View | Details | Raw Unified | Return to bug 14437
Collapse All | Expand All

(-)a/C4/Auth.pm (-27 / +124 lines)
Lines 23-28 use Digest::MD5 qw(md5_base64); Link Here
23
use JSON qw/encode_json/;
23
use JSON qw/encode_json/;
24
use URI::Escape;
24
use URI::Escape;
25
use CGI::Session;
25
use CGI::Session;
26
use Scalar::Util qw(blessed);
26
27
27
require Exporter;
28
require Exporter;
28
use C4::Context;
29
use C4::Context;
Lines 31-41 use C4::Languages; Link Here
31
use C4::Branch;       # GetBranches
32
use C4::Branch;       # GetBranches
32
use C4::Search::History;
33
use C4::Search::History;
33
use Koha;
34
use Koha;
35
use Koha::Borrowers;
34
use Koha::AuthUtils qw(hash_password);
36
use Koha::AuthUtils qw(hash_password);
35
use POSIX qw/strftime/;
37
use POSIX qw/strftime/;
36
use List::MoreUtils qw/ any /;
38
use List::MoreUtils qw/ any /;
37
use Encode qw( encode is_utf8);
39
use Encode qw( encode is_utf8);
38
40
41
use Koha::Exception::BadParameter;
42
use Koha::Exception::UnknownObject;
43
39
# use utf8;
44
# use utf8;
40
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
45
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login);
41
46
Lines 1917-1938 sub get_all_subpermissions { Link Here
1917
}
1922
}
1918
1923
1919
=head2 haspermission
1924
=head2 haspermission
1925
PUBLIC
1926
1927
    my ($failedPermission, $borrowerPermissions) = C4::Auth::haspermission($borrowerOrIdentifier, $flagsrequired);
1928
    #or
1929
    #If you don't care about the reason why the permission check failed
1930
    my $borrowerPermissions = C4::Auth::haspermission($borrowerOrIdentifier, $flagsrequired);
1931
    #or
1932
    #Just get the borrower permissions
1933
    my $borrowerPermissions = C4::Auth::haspermission($borrowerOrIdentifier);
1934
1935
Finds the borrower's permission flags or checks if the borrower has the proper
1936
permissions if $flagsrequired is given.
1937
1938
C<$borrowerOrIdentifier> MANDATORY, either the userid of the borrower
1939
                         or a Koha::Borrower-object
1940
C<$flagsrequired> OPTIONAL, is a hashref of required flags
1941
                { borrowers => 1,               #Must have all borrowers permission
1942
                  circulate => *,               #Must have any circulate permission
1943
                  tools => 'stage_marc_import', #Must have the specific permission
1944
                }
1920
1945
1921
  $flags = ($userid, $flagsrequired);
1946
C<RETURNS> A List of String and a Reference to a HASH of HASHes, member's flags. Eg.
1947
            C<A successful permissions check>
1948
            (
1949
                undef,                                    ##No failed permission
1950
                { tools => 1,                             ##borrower permissions 
1951
                  catalogue =>  1,                        #All catalogue permissions
1952
                  circulate =>  { override_renewals => 1,
1953
                                  force_checkout => 1,
1954
                                },
1955
                  lists     =>  0,                        #No lists permissions
1956
                  ...
1957
                }
1958
            )
1959
            C<A failed permissions check>
1960
            (
1961
                "circulate => force_checkout",  ##The failed permission, see. C4::Auth::check_permissions()
1962
                0                               ##Notify that the check failed.
1963
            )
1964
1965
C<THROWS> Koha::Exception::UnknownObject, if no borrower is found.
1966
          Koha::Exception::BadParameter, if parameters are not properly given.
1967
=cut
1922
1968
1923
C<$userid> the userid of the member
1969
sub haspermission {
1924
C<$flags> is a hashref of required flags like C<$borrower-&lt;{authflags}> 
1970
    my ( $borrOrId, $flagsrequired ) = @_;
1971
    my ($borrower);
1925
1972
1926
Returns member's flags or 0 if a permission is not met.
1927
1973
1928
=cut
1974
    ##Validate parameters since this is a public subroutine
1975
    #The best thing would be to get a honest reference to the Borrower-object,
1976
    #but currently we can only prepare that some day somebody will use me properly.
1977
    if (blessed($borrOrId) && $borrOrId->isa('Koha::Borrower')) {
1978
        $borrower = $borrOrId;
1979
    }
1980
    #We can get back to the DBIx to refetch the Borrower-object from the given borrower identifier, again.
1981
    elsif ($borrOrId && length($borrOrId) > 0) {
1982
        my @b = Koha::Borrowers->search( {userid => $borrOrId} );
1983
        if ( $borrOrId eq C4::Context->config('user') ) { #Mock a Borrower-object for superuser
1984
            $borrower = Koha::Borrower->new();
1985
            $borrower->set({userid => $borrOrId});
1986
        }
1987
        elsif (scalar(@b)) {
1988
            $borrower = $b[0];
1989
        }
1990
        else {
1991
            Koha::Exception::UnknownObject->throw(error => __PACKAGE__."::haspermission():> No borrower found with the given borrower identifier '$borrOrId'.");
1992
        }
1993
    }
1994
    else {
1995
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::haspermission():> No borrower or borrowerIdentifier given.");
1996
    }
1929
1997
1930
sub haspermission {
1998
    ##Parameters validated, time to get the flags!
1931
    my ( $userid, $flagsrequired ) = @_;
1999
    my $userid = $borrower->userid();
1932
    my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?");
2000
    my $flags = getuserflags( $borrower->flags(), $userid );
1933
    $sth->execute($userid);
1934
    my $row = $sth->fetchrow();
1935
    my $flags = getuserflags( $row, $userid );
1936
    if ( $userid eq C4::Context->config('user') ) {
2001
    if ( $userid eq C4::Context->config('user') ) {
1937
2002
1938
        # Super User Account from /etc/koha.conf
2003
        # Super User Account from /etc/koha.conf
Lines 1944-1969 sub haspermission { Link Here
1944
        $flags->{'superlibrarian'} = 1;
2009
        $flags->{'superlibrarian'} = 1;
1945
    }
2010
    }
1946
2011
1947
    return $flags if $flags->{superlibrarian};
2012
    #This fcn returns the failed permission so a suitable error msg can be delivered.
2013
    my $failedPermission = ($flagsrequired) ? check_permissions($flagsrequired, $flags) : undef;
2014
    if ($failedPermission) {
2015
        return ($failedPermission, 0);
2016
    }
2017
    return ($failedPermission, $flags);
2018
}
2019
2020
=head check_permissions
2021
PUBLIC
2022
2023
    my $failedPermission = check_permissions($permissionsRequired, $permissions);
2024
2025
Check if the given $permissions satisfy the $permissionsRequired.
2026
@PARAM1 Reference to HASH of HASHes, see. C4::Auth::haspermission() $flagsrequired
2027
@PARAM2 Reference to HASH of HASHes, see. C4::Auth::haspermission() @RETURNS
2028
@RETURNS String, the failed permission, eg:
2029
         "circulate == 1", or "circulate == *", or "circulate => force_checkout"
2030
         or
2031
         undef if everything went ok.
2032
@THROWS Koha::Exception::BadParameter, if all parameters are not properly given.
2033
=cut
2034
2035
sub check_permissions {
2036
    my ($permissionsRequired, $permissions) = @_;
2037
2038
    ##Validate parameters, since this is a public subroutine
2039
    unless ($permissionsRequired && ref($permissionsRequired) eq 'HASH' && scalar(%$permissionsRequired)) {
2040
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::check_permission():> Mandatory parameter \$permissionsRequired is not given or is not a reference to HASH, or the HASH is empty.");
2041
    }
2042
    unless ($permissions && ref($permissions) eq 'HASH' && scalar(%$permissions)) {
2043
        Koha::Exception::BadParameter->throw(error => __PACKAGE__."::check_permission():> Mandatory parameter \$permissions is not given or is not a reference to HASH, or the HASH is empty.");
2044
    }
2045
2046
    ##Start checking permissions
2047
    return undef if $permissions->{superlibrarian};
1948
2048
1949
    foreach my $module ( keys %$flagsrequired ) {
2049
    my $failedPermission;
1950
        my $subperm = $flagsrequired->{$module};
2050
    foreach my $module ( keys %$permissionsRequired ) {
2051
        my $subperm = $permissionsRequired->{$module};
1951
        if ( $subperm eq '*' ) {
2052
        if ( $subperm eq '*' ) {
1952
            return 0 unless ( $flags->{$module} == 1 or ref( $flags->{$module} ) );
2053
            $failedPermission = {$module => '*'} unless ( $permissions->{$module} == 1 or
2054
                                                        ref( $permissions->{$module} ) );
1953
        } else {
2055
        } else {
1954
            return 0 unless (
2056
            $failedPermission = {$module => '1'} unless ( defined($permissions->{$module}) and
1955
                ( defined $flags->{$module} and
2057
                                                        $permissions->{$module} == 1 );
1956
                    $flags->{$module} == 1 )
2058
            $failedPermission = {$module => $subperm} unless ( ref($permissions->{$module}) and
1957
                or
2059
                                            exists($permissions->{$module}->{$subperm}) and
1958
                ( ref( $flags->{$module} ) and
2060
                                            $permissions->{$module}->{$subperm} == 1 );
1959
                    exists $flags->{$module}->{$subperm} and
1960
                    $flags->{$module}->{$subperm} == 1 )
1961
            );
1962
        }
2061
        }
2062
        last() if $failedPermission;
1963
    }
2063
    }
1964
    return $flags;
2064
    return $failedPermission || undef;
1965
1966
    #FIXME - This fcn should return the failed permission so a suitable error msg can be delivered.
1967
}
2065
}
1968
2066
1969
sub getborrowernumber {
2067
sub getborrowernumber {
1970
- 

Return to bug 14437