343. * @return int
  344. */
  345. final protected function retrieveObjectIdentityPrimaryKey(ObjectIdentityInterface $oid)
  346. {
  347. return $this->connection->executeQuery($this->getSelectObjectIdentityIdSql($oid))->fetchColumn();
  348. }
  349. /**
  350. * This method is called when an ACL instance is retrieved from the cache.
  351. *
  352. * @param AclInterface $acl
  353. */
  354. private function updateAceIdentityMap(AclInterface $acl)
  355. {
  356. foreach (array('classAces', 'classFieldAces', 'objectAces', 'objectFieldAces') as $property) {
  357. $reflection = new \ReflectionProperty($acl, $property);
  358. $reflection->setAccessible(true);
  359. $value = $reflection->getValue($acl);
  360. if ('classAces' === $property || 'objectAces' === $property) {
  361. $this->doUpdateAceIdentityMap($value);
  362. } else {
  363. foreach ($value as $field => $aces) {
  364. $this->doUpdateAceIdentityMap($value[$field]);
  365. }
  366. }
  367. $reflection->setValue($acl, $value);
  368. $reflection->setAccessible(false);
  369. }
  370. }
  371. /**
  372. * Retrieves all the ids which need to be queried from the database
  373. * including the ids of parent ACLs.
  374. *
  375. * @param array $batch
  376. *
  377. * @return array
  378. */
  379. private function getAncestorIds(array $batch)
  380. {
  381. $sql = $this->getAncestorLookupSql($batch);
  382. $ancestorIds = array();
  383. foreach ($this->connection->executeQuery($sql)->fetchAll() as $data) {
  384. // FIXME: skip ancestors which are cached
  385. // Fix: Oracle returns keys in uppercase
  386. $ancestorIds[] = reset($data);
  387. }
  388. return $ancestorIds;
  389. }
  390. /**
  391. * Does either overwrite the passed ACE, or saves it in the global identity
  392. * map to ensure every ACE only gets instantiated once.
  393. *
  394. * @param array &$aces
  395. */
  396. private function doUpdateAceIdentityMap(array &$aces)
  397. {
  398. foreach ($aces as $index => $ace) {
  399. if (isset($this->loadedAces[$ace->getId()])) {
  400. $aces[$index] = $this->loadedAces[$ace->getId()];
  401. } else {
  402. $this->loadedAces[$ace->getId()] = $ace;
  403. }
  404. }
  405. }
  406. /**
  407. * This method is called for object identities which could not be retrieved
  408. * from the cache, and for which thus a database query is required.
  409. *
  410. * @param array $batch
  411. * @param array $sids
  412. * @param array $oidLookup
  413. *
  414. * @return \SplObjectStorage mapping object identities to ACL instances
  415. *
  416. * @throws AclNotFoundException
  417. */
  418. private function lookupObjectIdentities(array $batch, array $sids, array $oidLookup)
  419. {
  420. $ancestorIds = $this->getAncestorIds($batch);
  421. if (!$ancestorIds) {
  422. throw new AclNotFoundException('There is no ACL for the given object identity.');
  423. }
  424. $sql = $this->getLookupSql($ancestorIds);
  425. $stmt = $this->connection->executeQuery($sql);
  426. return $this->hydrateObjectIdentities($stmt, $oidLookup, $sids);
  427. }
  428. /**
  429. * This method is called to hydrate ACLs and ACEs.
  430. *
  431. * This method was designed for performance; thus, a lot of code has been
  432. * inlined at the cost of readability, and maintainability.
  433. *
  434. * Keep in mind that changes to this method might severely reduce the
  435. * performance of the entire ACL system.
  436. *
  437. * @param Statement $stmt
  438. * @param array $oidLookup
  439. * @param array $sids
  440. *
  441. * @return \SplObjectStorage
  442. *
  443. * @throws \RuntimeException
  444. */
  445. private function hydrateObjectIdentities(Statement $stmt, array $oidLookup, array $sids)
  446. {
  447. $parentIdToFill = new \SplObjectStorage();
  448. $acls = $aces = $emptyArray = array();
  449. $oidCache = $oidLookup;
  450. $result = new \SplObjectStorage();
  451. $loadedAces = &$this->loadedAces;
  452. $loadedAcls = &$this->loadedAcls;
  453. $permissionGrantingStrategy = $this->permissionGrantingStrategy;
  454. // we need these to set protected properties on hydrated objects
  455. $aclReflection = new \ReflectionClass('Symfony\Component\Security\Acl\Domain\Acl');
  456. $aclClassAcesProperty = $aclReflection->getProperty('classAces');
  457. $aclClassAcesProperty->setAccessible(true);
  458. $aclClassFieldAcesProperty = $aclReflection->getProperty('classFieldAces');
  459. $aclClassFieldAcesProperty->setAccessible(true);
  460. $aclObjectAcesProperty = $aclReflection->getProperty('objectAces');
  461. $aclObjectAcesProperty->setAccessible(true);
  462. $aclObjectFieldAcesProperty = $aclReflection->getProperty('objectFieldAces');
  463. $aclObjectFieldAcesProperty->setAccessible(true);
  464. $aclParentAclProperty = $aclReflection->getProperty('parentAcl');
  465. $aclParentAclProperty->setAccessible(true);
  466. // fetchAll() consumes more memory than consecutive calls to fetch(),
  467. // but it is faster
  468. foreach ($stmt->fetchAll(\PDO::FETCH_NUM) as $data) {
  469. list($aclId,
  470. $objectIdentifier,
  471. $parentObjectIdentityId,
  472. $entriesInheriting,
  473. $classType,
  474. $aceId,
  475. $objectIdentityId,
  476. $fieldName,
  477. $aceOrder,
  478. $mask,
  479. $granting,
  480. $grantingStrategy,
  481. $auditSuccess,
  482. $auditFailure,
  483. $username,
  484. $securityIdentifier) = array_values($data);
  485. // has the ACL been hydrated during this hydration cycle?
  486. if (isset($acls[$aclId])) {
  487. $acl = $acls[$aclId];
  488. // has the ACL been hydrated during any previous cycle, or was possibly loaded
  489. // from cache?
  490. } elseif (isset($loadedAcls[$classType][$objectIdentifier])) {
  491. $acl = $loadedAcls[$classType][$objectIdentifier];
  492. // keep reference in local array (saves us some hash calculations)
  493. $acls[$aclId] = $acl;
  494. // attach ACL to the result set; even though we do not enforce that every
  495. // object identity has only one instance, we must make sure to maintain
  496. // referential equality with the oids passed to findAcls()
  497. $oidCacheKey = $objectIdentifier.$classType;
  498. if (!isset($oidCache[$oidCacheKey])) {
  499. $oidCache[$oidCacheKey] = $acl->getObjectIdentity();
  500. }
  501. $result->attach($oidCache[$oidCacheKey], $acl);
  502. // so, this hasn't been hydrated yet
  503. } else {
  504. // create object identity if we haven't done so yet
  505. $oidLookupKey = $objectIdentifier.$classType;
  506. if (!isset($oidCache[$oidLookupKey])) {
  507. $oidCache[$oidLookupKey] = new ObjectIdentity($objectIdentifier, $classType);
  508. }
  509. $acl = new Acl((int) $aclId, $oidCache[$oidLookupKey], $permissionGrantingStrategy, $emptyArray, (bool) $entriesInheriting);
  510. // keep a local, and global reference to this ACL
  511. $loadedAcls[$classType][$objectIdentifier] = $acl;
  512. $acls[$aclId] = $acl;
  513. // try to fill in parent ACL, or defer until all ACLs have been hydrated
  514. if (null !== $parentObjectIdentityId) {
  515. if (isset($acls[$parentObjectIdentityId])) {
  516. $aclParentAclProperty->setValue($acl, $acls[$parentObjectIdentityId]);
  517. } else {
  518. $parentIdToFill->attach($acl, $parentObjectIdentityId);
  519. }
  520. }
  521. $result->attach($oidCache[$oidLookupKey], $acl);
  522. }
  523. // check if this row contains an ACE record
  524. if (null !== $aceId) {
  525. // have we already hydrated ACEs for this ACL?
  526. if (!isset($aces[$aclId])) {
  527. $aces[$aclId] = array($emptyArray, $emptyArray, $emptyArray, $emptyArray);
  528. }
  529. // has this ACE already been hydrated during a previous cycle, or
  530. // possible been loaded from cache?
  531. // It is important to only ever have one ACE instance per actual row since
  532. // some ACEs are shared between ACL instances
  533. if (!isset($loadedAces[$aceId])) {
  534. if (!isset($sids[$key = ($username ? '1' : '0').$securityIdentifier])) {
  535. if ($username) {
  536. $sids[$key] = new UserSecurityIdentity(
  537. substr($securityIdentifier, 1 + $pos = strpos($securityIdentifier, '-')),
  538. substr($securityIdentifier, 0, $pos)
  539. );
  540. } else {
  541. $sids[$key] = new RoleSecurityIdentity($securityIdentifier);
  542. }
  543. }
  544. if (null === $fieldName) {
  545. $loadedAces[$aceId] = new Entry((int) $aceId, $acl, $sids[$key], $grantingStrategy, (int) $mask, (bool) $granting, (bool) $auditFailure, (bool) $auditSuccess);
  546. } else {
  547. $loadedAces[$aceId] = new FieldEntry((int) $aceId, $acl, $fieldName, $sids[$key], $grantingStrategy, (int) $mask, (bool) $granting, (bool) $auditFailure, (bool) $auditSuccess);
  548. }
  549. }
  550. $ace = $loadedAces[$aceId];
  551. // assign ACE to the correct property
  552. if (null === $objectIdentityId) {
  553. if (null === $fieldName) {
  554. $aces[$aclId][0][$aceOrder] = $ace;
  555. } else {
  556. $aces[$aclId][1][$fieldName][$aceOrder] = $ace;
  557. }
  558. } else {
  559. if (null === $fieldName) {
  560. $aces[$aclId][2][$aceOrder] = $ace;
  561. } else {
  562. $aces[$aclId][3][$fieldName][$aceOrder] = $ace;
  563. }
  564. }
  565. }
  566. }
  567. // We do not sort on database level since we only want certain subsets to be sorted,
  568. // and we are going to read the entire result set anyway.
  569. // Sorting on DB level increases query time by an order of magnitude while it is
  570. // almost negligible when we use PHPs array sort functions.
  571. foreach ($aces as $aclId => $aceData) {
  572. $acl = $acls[$aclId];
  573. ksort($aceData[0]);
  574. $aclClassAcesProperty->setValue($acl, $aceData[0]);
  575. foreach (array_keys($aceData[1]) as $fieldName) {
  576. ksort($aceData[1][$fieldName]);
  577. }
  578. $aclClassFieldAcesProperty->setValue($acl, $aceData[1]);
  579. ksort($aceData[2]);
  580. $aclObjectAcesProperty->setValue($acl, $aceData[2]);
  581. foreach (array_keys($aceData[3]) as $fieldName) {
  582. ksort($aceData[3][$fieldName]);
  583. }
  584. $aclObjectFieldAcesProperty->setValue($acl, $aceData[3]);
  585. }
  586. // fill-in parent ACLs where this hasn't been done yet cause the parent ACL was not
  587. // yet available
  588. $processed = 0;
  589. foreach ($parentIdToFill as $acl) {
  590. $parentId = $parentIdToFill->offsetGet($acl);
  591. // let's see if we have already hydrated this
  592. if (isset($acls[$parentId])) {
  593. $aclParentAclProperty->setValue($acl, $acls[$parentId]);
  594. ++$processed;
  595. continue;
  596. }
  597. }
  598. // reset reflection changes
  599. $aclClassAcesProperty->setAccessible(false);
  600. $aclClassFieldAcesProperty->setAccessible(false);
  601. $aclObjectAcesProperty->setAccessible(false);
  602. $aclObjectFieldAcesProperty->setAccessible(false);
  603. $aclParentAclProperty->setAccessible(false);
  604. // this should never be true if the database integrity hasn't been compromised
  605. if ($processed < count($parentIdToFill)) {
  606. throw new \RuntimeException('Not all parent ids were populated. This implies an integrity problem.');
  607. }
  608. return $result;
  609. }
  610. }