TYPO3 Core

<?php

/***************************************************************

/**

* Contains an extension class specifically for authentication/initialization of backend users in TYPO3

*

*

* 135: class t3lib_userAuthGroup extends t3lib_userAuth

*

*

*

*

*

*

* TOTAL FUNCTIONS: 45

* (This index is automatically created/updated by the extension "extdeveval")

*/

/**

* Extension to class.t3lib_userauth.php; Authentication of users in TYPO3 Backend

*

* @subpackage t3lib

*/

class t3lib_userAuthGroup extends t3lib_userAuth {

// internal

);

'fileoper_perms' => 0,

'allowed_languages' => '',

'workspace_perms' => '',

'custom_options' => '',

);

/************************************

*

* Permission checking functions:

*

* @return boolean

*/

}

/**

* @param integer Group ID to look for in $this->groupList

* @return boolean

*/

$groupId = intval($groupId);

return $this->inList($this->groupList, $groupId);

}

}

*

* Bits for permissions, see $perms variable:

*

*

* @param array $row is the pagerow for which the permissions is checked

* @param integer $perms is the binary representation of the permission we are going to check. Every bit in this number represents a permission that must be set. See function explanation.

* @return boolean True or False upon evaluation

*/

$userPerms = $this->calcPerms($row);

}

/**

* @param boolean If set, then the function will exit with an error message.

* @return integer The page UID of a page in the rootline that matched a mount point

*/

$id = intval($id);

// Check if input id is an offline version page in which case we will map id to the online version:

$id = intval($checkRec['t3ver_oid']);

}

$wM = $this->returnWebmounts();

return $v['uid'];

}

}

* @param boolean If set, an array will issue an error message and exit.

* @return boolean Will return true if $MCONF['access'] is not set at all, if the BE_USER is admin or if the module is enabled in the be_users/be_groups records of the user (specifically enabled). Will return false if the module name is not even found in $TBE_MODULES

*/

if ($exitOnError) {

}

return FALSE;

}

// Workspaces check:

} else {

if ($exitOnError) {

}

return FALSE;

}

}

// Returns true if conf[access] is not set at all or if the user is admin

// If $conf['access'] is set but not with 'admin' then we return true, if the module is found in the modList

}

throw new RuntimeException('Access Error: You don\'t have access to this module.');

} else {

return $acs;

/**

* Returns a WHERE-clause for the pages-table where user permissions according to input argument, $perms, is validated.

* $perms is the "mask" used to select. Fx. if $perms is 1 then you'll get all pages that a user can actually see!

* If the user is 'admin' " 1=1" is returned (no effect)

* If the user is not set at all (->user is not an array), then " 1=0" is returned (will cause no selection results at all)

* The 95% use of this function is "->getPagePermsClause(1)" which will return WHERE clauses for *selecting* pages in backend listings - in other words this will check read permissions.

* @param integer Permission mask to use, see function description

* @return string Part of where clause. Prefix " AND " to this.

*/

global $TYPO3_CONF_VARS;

return ' 1=1';

}

}

if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['getPagePermsClause'])) {

$_params = array('currentClause' => $str, 'perms' => $perms);

$str = t3lib_div::callUserFunction($_funcRef, $_params, $this);

}

* @param array Input page row with all perms_* fields available.

* @return integer Bitwise representation of the users permissions in relation to input page row, $row

*/

global $TYPO3_CONF_VARS;

}

}

}

if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['calcPerms'])) {

$_params = array(

'row' => $row,

'outputPermissions' => $out

*

* @return boolean

*/

global $CLIENT;

// Start:

$this->RTE_errors = array();

$this->RTE_errors[] = 'RTE is not enabled for user!';

$this->RTE_errors[] = 'RTE is not enabled in $TYPO3_CONF_VARS["BE"]["RTEenabled"]';

// Acquire RTE object:

$RTE = t3lib_BEfunc::RTEgetObj();

$this->RTE_errors = array_merge($this->RTE_errors, $RTE);

}

return TRUE;

} else {

return FALSE;

* @param string Auth mode keyword (explicitAllow, explicitDeny, individual)

* @return boolean True or false whether access is granted or not.

*/

global $TCA;

// Admin users can do anything:

// Allow all blank values:

// Certain characters are not allowed in the value

return FALSE;

}

// Initialize:

$out = TRUE;

// Checking value:

case 'explicitAllow':

$out = FALSE;

}

break;

case 'explicitDeny':

$out = FALSE;

}

break;

case 'individual':

t3lib_div::loadTCA($table);

$items = $TCA[$table]['columns'][$field]['config']['items'];

case 'EXPL_ALLOW':

$out = FALSE;

}

break;

case 'EXPL_DENY':

$out = FALSE;

}

break;

}

}

}

}

* @param integer Language value to evaluate

* @return boolean Returns true if the language value is allowed, otherwise false.

*/

$langValue = intval($langValue);

return FALSE;

}

}

/**

* Check if user has access to all existing localizations for a certain record

*

* @return boolean

*/

function checkFullLanguagesAccess($table, $record) {

$recordLocalizationAccess = $this->checkLanguageAccess(0);

if ($recordLocalizationAccess

)

) {

);

if (is_array($recordLocalizations)) {

$recordLocalizationAccess = $recordLocalizationAccess

if (!$recordLocalizationAccess) {

break;

}

function recordEditAccessInternals($table, $idOrRow, $newRecord = FALSE, $deletedRecord = FALSE, $checkFullLanguageAccess = FALSE) {

global $TCA;

t3lib_div::loadTCA($table);

// Always return true for Admin users.

// Fetching the record if the $idOrRow variable was not an array on input:

if ($deletedRecord) {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow, '*', '', FALSE);

} else {

$idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow);

}

$this->errorMsg = 'ERROR: Record could not be fetched.';

return FALSE;

}

}

// Checking languages:

$this->errorMsg = 'ERROR: Language was not allowed.';

return FALSE;

$this->errorMsg = 'ERROR: Related/affected language was not allowed.';

return FALSE;

}

} else {

return FALSE;

}

} elseif (isset($TCA[$table]['ctrl']['transForeignTable']) && $checkFullLanguageAccess && !$this->checkFullLanguagesAccess($table, $idOrRow)) {

}

// Checking authMode fields:

foreach ($TCA[$table]['columns'] as $fieldName => $fieldValue) {

if (isset($idOrRow[$fieldName])) {

if ($fieldValue['config']['type'] == 'select' && $fieldValue['config']['authMode'] && !strcmp($fieldValue['config']['authMode_enforce'], 'strict')) {

}

// Checking "editlock" feature (doesn't apply to new records)

$this->errorMsg = 'ERROR: Record was locked for editing. Only admin users can change this state.';

return FALSE;

}

} else {

return FALSE;

}

}

// Checking record permissions

// Process any hooks

$params = array(

'table' => $table,

'idOrRow' => $idOrRow,

$result = TRUE;

}

elseif ($tableName == 'pages') {

case 'edit':

$result = ($compiledPermissions & 2) !== 0;

case 'new':

$result = ($compiledPermissions & (8 + 16)) !== 0;

case 'delete':

$result = ($compiledPermissions & 4) !== 0;

case 'editcontent':

$result = ($compiledPermissions & 16) !== 0;

default:

$result = FALSE;

}

*

* @return boolean

*/

// "Shortcuts" have been renamed to "Bookmarks"

// @deprecated remove shortcuts code in TYPO3 4.7

|| $this->getTSConfigVal('options.enableBookmarks'))

}

/**

* Checking if editing of an existing record is allowed in current workspace if that is offline.

* Rules for editing in offline mode:

*

* @param string Table of record

* @param array Integer (record uid) or array where fields are at least: pid, t3ver_wsid, t3ver_stage (if versioningWS is set)

* @return string String error code, telling the failure state. FALSE=All ok

*/

}

return 'Versioning disabled for table';

return 'Workspace ID of record didn\'t match current workspace';

}

return 'Online record was not in versionized branch!';

}

}

}

}

* @return string String error code, telling the failure state. FALSE=All ok

* @see workspaceCannotEditRecord()

*/

}

/**

* Check if "live" records from $table may be created or edited in this PID.

* @param string Table name

* @return mixed Returns FALSE if a live record cannot be created and must be versionized in order to do so. 2 means a) Workspace is "Live" or workspace allows "live edit" of records from non-versionized tables (and the $table is not versionizable). 1 and -1 means the pid is inside a versionized branch where -1 means that the branch-point did NOT allow a new record according to its state.

*/

// Always for Live workspace AND if live-edit is enabled and tables are completely without versioning it is ok as well.

// Now, check what the stage of that "page" or "branch" version type is:

$stage = t3lib_BEfunc::isPidInVersionizedBranch($pid, $table, TRUE);

return $this->workspaceCheckStageForCurrent($stage) ? 1 : -1;

} else {

}

}

* @param string Table name

* @return boolean TRUE if OK.

*/

}

return FALSE;

}

return TRUE;

* @param integer PID of record

* @return boolean TRUE if ok.

*/

// Auto-creation of version: In offline workspace, test if versioning is enabled and look for workspace version of input record. If there is no versionized record found we will create one and save to that.

}

}

* @param integer Stage id from an element: -1,0 = editing, 1 = reviewer, >1 = owner

* @return boolean TRUE if user is allowed access

*/

$stat = $this->checkWorkspaceCurrent();

// Check if custom staging is activated

$workspaceRec = t3lib_BEfunc::getRecord('sys_workspace', $stat['uid']);

// Get custom stage record

$workspaceStageRec = t3lib_BEfunc::getRecord('sys_workspace_stage', $stage);

// Check if the user is responsible for the current stage

if ((t3lib_div::inList($workspaceStageRec['responsible_persons'], 'be_users_' . $this->user['uid'])

|| $stat['_ACCESS'] === 'owner') {

return TRUE; // OK for these criteria

}

// Check if the user is in a group which is responsible for the current stage

foreach ($this->userGroupsUID as $groupUid) {

if ((t3lib_div::inList($workspaceStageRec['responsible_persons'], 'be_groups_' . $groupUid)

|| $stat['_ACCESS'] === 'owner') {

return TRUE; // OK for these criteria

}

} else {

$memberStageLimit = $this->workspaceRec['review_stage_edit'] ? 1 : 0;

if (($stage <= $memberStageLimit && $stat['_ACCESS'] === 'member')

}

}

}

/**

* @param integer Workspace UID; -1,0,1+

* @return boolean Returns TRUE if the user has access to publish content from the workspace ID given.

*/

// If no access to workspace, of course you cannot publish!

$retVal = FALSE;

$wsAccess = $this->checkWorkspace($wsid);

break;

break;

break;

}

}

*

* @return boolean Returns TRUE if records can be swapped in the current workspace, otherwise false

*/

return FALSE;

/**

* Workspace Versioning type access. Check wether the requsted type of versioning (element/page/branch) is allowd in current workspace

* >1 = branch (deprecated), indicating the "nesting" level

* @return boolean TRUE if OK

*/

$retVal = FALSE;

// Check if only element versioning is allowed:

return FALSE;

}

$stat = $this->checkWorkspaceCurrent();

case -1:

break;

case 0:

break;

default:

break;

}

return $retVal;

}

* @param integer Versioning type to evaluation: -1, 0, >1

* @return integer Returning versioning type

*/

case -1:

$type = -1;

break;

}

/*************************************

*

* Miscellaneous functions

* @return array An array with two keys, "value" and "properties" where "value" is a string with the value of the objectsting and "properties" is an array with the properties of the objectstring.

* @params array An array with the TypoScript where the $objectString is located. If this argument is not an array, then internal ->userTS (User TSconfig for the current BE_USER) will be used instead.

*/

}

$key = $parts[0];

} else {

}

}

return $TSConf;

* @return string The value for that object string (object path)

* @see getTSConfig()

*/

$TSConf = $this->getTSConfig($objectString);

return $TSConf['value'];

}

* @return array The properties for that object string (object path) - if any

* @see getTSConfig()

*/

$TSConf = $this->getTSConfig($objectString);

return $TSConf['properties'];

}

* @param string The string to find in the list of items

* @return string Boolean

*/

}

/**

*

* @return array

*/

}

/**

*

* @return array

*/

return $this->groupData['filemounts'];

}

* Permissions of the user and groups the user is a member of were combined by a logical OR.

*

* Meaning of each bit:

*

* @return integer File operation permission bitmask

*/

* Returns true or false, depending if an alert popup (a javascript confirmation) should be shown

* call like $GLOBALS['BE_USER']->jsConfirmation($BITMASK)

*

*

* @param integer Bitmask

* @return boolean true if the confirmation should be shown

*/

/*************************************

*

* Authentication methods

* @access private

* @see t3lib_TSparser

*/

// Get lists for the be_user record and set them as default/primary values.

// Setting default User TSconfig:

// Default TSconfig for admin-users

admPanel.enable.all = 1

';

';

}

}

// FILE MOUNTS:

// Admin users has the base fileadmin dir mounted

}

// If userHomePath is set, we attempt to mount it

// First try and mount with [uid]_[username]

// If that failed, try and mount with only [uid]

}

}

// BE_GROUPS:

// Get the groups...

// Fetch groups will add a lot of information to the internal arrays: modules, accesslists, TSconfig etc. Refer to fetchGroups() function.

$this->fetchGroups($grList);

}

// Add the TSconfig for this specific user:

// Check include lines.

$this->TSdataArray = t3lib_TSparser::checkIncludeLines_array($this->TSdataArray);

if ($GLOBALS['TYPO3_CONF_VARS']['BE']['TSconfigConditions'] && !$this->userTS_dontGetCached) {

// Perform TS-Config parsing with condition matching

$this->userTS = $parseObj->setup;

t3lib_BEfunc::storeHash($hash, serialize($this->userTS), 'BE_USER_TSconfig');

// Update UC:

}

}

// Processing webmounts

}

// Processing filemounts

t3lib_div::loadTCA('sys_filemounts');

$orderBy = $GLOBALS['TCA']['sys_filemounts']['ctrl']['default_sortby'] ? $GLOBALS['TYPO3_DB']->stripOrderBy($GLOBALS['TCA']['sys_filemounts']['ctrl']['default_sortby']) : 'sorting';

$this->dataLists['filemount_list'] = t3lib_div::uniqueList($this->dataLists['filemount_list']);

}

}

// The lists are cleaned for duplicates

$this->groupData['webmounts'] = t3lib_div::uniqueList($this->dataLists['webmount_list']);

$this->groupData['pagetypes_select'] = t3lib_div::uniqueList($this->dataLists['pagetypes_select']);

$this->groupData['tables_modify'] = t3lib_div::uniqueList($this->dataLists['tables_modify']);

$this->groupData['non_exclude_fields'] = t3lib_div::uniqueList($this->dataLists['non_exclude_fields']);

$this->groupData['explicit_allowdeny'] = t3lib_div::uniqueList($this->dataLists['explicit_allowdeny']);

$this->userGroupsUID = array_reverse(array_unique(array_reverse($this->includeGroupArray)));

// Finally this is the list of group_uid's in the order they are parsed (including subgroups!) and without duplicates (duplicates are presented with their last entrance in the list, which thus reflects the order of the TypoScript in TSconfig)

$this->setCachedList($this->groupList);

// Checking read access to webmounts:

unset($webmounts[$idx]);

}

}

}

// Setting up workspace situation (after webmounts are processed!):

* @return void

* @access private

*/

global $TYPO3_CONF_VARS;

// Fetching records of the groups in $grList (which are not blocked by lockedToDomain either):