TYPO3 Core

var $userGroups = Array(); // This array will hold the groups that the user is a member of

var $userGroupsUID = Array(); // This array holds the uid's of the groups in the listed order

'fileoper_perms' => 0,

'allowed_languages' => '',

'workspace_perms' => '',

'custom_options' => '',

);

var $userTS_text = ''; // Contains the non-parsed user TSconfig

var $userTS = array(); // Contains the parsed user TSconfig

var $RTE_errors = array(); // RTE availability errors collected.

var $errorMsg = ''; // Contains last error message

*

* @return boolean

*/

}

/**

* @param integer Group ID to look for in $this->groupList

* @return boolean

*/

$groupId = intval($groupId);

return $this->inList($this->groupList, $groupId);

}

}

* @param integer $perms is the binary representation of the permission we are going to check. Every bit in this number represents a permission that must be set. See function explanation.

* @return boolean True or False upon evaluation

*/

$userPerms = $this->calcPerms($row);

}

/**

* @param boolean If set, then the function will exit with an error message.

* @return integer The page UID of a page in the rootline that matched a mount point

*/

$id = intval($id);

// Check if input id is an offline version page in which case we will map id to the online version:

$id = intval($checkRec['t3ver_oid']);

}

$wM = $this->returnWebmounts();

return $v['uid'];

}

}

}

exit;

}

}

* @param boolean If set, an array will issue an error message and exit.

* @return boolean Will return true if $MCONF['access'] is not set at all, if the BE_USER is admin or if the module is enabled in the be_users/be_groups records of the user (specifically enabled). Will return false if the module name is not even found in $TBE_MODULES

*/

exit;

}

return FALSE;

}

// Workspaces check:

// ok, go on...

} else {

exit;

}

return FALSE;

}

// Returns true if conf[access] is not set at all or if the user is admin

// If $conf['access'] is set but not with 'admin' then we return true, if the module is found in the modList

if (!strstr($conf['access'],'admin') && $conf['name']) {

}

exit;

} else return $acs;

}

* @param integer Permission mask to use, see function description

* @return string Part of where clause. Prefix " AND " to this.

*/

global $TYPO3_CONF_VARS;

return ' 1=1';

}

$perms = intval($perms); // Make sure it's integer.

}

// ****************

// getPagePermsClause-HOOK

* @param array Input page row with all perms_* fields available.

* @return integer Bitwise representation of the users permissions in relation to input page row, $row

*/

global $TYPO3_CONF_VARS;

if (isset($row['perms_userid']) && isset($row['perms_user']) && isset($row['perms_groupid']) && isset($row['perms_group']) && isset($row['perms_everybody']) && isset($this->groupList)) {

}

}

}

// ****************

*

* @return boolean

*/

global $CLIENT;

// Start:

// Acquire RTE object:

$RTE = t3lib_BEfunc::RTEgetObj();

$this->RTE_errors = array_merge($this->RTE_errors, $RTE);

}

* @param string Auth mode keyword (explicitAllow, explicitDeny, individual)

* @return boolean True or false whether access is granted or not.

*/

global $TCA;

// Admin users can do anything:

// Allow all blank values:

// Certain characters are not allowed in the value

return FALSE;

}

// Initialize:

$out = TRUE;

// Checking value:

case 'explicitAllow':

$out = FALSE;

}

break;

case 'explicitDeny':

$out = FALSE;

}

break;

case 'individual':

t3lib_div::loadTCA($table);

$items = $TCA[$table]['columns'][$field]['config']['items'];

case 'EXPL_ALLOW':

$out = FALSE;

}

break;

* @param integer Language value to evaluate

* @return boolean Returns true if the language value is allowed, otherwise false.

*/

$langValue = intval($langValue);

return FALSE;

}

}

function recordEditAccessInternals($table, $idOrRow, $newRecord = FALSE, $deletedRecord = FALSE, $checkFullLanguageAccess = FALSE) {

global $TCA;

t3lib_div::loadTCA($table);

// Always return true for Admin users.

// Fetching the record if the $idOrRow variable was not an array on input:

if ($deletedRecord) {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow, '*', '', FALSE);

} else {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow);

}

$this->errorMsg = 'ERROR: Record could not be fetched.';

return FALSE;

}

}

// Checking languages:

$this->errorMsg = 'ERROR: Language was not allowed.';

return FALSE;

$this->errorMsg = 'ERROR: Related/affected language was not allowed.';

return FALSE;

}

} else {

return FALSE;

}

} elseif (isset($TCA[$table]['ctrl']['transForeignTable']) && $checkFullLanguageAccess && !$this->checkFullLanguagesAccess($table, $idOrRow)) {

}

// Checking "editlock" feature (doesn't apply to new records)

if (isset($idOrRow[$TCA[$table]['ctrl']['editlock']])) {

if ($idOrRow[$TCA[$table]['ctrl']['editlock']]) {

$this->errorMsg = 'ERROR: Record was locked for editing. Only admin users can change this state.';

return FALSE;

}

} else {

return FALSE;

}

}

// THIS is where we can include a check for "perms_" fields for other records than pages...

// Process any hooks

$params = array(

'table' => $table,

'idOrRow' => $idOrRow,

* @param array Integer (record uid) or array where fields are at least: pid, t3ver_wsid, t3ver_stage (if versioningWS is set)

* @return string String error code, telling the failure state. FALSE=All ok

*/

}

if (is_array($recData)) {

return 'Versioning disabled for table';

return 'Workspace ID of record didn\'t match current workspace';

} else { // So what about the stage of the version, does that allow editing for this user?

}

} else { // We are testing a "live" record:

if ($res = $this->workspaceAllowLiveRecordsInPID($recData['pid'], $table)) { // For "Live" records, check that PID for table allows editing

// Live records are OK in this branch, but what about the stage of branch point, if any:

} else { // If not offline and not in versionized branch, output error:

return 'Online record was not in versionized branch!';

}

* @return string String error code, telling the failure state. FALSE=All ok

* @see workspaceCannotEditRecord()

*/

}

if (is_array($recData)) {

} else return 'Not an offline version';

} else return 'No record';

} else return 'Table does not support versioning.';

* @param string Table name

* @return mixed Returns FALSE if a live record cannot be created and must be versionized in order to do so. 2 means a) Workspace is "Live" or workspace allows "live edit" of records from non-versionized tables (and the $table is not versionizable). 1 and -1 means the pid is inside a versionized branch where -1 means that the branch-point did NOT allow a new record according to its state.

*/

// Always for Live workspace AND if live-edit is enabled and tables are completely without versioning it is ok as well.

return 2; // OK to create for this table.

} elseif (t3lib_BEfunc::isPidInVersionizedBranch($pid, $table)) { // Check if records from $table can be created with this PID: Either if inside "branch" versioning type or a "versioning_followPages" table on a "page" versioning type.

// Now, check what the stage of that "page" or "branch" version type is:

* @return boolean TRUE if OK.

*/

function workspaceCreateNewRecord($pid, $table) {

return FALSE; // Stage for versioning root point and users access level did not allow for editing

}

return FALSE;

}

return TRUE;

*/

function workspaceAllowAutoCreation($table,$id,$recpid) {

// Auto-creation of version: In offline workspace, test if versioning is enabled and look for workspace version of input record. If there is no versionized record found we will create one and save to that.

&& !$this->workspaceRec['disable_autocreate'] // Auto-creation must not be disabled.

&& $GLOBALS['TCA'][$table]['ctrl']['versioningWS'] // Table must be versionizable

&& $recpid >= 0 // The PID of the record must NOT be -1 or less (would indicate that it already was a version!)

&& !t3lib_BEfunc::getWorkspaceVersionOfRecord($this->workspace, $table, $id, 'uid') // There must be no existing version of this record in workspace.

return TRUE;

}

}

* @param integer Stage id from an element: -1,0 = editing, 1 = reviewer, >1 = owner

* @return boolean TRUE if user is allowed access

*/

$stat = $this->checkWorkspaceCurrent();

$memberStageLimit = $this->workspaceRec['review_stage_edit'] ? 1 : 0;

return TRUE; // OK for these criteria

}

}

/**

* @param integer Workspace UID; -1,0,1+

* @return boolean Returns TRUE if the user has access to publish content from the workspace ID given.

*/

// If no access to workspace, of course you cannot publish!

$retVal = FALSE;

$wsAccess = $this->checkWorkspace($wsid);

if ($wsAccess) {

case 0: // Live workspace

$retVal = TRUE; // If access to Live workspace, no problem.

break;

$retVal = $this->checkWorkspace(0) ? TRUE : FALSE; // If access to Live workspace, no problem.

break;

default: // Custom workspace

break;

}

}

*

* @return boolean Returns TRUE if records can be swapped in the current workspace, otherwise false

*/

return FALSE;

}

/**

* @param integer Versioning type to evaluation: -1, 0, >1

* @return boolean TRUE if OK

*/

$retVal = FALSE;

// Check if only element versioning is allowed:

return FALSE;

}

$stat = $this->checkWorkspaceCurrent();

case -1:

break;

case 0:

break;

default:

break;

}

return $retVal;

}

* @param integer Versioning type to evaluation: -1, 0, >1

* @return integer Returning versioning type

*/

case -1:

$type = -1;

break;

* @return array An array with two keys, "value" and "properties" where "value" is a string with the value of the objectsting and "properties" is an array with the properties of the objectstring.

* @params array An array with the TypoScript where the $objectString is located. If this argument is not an array, then internal ->userTS (User TSconfig for the current BE_USER) will be used instead.

*/

if (!is_array($config)) {

}

$key = $parts[0];

if (trim($key)) {

// Go on, get the next level

} else {

}

}

return $TSConf;

* @param string The string to find in the list of items

* @return string Boolean

*/

}

/**

*

* @return array

*/

}

/**

*

* @return array

*/

return $this->groupData['filemounts'];

}

* @param integer Bitmask

* @return boolean true if the confirmation should be shown

*/

$alertPopup = $GLOBALS['BE_USER']->getTSConfig('options.alertPopups');

$alertPopup = 255; // default: show all warnings

} else {

$alertPopup = (int)$alertPopup['value'];

}

return 1;

} else { // don't show confirmation

return 0;

* @access private

* @see t3lib_TSparser

*/

if ($this->user['uid']) {

// Get lists for the be_user record and set them as default/primary values.

$this->dataLists['fileoper_perms'] = (int)$this->user['fileoper_perms']; // Fileoperation permissions

// Setting default User TSconfig:

$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig'];

// Default TSconfig for admin-users

admPanel.enable.all = 1

options.shortcutFrame = 1

';

if (t3lib_extMgm::isLoaded('sys_note')) {

$this->TSdataArray[]='

// Setting defaults for sys_note author / email...

';

}

}

// FILE MOUNTS:

// Admin users has the base fileadmin dir mounted

$this->addFileMount($GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'], '', PATH_site.$GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'], 0, '');

}

// If userHomePath is set, we attempt to mount it

// First try and mount with [uid]_[username]

if (!$didMount) {

// If that failed, try and mount with only [uid]

}

}

// Get the groups...

# $grList = t3lib_BEfunc::getSQLselectableList($this->user[$this->usergroup_column],$this->usergroup_table,$this->usergroup_table);

$grList = $GLOBALS['TYPO3_DB']->cleanIntList($this->user[$this->usergroup_column]); // 240203: Since the group-field never contains any references to groups with a prepended table name we think it's safe to just intExplode and re-implode - which should be much faster than the other function call.

// Fetch groups will add a lot of information to the internal arrays: modules, accesslists, TSconfig etc. Refer to fetchGroups() function.

$this->fetchGroups($grList);

}

// Add the TSconfig for this specific user:

// Check include lines.

$this->TSdataArray = t3lib_TSparser::checkIncludeLines_array($this->TSdataArray);

if ($GLOBALS['TYPO3_CONF_VARS']['BE']['TSconfigConditions'] && !$this->userTS_dontGetCached) {

// Perform TS-Config parsing with condition matching

$this->userTS = $parseObj->setup;

t3lib_BEfunc::storeHash($hash, serialize($this->userTS), 'BE_USER_TSconfig');

// Update UC:

}

}

// Processing webmounts

if ($this->isAdmin() && !$this->getTSConfigVal('options.dontMountAdminMounts')) { // Admin's always have the root mounted

}

// Processing filemounts

$orderBy = $GLOBALS['TCA']['sys_filemounts']['ctrl']['default_sortby'] ? $GLOBALS['TYPO3_DB']->stripOrderBy($GLOBALS['TCA']['sys_filemounts']['ctrl']['default_sortby']) : 'sorting';

$this->dataLists['filemount_list'] = t3lib_div::uniqueList($this->dataLists['filemount_list']);

if ($this->dataLists['filemount_list']) {

}

}

// The lists are cleaned for duplicates

$this->groupData['webmounts'] = t3lib_div::uniqueList($this->dataLists['webmount_list']);

$this->groupData['pagetypes_select'] = t3lib_div::uniqueList($this->dataLists['pagetypes_select']);

$this->groupData['tables_modify'] = t3lib_div::uniqueList($this->dataLists['tables_modify']);

$this->groupData['non_exclude_fields'] = t3lib_div::uniqueList($this->dataLists['non_exclude_fields']);

$this->groupData['explicit_allowdeny'] = t3lib_div::uniqueList($this->dataLists['explicit_allowdeny']);

$this->userGroupsUID = array_reverse(array_unique(array_reverse($this->includeGroupArray)));

// Finally this is the list of group_uid's in the order they are parsed (including subgroups!) and without duplicates (duplicates are presented with their last entrance in the list, which thus reflects the order of the TypoScript in TSconfig)

$this->setCachedList($this->groupList);

// Checking read access to webmounts:

unset($webmounts[$idx]);

}

}

}

// Setting up workspace situation (after webmounts are processed!):

* @return void

* @access private

*/

global $TYPO3_CONF_VARS;

// Fetching records of the groups in $grList (which are not blocked by lockedToDomain either):

// Hook for manipulation of the WHERE sql sentence which controls which BE-groups are included

if (is_array ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroupQuery'])) {

foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroupQuery'] as $classRef) {

}

}

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $this->usergroup_table, $whereSQL);

// The userGroups array is filled

$this->userGroups[$row['uid']] = $row;

}

// Traversing records in the correct order

reset($include_staticArr);

// traversing list

foreach ($include_staticArr as $key => $uid) {

// Get row:

// Include sub groups

}

// Add the group uid, current list, TSconfig to the internal arrays.

// Mount group database-mounts

// Mount group file-mounts

// Mount group home-dirs

// If groupHomePath is set, we attempt to mount it

if ($GLOBALS['TYPO3_CONF_VARS']['BE']['groupHomePath']) {

}

}

// The lists are made: groupMods, tables_select, tables_modify, pagetypes_select, non_exclude_fields, explicit_allowdeny, allowed_languages, custom_options

}

// Setting fileoperation permissions

$this->dataLists['workspace_perms'] |= $row['workspace_perms'];

// If this function is processing the users OWN group-list (not subgroups) AND if the ->firstMainGroup is not set, then the ->firstMainGroup will be set.

}

}

}

* @access private

*/

function setCachedList($cList) {

}

}

* @return boolean Returns "1" if the requested filemount was mounted, otherwise no return value.

* @access private

*/

// Return false if fileadminDir is not set and we try to mount a relative path

// Trimming and pre-processing

}

// If the path is true and validates as a valid path string:

// normalize path: remove leading '/' and './', and trailing '/' and '/.'

} else {

}

}

// We now have a path with slash after and slash before (if unix)

if (@is_dir($path) &&

// Alternative title?

$name = $title ? $title : $altTitle;

// Adds the filemount. The same filemount with same name, type and path cannot be set up twice because of the hash string used as key.

// Return true - went well, success!

return 1;

}

* @param string The text to wrap in comment prefixes and delimiters.

* @return string TypoScript comment with the string text inside.

*/

$delimiter = '# ***********************************************';

}

return $out;

}

* @return void

* @see fetchGroupData()

*/

// Initializing workspace by evaluating and setting the workspace, possibly updating it in the user record!

$this->setWorkspace($this->user['workspace_id']);

// Setting up the db mount points of the (custom) workspace, if any:

// Initialize:

$newMounts = array();

$readPerms = '1=1'; // Notice: We cannot call $this->getPagePermsClause(1); as usual because the group-list is not available at this point. But bypassing is fine because all we want here is check if the workspace mounts are inside the current webmounts rootline. The actual permission checking on page level is done elsewhere as usual anyway before the page tree is rendered.

// Traverse mount points of the

foreach($mountPoints as $mpId) {

$newMounts[] = $mpId;

}

}

// Re-insert webmounts:

}

// Setting up the file mount points of the (custom) workspace, if any:

// Processing filemounts

}

}

$this->groupData['allowed_languages'] = $allowed_languages;

$this->groupData['allowed_languages'] = t3lib_div::uniqueList($this->groupData['allowed_languages']);

}

* @param string List of fields to select. Default fields are: uid,title,adminusers,members,reviewers,publish_access,stagechg_notification

* @return array TRUE if access. Output will also show how access was granted. Admin users will have a true output regardless of input.

*/

$retVal = FALSE;

// If not array, look up workspace record:

case '0':

case '-1':

$wsRec = array('uid' => $wsRec);

list($wsRec) = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows(

$fields,

'sys_workspace',

t3lib_BEfunc::deleteClause('sys_workspace'),

'',

'title'

}

// If wsRec is set to an array, evaluate it:

} else {

case '0':

break;

case '-1':

break;

default:

// Checking if the guy is admin:

return array_merge($wsRec, array('_ACCESS' => 'owner'));

}

// Checking if he is reviewer user:

return array_merge($wsRec, array('_ACCESS' => 'reviewer'));

}

// Checking if he is reviewer through a user group of his:

return array_merge($wsRec, array('_ACCESS' => 'reviewer'));

}

}

// Checking if he is member as user:

return array_merge($wsRec, array('_ACCESS' => 'member'));

}

// Checking if he is member through a user group of his:

return array_merge($wsRec, array('_ACCESS' => 'member'));

}

}

* @return array See checkWorkspace()

* @see checkWorkspace()

*/

if (!isset($this->checkWorkspaceCurrent_cache)) {

$this->checkWorkspaceCurrent_cache = $this->checkWorkspace($this->workspace);

}

* @param integer ID of workspace to set for backend user. If not valid the default workspace for BE user is found and set.

* @return void

*/

// Check workspace validity and if not found, revert to default workspace.

// Set workspace ID internally

$this->workspace = (int)$workspaceId;

} else {

$this->workspace = (int)$this->getDefaultWorkspace();

}

// Unset access cache:

unset($this->checkWorkspaceCurrent_cache);

// If ID is different from the stored one, change it:

$this->user['workspace_id'] = $this->workspace;

}

}

* @param boolean State of user preview.

* @return void

*/

$this->user['workspace_preview'] = $previewState;

}

/**

*

* @return integer Default workspace id. If no workspace is available it will be "-99"

*/

return 0;

return -1;

} else { // Traverse custom workspaces:

return $rec['uid'];

}

}

* @param integer Alternative Backend User ID (used for logging login actions where this is not yet known).

* @return integer Log entry ID.

*/

$fields_values = Array (

'userid' => $userId ? $userId : intval($this->user['uid']),

* @param integer Error level. 0 = message, 1 = error (user problem), 2 = System Error (which should not happen), 3 = security notice (admin)

* @return integer Log entry UID

*/

return $this->writelog(

4,

0,

$error,

0,

array()

);

}

* @return void

* @access private

*/

// get last flag set in the log for sending

$theTimeBack = $GLOBALS['EXEC_TIME'] - $secondsBack;

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery(

'tstamp',

'sys_log',

'',

'tstamp DESC',

'1'

);

$theTimeBack = $testRow['tstamp'];

}

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery(

'*',

'sys_log',

'',

'tstamp'

);

// OK, so there were more than the max allowed number of login failures - so we will send an email then.

$email_body = '

This is a dump of the failures:

';

$theData = unserialize($testRows['log_data']);

}

t3lib_utility_Mail::mail($email,

$subject,

$email_body,

'From: TYPO3 Login WARNING<>'

);

}

}

}

include_once($TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['t3lib/class.t3lib_userauthgroup.php']);

}