View | Details | Raw Unified | Return to bug 14437
Collapse All | Expand All

(-)a/C4/Auth.pm (-28 / +118 lines)
Lines 23-28 use Digest::MD5 qw(md5_base64); Link Here
23
use JSON qw/encode_json/;
23
use JSON qw/encode_json/;
24
use URI::Escape;
24
use URI::Escape;
25
use CGI::Session;
25
use CGI::Session;
26
use Scalar::Util qw(blessed);
26
27
27
require Exporter;
28
require Exporter;
28
use C4::Context;
29
use C4::Context;
Lines 31-41 use C4::Languages; Link Here
31
use C4::Branch;       # GetBranches
32
use C4::Branch;       # GetBranches
32
use C4::Search::History;
33
use C4::Search::History;
33
use Koha;
34
use Koha;
35
use Koha::Borrowers;
34
use Koha::AuthUtils qw(hash_password);
36
use Koha::AuthUtils qw(hash_password);
35
use POSIX qw/strftime/;
37
use POSIX qw/strftime/;
36
use List::MoreUtils qw/ any /;
38
use List::MoreUtils qw/ any /;
37
use Encode qw( encode is_utf8);
39
use Encode qw( encode is_utf8);
38
40
41
use Koha::Exception::BadParameter;
42
use Koha::Exception::UnknownObject;
43
39
# use utf8;
44
# use utf8;
40
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
45
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
41
46
Lines 1915-1936 sub get_all_subpermissions { Link Here
1915
}
1920
}
1916
1921
1917
=head2 haspermission
1922
=head2 haspermission
1923
PUBLIC
1924
1925
    my ($failedPermission, $borrowerPermissions) = C4::Auth::haspermission($borrowerOrIdentifier, $flagsrequired);
1926
    #or
1927
    #If you don't care about the reason why the permission check failed
1928
    my $borrowerPermissions = C4::Auth::haspermission($borrowerOrIdentifier, $flagsrequired);
1929
    #or
1930
    #Just get the borrower permissions
1931
    my $borrowerPermissions = C4::Auth::haspermission($borrowerOrIdentifier);
1932
1933
Finds the borrower's permission flags or checks if the borrower has the proper
1934
permissions if $flagsrequired is given.
1935
1936
C<$borrowerOrIdentifier> MANDATORY, either the userid of the borrower
1937
                         or a Koha::Borrower-object
1938
C<$flagsrequired> OPTIONAL, is a hashref of required flags
1939
                { borrowers => 1,               #Must have all borrowers permission
1940
                  circulate => *,               #Must have any circulate permission
1941
                  tools => 'stage_marc_import', #Must have the specific permission
1942
                }
1918
1943
1919
  $flags = ($userid, $flagsrequired);
1944
C<RETURNS> A List of String and a Reference to a HASH of HASHes, member's flags. Eg.
1920
1945
            C<A successful permissions check>
1921
C<$userid> the userid of the member
1946
            (
1922
C<$flags> is a hashref of required flags like C<$borrower-&lt;{authflags}> 
1947
                undef,                                    ##No failed permission
1923
1948
                { tools => 1,                             ##borrower permissions 
1924
Returns member's flags or 0 if a permission is not met.
1949
                  catalogue =>  1,                        #All catalogue permissions
1925
1950
                  circulate =>  { override_renewals => 1,
1951
                                  force_checkout => 1,
1952
                                },
1953
                  lists     =>  0,                        #No lists permissions
1954
                  ...
1955
                }
1956
            )
1957
            C<A failed permissions check>
1958
            (
1959
                "circulate => force_checkout",  ##The failed permission, see. C4::Auth::check_permissions()
1960
                0                               ##Notify that the check failed.
1961
            )
1962
1963
C<THROWS> Koha::Exception::UnknownObject, if no borrower is found.
1964
          Koha::Exception::BadParameter, if parameters are not properly given.
1926
=cut
1965
=cut
1927
1966
1928
sub haspermission {
1967
sub haspermission {
1929
    my ( $userid, $flagsrequired ) = @_;
1968
    my ( $borrOrId, $flagsrequired ) = @_;
1930
    my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
1969
    my ($borrower);
1931
    $sth->execute($userid);
1970
1932
    my $row = $sth->fetchrow();
1971
    ##Validate parameters since this is a public subroutine
1933
    my $flags = getuserflags( $row, $userid );
1972
    #The best thing would be to get a honest reference to the Borrower-object,
1973
    #but currently we can only prepare that some day somebody will use me properly.
1974
    if (blessed($borrOrId) && $borrOrId->isa('Koha::Borrower')) {
1975
        $borrower = $borrOrId;
1976
    }
1977
    #We can get back to the DBIx to refetch the Borrower-object from the given borrower identifier, again.
1978
    elsif ($borrOrId && length($borrOrId) > 0) {
1979
        my @b = Koha::Borrowers->search( {userid => $borrOrId} );
1980
        unless (scalar(@b)) {
1981
            Koha::Exception::UnknownObject->throw(error => __PACKAGE__."::haspermission():> No borrower found with the given borrower identifier '$borrOrId'.");
1982
        }
1983
        $borrower = $b[0];
1984
    }
1985
    else {
1986
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::haspermission():> No borrower or borrowerIdentifier given.");
1987
    }
1988
1989
    ##Parameters validated, time to get the flags!
1990
    my $userid = $borrower->userid();
1991
    my $flags = getuserflags( $borrower->flags(), $userid );
1934
    if ( $userid eq C4::Context->config('user') ) {
1992
    if ( $userid eq C4::Context->config('user') ) {
1935
1993
1936
        # Super User Account from /etc/koha.conf
1994
        # Super User Account from /etc/koha.conf
Lines 1942-1967 sub haspermission { Link Here
1942
        $flags->{'superlibrarian'} = 1;
2000
        $flags->{'superlibrarian'} = 1;
1943
    }
2001
    }
1944
2002
1945
    return $flags if $flags->{superlibrarian};
2003
    #This fcn returns the failed permission so a suitable error msg can be delivered.
2004
    my $failedPermission = ($flagsrequired) ? check_permissions($flagsrequired, $flags) : undef;
2005
    if ($failedPermission) {
2006
        return ($failedPermission, 0);
2007
    }
2008
    return ($failedPermission, $flags);
2009
}
2010
2011
=head check_permissions
2012
PUBLIC
2013
2014
    my $failedPermission = check_permissions($permissionsRequired, $permissions);
2015
2016
Check if the given $permissions satisfy the $permissionsRequired.
2017
@PARAM1 Reference to HASH of HASHes, see. C4::Auth::haspermission() $flagsrequired
2018
@PARAM2 Reference to HASH of HASHes, see. C4::Auth::haspermission() @RETURNS
2019
@RETURNS String, the failed permission, eg:
2020
         "circulate == 1", or "circulate == *", or "circulate => force_checkout"
2021
         or
2022
         undef if everything went ok.
2023
@THROWS Koha::Exception::BadParameter, if all parameters are not properly given.
2024
=cut
2025
2026
sub check_permissions {
2027
    my ($permissionsRequired, $permissions) = @_;
1946
2028
1947
    foreach my $module ( keys %$flagsrequired ) {
2029
    ##Validate parameters, since this is a public subroutine
1948
        my $subperm = $flagsrequired->{$module};
2030
    unless ($permissionsRequired && ref($permissionsRequired) eq 'HASH' && scalar(%$permissionsRequired)) {
2031
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::check_permission():> Mandatory parameter \$permissionsRequired is not given or is not a reference to HASH, or the HASH is empty.");
2032
    }
2033
    unless ($permissions && ref($permissions) eq 'HASH' && scalar(%$permissions)) {
2034
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::check_permission():> Mandatory parameter \$permissions is not given or is not a reference to HASH, or the HASH is empty.");
2035
    }
2036
2037
    ##Start checking permissions
2038
    return undef if $permissions->{superlibrarian};
2039
2040
    my $failedPermission;
2041
    foreach my $module ( keys %$permissionsRequired ) {
2042
        my $subperm = $permissionsRequired->{$module};
1949
        if ( $subperm eq '*' ) {
2043
        if ( $subperm eq '*' ) {
1950
            return 0 unless ( $flags->{$module} == 1 or ref( $flags->{$module} ) );
2044
            $failedPermission = "$module == *" unless ( $permissions->{$module} == 1 or
2045
                                                        ref( $permissions->{$module} ) );
1951
        } else {
2046
        } else {
1952
            return 0 unless (
2047
            $failedPermission = "$module == 1" unless ( defined($permissions->{$module}) and
1953
                ( defined $flags->{$module} and
2048
                                                        $permissions->{$module} == 1 );
1954
                    $flags->{$module} == 1 )
2049
            $failedPermission = "$module -> $subperm" unless ( ref($permissions->{$module}) and
1955
                or
2050
                                            exists($permissions->{$module}->{$subperm}) and
1956
                ( ref( $flags->{$module} ) and
2051
                                            $permissions->{$module}->{$subperm} == 1 );
1957
                    exists $flags->{$module}->{$subperm} and
1958
                    $flags->{$module}->{$subperm} == 1 )
1959
            );
1960
        }
2052
        }
2053
        last() if $failedPermission;
1961
    }
2054
    }
1962
    return $flags;
2055
    return $failedPermission || undef;
1963
1964
    #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
1965
}
2056
}
1966
2057
1967
sub getborrowernumber {
2058
sub getborrowernumber {
1968
- 

Return to bug 14437