1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
|
#
# Bad translation from the original phpgacl class
#
# implemented: acl_check, acl_query, acl_get_groups
#
# NOTES:
# Changed initialization to use either default settings, object init options
# for adodb connection or optionally a passed in adodb connection object.
#
# TODO: implement complete interface, right now it only queries DB for permissions
# TODO: make this good python code, right now its a rough copy of php (YUCK!).
# TODO: implement caching and debug (debug is called in code, keeping var to false to prevent errors)
#
from sets import Set
class gacl:
__debug = False
__db_table_prefix = 'gacl_'
__db_type = 'mysql'
__db_host = 'localhost'
__db_user = ''
__db_password = ''
__db_name = 'gacl'
__caching = False
__force_cache_expire = True
__cache_dir = '/tmp/pygacl_cache'
__cache_expire_time=600
__group_switch = '_group_'
__conn = None
def __init__(self, conn=None, opts=None):
useropts = Set()
# valid options
options = Set(['debug','items_per_page','max_select_box_items','max_search_return_items',
'db_table_prefix','db_type','db_host','db_user','db_password','db_name',
'caching','force_cache_expire','cache_dir','cache_expire_time'])
# keep only valid options
if (opts):
useropts = Set([key for key in opts.items()])
useropts = options & useropts
for k in useropts:
myexpr = "self.__" + k + " = opts['" + k + "']"
eval(myexpr)
# get passed connection or create new one from config
if conn:
self.__conn = conn
else:
import adodb
self.__conn = adodb.NewADOConnection(__db_type)
self.__conn.Connect(__db_host,__db_user,__db_password,__db_name)
def acl_check(self, aco_section_value, aco_value, aro_section_value, aro_value, axo_section_value=None, axo_value=None, root_aro_group=None, root_axo_group=None):
acl_result = self.acl_query(aco_section_value, aco_value, aro_section_value, aro_value, axo_section_value, axo_value, root_aro_group, root_axo_group)
if acl_result:
return acl_result['allow']
else:
return False
def acl_query(self, aco_section_value, aco_value, aro_section_value, aro_value, axo_section_value=None, axo_value=None, root_aro_group=None, root_axo_group=None, debug=None):
#TODO: implement caching
cresult = ''
if not cresult:
sql_aro_group_ids = ""
sql_axo_group_ids = ""
# Get groups
aro_group_ids = self.acl_get_groups(aro_section_value, aro_value, root_aro_group, 'ARO')
if aro_group_ids:
sql_aro_group_ids = ','.join(aro_group_ids.items())
if axo_section_value != '' and axo_value != '':
axo_group_ids = self.acl_get_groups(axo_section_value, axo_value, root_axo_group, 'AXO')
if axo_group_ids:
sql_axo_group_ids = ','.join(axo_group_ids.items())
# Create query
order_by = []
query = 'SELECT a.id,a.allow,a.return_value '
query +=' FROM ' + self.__db_table_prefix + 'acl a '
query +=' LEFT JOIN ' + self.__db_table_prefix + 'aco_map ac ON ac.acl_id=a.id '
if aro_section_value != self.__group_switch:
query += ' LEFT JOIN ' + self.__db_table_prefix + 'aro_map ar ON ar.acl_id=a.id '
if axo_section_value != self.__group_switch:
query += ' LEFT JOIN ' + self.__db_table_prefix + 'axo_map ax ON ax.acl_id=a.id '
# Only join by group if we have any
if sql_aro_group_ids:
query += ' LEFT JOIN ' + self.__db_table_prefix + 'aro_groups_map arg ON arg.acl_id=a.id \
LEFT JOIN ' + self.__db_table_prefix + 'aro_groups rg ON rg.id=arg.group_id \
LEFT JOIN ' + self.__db_table_prefix + 'axo_groups_map axg ON axg.acl_id=a.id '
# Only join by group if we have any
if sql_axo_group_ids:
query += ' LEFT JOIN ' + self.__db_table_prefix + 'axo_groups xg ON xg.id=axg.group_id '
# Here comes the Where
query += ' WHERE a.enabled=1 and (ac.section_value=' + self.__conn.quote(aco_section_value) + \
' and ac.value=' + self.__conn.quote(aco_value) + ') '
if aro_section_value == self.__group_switch:
if not sql_aro_group_ids:
self.debug_text ('acl_query(): Invalid ARO Group: ' + aro_value)
return False
query += ' AND rg.id IN (' + sql_aro_group_ids + ') '
order_by.append('(rg.rgt-rg.lft) ASC')
else:
query += ' AND ((ar.section_value=' + self.__conn.quote(aro_section_value) + \
' AND ar.value=' + self.__conn.quote(aro_value) + ') '
if sql_aro_group_ids:
order_by.append('(CASE WHEN ar.value IS NULL THEN 0 ELSE 1 END) DESC')
order_by.append('(rg.rgt-rg.lft) ASC')
query += ')'
# for axo groups
if axo_section_value == self.__group_switch:
if not sql_axo_group_ids:
self.debug_text('acl_query(): Invalid AXO Group: ' + axo_value)
return False
query += 'AND xg.id IN (' + sql_axo_group_ids + ')'
order_by.append('(xg.rgt-xg.lft) ASC')
query += 'AND ('
if (axo_section_value == '' and axo_value == ''):
query += '(ax.section_value IS NULL and ax.value IS NULL)'
else:
query += '(ax.section_value=' + self.__conn.quote(axo_section_value) + \
' and ax.value=' + self.__conn.quote(axo_value) + ')' + ' OR xg.id IN (' + sql_axo_group_ids + ')'
order_by.append('(CASE WHEN ax.value IS NULL THEN 0 ELSE 1 END) DESC')
order_by.append('(xg.rgt-xg.lft) ASC')
query += ')'
# else:
# query += ' AND axg.group_id IS NULL'
order_by.append('a.updated_date DESC')
query += ' ORDER BY ' + ','.join(order_by) + ' '
rs = self.__conn.Execute(query)
if not rs:
self.debug_text('acl_query empty: ' + query)
return False
row = rs.fields
rs.MoveNext()
row = rs.fields
if (row):
if row[1] and row[1] == 1:
allow = True
else:
allow = False
retarr = {'acl_id': row[0], 'return_value': row[2], 'allow': allow}
else:
retarr = {'acl_id': None, 'return_value': None , 'allow': False}
if self.__debug == True:
retarr['query'] = query
self.debug_text("<b>acl_query():</b> ACO Section: aco_section_value ACO Value: aco_value ARO Section: aro_section_value ARO Value aro_value ACL ID: " + retarr['acl_id'] + ' Result: ' + retarr['allow'])
return retarr
def acl_get_groups(self, section_value, value, root_group=None, group_type='ARO'):
if (group_type == 'axo' or group_type == 'AXO'):
group_type = 'axo'
object_table = self.__db_table_prefix + 'axo'
group_table = self.__db_table_prefix + 'axo_groups'
group_map_table = self.__db_table_prefix +'groups_axo_map'
else:
group_type = 'aro'
object_table = self.__db_table_prefix + 'aro'
group_table = self.__db_table_prefix + 'aro_groups'
group_map_table = self.__db_table_prefix + 'groups_aro_map'
# TODO: implement cache
# Make sure we get the groups
query = 'SELECT DISTINCT g2.id'
if (section_value == self.__group_switch):
query += ' FROM ' + group_table + ' g1,' + group_table + ' g2'
where = ' WHERE g1.value=' + value
else:
query += ' FROM ' + object_table + ' o,' + group_map_table + ' gm,' + group_table + ' g1,' + group_table + ' g2'
where = ' WHERE (o.section_value=' + self.__conn.quote(section_value) + ' AND o.value=' + \
self.__conn.quote(value) + ') AND gm.' + group_type + '_id=o.id AND g1.id=gm.group_id'
if ( root_group != ''):
query += ','+ group_table +' g3'
where += ' AND g3.value=' + self.__conn.quote(root_group) + \
' AND ((g2.lft BETWEEN g3.lft AND g1.lft) AND (g2.rgt BETWEEN g1.rgt AND g3.rgt))'
else:
where += ' AND (g2.lft <= g1.lft AND g2.rgt >= g1.rgt)'
query += where
rs = self.__conn.Execute(query)
if rs == None:
print conn.ErrorMsg()
return False
retarr = Set()
while not rs.EOF:
retarr.append(reset(rs.fields))
rs.MoveNext()
return retarr
|
GitWeb