TYPO3 Core

var $usergroup_table = 'be_groups'; // The name of the group-table

// internal

);

var $workspace = -99; // User workspace. -99 is ERROR (none available), -1 is offline, 0 is online, >0 is custom workspaces.

var $workspaceRec = array(); // Custom workspace record if any

'fileoper_perms' => 0,

'allowed_languages' => '',

'workspace_perms' => '',

'custom_options' => '',

);

var $userTS_text = ''; // Contains the non-parsed user TSconfig

var $userTS = array(); // Contains the parsed user TSconfig

var $RTE_errors = array(); // RTE availability errors collected.

var $errorMsg = ''; // Contains last error message

*

* @return boolean

*/

}

/**

* @param integer Group ID to look for in $this->groupList

* @return boolean

*/

$groupId = intval($groupId);

return $this->inList($this->groupList, $groupId);

}

}

* @param integer $perms is the binary representation of the permission we are going to check. Every bit in this number represents a permission that must be set. See function explanation.

* @return boolean True or False upon evaluation

*/

$userPerms = $this->calcPerms($row);

}

/**

* @param boolean If set, then the function will exit with an error message.

* @return integer The page UID of a page in the rootline that matched a mount point

*/

$id = intval($id);

// Check if input id is an offline version page in which case we will map id to the online version:

$id = intval($checkRec['t3ver_oid']);

}

$wM = $this->returnWebmounts();

}

}

}

exit;

}

}

/**

* @param boolean If set, an array will issue an error message and exit.

* @return boolean Will return true if $MCONF['access'] is not set at all, if the BE_USER is admin or if the module is enabled in the be_users/be_groups records of the user (specifically enabled). Will return false if the module name is not even found in $TBE_MODULES

*/

if (!t3lib_BEfunc::isModuleSetInTBE_MODULES($conf['name'])) {

exit;

}

}

// Workspaces check:

// ok, go on...

} else {

exit;

}

}

}

// Returns true if conf[access] is not set at all or if the user is admin

// If $conf['access'] is set but not with 'admin' then we return true, if the module is found in the modList

}

exit;

}

/**

* @return string Part of where clause. Prefix " AND " to this.

*/

function getPagePermsClause($perms) {

global $TYPO3_CONF_VARS;

}

$perms = intval($perms); // Make sure it's integer.

}

// ****************

// getPagePermsClause-HOOK

}

}

} else {

}

}

/**

* @param array Input page row with all perms_* fields available.

* @return integer Bitwise representation of the users permissions in relation to input page row, $row

*/

global $TYPO3_CONF_VARS;

}

}

}

// ****************

*

* @return boolean

*/

global $CLIENT;

// Start:

$this->RTE_errors = array();

$this->RTE_errors[] = 'RTE is not enabled for user!';

$this->RTE_errors[] = 'RTE is not enabled in $TYPO3_CONF_VARS["BE"]["RTEenabled"]';

// Acquire RTE object:

$RTE = t3lib_BEfunc::RTEgetObj();

$this->RTE_errors = array_merge($this->RTE_errors, $RTE);

}

}

}

/**

* @return boolean True if permission is granted (that is, the value was found in the groupData list - or the BE_USER is "admin")

*/

function check($type, $value) {

if (isset($this->groupData[$type])) {

if ($this->isAdmin() || $this->inList($this->groupData[$type], $value)) {

}

}

}

/**

* @param string Auth mode keyword (explicitAllow, explicitDeny, individual)

* @return boolean True or false whether access is granted or not.

*/

global $TCA;

// Admin users can do anything:

// Allow all blank values:

// Certain characters are not allowed in the value

}

// Initialize:

$out = TRUE;

// Checking value:

case 'explicitAllow':

$out = FALSE;

}

break;

case 'explicitDeny':

$out = FALSE;

}

break;

case 'individual':

t3lib_div::loadTCA($table);

$items = $TCA[$table]['columns'][$field]['config']['items'];

case 'EXPL_ALLOW':

$out = FALSE;

}

break;

case 'EXPL_DENY':

$out = FALSE;

}

break;

}

break;

}

}

/**

* @param integer Language value to evaluate

* @return boolean Returns true if the language value is allowed, otherwise false.

*/

$langValue = intval($langValue);

}

}

}

/**

* @return boolean True if OK, otherwise false

*/

function recordEditAccessInternals($table, $idOrRow, $newRecord = FALSE, $deletedRecord = FALSE, $checkFullLanguageAccess = FALSE) {

global $TCA;

t3lib_div::loadTCA($table);

// Always return true for Admin users.

// Fetching the record if the $idOrRow variable was not an array on input:

if ($deletedRecord) {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow, '*', '', FALSE);

} else {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow);

}

$this->errorMsg = 'ERROR: Record could not be fetched.';

}

}

// Checking languages:

if (isset($idOrRow[$TCA[$table]['ctrl']['languageField']])) { // Language field must be found in input row - otherwise it does not make sense.

$this->errorMsg = 'ERROR: Language was not allowed.';

$this->errorMsg = 'ERROR: Related/affected language was not allowed.';

}

} else {

}

} elseif (isset($TCA[$table]['ctrl']['transForeignTable']) && $checkFullLanguageAccess && !$this->checkFullLanguagesAccess($table, $idOrRow)) {

}

// Checking authMode fields:

foreach ($TCA[$table]['columns'] as $fieldName => $fieldValue) {

if (isset($idOrRow[$fieldName])) {

if ($fieldValue['config']['type'] == 'select' && $fieldValue['config']['authMode'] && !strcmp($fieldValue['config']['authMode_enforce'], 'strict')) {

if (!$this->checkAuthMode($table, $fieldName, $idOrRow[$fieldName], $fieldValue['config']['authMode'])) {

$this->errorMsg = 'ERROR: authMode "' . $fieldValue['config']['authMode'] . '" failed for field "' . $fieldName . '" with value "' . $idOrRow[$fieldName] . '" evaluated';

}

}

}

}

// Checking "editlock" feature (doesn't apply to new records)

if ($idOrRow[$TCA[$table]['ctrl']['editlock']]) {

$this->errorMsg = 'ERROR: Record was locked for editing. Only admin users can change this state.';

}

} else {

}

}

'newRecord' => $newRecord

);

if (!t3lib_div::callUserFunction($funcRef, $params, $this)) {

}

}

}

// Finally, return true if all is well.

}

}

/**

public function isPSet($compiledPermissions, $tableName, $actionType = '') {

if ($this->isAdmin()) {

$result = TRUE;

switch($actionType) {

case 'edit':

$result = ($compiledPermissions & 2) !== 0;

*

* @return boolean

*/

// If the old BE is used (maybe with some parameters),

// check for options.enableShortcuts and options.shortcutFrame being set.

if (substr($this->getTSConfigVal('auth.BE.redirectToURL'), 0, 12) == 'alt_main.php') {

$this->getTSConfigVal('options.shortcutFrame') &&

!$this->getTSConfigVal('options.mayNotCreateEditShortcuts');

}

// If the new BE is used, don't check options.shortcutFrame,

// because this is not used there anymore.

else {

!$this->getTSConfigVal('options.mayNotCreateEditShortcuts');

}

}

/**

* @param array Integer (record uid) or array where fields are at least: pid, t3ver_wsid, t3ver_stage (if versioningWS is set)

* @return string String error code, telling the failure state. FALSE=All ok

*/

}

if (is_array($recData)) {

} else { // So what about the stage of the version, does that allow editing for this user?

}

} else { // We are testing a "live" record:

if ($res = $this->workspaceAllowLiveRecordsInPID($recData['pid'], $table)) { // For "Live" records, check that PID for table allows editing

// Live records are OK in this branch, but what about the stage of branch point, if any:

} else { // If not offline and not in versionized branch, output error:

}

}

} else {

}

}

/**

* @see workspaceCannotEditRecord()

*/

function workspaceCannotEditOfflineVersion($table,$recData) {

}

if (is_array($recData)) {

}

/**

* @param string Table name

* @return mixed Returns FALSE if a live record cannot be created and must be versionized in order to do so. 2 means a) Workspace is "Live" or workspace allows "live edit" of records from non-versionized tables (and the $table is not versionizable). 1 and -1 means the pid is inside a versionized branch where -1 means that the branch-point did NOT allow a new record according to its state.

*/

// Always for Live workspace AND if live-edit is enabled and tables are completely without versioning it is ok as well.

} elseif (t3lib_BEfunc::isPidInVersionizedBranch($pid, $table)) { // Check if records from $table can be created with this PID: Either if inside "branch" versioning type or a "versioning_followPages" table on a "page" versioning type.

// Now, check what the stage of that "page" or "branch" version type is:

$stage = t3lib_BEfunc::isPidInVersionizedBranch($pid, $table, TRUE);

} else {

}

}

/**

* @return boolean TRUE if OK.

*/

function workspaceCreateNewRecord($pid, $table) {

}

} elseif (!$GLOBALS['TCA'][$table]['ctrl']['versioningWS']) { // So, if no live records were allowed, we have to create a new version of this record:

}

}

/**

* @param integer PID of record

* @return boolean TRUE if ok.

*/

// Auto-creation of version: In offline workspace, test if versioning is enabled and look for workspace version of input record. If there is no versionized record found we will create one and save to that.

&& !$this->workspaceRec['disable_autocreate'] // Auto-creation must not be disabled.

&& $GLOBALS['TCA'][$table]['ctrl']['versioningWS'] // Table must be versionizable

&& $recpid >= 0 // The PID of the record must NOT be -1 or less (would indicate that it already was a version!)

&& !t3lib_BEfunc::getWorkspaceVersionOfRecord($this->workspace, $table, $id, 'uid') // There must be no existing version of this record in workspace.

return TRUE;

}

}

* @return boolean TRUE if user is allowed access

*/

function workspaceCheckStageForCurrent($stage) {

$stat = $this->checkWorkspaceCurrent();

$memberStageLimit = $this->workspaceRec['review_stage_edit'] ? 1 : 0;

}

}

/**

* @param integer Workspace UID; -1,0,1+

* @return boolean Returns TRUE if the user has access to publish content from the workspace ID given.

*/

$wsAccess = $this->checkWorkspace($wsid);

case 0: // Live workspace

break;

case -1: // Default draft workspace

break;

default: // Custom workspace

break;

}

}

}

/**

* @return boolean Returns TRUE if records can be swapped in the current workspace, otherwise false

*/

function workspaceSwapAccess() {

}

/**

* @param integer Versioning type to evaluation: -1, 0, >1

* @return boolean TRUE if OK

*/

// Check if only element versioning is allowed:

}

$stat = $this->checkWorkspaceCurrent();

switch((int)$type) {

case -1:

break;

case 0:

break;

default:

break;

}

}

/**

* @param integer Versioning type to evaluation: -1, 0, >1

* @return integer Returning versioning type

*/

case -1:

$type = -1;

break;

* @return array An array with two keys, "value" and "properties" where "value" is a string with the value of the objectsting and "properties" is an array with the properties of the objectstring.

* @params array An array with the TypoScript where the $objectString is located. If this argument is not an array, then internal ->userTS (User TSconfig for the current BE_USER) will be used instead.

*/

if (!is_array($config)) {

}

$key = $parts[0];

if (trim($key)) {

// Go on, get the next level

} else {

}

}

return $TSConf;

* @return string The value for that object string (object path)

* @see getTSConfig()

*/

$TSConf = $this->getTSConfig($objectString);

return $TSConf['value'];

}

* @param string The string to find in the list of items

* @return string Boolean

*/

}

/**

*

* @return array

*/

}

/**

* @return integer File operation permission bitmask

*/

public function getFileoperationPermissions() {

if ($this->isAdmin()) {

} else {

}

}

/**

* @param integer Bitmask

* @return boolean true if the confirmation should be shown

*/

}

* @access private

* @see t3lib_TSparser

*/

if ($this->user['uid']) {

// Get lists for the be_user record and set them as default/primary values.

$this->dataLists['fileoper_perms'] = (int)$this->user['fileoper_perms']; // Fileoperation permissions

// Setting default User TSconfig:

$GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig'];

// Default TSconfig for admin-users

admPanel.enable.all = 1

options.shortcutFrame = 1

';

if (t3lib_extMgm::isLoaded('sys_note')) {

// Setting defaults for sys_note author / email...

';

}

}

// FILE MOUNTS:

// Admin users has the base fileadmin dir mounted

}

// If userHomePath is set, we attempt to mount it

// First try and mount with [uid]_[username]

if (!$didMount) {

// If that failed, try and mount with only [uid]

}

}

// Get the groups...

# $grList = t3lib_BEfunc::getSQLselectableList($this->user[$this->usergroup_column],$this->usergroup_table,$this->usergroup_table);

$grList = $GLOBALS['TYPO3_DB']->cleanIntList($this->user[$this->usergroup_column]); // 240203: Since the group-field never contains any references to groups with a prepended table name we think it's safe to just intExplode and re-implode - which should be much faster than the other function call.

// Fetch groups will add a lot of information to the internal arrays: modules, accesslists, TSconfig etc. Refer to fetchGroups() function.

$this->fetchGroups($grList);

}

// Add the TSconfig for this specific user:

// Check include lines.

$this->TSdataArray = t3lib_TSparser::checkIncludeLines_array($this->TSdataArray);

if ($GLOBALS['TYPO3_CONF_VARS']['BE']['TSconfigConditions'] && !$this->userTS_dontGetCached) {

// Perform TS-Config parsing with condition matching

$this->userTS = $parseObj->setup;

t3lib_BEfunc::storeHash($hash, serialize($this->userTS), 'BE_USER_TSconfig');

// Update UC:

}

}

// Processing webmounts

if ($this->isAdmin() && !$this->getTSConfigVal('options.dontMountAdminMounts')) { // Admin's always have the root mounted

}

// Processing filemounts

$this->dataLists['filemount_list'] = t3lib_div::uniqueList($this->dataLists['filemount_list']);

if ($this->dataLists['filemount_list']) {

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'sys_filemounts', 'deleted=0 AND hidden=0 AND pid=0 AND uid IN ('.$this->dataLists['filemount_list'].')', '', $orderBy);

}

}

// The lists are cleaned for duplicates

$this->groupData['webmounts'] = t3lib_div::uniqueList($this->dataLists['webmount_list']);

$this->groupData['pagetypes_select'] = t3lib_div::uniqueList($this->dataLists['pagetypes_select']);

$this->groupData['tables_modify'] = t3lib_div::uniqueList($this->dataLists['tables_modify']);

$this->groupData['non_exclude_fields'] = t3lib_div::uniqueList($this->dataLists['non_exclude_fields']);

$this->groupData['explicit_allowdeny'] = t3lib_div::uniqueList($this->dataLists['explicit_allowdeny']);

$this->userGroupsUID = array_reverse(array_unique(array_reverse($this->includeGroupArray)));

// Finally this is the list of group_uid's in the order they are parsed (including subgroups!) and without duplicates (duplicates are presented with their last entrance in the list, which thus reflects the order of the TypoScript in TSconfig)

$this->setCachedList($this->groupList);

// Checking read access to webmounts:

unset($webmounts[$idx]);

}

}

}

// Setting up workspace situation (after webmounts are processed!):

* @return void

* @access private

*/

global $TYPO3_CONF_VARS;

// Fetching records of the groups in $grList (which are not blocked by lockedToDomain either):

// Hook for manipulation of the WHERE sql sentence which controls which BE-groups are included

if (is_array ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroupQuery'])) {

$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $this->usergroup_table, $whereSQL);

// The userGroups array is filled

$this->userGroups[$row['uid']] = $row;

}

// Traversing records in the correct order

// traversing list

// Get row:

// Include sub groups

if (trim($row['subgroup'])) {

}

// Add the group uid, current list, TSconfig to the internal arrays.

// Mount group database-mounts

// Mount group file-mounts

// Mount group home-dirs

// If groupHomePath is set, we attempt to mount it

if ($GLOBALS['TYPO3_CONF_VARS']['BE']['groupHomePath']) {

}

}

// The lists are made: groupMods, tables_select, tables_modify, pagetypes_select, non_exclude_fields, explicit_allowdeny, allowed_languages, custom_options

}

// Setting fileoperation permissions

$this->dataLists['workspace_perms'] |= $row['workspace_perms'];

// If this function is processing the users OWN group-list (not subgroups) AND if the ->firstMainGroup is not set, then the ->firstMainGroup will be set.

}

}

}

* @return void

* @access private

*/

if ((string)$cList != (string)$this->user['usergroup_cached_list']) {

}

}

* @return boolean Returns "1" if the requested filemount was mounted, otherwise no return value.

* @access private

*/

// Return false if fileadminDir is not set and we try to mount a relative path

// Trimming and pre-processing

}

// If the path is true and validates as a valid path string:

// normalize path: remove leading '/' and './', and trailing '/' and '/.'

} else {

}

}

// We now have a path with slash after and slash before (if unix)

if (@is_dir($path) &&

// Alternative title?

$name = $title ? $title : $altTitle;

// Adds the filemount. The same filemount with same name, type and path cannot be set up twice because of the hash string used as key.

// Return true - went well, success!

}

}

}

}

/**

function addTScomment($str) {

$delimiter = '# ***********************************************';

foreach($lines as $v) {

}

return $out;

}

* @return void

* @see fetchGroupData()

*/

// Initializing workspace by evaluating and setting the workspace, possibly updating it in the user record!

$this->setWorkspace($this->user['workspace_id']);

// Setting up the db mount points of the (custom) workspace, if any:

// Initialize:

$newMounts = array();

$readPerms = '1=1'; // Notice: We cannot call $this->getPagePermsClause(1); as usual because the group-list is not available at this point. But bypassing is fine because all we want here is check if the workspace mounts are inside the current webmounts rootline. The actual permission checking on page level is done elsewhere as usual anyway before the page tree is rendered.

// Traverse mount points of the

foreach($mountPoints as $mpId) {

$newMounts[] = $mpId;

}

}

// Re-insert webmounts:

}

// Setting up the file mount points of the (custom) workspace, if any:

// Processing filemounts

}

}

$this->groupData['allowed_languages'] = $allowed_languages;

$this->groupData['allowed_languages'] = t3lib_div::uniqueList($this->groupData['allowed_languages']);

}

* @param string List of fields to select. Default fields are: uid,title,adminusers,members,reviewers,publish_access,stagechg_notification

* @return array TRUE if access. Output will also show how access was granted. Admin users will have a true output regardless of input.

*/

// If not array, look up workspace record:

case '0':

case '-1':

$wsRec = array('uid' => $wsRec);

list($wsRec) = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows(

$fields,

'sys_workspace',

t3lib_BEfunc::deleteClause('sys_workspace'),

'',

'title'

}

// If wsRec is set to an array, evaluate it:

} else {

case '0':

break;

case '-1':

break;

default:

// Checking if the guy is admin:

}

// Checking if he is reviewer user:

}