access.class.php 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203
  1. <?php
  2. /**
  3. * Authorize or deny calls.
  4. *
  5. *
  6. * Note:
  7. *
  8. * This class stores locally the security token so that the current call
  9. * can still be validated after generating the new token.
  10. *
  11. * The new security token is generated only on first call. Successive calls
  12. * return the same token. This ensure that different parts of the application
  13. * (form, javascript for javascript, etc) can get access to the same token.
  14. *
  15. * @author Laurent Opprecht <laurent@opprecht.info> for the Univesity of Geneva
  16. * @license /license.txt
  17. */
  18. abstract class Access
  19. {
  20. const SEC_TOKEN = 'sec_token';
  21. /**
  22. * Return view and edit access.
  23. *
  24. * @return \Access
  25. */
  26. public static function all()
  27. {
  28. return AccessAll::instance();
  29. }
  30. /**
  31. * Return no access.
  32. *
  33. * @return \Access
  34. */
  35. public static function forbidden()
  36. {
  37. AccessForbidden::instance();
  38. }
  39. protected $session_token;
  40. protected $token;
  41. /**
  42. * Returns true if security token is valid, false otherwise.
  43. *
  44. * @return bool
  45. */
  46. public function is_token_valid()
  47. {
  48. $call_token = Request::get_security_token();
  49. if (empty($call_token)) {
  50. return false;
  51. }
  52. $session_token = $this->get_session_token();
  53. return $session_token == $call_token;
  54. }
  55. /**
  56. * Returns the token contained in the session.
  57. * Stores the token for further reuse so that it can be changed in session.
  58. *
  59. * @return string
  60. */
  61. public function get_session_token()
  62. {
  63. if (empty($this->session_token)) {
  64. $key = self::SEC_TOKEN;
  65. $this->session_token = isset($_SESSION[$key]) ? $_SESSION[$key] : '';
  66. }
  67. return $this->session_token;
  68. }
  69. /*
  70. * On first call generate a new security token and save it in session.
  71. * On successful calls returns the same (new) token (function is repeatable).
  72. * If user do not have the right to edit, returns a blank (invalid) token.
  73. *
  74. * Stores the existing session token before saving the new one so that
  75. * the current call can still be validated after calling this function.
  76. */
  77. public function get_token()
  78. {
  79. if (!$this->can_edit()) {
  80. return '';
  81. }
  82. if ($this->token) {
  83. return $this->token;
  84. }
  85. $this->session_token = $this->get_session_token();
  86. $this->token = \Security::get_token();
  87. }
  88. /**
  89. * Returns true if the user has the right to edit.
  90. *
  91. * @return boolean
  92. */
  93. public abstract function can_edit();
  94. /**
  95. * Returns true if the current user has the right to view
  96. *
  97. * @return boolean
  98. */
  99. public abstract function can_view();
  100. public function authorize()
  101. {
  102. return $this->can_view();
  103. }
  104. }
  105. /**
  106. * Authorize access and view access.
  107. */
  108. class AccessAll extends Access
  109. {
  110. /**
  111. * Return the instance.
  112. *
  113. * @return \Access
  114. */
  115. public static function instance()
  116. {
  117. static $result = null;
  118. if (empty($result)) {
  119. $result = new self();
  120. }
  121. return $result;
  122. }
  123. private function __construct()
  124. {
  125. }
  126. public function can_edit()
  127. {
  128. return true;
  129. }
  130. public function can_view()
  131. {
  132. return true;
  133. }
  134. public function authorize()
  135. {
  136. return true;
  137. }
  138. }
  139. /**
  140. * Authorizev view access only
  141. */
  142. class AccessForbidden extends Access
  143. {
  144. /**
  145. * Return the instance.
  146. *
  147. * @return \AccessView
  148. */
  149. public static function instance()
  150. {
  151. static $result = null;
  152. if (empty($result)) {
  153. $result = new self();
  154. }
  155. return $result;
  156. }
  157. private function __construct()
  158. {
  159. }
  160. public function can_edit()
  161. {
  162. return false;
  163. }
  164. public function can_view()
  165. {
  166. return false;
  167. }
  168. public function authorize()
  169. {
  170. return false;
  171. }
  172. }