diff options
Diffstat (limited to 'framework/web/auth')
| -rw-r--r-- | framework/web/auth/CAccessControlFilter.php | 342 | ||||
| -rw-r--r-- | framework/web/auth/CAuthAssignment.php | 107 | ||||
| -rw-r--r-- | framework/web/auth/CAuthItem.php | 277 | ||||
| -rw-r--r-- | framework/web/auth/CAuthManager.php | 166 | ||||
| -rw-r--r-- | framework/web/auth/CBaseUserIdentity.php | 132 | ||||
| -rw-r--r-- | framework/web/auth/CDbAuthManager.php | 600 | ||||
| -rw-r--r-- | framework/web/auth/CPhpAuthManager.php | 504 | ||||
| -rw-r--r-- | framework/web/auth/CUserIdentity.php | 82 | ||||
| -rw-r--r-- | framework/web/auth/CWebUser.php | 796 | ||||
| -rw-r--r-- | framework/web/auth/schema-mssql.sql | 42 | ||||
| -rw-r--r-- | framework/web/auth/schema-mysql.sql | 42 | ||||
| -rw-r--r-- | framework/web/auth/schema-oci.sql | 42 | ||||
| -rw-r--r-- | framework/web/auth/schema-pgsql.sql | 42 | ||||
| -rw-r--r-- | framework/web/auth/schema-sqlite.sql | 42 |
14 files changed, 3216 insertions, 0 deletions
diff --git a/framework/web/auth/CAccessControlFilter.php b/framework/web/auth/CAccessControlFilter.php new file mode 100644 index 0000000..6ab4d2a --- /dev/null +++ b/framework/web/auth/CAccessControlFilter.php @@ -0,0 +1,342 @@ +<?php +/** + * CAccessControlFilter class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CAccessControlFilter performs authorization checks for the specified actions. + * + * By enabling this filter, controller actions can be checked for access permissions. + * When the user is not denied by one of the security rules or allowed by a rule explicitly, + * he will be able to access the action. + * + * For maximum security consider adding + * <pre>array('deny')</pre> + * as a last rule in a list so all actions will be denied by default. + * + * To specify the access rules, set the {@link setRules rules} property, which should + * be an array of the rules. Each rule is specified as an array of the following structure: + * <pre> + * array( + * 'allow', // or 'deny' + * // optional, list of action IDs (case insensitive) that this rule applies to + * // if not specified, rule applies to all actions + * 'actions'=>array('edit', 'delete'), + * // optional, list of controller IDs (case insensitive) that this rule applies to + * 'controllers'=>array('post', 'admin/user'), + * // optional, list of usernames (case insensitive) that this rule applies to + * // Use * to represent all users, ? guest users, and @ authenticated users + * 'users'=>array('thomas', 'kevin'), + * // optional, list of roles (case sensitive!) that this rule applies to. + * 'roles'=>array('admin', 'editor'), + * // optional, list of IP address/patterns that this rule applies to + * // e.g. 127.0.0.1, 127.0.0.* + * 'ips'=>array('127.0.0.1'), + * // optional, list of request types (case insensitive) that this rule applies to + * 'verbs'=>array('GET', 'POST'), + * // optional, a PHP expression whose value indicates whether this rule applies + * 'expression'=>'!$user->isGuest && $user->level==2', + * // optional, the customized error message to be displayed + * // This option is available since version 1.1.1. + * 'message'=>'Access Denied.', + * ) + * </pre> + * + * @property array $rules List of access rules. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CAccessControlFilter.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +class CAccessControlFilter extends CFilter +{ + /** + * @var string the error message to be displayed when authorization fails. + * This property can be overridden by individual access rule via {@link CAccessRule::message}. + * If this property is not set, a default error message will be displayed. + * @since 1.1.1 + */ + public $message; + + private $_rules=array(); + + /** + * @return array list of access rules. + */ + public function getRules() + { + return $this->_rules; + } + + /** + * @param array $rules list of access rules. + */ + public function setRules($rules) + { + foreach($rules as $rule) + { + if(is_array($rule) && isset($rule[0])) + { + $r=new CAccessRule; + $r->allow=$rule[0]==='allow'; + foreach(array_slice($rule,1) as $name=>$value) + { + if($name==='expression' || $name==='roles' || $name==='message') + $r->$name=$value; + else + $r->$name=array_map('strtolower',$value); + } + $this->_rules[]=$r; + } + } + } + + /** + * Performs the pre-action filtering. + * @param CFilterChain $filterChain the filter chain that the filter is on. + * @return boolean whether the filtering process should continue and the action + * should be executed. + */ + protected function preFilter($filterChain) + { + $app=Yii::app(); + $request=$app->getRequest(); + $user=$app->getUser(); + $verb=$request->getRequestType(); + $ip=$request->getUserHostAddress(); + + foreach($this->getRules() as $rule) + { + if(($allow=$rule->isUserAllowed($user,$filterChain->controller,$filterChain->action,$ip,$verb))>0) // allowed + break; + else if($allow<0) // denied + { + $this->accessDenied($user,$this->resolveErrorMessage($rule)); + return false; + } + } + + return true; + } + + /** + * Resolves the error message to be displayed. + * This method will check {@link message} and {@link CAccessRule::message} to see + * what error message should be displayed. + * @param CAccessRule $rule the access rule + * @return string the error message + * @since 1.1.1 + */ + protected function resolveErrorMessage($rule) + { + if($rule->message!==null) + return $rule->message; + else if($this->message!==null) + return $this->message; + else + return Yii::t('yii','You are not authorized to perform this action.'); + } + + /** + * Denies the access of the user. + * This method is invoked when access check fails. + * @param IWebUser $user the current user + * @param string $message the error message to be displayed + */ + protected function accessDenied($user,$message) + { + if($user->getIsGuest()) + $user->loginRequired(); + else + throw new CHttpException(403,$message); + } +} + + +/** + * CAccessRule represents an access rule that is managed by {@link CAccessControlFilter}. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CAccessControlFilter.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +class CAccessRule extends CComponent +{ + /** + * @var boolean whether this is an 'allow' rule or 'deny' rule. + */ + public $allow; + /** + * @var array list of action IDs that this rule applies to. The comparison is case-insensitive. + * If no actions are specified, rule applies to all actions. + */ + public $actions; + /** + * @var array list of controler IDs that this rule applies to. The comparison is case-insensitive. + */ + public $controllers; + /** + * @var array list of user names that this rule applies to. The comparison is case-insensitive. + * If no user names are specified, rule applies to all users. + */ + public $users; + /** + * @var array list of roles this rule applies to. For each role, the current user's + * {@link CWebUser::checkAccess} method will be invoked. If one of the invocations + * returns true, the rule will be applied. + * Note, you should mainly use roles in an "allow" rule because by definition, + * a role represents a permission collection. + * @see CAuthManager + */ + public $roles; + /** + * @var array IP patterns. + */ + public $ips; + /** + * @var array list of request types (e.g. GET, POST) that this rule applies to. + */ + public $verbs; + /** + * @var string a PHP expression whose value indicates whether this rule should be applied. + * In this expression, you can use <code>$user</code> which refers to <code>Yii::app()->user</code>. + * The expression can also be a valid PHP callback, + * including class method name (array(ClassName/Object, MethodName)), + * or anonymous function (PHP 5.3.0+). The function/method signature should be as follows: + * <pre> + * function foo($user, $rule) { ... } + * </pre> + * where $user is the current application user object and $rule is this access rule. + */ + public $expression; + /** + * @var string the error message to be displayed when authorization is denied by this rule. + * If not set, a default error message will be displayed. + * @since 1.1.1 + */ + public $message; + + + /** + * Checks whether the Web user is allowed to perform the specified action. + * @param CWebUser $user the user object + * @param CController $controller the controller currently being executed + * @param CAction $action the action to be performed + * @param string $ip the request IP address + * @param string $verb the request verb (GET, POST, etc.) + * @return integer 1 if the user is allowed, -1 if the user is denied, 0 if the rule does not apply to the user + */ + public function isUserAllowed($user,$controller,$action,$ip,$verb) + { + if($this->isActionMatched($action) + && $this->isUserMatched($user) + && $this->isRoleMatched($user) + && $this->isIpMatched($ip) + && $this->isVerbMatched($verb) + && $this->isControllerMatched($controller) + && $this->isExpressionMatched($user)) + return $this->allow ? 1 : -1; + else + return 0; + } + + /** + * @param CAction $action the action + * @return boolean whether the rule applies to the action + */ + protected function isActionMatched($action) + { + return empty($this->actions) || in_array(strtolower($action->getId()),$this->actions); + } + + /** + * @param CAction $controller the action + * @return boolean whether the rule applies to the action + */ + protected function isControllerMatched($controller) + { + return empty($this->controllers) || in_array(strtolower($controller->getId()),$this->controllers); + } + + /** + * @param IWebUser $user the user + * @return boolean whether the rule applies to the user + */ + protected function isUserMatched($user) + { + if(empty($this->users)) + return true; + foreach($this->users as $u) + { + if($u==='*') + return true; + else if($u==='?' && $user->getIsGuest()) + return true; + else if($u==='@' && !$user->getIsGuest()) + return true; + else if(!strcasecmp($u,$user->getName())) + return true; + } + return false; + } + + /** + * @param IWebUser $user the user object + * @return boolean whether the rule applies to the role + */ + protected function isRoleMatched($user) + { + if(empty($this->roles)) + return true; + foreach($this->roles as $role) + { + if($user->checkAccess($role)) + return true; + } + return false; + } + + /** + * @param string $ip the IP address + * @return boolean whether the rule applies to the IP address + */ + protected function isIpMatched($ip) + { + if(empty($this->ips)) + return true; + foreach($this->ips as $rule) + { + if($rule==='*' || $rule===$ip || (($pos=strpos($rule,'*'))!==false && !strncmp($ip,$rule,$pos))) + return true; + } + return false; + } + + /** + * @param string $verb the request method + * @return boolean whether the rule applies to the request + */ + protected function isVerbMatched($verb) + { + return empty($this->verbs) || in_array(strtolower($verb),$this->verbs); + } + + /** + * @param IWebUser $user the user + * @return boolean the expression value. True if the expression is not specified. + */ + protected function isExpressionMatched($user) + { + if($this->expression===null) + return true; + else + return $this->evaluateExpression($this->expression, array('user'=>$user)); + } +} diff --git a/framework/web/auth/CAuthAssignment.php b/framework/web/auth/CAuthAssignment.php new file mode 100644 index 0000000..b841437 --- /dev/null +++ b/framework/web/auth/CAuthAssignment.php @@ -0,0 +1,107 @@ +<?php +/** + * CAuthAssignment class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CAuthAssignment represents an assignment of a role to a user. + * It includes additional assignment information such as {@link bizRule} and {@link data}. + * Do not create a CAuthAssignment instance using the 'new' operator. + * Instead, call {@link IAuthManager::assign}. + * + * @property mixed $userId User ID (see {@link IWebUser::getId}). + * @property string $itemName The authorization item name. + * @property string $bizRule The business rule associated with this assignment. + * @property mixed $data Additional data for this assignment. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CAuthAssignment.php 3426 2011-10-25 00:01:09Z alexander.makarow $ + * @package system.web.auth + * @since 1.0 + */ +class CAuthAssignment extends CComponent +{ + private $_auth; + private $_itemName; + private $_userId; + private $_bizRule; + private $_data; + + /** + * Constructor. + * @param IAuthManager $auth the authorization manager + * @param string $itemName authorization item name + * @param mixed $userId user ID (see {@link IWebUser::getId}) + * @param string $bizRule the business rule associated with this assignment + * @param mixed $data additional data for this assignment + */ + public function __construct($auth,$itemName,$userId,$bizRule=null,$data=null) + { + $this->_auth=$auth; + $this->_itemName=$itemName; + $this->_userId=$userId; + $this->_bizRule=$bizRule; + $this->_data=$data; + } + + /** + * @return mixed user ID (see {@link IWebUser::getId}) + */ + public function getUserId() + { + return $this->_userId; + } + + /** + * @return string the authorization item name + */ + public function getItemName() + { + return $this->_itemName; + } + + /** + * @return string the business rule associated with this assignment + */ + public function getBizRule() + { + return $this->_bizRule; + } + + /** + * @param string $value the business rule associated with this assignment + */ + public function setBizRule($value) + { + if($this->_bizRule!==$value) + { + $this->_bizRule=$value; + $this->_auth->saveAuthAssignment($this); + } + } + + /** + * @return mixed additional data for this assignment + */ + public function getData() + { + return $this->_data; + } + + /** + * @param mixed $value additional data for this assignment + */ + public function setData($value) + { + if($this->_data!==$value) + { + $this->_data=$value; + $this->_auth->saveAuthAssignment($this); + } + } +}
\ No newline at end of file diff --git a/framework/web/auth/CAuthItem.php b/framework/web/auth/CAuthItem.php new file mode 100644 index 0000000..7634786 --- /dev/null +++ b/framework/web/auth/CAuthItem.php @@ -0,0 +1,277 @@ +<?php +/** + * CAuthItem class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CAuthItem represents an authorization item. + * An authorization item can be an operation, a task or a role. + * They form an authorization hierarchy. Items on higher levels of the hierarchy + * inherit the permissions represented by items on lower levels. + * A user may be assigned one or several authorization items (called {@link CAuthAssignment assignments}. + * He can perform an operation only when it is among his assigned items. + * + * @property IAuthManager $authManager The authorization manager. + * @property integer $type The authorization item type. This could be 0 (operation), 1 (task) or 2 (role). + * @property string $name The item name. + * @property string $description The item description. + * @property string $bizRule The business rule associated with this item. + * @property mixed $data The additional data associated with this item. + * @property array $children All child items of this item. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CAuthItem.php 3442 2011-11-09 02:48:50Z alexander.makarow $ + * @package system.web.auth + * @since 1.0 + */ +class CAuthItem extends CComponent +{ + const TYPE_OPERATION=0; + const TYPE_TASK=1; + const TYPE_ROLE=2; + + private $_auth; + private $_type; + private $_name; + private $_description; + private $_bizRule; + private $_data; + + /** + * Constructor. + * @param IAuthManager $auth authorization manager + * @param string $name authorization item name + * @param integer $type authorization item type. This can be 0 (operation), 1 (task) or 2 (role). + * @param description $description the description + * @param string $bizRule the business rule associated with this item + * @param mixed $data additional data for this item + */ + public function __construct($auth,$name,$type,$description='',$bizRule=null,$data=null) + { + $this->_type=(int)$type; + $this->_auth=$auth; + $this->_name=$name; + $this->_description=$description; + $this->_bizRule=$bizRule; + $this->_data=$data; + } + + /** + * Checks to see if the specified item is within the hierarchy starting from this item. + * This method is internally used by {@link IAuthManager::checkAccess}. + * @param string $itemName the name of the item to be checked + * @param array $params the parameters to be passed to business rule evaluation + * @return boolean whether the specified item is within the hierarchy starting from this item. + */ + public function checkAccess($itemName,$params=array()) + { + Yii::trace('Checking permission "'.$this->_name.'"','system.web.auth.CAuthItem'); + if($this->_auth->executeBizRule($this->_bizRule,$params,$this->_data)) + { + if($this->_name==$itemName) + return true; + foreach($this->_auth->getItemChildren($this->_name) as $item) + { + if($item->checkAccess($itemName,$params)) + return true; + } + } + return false; + } + + /** + * @return IAuthManager the authorization manager + */ + public function getAuthManager() + { + return $this->_auth; + } + + /** + * @return integer the authorization item type. This could be 0 (operation), 1 (task) or 2 (role). + */ + public function getType() + { + return $this->_type; + } + + /** + * @return string the item name + */ + public function getName() + { + return $this->_name; + } + + /** + * @param string $value the item name + */ + public function setName($value) + { + if($this->_name!==$value) + { + $oldName=$this->_name; + $this->_name=$value; + $this->_auth->saveAuthItem($this,$oldName); + } + } + + /** + * @return string the item description + */ + public function getDescription() + { + return $this->_description; + } + + /** + * @param string $value the item description + */ + public function setDescription($value) + { + if($this->_description!==$value) + { + $this->_description=$value; + $this->_auth->saveAuthItem($this); + } + } + + /** + * @return string the business rule associated with this item + */ + public function getBizRule() + { + return $this->_bizRule; + } + + /** + * @param string $value the business rule associated with this item + */ + public function setBizRule($value) + { + if($this->_bizRule!==$value) + { + $this->_bizRule=$value; + $this->_auth->saveAuthItem($this); + } + } + + /** + * @return mixed the additional data associated with this item + */ + public function getData() + { + return $this->_data; + } + + /** + * @param mixed $value the additional data associated with this item + */ + public function setData($value) + { + if($this->_data!==$value) + { + $this->_data=$value; + $this->_auth->saveAuthItem($this); + } + } + + /** + * Adds a child item. + * @param string $name the name of the child item + * @return boolean whether the item is added successfully + * @throws CException if either parent or child doesn't exist or if a loop has been detected. + * @see IAuthManager::addItemChild + */ + public function addChild($name) + { + return $this->_auth->addItemChild($this->_name,$name); + } + + /** + * Removes a child item. + * Note, the child item is not deleted. Only the parent-child relationship is removed. + * @param string $name the child item name + * @return boolean whether the removal is successful + * @see IAuthManager::removeItemChild + */ + public function removeChild($name) + { + return $this->_auth->removeItemChild($this->_name,$name); + } + + /** + * Returns a value indicating whether a child exists + * @param string $name the child item name + * @return boolean whether the child exists + * @see IAuthManager::hasItemChild + */ + public function hasChild($name) + { + return $this->_auth->hasItemChild($this->_name,$name); + } + + /** + * Returns the children of this item. + * @return array all child items of this item. + * @see IAuthManager::getItemChildren + */ + public function getChildren() + { + return $this->_auth->getItemChildren($this->_name); + } + + /** + * Assigns this item to a user. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @param string $bizRule the business rule to be executed when {@link checkAccess} is called + * for this particular authorization item. + * @param mixed $data additional data associated with this assignment + * @return CAuthAssignment the authorization assignment information. + * @throws CException if the item has already been assigned to the user + * @see IAuthManager::assign + */ + public function assign($userId,$bizRule=null,$data=null) + { + return $this->_auth->assign($this->_name,$userId,$bizRule,$data); + } + + /** + * Revokes an authorization assignment from a user. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether removal is successful + * @see IAuthManager::revoke + */ + public function revoke($userId) + { + $this->_auth->revoke($this->_name,$userId); + } + + /** + * Returns a value indicating whether this item has been assigned to the user. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether the item has been assigned to the user. + * @see IAuthManager::isAssigned + */ + public function isAssigned($userId) + { + return $this->_auth->isAssigned($this->_name,$userId); + } + + /** + * Returns the item assignment information. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return CAuthAssignment the item assignment information. Null is returned if + * this item is not assigned to the user. + * @see IAuthManager::getAuthAssignment + */ + public function getAssignment($userId) + { + return $this->_auth->getAuthAssignment($this->_name,$userId); + } +} diff --git a/framework/web/auth/CAuthManager.php b/framework/web/auth/CAuthManager.php new file mode 100644 index 0000000..2756afb --- /dev/null +++ b/framework/web/auth/CAuthManager.php @@ -0,0 +1,166 @@ +<?php +/** + * CAuthManager class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CAuthManager is the base class for authorization manager classes. + * + * CAuthManager extends {@link CApplicationComponent} and implements some methods + * that are common among authorization manager classes. + * + * CAuthManager together with its concrete child classes implement the Role-Based + * Access Control (RBAC). + * + * The main idea is that permissions are organized as a hierarchy of + * {@link CAuthItem authorization items}. Items on higer level inherit the permissions + * represented by items on lower level. And roles are simply top-level authorization items + * that may be assigned to individual users. A user is said to have a permission + * to do something if the corresponding authorization item is inherited by one of his roles. + * + * Using authorization manager consists of two aspects. First, the authorization hierarchy + * and assignments have to be established. CAuthManager and its child classes + * provides APIs to accomplish this task. Developers may need to develop some GUI + * so that it is more intuitive to end-users. Second, developers call {@link IAuthManager::checkAccess} + * at appropriate places in the application code to check if the current user + * has the needed permission for an operation. + * + * @property array $roles Roles (name=>CAuthItem). + * @property array $tasks Tasks (name=>CAuthItem). + * @property array $operations Operations (name=>CAuthItem). + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CAuthManager.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +abstract class CAuthManager extends CApplicationComponent implements IAuthManager +{ + /** + * @var boolean Enable error reporting for bizRules. + * @since 1.1.3 + */ + public $showErrors = false; + + /** + * @var array list of role names that are assigned to all users implicitly. + * These roles do not need to be explicitly assigned to any user. + * When calling {@link checkAccess}, these roles will be checked first. + * For performance reason, you should minimize the number of such roles. + * A typical usage of such roles is to define an 'authenticated' role and associate + * it with a biz rule which checks if the current user is authenticated. + * And then declare 'authenticated' in this property so that it can be applied to + * every authenticated user. + */ + public $defaultRoles=array(); + + /** + * Creates a role. + * This is a shortcut method to {@link IAuthManager::createAuthItem}. + * @param string $name the item name + * @param string $description the item description. + * @param string $bizRule the business rule associated with this item + * @param mixed $data additional data to be passed when evaluating the business rule + * @return CAuthItem the authorization item + */ + public function createRole($name,$description='',$bizRule=null,$data=null) + { + return $this->createAuthItem($name,CAuthItem::TYPE_ROLE,$description,$bizRule,$data); + } + + /** + * Creates a task. + * This is a shortcut method to {@link IAuthManager::createAuthItem}. + * @param string $name the item name + * @param string $description the item description. + * @param string $bizRule the business rule associated with this item + * @param mixed $data additional data to be passed when evaluating the business rule + * @return CAuthItem the authorization item + */ + public function createTask($name,$description='',$bizRule=null,$data=null) + { + return $this->createAuthItem($name,CAuthItem::TYPE_TASK,$description,$bizRule,$data); + } + + /** + * Creates an operation. + * This is a shortcut method to {@link IAuthManager::createAuthItem}. + * @param string $name the item name + * @param string $description the item description. + * @param string $bizRule the business rule associated with this item + * @param mixed $data additional data to be passed when evaluating the business rule + * @return CAuthItem the authorization item + */ + public function createOperation($name,$description='',$bizRule=null,$data=null) + { + return $this->createAuthItem($name,CAuthItem::TYPE_OPERATION,$description,$bizRule,$data); + } + + /** + * Returns roles. + * This is a shortcut method to {@link IAuthManager::getAuthItems}. + * @param mixed $userId the user ID. If not null, only the roles directly assigned to the user + * will be returned. Otherwise, all roles will be returned. + * @return array roles (name=>CAuthItem) + */ + public function getRoles($userId=null) + { + return $this->getAuthItems(CAuthItem::TYPE_ROLE,$userId); + } + + /** + * Returns tasks. + * This is a shortcut method to {@link IAuthManager::getAuthItems}. + * @param mixed $userId the user ID. If not null, only the tasks directly assigned to the user + * will be returned. Otherwise, all tasks will be returned. + * @return array tasks (name=>CAuthItem) + */ + public function getTasks($userId=null) + { + return $this->getAuthItems(CAuthItem::TYPE_TASK,$userId); + } + + /** + * Returns operations. + * This is a shortcut method to {@link IAuthManager::getAuthItems}. + * @param mixed $userId the user ID. If not null, only the operations directly assigned to the user + * will be returned. Otherwise, all operations will be returned. + * @return array operations (name=>CAuthItem) + */ + public function getOperations($userId=null) + { + return $this->getAuthItems(CAuthItem::TYPE_OPERATION,$userId); + } + + /** + * Executes the specified business rule. + * @param string $bizRule the business rule to be executed. + * @param array $params parameters passed to {@link IAuthManager::checkAccess}. + * @param mixed $data additional data associated with the authorization item or assignment. + * @return boolean whether the business rule returns true. + * If the business rule is empty, it will still return true. + */ + public function executeBizRule($bizRule,$params,$data) + { + return $bizRule==='' || $bizRule===null || ($this->showErrors ? eval($bizRule)!=0 : @eval($bizRule)!=0); + } + + /** + * Checks the item types to make sure a child can be added to a parent. + * @param integer $parentType parent item type + * @param integer $childType child item type + * @throws CException if the item cannot be added as a child due to its incompatible type. + */ + protected function checkItemChildType($parentType,$childType) + { + static $types=array('operation','task','role'); + if($parentType < $childType) + throw new CException(Yii::t('yii','Cannot add an item of type "{child}" to an item of type "{parent}".', + array('{child}'=>$types[$childType], '{parent}'=>$types[$parentType]))); + } +} diff --git a/framework/web/auth/CBaseUserIdentity.php b/framework/web/auth/CBaseUserIdentity.php new file mode 100644 index 0000000..c2bf4e3 --- /dev/null +++ b/framework/web/auth/CBaseUserIdentity.php @@ -0,0 +1,132 @@ +<?php +/** + * CBaseUserIdentity class file + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CBaseUserIdentity is a base class implementing {@link IUserIdentity}. + * + * CBaseUserIdentity implements the scheme for representing identity + * information that needs to be persisted. It also provides the way + * to represent the authentication errors. + * + * Derived classes should implement {@link IUserIdentity::authenticate} + * and {@link IUserIdentity::getId} that are required by the {@link IUserIdentity} + * interface. + * + * @property mixed $id A value that uniquely represents the identity (e.g. primary key value). + * The default implementation simply returns {@link name}. + * @property string $name The display name for the identity. + * The default implementation simply returns empty string. + * @property array $persistentStates The identity states that should be persisted. + * @property whether $isAuthenticated The authentication is successful. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CBaseUserIdentity.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +abstract class CBaseUserIdentity extends CComponent implements IUserIdentity +{ + const ERROR_NONE=0; + const ERROR_USERNAME_INVALID=1; + const ERROR_PASSWORD_INVALID=2; + const ERROR_UNKNOWN_IDENTITY=100; + + /** + * @var integer the authentication error code. If there is an error, the error code will be non-zero. + * Defaults to 100, meaning unknown identity. Calling {@link authenticate} will change this value. + */ + public $errorCode=self::ERROR_UNKNOWN_IDENTITY; + /** + * @var string the authentication error message. Defaults to empty. + */ + public $errorMessage=''; + + private $_state=array(); + + /** + * Returns a value that uniquely represents the identity. + * @return mixed a value that uniquely represents the identity (e.g. primary key value). + * The default implementation simply returns {@link name}. + */ + public function getId() + { + return $this->getName(); + } + + /** + * Returns the display name for the identity (e.g. username). + * @return string the display name for the identity. + * The default implementation simply returns empty string. + */ + public function getName() + { + return ''; + } + + /** + * Returns the identity states that should be persisted. + * This method is required by {@link IUserIdentity}. + * @return array the identity states that should be persisted. + */ + public function getPersistentStates() + { + return $this->_state; + } + + /** + * Sets an array of presistent states. + * + * @param array $states the identity states that should be persisted. + */ + public function setPersistentStates($states) + { + $this->_state = $states; + } + + /** + * Returns a value indicating whether the identity is authenticated. + * This method is required by {@link IUserIdentity}. + * @return whether the authentication is successful. + */ + public function getIsAuthenticated() + { + return $this->errorCode==self::ERROR_NONE; + } + + /** + * Gets the persisted state by the specified name. + * @param string $name the name of the state + * @param mixed $defaultValue the default value to be returned if the named state does not exist + * @return mixed the value of the named state + */ + public function getState($name,$defaultValue=null) + { + return isset($this->_state[$name])?$this->_state[$name]:$defaultValue; + } + + /** + * Sets the named state with a given value. + * @param string $name the name of the state + * @param mixed $value the value of the named state + */ + public function setState($name,$value) + { + $this->_state[$name]=$value; + } + + /** + * Removes the specified state. + * @param string $name the name of the state + */ + public function clearState($name) + { + unset($this->_state[$name]); + } +} diff --git a/framework/web/auth/CDbAuthManager.php b/framework/web/auth/CDbAuthManager.php new file mode 100644 index 0000000..5172fcf --- /dev/null +++ b/framework/web/auth/CDbAuthManager.php @@ -0,0 +1,600 @@ +<?php +/** + * CDbAuthManager class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CDbAuthManager represents an authorization manager that stores authorization information in database. + * + * The database connection is specified by {@link connectionID}. And the database schema + * should be as described in "framework/web/auth/*.sql". You may change the names of + * the three tables used to store the authorization data by setting {@link itemTable}, + * {@link itemChildTable} and {@link assignmentTable}. + * + * @property array $authItems The authorization items of the specific type. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CDbAuthManager.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +class CDbAuthManager extends CAuthManager +{ + /** + * @var string the ID of the {@link CDbConnection} application component. Defaults to 'db'. + * The database must have the tables as declared in "framework/web/auth/*.sql". + */ + public $connectionID='db'; + /** + * @var string the name of the table storing authorization items. Defaults to 'AuthItem'. + */ + public $itemTable='AuthItem'; + /** + * @var string the name of the table storing authorization item hierarchy. Defaults to 'AuthItemChild'. + */ + public $itemChildTable='AuthItemChild'; + /** + * @var string the name of the table storing authorization item assignments. Defaults to 'AuthAssignment'. + */ + public $assignmentTable='AuthAssignment'; + /** + * @var CDbConnection the database connection. By default, this is initialized + * automatically as the application component whose ID is indicated as {@link connectionID}. + */ + public $db; + + private $_usingSqlite; + + /** + * Initializes the application component. + * This method overrides the parent implementation by establishing the database connection. + */ + public function init() + { + parent::init(); + $this->_usingSqlite=!strncmp($this->getDbConnection()->getDriverName(),'sqlite',6); + } + + /** + * Performs access check for the specified user. + * @param string $itemName the name of the operation that need access check + * @param mixed $userId the user ID. This should can be either an integer and a string representing + * the unique identifier of a user. See {@link IWebUser::getId}. + * @param array $params name-value pairs that would be passed to biz rules associated + * with the tasks and roles assigned to the user. + * @return boolean whether the operations can be performed by the user. + */ + public function checkAccess($itemName,$userId,$params=array()) + { + $assignments=$this->getAuthAssignments($userId); + return $this->checkAccessRecursive($itemName,$userId,$params,$assignments); + } + + /** + * Performs access check for the specified user. + * This method is internally called by {@link checkAccess}. + * @param string $itemName the name of the operation that need access check + * @param mixed $userId the user ID. This should can be either an integer and a string representing + * the unique identifier of a user. See {@link IWebUser::getId}. + * @param array $params name-value pairs that would be passed to biz rules associated + * with the tasks and roles assigned to the user. + * @param array $assignments the assignments to the specified user + * @return boolean whether the operations can be performed by the user. + * @since 1.1.3 + */ + protected function checkAccessRecursive($itemName,$userId,$params,$assignments) + { + if(($item=$this->getAuthItem($itemName))===null) + return false; + Yii::trace('Checking permission "'.$item->getName().'"','system.web.auth.CDbAuthManager'); + if($this->executeBizRule($item->getBizRule(),$params,$item->getData())) + { + if(in_array($itemName,$this->defaultRoles)) + return true; + if(isset($assignments[$itemName])) + { + $assignment=$assignments[$itemName]; + if($this->executeBizRule($assignment->getBizRule(),$params,$assignment->getData())) + return true; + } + $parents=$this->db->createCommand() + ->select('parent') + ->from($this->itemChildTable) + ->where('child=:name', array(':name'=>$itemName)) + ->queryColumn(); + foreach($parents as $parent) + { + if($this->checkAccessRecursive($parent,$userId,$params,$assignments)) + return true; + } + } + return false; + } + + /** + * Adds an item as a child of another item. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the item is added successfully + * @throws CException if either parent or child doesn't exist or if a loop has been detected. + */ + public function addItemChild($itemName,$childName) + { + if($itemName===$childName) + throw new CException(Yii::t('yii','Cannot add "{name}" as a child of itself.', + array('{name}'=>$itemName))); + + $rows=$this->db->createCommand() + ->select() + ->from($this->itemTable) + ->where('name=:name1 OR name=:name2', array( + ':name1'=>$itemName, + ':name2'=>$childName + )) + ->queryAll(); + + if(count($rows)==2) + { + if($rows[0]['name']===$itemName) + { + $parentType=$rows[0]['type']; + $childType=$rows[1]['type']; + } + else + { + $childType=$rows[0]['type']; + $parentType=$rows[1]['type']; + } + $this->checkItemChildType($parentType,$childType); + if($this->detectLoop($itemName,$childName)) + throw new CException(Yii::t('yii','Cannot add "{child}" as a child of "{name}". A loop has been detected.', + array('{child}'=>$childName,'{name}'=>$itemName))); + + $this->db->createCommand() + ->insert($this->itemChildTable, array( + 'parent'=>$itemName, + 'child'=>$childName, + )); + + return true; + } + else + throw new CException(Yii::t('yii','Either "{parent}" or "{child}" does not exist.',array('{child}'=>$childName,'{parent}'=>$itemName))); + } + + /** + * Removes a child from its parent. + * Note, the child item is not deleted. Only the parent-child relationship is removed. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the removal is successful + */ + public function removeItemChild($itemName,$childName) + { + return $this->db->createCommand() + ->delete($this->itemChildTable, 'parent=:parent AND child=:child', array( + ':parent'=>$itemName, + ':child'=>$childName + )) > 0; + } + + /** + * Returns a value indicating whether a child exists within a parent. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the child exists + */ + public function hasItemChild($itemName,$childName) + { + return $this->db->createCommand() + ->select('parent') + ->from($this->itemChildTable) + ->where('parent=:parent AND child=:child', array( + ':parent'=>$itemName, + ':child'=>$childName)) + ->queryScalar() !== false; + } + + /** + * Returns the children of the specified item. + * @param mixed $names the parent item name. This can be either a string or an array. + * The latter represents a list of item names. + * @return array all child items of the parent + */ + public function getItemChildren($names) + { + if(is_string($names)) + $condition='parent='.$this->db->quoteValue($names); + else if(is_array($names) && $names!==array()) + { + foreach($names as &$name) + $name=$this->db->quoteValue($name); + $condition='parent IN ('.implode(', ',$names).')'; + } + + $rows=$this->db->createCommand() + ->select('name, type, description, bizrule, data') + ->from(array( + $this->itemTable, + $this->itemChildTable + )) + ->where($condition.' AND name=child') + ->queryAll(); + + $children=array(); + foreach($rows as $row) + { + if(($data=@unserialize($row['data']))===false) + $data=null; + $children[$row['name']]=new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data); + } + return $children; + } + + /** + * Assigns an authorization item to a user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @param string $bizRule the business rule to be executed when {@link checkAccess} is called + * for this particular authorization item. + * @param mixed $data additional data associated with this assignment + * @return CAuthAssignment the authorization assignment information. + * @throws CException if the item does not exist or if the item has already been assigned to the user + */ + public function assign($itemName,$userId,$bizRule=null,$data=null) + { + if($this->usingSqlite() && $this->getAuthItem($itemName)===null) + throw new CException(Yii::t('yii','The item "{name}" does not exist.',array('{name}'=>$itemName))); + + $this->db->createCommand() + ->insert($this->assignmentTable, array( + 'itemname'=>$itemName, + 'userid'=>$userId, + 'bizrule'=>$bizRule, + 'data'=>serialize($data) + )); + return new CAuthAssignment($this,$itemName,$userId,$bizRule,$data); + } + + /** + * Revokes an authorization assignment from a user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether removal is successful + */ + public function revoke($itemName,$userId) + { + return $this->db->createCommand() + ->delete($this->assignmentTable, 'itemname=:itemname AND userid=:userid', array( + ':itemname'=>$itemName, + ':userid'=>$userId + )) > 0; + } + + /** + * Returns a value indicating whether the item has been assigned to the user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether the item has been assigned to the user. + */ + public function isAssigned($itemName,$userId) + { + return $this->db->createCommand() + ->select('itemname') + ->from($this->assignmentTable) + ->where('itemname=:itemname AND userid=:userid', array( + ':itemname'=>$itemName, + ':userid'=>$userId)) + ->queryScalar() !== false; + } + + /** + * Returns the item assignment information. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return CAuthAssignment the item assignment information. Null is returned if + * the item is not assigned to the user. + */ + public function getAuthAssignment($itemName,$userId) + { + $row=$this->db->createCommand() + ->select() + ->from($this->assignmentTable) + ->where('itemname=:itemname AND userid=:userid', array( + ':itemname'=>$itemName, + ':userid'=>$userId)) + ->queryRow(); + if($row!==false) + { + if(($data=@unserialize($row['data']))===false) + $data=null; + return new CAuthAssignment($this,$row['itemname'],$row['userid'],$row['bizrule'],$data); + } + else + return null; + } + + /** + * Returns the item assignments for the specified user. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return array the item assignment information for the user. An empty array will be + * returned if there is no item assigned to the user. + */ + public function getAuthAssignments($userId) + { + $rows=$this->db->createCommand() + ->select() + ->from($this->assignmentTable) + ->where('userid=:userid', array(':userid'=>$userId)) + ->queryAll(); + $assignments=array(); + foreach($rows as $row) + { + if(($data=@unserialize($row['data']))===false) + $data=null; + $assignments[$row['itemname']]=new CAuthAssignment($this,$row['itemname'],$row['userid'],$row['bizrule'],$data); + } + return $assignments; + } + + /** + * Saves the changes to an authorization assignment. + * @param CAuthAssignment $assignment the assignment that has been changed. + */ + public function saveAuthAssignment($assignment) + { + $this->db->createCommand() + ->update($this->assignmentTable, array( + 'bizrule'=>$assignment->getBizRule(), + 'data'=>serialize($assignment->getData()), + ), 'itemname=:itemname AND userid=:userid', array( + 'itemname'=>$assignment->getItemName(), + 'userid'=>$assignment->getUserId() + )); + } + + /** + * Returns the authorization items of the specific type and user. + * @param integer $type the item type (0: operation, 1: task, 2: role). Defaults to null, + * meaning returning all items regardless of their type. + * @param mixed $userId the user ID. Defaults to null, meaning returning all items even if + * they are not assigned to a user. + * @return array the authorization items of the specific type. + */ + public function getAuthItems($type=null,$userId=null) + { + if($type===null && $userId===null) + { + $command=$this->db->createCommand() + ->select() + ->from($this->itemTable); + } + else if($userId===null) + { + $command=$this->db->createCommand() + ->select() + ->from($this->itemTable) + ->where('type=:type', array(':type'=>$type)); + } + else if($type===null) + { + $command=$this->db->createCommand() + ->select('name,type,description,t1.bizrule,t1.data') + ->from(array( + $this->itemTable.' t1', + $this->assignmentTable.' t2' + )) + ->where('name=itemname AND userid=:userid', array(':userid'=>$userId)); + } + else + { + $command=$this->db->createCommand() + ->select('name,type,description,t1.bizrule,t1.data') + ->from(array( + $this->itemTable.' t1', + $this->assignmentTable.' t2' + )) + ->where('name=itemname AND type=:type AND userid=:userid', array( + ':type'=>$type, + ':userid'=>$userId + )); + } + $items=array(); + foreach($command->queryAll() as $row) + { + if(($data=@unserialize($row['data']))===false) + $data=null; + $items[$row['name']]=new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data); + } + return $items; + } + + /** + * Creates an authorization item. + * An authorization item represents an action permission (e.g. creating a post). + * It has three types: operation, task and role. + * Authorization items form a hierarchy. Higher level items inheirt permissions representing + * by lower level items. + * @param string $name the item name. This must be a unique identifier. + * @param integer $type the item type (0: operation, 1: task, 2: role). + * @param string $description description of the item + * @param string $bizRule business rule associated with the item. This is a piece of + * PHP code that will be executed when {@link checkAccess} is called for the item. + * @param mixed $data additional data associated with the item. + * @return CAuthItem the authorization item + * @throws CException if an item with the same name already exists + */ + public function createAuthItem($name,$type,$description='',$bizRule=null,$data=null) + { + $this->db->createCommand() + ->insert($this->itemTable, array( + 'name'=>$name, + 'type'=>$type, + 'description'=>$description, + 'bizrule'=>$bizRule, + 'data'=>serialize($data) + )); + return new CAuthItem($this,$name,$type,$description,$bizRule,$data); + } + + /** + * Removes the specified authorization item. + * @param string $name the name of the item to be removed + * @return boolean whether the item exists in the storage and has been removed + */ + public function removeAuthItem($name) + { + if($this->usingSqlite()) + { + $this->db->createCommand() + ->delete($this->itemChildTable, 'parent=:name1 OR child=:name2', array( + ':name1'=>$name, + ':name2'=>$name + )); + $this->db->createCommand() + ->delete($this->assignmentTable, 'itemname=:name', array( + ':name'=>$name, + )); + } + + return $this->db->createCommand() + ->delete($this->itemTable, 'name=:name', array( + ':name'=>$name + )) > 0; + } + + /** + * Returns the authorization item with the specified name. + * @param string $name the name of the item + * @return CAuthItem the authorization item. Null if the item cannot be found. + */ + public function getAuthItem($name) + { + $row=$this->db->createCommand() + ->select() + ->from($this->itemTable) + ->where('name=:name', array(':name'=>$name)) + ->queryRow(); + + if($row!==false) + { + if(($data=@unserialize($row['data']))===false) + $data=null; + return new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data); + } + else + return null; + } + + /** + * Saves an authorization item to persistent storage. + * @param CAuthItem $item the item to be saved. + * @param string $oldName the old item name. If null, it means the item name is not changed. + */ + public function saveAuthItem($item,$oldName=null) + { + if($this->usingSqlite() && $oldName!==null && $item->getName()!==$oldName) + { + $this->db->createCommand() + ->update($this->itemChildTable, array( + 'parent'=>$item->getName(), + ), 'parent=:whereName', array( + ':whereName'=>$oldName, + )); + $this->db->createCommand() + ->update($this->itemChildTable, array( + 'child'=>$item->getName(), + ), 'child=:whereName', array( + ':whereName'=>$oldName, + )); + $this->db->createCommand() + ->update($this->assignmentTable, array( + 'itemname'=>$item->getName(), + ), 'itemname=:whereName', array( + ':whereName'=>$oldName, + )); + } + + $this->db->createCommand() + ->update($this->itemTable, array( + 'name'=>$item->getName(), + 'type'=>$item->getType(), + 'description'=>$item->getDescription(), + 'bizrule'=>$item->getBizRule(), + 'data'=>serialize($item->getData()), + ), 'name=:whereName', array( + ':whereName'=>$oldName===null?$item->getName():$oldName, + )); + } + + /** + * Saves the authorization data to persistent storage. + */ + public function save() + { + } + + /** + * Removes all authorization data. + */ + public function clearAll() + { + $this->clearAuthAssignments(); + $this->db->createCommand()->delete($this->itemChildTable); + $this->db->createCommand()->delete($this->itemTable); + } + + /** + * Removes all authorization assignments. + */ + public function clearAuthAssignments() + { + $this->db->createCommand()->delete($this->assignmentTable); + } + + /** + * Checks whether there is a loop in the authorization item hierarchy. + * @param string $itemName parent item name + * @param string $childName the name of the child item that is to be added to the hierarchy + * @return boolean whether a loop exists + */ + protected function detectLoop($itemName,$childName) + { + if($childName===$itemName) + return true; + foreach($this->getItemChildren($childName) as $child) + { + if($this->detectLoop($itemName,$child->getName())) + return true; + } + return false; + } + + /** + * @return CDbConnection the DB connection instance + * @throws CException if {@link connectionID} does not point to a valid application component. + */ + protected function getDbConnection() + { + if($this->db!==null) + return $this->db; + else if(($this->db=Yii::app()->getComponent($this->connectionID)) instanceof CDbConnection) + return $this->db; + else + throw new CException(Yii::t('yii','CDbAuthManager.connectionID "{id}" is invalid. Please make sure it refers to the ID of a CDbConnection application component.', + array('{id}'=>$this->connectionID))); + } + + /** + * @return boolean whether the database is a SQLite database + */ + protected function usingSqlite() + { + return $this->_usingSqlite; + } +} diff --git a/framework/web/auth/CPhpAuthManager.php b/framework/web/auth/CPhpAuthManager.php new file mode 100644 index 0000000..4a62c67 --- /dev/null +++ b/framework/web/auth/CPhpAuthManager.php @@ -0,0 +1,504 @@ +<?php +/** + * CPhpAuthManager class file. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CPhpAuthManager represents an authorization manager that stores authorization information in terms of a PHP script file. + * + * The authorization data will be saved to and loaded from a file + * specified by {@link authFile}, which defaults to 'protected/data/auth.php'. + * + * CPhpAuthManager is mainly suitable for authorization data that is not too big + * (for example, the authorization data for a personal blog system). + * Use {@link CDbAuthManager} for more complex authorization data. + * + * @property array $authItems The authorization items of the specific type. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CPhpAuthManager.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +class CPhpAuthManager extends CAuthManager +{ + /** + * @var string the path of the PHP script that contains the authorization data. + * If not set, it will be using 'protected/data/auth.php' as the data file. + * Make sure this file is writable by the Web server process if the authorization + * needs to be changed. + * @see loadFromFile + * @see saveToFile + */ + public $authFile; + + private $_items=array(); // itemName => item + private $_children=array(); // itemName, childName => child + private $_assignments=array(); // userId, itemName => assignment + + /** + * Initializes the application component. + * This method overrides parent implementation by loading the authorization data + * from PHP script. + */ + public function init() + { + parent::init(); + if($this->authFile===null) + $this->authFile=Yii::getPathOfAlias('application.data.auth').'.php'; + $this->load(); + } + + /** + * Performs access check for the specified user. + * @param string $itemName the name of the operation that need access check + * @param mixed $userId the user ID. This should can be either an integer and a string representing + * the unique identifier of a user. See {@link IWebUser::getId}. + * @param array $params name-value pairs that would be passed to biz rules associated + * with the tasks and roles assigned to the user. + * @return boolean whether the operations can be performed by the user. + */ + public function checkAccess($itemName,$userId,$params=array()) + { + if(!isset($this->_items[$itemName])) + return false; + $item=$this->_items[$itemName]; + Yii::trace('Checking permission "'.$item->getName().'"','system.web.auth.CPhpAuthManager'); + if($this->executeBizRule($item->getBizRule(),$params,$item->getData())) + { + if(in_array($itemName,$this->defaultRoles)) + return true; + if(isset($this->_assignments[$userId][$itemName])) + { + $assignment=$this->_assignments[$userId][$itemName]; + if($this->executeBizRule($assignment->getBizRule(),$params,$assignment->getData())) + return true; + } + foreach($this->_children as $parentName=>$children) + { + if(isset($children[$itemName]) && $this->checkAccess($parentName,$userId,$params)) + return true; + } + } + return false; + } + + /** + * Adds an item as a child of another item. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the item is added successfully + * @throws CException if either parent or child doesn't exist or if a loop has been detected. + */ + public function addItemChild($itemName,$childName) + { + if(!isset($this->_items[$childName],$this->_items[$itemName])) + throw new CException(Yii::t('yii','Either "{parent}" or "{child}" does not exist.',array('{child}'=>$childName,'{name}'=>$itemName))); + $child=$this->_items[$childName]; + $item=$this->_items[$itemName]; + $this->checkItemChildType($item->getType(),$child->getType()); + if($this->detectLoop($itemName,$childName)) + throw new CException(Yii::t('yii','Cannot add "{child}" as a child of "{parent}". A loop has been detected.', + array('{child}'=>$childName,'{parent}'=>$itemName))); + if(isset($this->_children[$itemName][$childName])) + throw new CException(Yii::t('yii','The item "{parent}" already has a child "{child}".', + array('{child}'=>$childName,'{parent}'=>$itemName))); + $this->_children[$itemName][$childName]=$this->_items[$childName]; + return true; + } + + /** + * Removes a child from its parent. + * Note, the child item is not deleted. Only the parent-child relationship is removed. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the removal is successful + */ + public function removeItemChild($itemName,$childName) + { + if(isset($this->_children[$itemName][$childName])) + { + unset($this->_children[$itemName][$childName]); + return true; + } + else + return false; + } + + /** + * Returns a value indicating whether a child exists within a parent. + * @param string $itemName the parent item name + * @param string $childName the child item name + * @return boolean whether the child exists + */ + public function hasItemChild($itemName,$childName) + { + return isset($this->_children[$itemName][$childName]); + } + + /** + * Returns the children of the specified item. + * @param mixed $names the parent item name. This can be either a string or an array. + * The latter represents a list of item names. + * @return array all child items of the parent + */ + public function getItemChildren($names) + { + if(is_string($names)) + return isset($this->_children[$names]) ? $this->_children[$names] : array(); + + $children=array(); + foreach($names as $name) + { + if(isset($this->_children[$name])) + $children=array_merge($children,$this->_children[$name]); + } + return $children; + } + + /** + * Assigns an authorization item to a user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @param string $bizRule the business rule to be executed when {@link checkAccess} is called + * for this particular authorization item. + * @param mixed $data additional data associated with this assignment + * @return CAuthAssignment the authorization assignment information. + * @throws CException if the item does not exist or if the item has already been assigned to the user + */ + public function assign($itemName,$userId,$bizRule=null,$data=null) + { + if(!isset($this->_items[$itemName])) + throw new CException(Yii::t('yii','Unknown authorization item "{name}".',array('{name}'=>$itemName))); + else if(isset($this->_assignments[$userId][$itemName])) + throw new CException(Yii::t('yii','Authorization item "{item}" has already been assigned to user "{user}".', + array('{item}'=>$itemName,'{user}'=>$userId))); + else + return $this->_assignments[$userId][$itemName]=new CAuthAssignment($this,$itemName,$userId,$bizRule,$data); + } + + /** + * Revokes an authorization assignment from a user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether removal is successful + */ + public function revoke($itemName,$userId) + { + if(isset($this->_assignments[$userId][$itemName])) + { + unset($this->_assignments[$userId][$itemName]); + return true; + } + else + return false; + } + + /** + * Returns a value indicating whether the item has been assigned to the user. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return boolean whether the item has been assigned to the user. + */ + public function isAssigned($itemName,$userId) + { + return isset($this->_assignments[$userId][$itemName]); + } + + /** + * Returns the item assignment information. + * @param string $itemName the item name + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return CAuthAssignment the item assignment information. Null is returned if + * the item is not assigned to the user. + */ + public function getAuthAssignment($itemName,$userId) + { + return isset($this->_assignments[$userId][$itemName])?$this->_assignments[$userId][$itemName]:null; + } + + /** + * Returns the item assignments for the specified user. + * @param mixed $userId the user ID (see {@link IWebUser::getId}) + * @return array the item assignment information for the user. An empty array will be + * returned if there is no item assigned to the user. + */ + public function getAuthAssignments($userId) + { + return isset($this->_assignments[$userId])?$this->_assignments[$userId]:array(); + } + + /** + * Returns the authorization items of the specific type and user. + * @param integer $type the item type (0: operation, 1: task, 2: role). Defaults to null, + * meaning returning all items regardless of their type. + * @param mixed $userId the user ID. Defaults to null, meaning returning all items even if + * they are not assigned to a user. + * @return array the authorization items of the specific type. + */ + public function getAuthItems($type=null,$userId=null) + { + if($type===null && $userId===null) + return $this->_items; + $items=array(); + if($userId===null) + { + foreach($this->_items as $name=>$item) + { + if($item->getType()==$type) + $items[$name]=$item; + } + } + else if(isset($this->_assignments[$userId])) + { + foreach($this->_assignments[$userId] as $assignment) + { + $name=$assignment->getItemName(); + if(isset($this->_items[$name]) && ($type===null || $this->_items[$name]->getType()==$type)) + $items[$name]=$this->_items[$name]; + } + } + return $items; + } + + /** + * Creates an authorization item. + * An authorization item represents an action permission (e.g. creating a post). + * It has three types: operation, task and role. + * Authorization items form a hierarchy. Higher level items inheirt permissions representing + * by lower level items. + * @param string $name the item name. This must be a unique identifier. + * @param integer $type the item type (0: operation, 1: task, 2: role). + * @param string $description description of the item + * @param string $bizRule business rule associated with the item. This is a piece of + * PHP code that will be executed when {@link checkAccess} is called for the item. + * @param mixed $data additional data associated with the item. + * @return CAuthItem the authorization item + * @throws CException if an item with the same name already exists + */ + public function createAuthItem($name,$type,$description='',$bizRule=null,$data=null) + { + if(isset($this->_items[$name])) + throw new CException(Yii::t('yii','Unable to add an item whose name is the same as an existing item.')); + return $this->_items[$name]=new CAuthItem($this,$name,$type,$description,$bizRule,$data); + } + + /** + * Removes the specified authorization item. + * @param string $name the name of the item to be removed + * @return boolean whether the item exists in the storage and has been removed + */ + public function removeAuthItem($name) + { + if(isset($this->_items[$name])) + { + foreach($this->_children as &$children) + unset($children[$name]); + foreach($this->_assignments as &$assignments) + unset($assignments[$name]); + unset($this->_items[$name]); + return true; + } + else + return false; + } + + /** + * Returns the authorization item with the specified name. + * @param string $name the name of the item + * @return CAuthItem the authorization item. Null if the item cannot be found. + */ + public function getAuthItem($name) + { + return isset($this->_items[$name])?$this->_items[$name]:null; + } + + /** + * Saves an authorization item to persistent storage. + * @param CAuthItem $item the item to be saved. + * @param string $oldName the old item name. If null, it means the item name is not changed. + */ + public function saveAuthItem($item,$oldName=null) + { + if($oldName!==null && ($newName=$item->getName())!==$oldName) // name changed + { + if(isset($this->_items[$newName])) + throw new CException(Yii::t('yii','Unable to change the item name. The name "{name}" is already used by another item.',array('{name}'=>$newName))); + if(isset($this->_items[$oldName]) && $this->_items[$oldName]===$item) + { + unset($this->_items[$oldName]); + $this->_items[$newName]=$item; + if(isset($this->_children[$oldName])) + { + $this->_children[$newName]=$this->_children[$oldName]; + unset($this->_children[$oldName]); + } + foreach($this->_children as &$children) + { + if(isset($children[$oldName])) + { + $children[$newName]=$children[$oldName]; + unset($children[$oldName]); + } + } + foreach($this->_assignments as &$assignments) + { + if(isset($assignments[$oldName])) + { + $assignments[$newName]=$assignments[$oldName]; + unset($assignments[$oldName]); + } + } + } + } + } + + /** + * Saves the changes to an authorization assignment. + * @param CAuthAssignment $assignment the assignment that has been changed. + */ + public function saveAuthAssignment($assignment) + { + } + + /** + * Saves authorization data into persistent storage. + * If any change is made to the authorization data, please make + * sure you call this method to save the changed data into persistent storage. + */ + public function save() + { + $items=array(); + foreach($this->_items as $name=>$item) + { + $items[$name]=array( + 'type'=>$item->getType(), + 'description'=>$item->getDescription(), + 'bizRule'=>$item->getBizRule(), + 'data'=>$item->getData(), + ); + if(isset($this->_children[$name])) + { + foreach($this->_children[$name] as $child) + $items[$name]['children'][]=$child->getName(); + } + } + + foreach($this->_assignments as $userId=>$assignments) + { + foreach($assignments as $name=>$assignment) + { + if(isset($items[$name])) + { + $items[$name]['assignments'][$userId]=array( + 'bizRule'=>$assignment->getBizRule(), + 'data'=>$assignment->getData(), + ); + } + } + } + + $this->saveToFile($items,$this->authFile); + } + + /** + * Loads authorization data. + */ + public function load() + { + $this->clearAll(); + + $items=$this->loadFromFile($this->authFile); + + foreach($items as $name=>$item) + $this->_items[$name]=new CAuthItem($this,$name,$item['type'],$item['description'],$item['bizRule'],$item['data']); + + foreach($items as $name=>$item) + { + if(isset($item['children'])) + { + foreach($item['children'] as $childName) + { + if(isset($this->_items[$childName])) + $this->_children[$name][$childName]=$this->_items[$childName]; + } + } + if(isset($item['assignments'])) + { + foreach($item['assignments'] as $userId=>$assignment) + { + $this->_assignments[$userId][$name]=new CAuthAssignment($this,$name,$userId,$assignment['bizRule'],$assignment['data']); + } + } + } + } + + /** + * Removes all authorization data. + */ + public function clearAll() + { + $this->clearAuthAssignments(); + $this->_children=array(); + $this->_items=array(); + } + + /** + * Removes all authorization assignments. + */ + public function clearAuthAssignments() + { + $this->_assignments=array(); + } + + /** + * Checks whether there is a loop in the authorization item hierarchy. + * @param string $itemName parent item name + * @param string $childName the name of the child item that is to be added to the hierarchy + * @return boolean whether a loop exists + */ + protected function detectLoop($itemName,$childName) + { + if($childName===$itemName) + return true; + if(!isset($this->_children[$childName], $this->_items[$itemName])) + return false; + + foreach($this->_children[$childName] as $child) + { + if($this->detectLoop($itemName,$child->getName())) + return true; + } + return false; + } + + /** + * Loads the authorization data from a PHP script file. + * @param string $file the file path. + * @return array the authorization data + * @see saveToFile + */ + protected function loadFromFile($file) + { + if(is_file($file)) + return require($file); + else + return array(); + } + + /** + * Saves the authorization data to a PHP script file. + * @param array $data the authorization data + * @param string $file the file path. + * @see loadFromFile + */ + protected function saveToFile($data,$file) + { + file_put_contents($file,"<?php\nreturn ".var_export($data,true).";\n"); + } +} diff --git a/framework/web/auth/CUserIdentity.php b/framework/web/auth/CUserIdentity.php new file mode 100644 index 0000000..560e75a --- /dev/null +++ b/framework/web/auth/CUserIdentity.php @@ -0,0 +1,82 @@ +<?php +/** + * CUserIdentity class file + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CUserIdentity is a base class for representing identities that are authenticated based on a username and a password. + * + * Derived classes should implement {@link authenticate} with the actual + * authentication scheme (e.g. checking username and password against a DB table). + * + * By default, CUserIdentity assumes the {@link username} is a unique identifier + * and thus use it as the {@link id ID} of the identity. + * + * @property string $id The unique identifier for the identity. + * @property string $name The display name for the identity. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CUserIdentity.php 3426 2011-10-25 00:01:09Z alexander.makarow $ + * @package system.web.auth + * @since 1.0 + */ +class CUserIdentity extends CBaseUserIdentity +{ + /** + * @var string username + */ + public $username; + /** + * @var string password + */ + public $password; + + /** + * Constructor. + * @param string $username username + * @param string $password password + */ + public function __construct($username,$password) + { + $this->username=$username; + $this->password=$password; + } + + /** + * Authenticates a user based on {@link username} and {@link password}. + * Derived classes should override this method, or an exception will be thrown. + * This method is required by {@link IUserIdentity}. + * @return boolean whether authentication succeeds. + */ + public function authenticate() + { + throw new CException(Yii::t('yii','{class}::authenticate() must be implemented.',array('{class}'=>get_class($this)))); + } + + /** + * Returns the unique identifier for the identity. + * The default implementation simply returns {@link username}. + * This method is required by {@link IUserIdentity}. + * @return string the unique identifier for the identity. + */ + public function getId() + { + return $this->username; + } + + /** + * Returns the display name for the identity. + * The default implementation simply returns {@link username}. + * This method is required by {@link IUserIdentity}. + * @return string the display name for the identity. + */ + public function getName() + { + return $this->username; + } +} diff --git a/framework/web/auth/CWebUser.php b/framework/web/auth/CWebUser.php new file mode 100644 index 0000000..73e5a63 --- /dev/null +++ b/framework/web/auth/CWebUser.php @@ -0,0 +1,796 @@ +<?php +/** + * CWebUser class file + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008-2011 Yii Software LLC + * @license http://www.yiiframework.com/license/ + */ + +/** + * CWebUser represents the persistent state for a Web application user. + * + * CWebUser is used as an application component whose ID is 'user'. + * Therefore, at any place one can access the user state via + * <code>Yii::app()->user</code>. + * + * CWebUser should be used together with an {@link IUserIdentity identity} + * which implements the actual authentication algorithm. + * + * A typical authentication process using CWebUser is as follows: + * <ol> + * <li>The user provides information needed for authentication.</li> + * <li>An {@link IUserIdentity identity instance} is created with the user-provided information.</li> + * <li>Call {@link IUserIdentity::authenticate} to check if the identity is valid.</li> + * <li>If valid, call {@link CWebUser::login} to login the user, and + * Redirect the user browser to {@link returnUrl}.</li> + * <li>If not valid, retrieve the error code or message from the identity + * instance and display it.</li> + * </ol> + * + * The property {@link id} and {@link name} are both identifiers + * for the user. The former is mainly used internally (e.g. primary key), while + * the latter is for display purpose (e.g. username). The {@link id} property + * is a unique identifier for a user that is persistent + * during the whole user session. It can be a username, or something else, + * depending on the implementation of the {@link IUserIdentity identity class}. + * + * Both {@link id} and {@link name} are persistent during the user session. + * Besides, an identity may have additional persistent data which can + * be accessed by calling {@link getState}. + * Note, when {@link allowAutoLogin cookie-based authentication} is enabled, + * all these persistent data will be stored in cookie. Therefore, do not + * store password or other sensitive data in the persistent storage. Instead, + * you should store them directly in session on the server side if needed. + * + * @property boolean $isGuest Whether the current application user is a guest. + * @property mixed $id The unique identifier for the user. If null, it means the user is a guest. + * @property string $name The user name. If the user is not logged in, this will be {@link guestName}. + * @property string $returnUrl The URL that the user should be redirected to after login. + * @property string $stateKeyPrefix A prefix for the name of the session variables storing user session data. + * @property array $flashes Flash messages (key => message). + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @version $Id: CWebUser.php 3515 2011-12-28 12:29:24Z mdomba $ + * @package system.web.auth + * @since 1.0 + */ +class CWebUser extends CApplicationComponent implements IWebUser +{ + const FLASH_KEY_PREFIX='Yii.CWebUser.flash.'; + const FLASH_COUNTERS='Yii.CWebUser.flashcounters'; + const STATES_VAR='__states'; + const AUTH_TIMEOUT_VAR='__timeout'; + + /** + * @var boolean whether to enable cookie-based login. Defaults to false. + */ + public $allowAutoLogin=false; + /** + * @var string the name for a guest user. Defaults to 'Guest'. + * This is used by {@link getName} when the current user is a guest (not authenticated). + */ + public $guestName='Guest'; + /** + * @var string|array the URL for login. If using array, the first element should be + * the route to the login action, and the rest name-value pairs are GET parameters + * to construct the login URL (e.g. array('/site/login')). If this property is null, + * a 403 HTTP exception will be raised instead. + * @see CController::createUrl + */ + public $loginUrl=array('/site/login'); + /** + * @var array the property values (in name-value pairs) used to initialize the identity cookie. + * Any property of {@link CHttpCookie} may be initialized. + * This property is effective only when {@link allowAutoLogin} is true. + */ + public $identityCookie; + /** + * @var integer timeout in seconds after which user is logged out if inactive. + * If this property is not set, the user will be logged out after the current session expires + * (c.f. {@link CHttpSession::timeout}). + * @since 1.1.7 + */ + public $authTimeout; + /** + * @var boolean whether to automatically renew the identity cookie each time a page is requested. + * Defaults to false. This property is effective only when {@link allowAutoLogin} is true. + * When this is false, the identity cookie will expire after the specified duration since the user + * is initially logged in. When this is true, the identity cookie will expire after the specified duration + * since the user visits the site the last time. + * @see allowAutoLogin + * @since 1.1.0 + */ + public $autoRenewCookie=false; + /** + * @var boolean whether to automatically update the validity of flash messages. + * Defaults to true, meaning flash messages will be valid only in the current and the next requests. + * If this is set false, you will be responsible for ensuring a flash message is deleted after usage. + * (This can be achieved by calling {@link getFlash} with the 3rd parameter being true). + * @since 1.1.7 + */ + public $autoUpdateFlash=true; + /** + * @var string value that will be echoed in case that user session has expired during an ajax call. + * When a request is made and user session has expired, {@link loginRequired} redirects to {@link loginUrl} for login. + * If that happens during an ajax call, the complete HTML login page is returned as the result of that ajax call. That could be + * a problem if the ajax call expects the result to be a json array or a predefined string, as the login page is ignored in that case. + * To solve this, set this property to the desired return value. + * + * If this property is set, this value will be returned as the result of the ajax call in case that the user session has expired. + * @since 1.1.9 + * @see loginRequired + */ + public $loginRequiredAjaxResponse; + + private $_keyPrefix; + private $_access=array(); + + /** + * PHP magic method. + * This method is overriden so that persistent states can be accessed like properties. + * @param string $name property name + * @return mixed property value + */ + public function __get($name) + { + if($this->hasState($name)) + return $this->getState($name); + else + return parent::__get($name); + } + + /** + * PHP magic method. + * This method is overriden so that persistent states can be set like properties. + * @param string $name property name + * @param mixed $value property value + */ + public function __set($name,$value) + { + if($this->hasState($name)) + $this->setState($name,$value); + else + parent::__set($name,$value); + } + + /** + * PHP magic method. + * This method is overriden so that persistent states can also be checked for null value. + * @param string $name property name + * @return boolean + */ + public function __isset($name) + { + if($this->hasState($name)) + return $this->getState($name)!==null; + else + return parent::__isset($name); + } + + /** + * PHP magic method. + * This method is overriden so that persistent states can also be unset. + * @param string $name property name + * @throws CException if the property is read only. + */ + public function __unset($name) + { + if($this->hasState($name)) + $this->setState($name,null); + else + parent::__unset($name); + } + + /** + * Initializes the application component. + * This method overrides the parent implementation by starting session, + * performing cookie-based authentication if enabled, and updating the flash variables. + */ + public function init() + { + parent::init(); + Yii::app()->getSession()->open(); + if($this->getIsGuest() && $this->allowAutoLogin) + $this->restoreFromCookie(); + else if($this->autoRenewCookie && $this->allowAutoLogin) + $this->renewCookie(); + if($this->autoUpdateFlash) + $this->updateFlash(); + + $this->updateAuthStatus(); + } + + /** + * Logs in a user. + * + * The user identity information will be saved in storage that is + * persistent during the user session. By default, the storage is simply + * the session storage. If the duration parameter is greater than 0, + * a cookie will be sent to prepare for cookie-based login in future. + * + * Note, you have to set {@link allowAutoLogin} to true + * if you want to allow user to be authenticated based on the cookie information. + * + * @param IUserIdentity $identity the user identity (which should already be authenticated) + * @param integer $duration number of seconds that the user can remain in logged-in status. Defaults to 0, meaning login till the user closes the browser. + * If greater than 0, cookie-based login will be used. In this case, {@link allowAutoLogin} + * must be set true, otherwise an exception will be thrown. + * @return boolean whether the user is logged in + */ + public function login($identity,$duration=0) + { + $id=$identity->getId(); + $states=$identity->getPersistentStates(); + if($this->beforeLogin($id,$states,false)) + { + $this->changeIdentity($id,$identity->getName(),$states); + + if($duration>0) + { + if($this->allowAutoLogin) + $this->saveToCookie($duration); + else + throw new CException(Yii::t('yii','{class}.allowAutoLogin must be set true in order to use cookie-based authentication.', + array('{class}'=>get_class($this)))); + } + + $this->afterLogin(false); + } + return !$this->getIsGuest(); + } + + /** + * Logs out the current user. + * This will remove authentication-related session data. + * If the parameter is true, the whole session will be destroyed as well. + * @param boolean $destroySession whether to destroy the whole session. Defaults to true. If false, + * then {@link clearStates} will be called, which removes only the data stored via {@link setState}. + */ + public function logout($destroySession=true) + { + if($this->beforeLogout()) + { + if($this->allowAutoLogin) + { + Yii::app()->getRequest()->getCookies()->remove($this->getStateKeyPrefix()); + if($this->identityCookie!==null) + { + $cookie=$this->createIdentityCookie($this->getStateKeyPrefix()); + $cookie->value=null; + $cookie->expire=0; + Yii::app()->getRequest()->getCookies()->add($cookie->name,$cookie); + } + } + if($destroySession) + Yii::app()->getSession()->destroy(); + else + $this->clearStates(); + $this->afterLogout(); + } + } + + /** + * @return boolean whether the current application user is a guest. + */ + public function getIsGuest() + { + return $this->getState('__id')===null; + } + + /** + * @return mixed the unique identifier for the user. If null, it means the user is a guest. + */ + public function getId() + { + return $this->getState('__id'); + } + + /** + * @param mixed $value the unique identifier for the user. If null, it means the user is a guest. + */ + public function setId($value) + { + $this->setState('__id',$value); + } + + /** + * Returns the unique identifier for the user (e.g. username). + * This is the unique identifier that is mainly used for display purpose. + * @return string the user name. If the user is not logged in, this will be {@link guestName}. + */ + public function getName() + { + if(($name=$this->getState('__name'))!==null) + return $name; + else + return $this->guestName; + } + + /** + * Sets the unique identifier for the user (e.g. username). + * @param string $value the user name. + * @see getName + */ + public function setName($value) + { + $this->setState('__name',$value); + } + + /** + * Returns the URL that the user should be redirected to after successful login. + * This property is usually used by the login action. If the login is successful, + * the action should read this property and use it to redirect the user browser. + * @param string $defaultUrl the default return URL in case it was not set previously. If this is null, + * the application entry URL will be considered as the default return URL. + * @return string the URL that the user should be redirected to after login. + * @see loginRequired + */ + public function getReturnUrl($defaultUrl=null) + { + return $this->getState('__returnUrl', $defaultUrl===null ? Yii::app()->getRequest()->getScriptUrl() : CHtml::normalizeUrl($defaultUrl)); + } + + /** + * @param string $value the URL that the user should be redirected to after login. + */ + public function setReturnUrl($value) + { + $this->setState('__returnUrl',$value); + } + + /** + * Redirects the user browser to the login page. + * Before the redirection, the current URL (if it's not an AJAX url) will be + * kept in {@link returnUrl} so that the user browser may be redirected back + * to the current page after successful login. Make sure you set {@link loginUrl} + * so that the user browser can be redirected to the specified login URL after + * calling this method. + * After calling this method, the current request processing will be terminated. + */ + public function loginRequired() + { + $app=Yii::app(); + $request=$app->getRequest(); + + if(!$request->getIsAjaxRequest()) + $this->setReturnUrl($request->getUrl()); + elseif(isset($this->loginRequiredAjaxResponse)) + { + echo $this->loginRequiredAjaxResponse; + Yii::app()->end(); + } + + if(($url=$this->loginUrl)!==null) + { + if(is_array($url)) + { + $route=isset($url[0]) ? $url[0] : $app->defaultController; + $url=$app->createUrl($route,array_splice($url,1)); + } + $request->redirect($url); + } + else + throw new CHttpException(403,Yii::t('yii','Login Required')); + } + + /** + * This method is called before logging in a user. + * You may override this method to provide additional security check. + * For example, when the login is cookie-based, you may want to verify + * that the user ID together with a random token in the states can be found + * in the database. This will prevent hackers from faking arbitrary + * identity cookies even if they crack down the server private key. + * @param mixed $id the user ID. This is the same as returned by {@link getId()}. + * @param array $states a set of name-value pairs that are provided by the user identity. + * @param boolean $fromCookie whether the login is based on cookie + * @return boolean whether the user should be logged in + * @since 1.1.3 + */ + protected function beforeLogin($id,$states,$fromCookie) + { + return true; + } + + /** + * This method is called after the user is successfully logged in. + * You may override this method to do some postprocessing (e.g. log the user + * login IP and time; load the user permission information). + * @param boolean $fromCookie whether the login is based on cookie. + * @since 1.1.3 + */ + protected function afterLogin($fromCookie) + { + } + + /** + * This method is invoked when calling {@link logout} to log out a user. + * If this method return false, the logout action will be cancelled. + * You may override this method to provide additional check before + * logging out a user. + * @return boolean whether to log out the user + * @since 1.1.3 + */ + protected function beforeLogout() + { + return true; + } + + /** + * This method is invoked right after a user is logged out. + * You may override this method to do some extra cleanup work for the user. + * @since 1.1.3 + */ + protected function afterLogout() + { + } + + /** + * Populates the current user object with the information obtained from cookie. + * This method is used when automatic login ({@link allowAutoLogin}) is enabled. + * The user identity information is recovered from cookie. + * Sufficient security measures are used to prevent cookie data from being tampered. + * @see saveToCookie + */ + protected function restoreFromCookie() + { + $app=Yii::app(); + $request=$app->getRequest(); + $cookie=$request->getCookies()->itemAt($this->getStateKeyPrefix()); + if($cookie && !empty($cookie->value) && ($data=$app->getSecurityManager()->validateData($cookie->value))!==false) + { + $data=@unserialize($data); + if(is_array($data) && isset($data[0],$data[1],$data[2],$data[3])) + { + list($id,$name,$duration,$states)=$data; + if($this->beforeLogin($id,$states,true)) + { + $this->changeIdentity($id,$name,$states); + if($this->autoRenewCookie) + { + $cookie->expire=time()+$duration; + $request->getCookies()->add($cookie->name,$cookie); + } + $this->afterLogin(true); + } + } + } + } + + /** + * Renews the identity cookie. + * This method will set the expiration time of the identity cookie to be the current time + * plus the originally specified cookie duration. + * @since 1.1.3 + */ + protected function renewCookie() + { + $request=Yii::app()->getRequest(); + $cookies=$request->getCookies(); + $cookie=$cookies->itemAt($this->getStateKeyPrefix()); + if($cookie && !empty($cookie->value) && ($data=Yii::app()->getSecurityManager()->validateData($cookie->value))!==false) + { + $data=@unserialize($data); + if(is_array($data) && isset($data[0],$data[1],$data[2],$data[3])) + { + $cookie->expire=time()+$data[2]; + $cookies->add($cookie->name,$cookie); + } + } + } + + /** + * Saves necessary user data into a cookie. + * This method is used when automatic login ({@link allowAutoLogin}) is enabled. + * This method saves user ID, username, other identity states and a validation key to cookie. + * These information are used to do authentication next time when user visits the application. + * @param integer $duration number of seconds that the user can remain in logged-in status. Defaults to 0, meaning login till the user closes the browser. + * @see restoreFromCookie + */ + protected function saveToCookie($duration) + { + $app=Yii::app(); + $cookie=$this->createIdentityCookie($this->getStateKeyPrefix()); + $cookie->expire=time()+$duration; + $data=array( + $this->getId(), + $this->getName(), + $duration, + $this->saveIdentityStates(), + ); + $cookie->value=$app->getSecurityManager()->hashData(serialize($data)); + $app->getRequest()->getCookies()->add($cookie->name,$cookie); + } + + /** + * Creates a cookie to store identity information. + * @param string $name the cookie name + * @return CHttpCookie the cookie used to store identity information + */ + protected function createIdentityCookie($name) + { + $cookie=new CHttpCookie($name,''); + if(is_array($this->identityCookie)) + { + foreach($this->identityCookie as $name=>$value) + $cookie->$name=$value; + } + return $cookie; + } + + /** + * @return string a prefix for the name of the session variables storing user session data. + */ + public function getStateKeyPrefix() + { + if($this->_keyPrefix!==null) + return $this->_keyPrefix; + else + return $this->_keyPrefix=md5('Yii.'.get_class($this).'.'.Yii::app()->getId()); + } + + /** + * @param string $value a prefix for the name of the session variables storing user session data. + */ + public function setStateKeyPrefix($value) + { + $this->_keyPrefix=$value; + } + + /** + * Returns the value of a variable that is stored in user session. + * + * This function is designed to be used by CWebUser descendant classes + * who want to store additional user information in user session. + * A variable, if stored in user session using {@link setState} can be + * retrieved back using this function. + * + * @param string $key variable name + * @param mixed $defaultValue default value + * @return mixed the value of the variable. If it doesn't exist in the session, + * the provided default value will be returned + * @see setState + */ + public function getState($key,$defaultValue=null) + { + $key=$this->getStateKeyPrefix().$key; + return isset($_SESSION[$key]) ? $_SESSION[$key] : $defaultValue; + } + + /** + * Stores a variable in user session. + * + * This function is designed to be used by CWebUser descendant classes + * who want to store additional user information in user session. + * By storing a variable using this function, the variable may be retrieved + * back later using {@link getState}. The variable will be persistent + * across page requests during a user session. + * + * @param string $key variable name + * @param mixed $value variable value + * @param mixed $defaultValue default value. If $value===$defaultValue, the variable will be + * removed from the session + * @see getState + */ + public function setState($key,$value,$defaultValue=null) + { + $key=$this->getStateKeyPrefix().$key; + if($value===$defaultValue) + unset($_SESSION[$key]); + else + $_SESSION[$key]=$value; + } + + /** + * Returns a value indicating whether there is a state of the specified name. + * @param string $key state name + * @return boolean whether there is a state of the specified name. + */ + public function hasState($key) + { + $key=$this->getStateKeyPrefix().$key; + return isset($_SESSION[$key]); + } + + /** + * Clears all user identity information from persistent storage. + * This will remove the data stored via {@link setState}. + */ + public function clearStates() + { + $keys=array_keys($_SESSION); + $prefix=$this->getStateKeyPrefix(); + $n=strlen($prefix); + foreach($keys as $key) + { + if(!strncmp($key,$prefix,$n)) + unset($_SESSION[$key]); + } + } + + /** + * Returns all flash messages. + * This method is similar to {@link getFlash} except that it returns all + * currently available flash messages. + * @param boolean $delete whether to delete the flash messages after calling this method. + * @return array flash messages (key => message). + * @since 1.1.3 + */ + public function getFlashes($delete=true) + { + $flashes=array(); + $prefix=$this->getStateKeyPrefix().self::FLASH_KEY_PREFIX; + $keys=array_keys($_SESSION); + $n=strlen($prefix); + foreach($keys as $key) + { + if(!strncmp($key,$prefix,$n)) + { + $flashes[substr($key,$n)]=$_SESSION[$key]; + if($delete) + unset($_SESSION[$key]); + } + } + if($delete) + $this->setState(self::FLASH_COUNTERS,array()); + return $flashes; + } + + /** + * Returns a flash message. + * A flash message is available only in the current and the next requests. + * @param string $key key identifying the flash message + * @param mixed $defaultValue value to be returned if the flash message is not available. + * @param boolean $delete whether to delete this flash message after accessing it. + * Defaults to true. + * @return mixed the message message + */ + public function getFlash($key,$defaultValue=null,$delete=true) + { + $value=$this->getState(self::FLASH_KEY_PREFIX.$key,$defaultValue); + if($delete) + $this->setFlash($key,null); + return $value; + } + + /** + * Stores a flash message. + * A flash message is available only in the current and the next requests. + * @param string $key key identifying the flash message + * @param mixed $value flash message + * @param mixed $defaultValue if this value is the same as the flash message, the flash message + * will be removed. (Therefore, you can use setFlash('key',null) to remove a flash message.) + */ + public function setFlash($key,$value,$defaultValue=null) + { + $this->setState(self::FLASH_KEY_PREFIX.$key,$value,$defaultValue); + $counters=$this->getState(self::FLASH_COUNTERS,array()); + if($value===$defaultValue) + unset($counters[$key]); + else + $counters[$key]=0; + $this->setState(self::FLASH_COUNTERS,$counters,array()); + } + + /** + * @param string $key key identifying the flash message + * @return boolean whether the specified flash message exists + */ + public function hasFlash($key) + { + return $this->getFlash($key, null, false)!==null; + } + + /** + * Changes the current user with the specified identity information. + * This method is called by {@link login} and {@link restoreFromCookie} + * when the current user needs to be populated with the corresponding + * identity information. Derived classes may override this method + * by retrieving additional user-related information. Make sure the + * parent implementation is called first. + * @param mixed $id a unique identifier for the user + * @param string $name the display name for the user + * @param array $states identity states + */ + protected function changeIdentity($id,$name,$states) + { + Yii::app()->getSession()->regenerateID(); + $this->setId($id); + $this->setName($name); + $this->loadIdentityStates($states); + } + + /** + * Retrieves identity states from persistent storage and saves them as an array. + * @return array the identity states + */ + protected function saveIdentityStates() + { + $states=array(); + foreach($this->getState(self::STATES_VAR,array()) as $name=>$dummy) + $states[$name]=$this->getState($name); + return $states; + } + + /** + * Loads identity states from an array and saves them to persistent storage. + * @param array $states the identity states + */ + protected function loadIdentityStates($states) + { + $names=array(); + if(is_array($states)) + { + foreach($states as $name=>$value) + { + $this->setState($name,$value); + $names[$name]=true; + } + } + $this->setState(self::STATES_VAR,$names); + } + + /** + * Updates the internal counters for flash messages. + * This method is internally used by {@link CWebApplication} + * to maintain the availability of flash messages. + */ + protected function updateFlash() + { + $counters=$this->getState(self::FLASH_COUNTERS); + if(!is_array($counters)) + return; + foreach($counters as $key=>$count) + { + if($count) + { + unset($counters[$key]); + $this->setState(self::FLASH_KEY_PREFIX.$key,null); + } + else + $counters[$key]++; + } + $this->setState(self::FLASH_COUNTERS,$counters,array()); + } + + /** + * Updates the authentication status according to {@link authTimeout}. + * If the user has been inactive for {@link authTimeout} seconds, + * he will be automatically logged out. + * @since 1.1.7 + */ + protected function updateAuthStatus() + { + if($this->authTimeout!==null && !$this->getIsGuest()) + { + $expires=$this->getState(self::AUTH_TIMEOUT_VAR); + if ($expires!==null && $expires < time()) + $this->logout(false); + else + $this->setState(self::AUTH_TIMEOUT_VAR,time()+$this->authTimeout); + } + } + + /** + * Performs access check for this user. + * @param string $operation the name of the operation that need access check. + * @param array $params name-value pairs that would be passed to business rules associated + * with the tasks and roles assigned to the user. + * @param boolean $allowCaching whether to allow caching the result of access check. + * When this parameter + * is true (default), if the access check of an operation was performed before, + * its result will be directly returned when calling this method to check the same operation. + * If this parameter is false, this method will always call {@link CAuthManager::checkAccess} + * to obtain the up-to-date access result. Note that this caching is effective + * only within the same request. + * @return boolean whether the operations can be performed by this user. + */ + public function checkAccess($operation,$params=array(),$allowCaching=true) + { + if($allowCaching && $params===array() && isset($this->_access[$operation])) + return $this->_access[$operation]; + else + return $this->_access[$operation]=Yii::app()->getAuthManager()->checkAccess($operation,$this->getId(),$params); + } +} diff --git a/framework/web/auth/schema-mssql.sql b/framework/web/auth/schema-mssql.sql new file mode 100644 index 0000000..7c1208b --- /dev/null +++ b/framework/web/auth/schema-mssql.sql @@ -0,0 +1,42 @@ +/** + * Database schema required by CDbAuthManager. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008 Yii Software LLC + * @license http://www.yiiframework.com/license/ + * @since 1.0 + */ + +drop table if exists [AuthAssignment]; +drop table if exists [AuthItemChild]; +drop table if exists [AuthItem]; + +create table [AuthItem] +( + [name] varchar(64) not null, + [type] integer not null, + [description] text, + [bizrule] text, + [data] text, + primary key ([name]) +); + +create table [AuthItemChild] +( + [parent] varchar(64) not null, + [child] varchar(64) not null, + primary key ([parent],[child]), + foreign key ([parent]) references [AuthItem] ([name]) on delete cascade on update cascade, + foreign key ([child]) references [AuthItem] ([name]) on delete cascade on update cascade +); + +create table [AuthAssignment] +( + [itemname] varchar(64) not null, + [userid] varchar(64) not null, + [bizrule] text, + [data] text, + primary key ([itemname],[userid]), + foreign key ([itemname]) references [AuthItem] ([name]) on delete cascade on update cascade +); diff --git a/framework/web/auth/schema-mysql.sql b/framework/web/auth/schema-mysql.sql new file mode 100644 index 0000000..8ed5556 --- /dev/null +++ b/framework/web/auth/schema-mysql.sql @@ -0,0 +1,42 @@ +/** + * Database schema required by CDbAuthManager. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008 Yii Software LLC + * @license http://www.yiiframework.com/license/ + * @since 1.0 + */ + +drop table if exists `AuthAssignment`; +drop table if exists `AuthItemChild`; +drop table if exists `AuthItem`; + +create table `AuthItem` +( + `name` varchar(64) not null, + `type` integer not null, + `description` text, + `bizrule` text, + `data` text, + primary key (`name`) +) engine InnoDB; + +create table `AuthItemChild` +( + `parent` varchar(64) not null, + `child` varchar(64) not null, + primary key (`parent`,`child`), + foreign key (`parent`) references `AuthItem` (`name`) on delete cascade on update cascade, + foreign key (`child`) references `AuthItem` (`name`) on delete cascade on update cascade +) engine InnoDB; + +create table `AuthAssignment` +( + `itemname` varchar(64) not null, + `userid` varchar(64) not null, + `bizrule` text, + `data` text, + primary key (`itemname`,`userid`), + foreign key (`itemname`) references `AuthItem` (`name`) on delete cascade on update cascade +) engine InnoDB; diff --git a/framework/web/auth/schema-oci.sql b/framework/web/auth/schema-oci.sql new file mode 100644 index 0000000..2d597b4 --- /dev/null +++ b/framework/web/auth/schema-oci.sql @@ -0,0 +1,42 @@ +/** + * Database schema required by CDbAuthManager. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008 Yii Software LLC + * @license http://www.yiiframework.com/license/ + * @since 1.0 + */ + +drop table if exists "AuthAssignment"; +drop table if exists "AuthItemChild"; +drop table if exists "AuthItem"; + +create table "AuthItem" +( + "name" varchar(64) not null, + "type" integer not null, + "description" text, + "bizrule" text, + "data" text, + primary key ("name") +); + +create table "AuthItemChild" +( + "parent" varchar(64) not null, + "child" varchar(64) not null, + primary key ("parent","child"), + foreign key ("parent") references "AuthItem" ("name") on delete cascade on update cascade, + foreign key ("child") references "AuthItem" ("name") on delete cascade on update cascade +); + +create table "AuthAssignment" +( + "itemname" varchar(64) not null, + "userid" varchar(64) not null, + "bizrule" text, + "data" text, + primary key ("itemname","userid"), + foreign key ("itemname") references "AuthItem" ("name") on delete cascade on update cascade +); diff --git a/framework/web/auth/schema-pgsql.sql b/framework/web/auth/schema-pgsql.sql new file mode 100644 index 0000000..2d597b4 --- /dev/null +++ b/framework/web/auth/schema-pgsql.sql @@ -0,0 +1,42 @@ +/** + * Database schema required by CDbAuthManager. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008 Yii Software LLC + * @license http://www.yiiframework.com/license/ + * @since 1.0 + */ + +drop table if exists "AuthAssignment"; +drop table if exists "AuthItemChild"; +drop table if exists "AuthItem"; + +create table "AuthItem" +( + "name" varchar(64) not null, + "type" integer not null, + "description" text, + "bizrule" text, + "data" text, + primary key ("name") +); + +create table "AuthItemChild" +( + "parent" varchar(64) not null, + "child" varchar(64) not null, + primary key ("parent","child"), + foreign key ("parent") references "AuthItem" ("name") on delete cascade on update cascade, + foreign key ("child") references "AuthItem" ("name") on delete cascade on update cascade +); + +create table "AuthAssignment" +( + "itemname" varchar(64) not null, + "userid" varchar(64) not null, + "bizrule" text, + "data" text, + primary key ("itemname","userid"), + foreign key ("itemname") references "AuthItem" ("name") on delete cascade on update cascade +); diff --git a/framework/web/auth/schema-sqlite.sql b/framework/web/auth/schema-sqlite.sql new file mode 100644 index 0000000..8d93272 --- /dev/null +++ b/framework/web/auth/schema-sqlite.sql @@ -0,0 +1,42 @@ +/** + * Database schema required by CDbAuthManager. + * + * @author Qiang Xue <qiang.xue@gmail.com> + * @link http://www.yiiframework.com/ + * @copyright Copyright © 2008 Yii Software LLC + * @license http://www.yiiframework.com/license/ + * @since 1.0 + */ + +drop table if exists 'AuthAssignment'; +drop table if exists 'AuthItemChild'; +drop table if exists 'AuthItem'; + +create table 'AuthItem' +( + "name" varchar(64) not null, + "type" integer not null, + "description" text, + "bizrule" text, + "data" text, + primary key ("name") +); + +create table 'AuthItemChild' +( + "parent" varchar(64) not null, + "child" varchar(64) not null, + primary key ("parent","child"), + foreign key ("parent") references 'AuthItem' ("name") on delete cascade on update cascade, + foreign key ("child") references 'AuthItem' ("name") on delete cascade on update cascade +); + +create table 'AuthAssignment' +( + "itemname" varchar(64) not null, + "userid" varchar(64) not null, + "bizrule" text, + "data" text, + primary key ("itemname","userid"), + foreign key ("itemname") references 'AuthItem' ("name") on delete cascade on update cascade +); |