openrat-cms

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs

commit 4d48a9326536ac7b880f02310025fad566476bc9
parent 504214116d9e07cf31b15206008e3d67f61e464a
Author: Jan Dankert <devnull@localhost>
Date:   Wed, 24 Oct 2012 20:37:56 +0200

Jede Actionklasse enthält nun ein Attribut 'security', welches die Sicherheitsstufe angib. ActionConfig entfernt, Dispatcher aufgeräumt.

Diffstat:
action/ConfigurationAction.class.php | 2++
action/ElementAction.class.php | 2++
action/ElementAction.ini.php | 33---------------------------------
action/FileAction.class.php | 2++
action/FileAction.ini.php | 88-------------------------------------------------------------------------------
action/FilebrowserAction.class.php | 4+++-
action/FilebrowserAction.ini.php | 19-------------------
action/FolderAction.class.php | 2++
action/FolderAction.ini.php | 123-------------------------------------------------------------------------------
action/GroupAction.class.php | 2++
action/GroupAction.ini.php | 41-----------------------------------------
action/GrouplistAction.class.php | 2++
action/IndexAction.class.php | 2++
action/LanguageAction.class.php | 2++
action/LanguageAction.ini.php | 37-------------------------------------
action/LanguagelistAction.class.php | 2++
action/LinkAction.class.php | 2++
action/LinkAction.ini.php | 44--------------------------------------------
action/LoginAction.class.php | 2++
action/LoginAction.ini.php | 101-------------------------------------------------------------------------------
action/ModelAction.class.php | 2++
action/ModelAction.ini.php | 30------------------------------
action/ModellistAction.class.php | 2++
action/PageAction.class.php | 2++
action/PageAction.ini.php | 64----------------------------------------------------------------
action/PageelementAction.class.php | 2++
action/PageelementAction.ini.php | 51---------------------------------------------------
action/ProfileAction.class.php | 2++
action/ProfileAction.ini.php | 12------------
action/ProjectAction.class.php | 2++
action/ProjectAction.ini.php | 28----------------------------
action/ProjectlistAction.class.php | 2++
action/ProjectlistAction.ini.php | 0
action/SearchAction.class.php | 2++
action/SearchAction.ini.php | 25-------------------------
action/StartAction.class.php | 2++
action/StartAction.ini.php | 19-------------------
action/TemplateAction.class.php | 2++
action/TemplateAction.ini.php | 52----------------------------------------------------
action/TemplatelistAction.class.php | 2++
action/TitleAction.class.php | 2++
action/TitleAction.ini.php | 13-------------
action/TreeAction.class.php | 2++
action/TreeAction.ini.php | 45---------------------------------------------
action/UserAction.class.php | 2++
action/UserAction.ini.php | 38--------------------------------------
action/UserlistAction.class.php | 2++
action/WebdavAction.class.php | 2++
action/WebdavAction.ini.php | 53-----------------------------------------------------
action/WorkbenchAction.class.php | 14+++++++++++---
action/WorkbenchAction.ini.php | 8--------
dispatcher.php | 84+++++++++++++++++++++++++------------------------------------------------------
init.php | 3+++
util/Http.class.php | 3+--
util/Preferences.class.php | 50--------------------------------------------------
55 files changed, 98 insertions(+), 1038 deletions(-)

diff --git a/action/ConfigurationAction.class.php b/action/ConfigurationAction.class.php @@ -23,6 +23,8 @@ */ class ConfigurationAction extends Action { + public $security = SECURITY_ADMIN; + /** * Konstruktor */ diff --git a/action/ElementAction.class.php b/action/ElementAction.class.php @@ -23,6 +23,8 @@ */ class ElementAction extends Action { + public $security = SECURITY_USER; + var $element; /** diff --git a/action/ElementAction.ini.php b/action/ElementAction.ini.php @@ -1,32 +0,0 @@ - -[default] -goto=name - -[name] -target=savename -menu=edit - -[type] -target=savetype -menu=edit - -[properties] -target=saveproperties -menu=edit - -[saveproperties] -goto=name - -[savename] -goto=name - -[savetype] -goto=name - -[delete] -menu=edit -target=delete - -[menu] -;edit=name,type,properties,remove -menu=name,type,properties,remove- \ No newline at end of file diff --git a/action/FileAction.class.php b/action/FileAction.class.php @@ -28,6 +28,8 @@ */ class FileAction extends ObjectAction { + public $security = SECURITY_USER; + var $file; var $defaultSubAction = 'show'; diff --git a/action/FileAction.ini.php b/action/FileAction.ini.php @@ -1,87 +0,0 @@ - -[default] -goto=show - -[preview] - -[show] -direct=true - -[edit] -menu=edit - -[replace] -menu=edit -goto=edit - -[editvalue] -menu=edit -target=savevalue - -[savevalue] -goto=show - -[prop] -menu=prop -target=saveprop -editable=true - -[saveprop] -goto=prop - -[size] -menu=prop -editable=true - -[remove] -menu=prop -target=delete - -[delete] -goto=prop - -[resize] -goto=prop - -[pub] -write=true -menu=pub - -; Die Aktionen "rights", "aclform", "addacl" und "delacl" sind -; f�r Seiten,Ordner,Links und Dateien identisch. -[rights] -menu=rights -action=object -editable=true - -[aclform] -menu=rights -target=addacl -action=object - -[addacl] -goto=rights - -[delacl] -goto=rights - - -[compress] -menu=edit -write=true - -[uncompress] -menu=edit -write=true - -[extract] -menu=edit -write=true - -[menu] -actions=show,edit,editvalue,compress,uncompress,extract,pub,prop,size,rights,aclform -edit=show,edit,editvalue,compress,uncompress,extract,pub,prop,size,rights,aclform -prop=show,edit,editvalue,compress,uncompress,extract,pub,prop,size,rights,aclform -rights=show,edit,editvalue,compress,uncompress,extract,pub,prop,size,rights,aclform -pub=show,edit,editvalue,compress,uncompress,extract,pub,prop,size,rights,aclform -menu=show,pub,prop,rights- \ No newline at end of file diff --git a/action/FilebrowserAction.class.php b/action/FilebrowserAction.class.php @@ -27,7 +27,9 @@ * @package openrat.actions */ class FilebrowserAction extends ObjectAction -{ +{ + public $security = SECURITY_USER; + var $command; var $resourceType; diff --git a/action/FilebrowserAction.ini.php b/action/FilebrowserAction.ini.php @@ -1,18 +0,0 @@ - -[default] -goto=show - -[directupload] -direct=true - -[browse] -menu=browse - -[upload] -goto=browse - -[addfolder] -goto=browse - -[menu] -browse=browse- \ No newline at end of file diff --git a/action/FolderAction.class.php b/action/FolderAction.class.php @@ -26,6 +26,8 @@ class FolderAction extends ObjectAction { + public $security = SECURITY_USER; + var $defaultSubAction = 'show'; var $folder; diff --git a/action/FolderAction.ini.php b/action/FolderAction.ini.php @@ -1,123 +0,0 @@ - -[default] -goto=show - -[show] -menu=show - -[select] -target=multiple -menu=show - -[edit] -menu=show - -[multiple] -goto=show - -[prop] -menu=prop -write=yes - -[remove] -menu=prop -target=delete - -[delete] -goto=show - -[order] -menu=show - -; Die Aktionen "rights", "aclform", "addacl" und "delacl" sind -; f�r Seiten,Ordner,Links und Dateien identisch. -[rights] -menu=rights -editable=true -action=object -target=inherit - -[aclform] -menu=rights -target=addacl -action=object - -[addacl] -goto=rights - -[delacl] -goto=rights - -[inherit] -goto=rights - - -[pub] -menu=pub -write=true - -[create] -target=createnew -menu=new - -[createfolder] -target=createnewfolder -menu=new - -[createlink] -target=createnewlink -menu=new - -[createfile] -target=createnewfile -menu=new - -[createpage] -target=createnewpage -menu=new - -[createnewfolder] -goto=createfolder - -[createnewfile] -goto=createfile - -[createnewpage] -goto=createpage - -[createnewlink] -goto=createlink - -[createnew] -goto=create - -[reorder] -menu=show -goto=order -write=get - -[changesequence] -goto=order -write=get - -[settop] -goto=order -write=get - -[setbottom] -goto=order -write=get - -[menu] -;pub=pub -;show=show,select,order -;new=create,createfolder,createfile,createpage,createlink -;prop=prop -;rights=rights,aclform - -pub=show,select,order,create,pub,prop,rights,aclform -show=show,select,order,create,pub,prop,rights,aclform -new=show,select,order,create,pub,prop,rights,aclform -prop=show,select,order,create,pub,prop,rights,aclform -rights=show,select,order,create,pub,prop,rights,aclform -menu=show,pub,prop,rights diff --git a/action/GroupAction.class.php b/action/GroupAction.class.php @@ -31,6 +31,8 @@ class GroupAction extends Action { + public $security = SECURITY_ADMIN; + var $group; var $defaultSubAction = 'edit'; diff --git a/action/GroupAction.ini.php b/action/GroupAction.ini.php @@ -1,40 +0,0 @@ - -admin=true - -[default] -goto=listing - -[add] -menu=listing -write=true - -[listing] -menu=listing - -[remove] -menu=edit -write=true - -[edit] -menu=edit -editable=true -write=true - -[deluser] -goto=users - -[memberships] -menu=memberships -editable=true -write=true - -[rights] -menu=rights - -[menu] -listing=listing,add -users=users,adduser -edit=edit,remove -memberships=users -rights=rights -menu=listing,edit,users,remove,rights- \ No newline at end of file diff --git a/action/GrouplistAction.class.php b/action/GrouplistAction.class.php @@ -31,6 +31,8 @@ class GrouplistAction extends Action { + public $security = SECURITY_ADMIN; + function GrouplistAction() { $this->requireAdmin(); diff --git a/action/IndexAction.class.php b/action/IndexAction.class.php @@ -23,6 +23,8 @@ */ class IndexAction extends Action { + public $security = SECURITY_GUEST; + /** * Konstruktor */ diff --git a/action/LanguageAction.class.php b/action/LanguageAction.class.php @@ -64,6 +64,8 @@ */ class LanguageAction extends Action { + public $security = SECURITY_USER; + var $defaultSubAction = 'listing'; /** diff --git a/action/LanguageAction.ini.php b/action/LanguageAction.ini.php @@ -1,36 +0,0 @@ - -[setdefault] -goto=listing - -[listing] -menu=listing - -[edit] -menu=edit -target=save - -[advanced] -menu=edit -target=save - -[add] -menu=listing -target=addlanguage - -[remove] -menu=edit -target=delete - -[delete] -goto=listing - -[save] -goto=listing - -[addlanguage] -goto=listing - -[menu] -listing=listing,add -edit=edit,advanced,remove -menu=listing,add,edit,advanced,remove- \ No newline at end of file diff --git a/action/LanguagelistAction.class.php b/action/LanguagelistAction.class.php @@ -64,6 +64,8 @@ O<?php */ class LanguagelistAction extends Action { + public $security = SECURITY_USER; + /** * Konstruktor diff --git a/action/LinkAction.class.php b/action/LinkAction.class.php @@ -61,6 +61,8 @@ */ class LinkAction extends ObjectAction { + public $security = SECURITY_USER; + var $link; var $defaultSubAction = 'prop'; diff --git a/action/LinkAction.ini.php b/action/LinkAction.ini.php @@ -1,43 +0,0 @@ - -[default] -goto=prop - -[edit] -menu=edit -target=save - -[save] -goto=edit - -[prop] -menu=prop -target=saveprop -editable=true - -[saveprop] -goto=prop - -[delete] -goto=prop - -[rights] -menu=rights -action=object -editable=true - -[aclform] -menu=rights -target=addacl -action=object - -[addacl] -goto=rights - -[delacl] -goto=rights - -[menu] -edit=edit -prop=prop -rights=rights,aclform -menu=edit,prop,rights- \ No newline at end of file diff --git a/action/LoginAction.class.php b/action/LoginAction.class.php @@ -31,6 +31,8 @@ define('PROJECTID_ADMIN',-1); class LoginAction extends Action { + public $security = SECURITY_GUEST; + var $mustChangePassword = false; function setDb( $dbid ) diff --git a/action/LoginAction.ini.php b/action/LoginAction.ini.php @@ -1,101 +0,0 @@ - -admin=false - - -[default] -goto=show - -[logout] -guest=true -goto=login -write=get -clear=tree - -[switchuser] -goto=show - -[object] -goto=show -guest=true - -[language] -goto=show - -[model] -goto=show - -[userinfo] -direct=true - -[project] -goto=show - -[register] -menu=login -target=registercode -guest=true - -[registercode] -goto=registeruserdata -guest=true - -[registeruserdata] -menu=login -target=registercommit -guest=true - -[registercommit] -menu=login -goto=showlogin -guest=true - -[password] -menu=login -guest=true - -[passwordcode] -guest=true -goto=passwordinputcode - -[passwordinputcode] -menu=login -guest=true - -[passwordcommit] -menu=login -goto=showlogin -guest=true - -[administration] -goto=show - -[login] -menu=login -write=true -guest=true -;goto=projectmenu - -[openid] -guest=true -goto=show - -[changepassword] -menu=menu -target=setnewpassword - -[setnewpassword] -menu=menu -goto=projectmenu - -[show] -guest=true - -[menu] -menu =login - -[license] -guest=true - -[ping] -guest=true -direct=true diff --git a/action/ModelAction.class.php b/action/ModelAction.class.php @@ -61,6 +61,8 @@ */ class ModelAction extends Action { + public $security = SECURITY_USER; + var $defaultSubAction = 'listing'; var $model; diff --git a/action/ModelAction.ini.php b/action/ModelAction.ini.php @@ -1,29 +0,0 @@ - -[default] -goto=listing - -[setdefault] -goto=listing - -[listing] -menu=listing - -[edit] -menu=edit -target=save - -[remove] -menu=edit -target=delete - -[delete] -goto=listing - -[save] -goto=edit - -[addmodel] -goto=listing - -[menu] -menu=listing,add,edit,remove- \ No newline at end of file diff --git a/action/ModellistAction.class.php b/action/ModellistAction.class.php @@ -25,6 +25,8 @@ */ class ModellistAction extends Action { + public $security = SECURITY_USER; + function ModellistAction() { if ( $this->getRequestId() != 0 ) diff --git a/action/PageAction.class.php b/action/PageAction.class.php @@ -29,6 +29,8 @@ class PageAction extends ObjectAction { + public $security = SECURITY_USER; + var $page; var $defaultSubAction = 'show'; diff --git a/action/PageAction.ini.php b/action/PageAction.ini.php @@ -1,64 +0,0 @@ - -[default] -goto=show - -;[remove] -;menu=prop -;target=delete - -;[delete] -;target=prop - -[show] -direct=true - -[preview] - -[edit] -direct=true - -[el] -menu=elements - -[form] - -[pub] -menu=pub -write=true - -[prop] -editable=true - -[changetemplate] -menu=prop -target=changetemplateselectelements - -[changetemplateselectelements] -menu=prop -target=changetemplateselectelements - -[replacetemplate] -goto=prop - -[src] -menu=src - -; Die Aktionen "rights", "aclform", "addacl" und "delacl" sind -; f�r Seiten,Ordner,Links und Dateien identisch. -[rights] -menu=rights -action=object -editable=true - -[aclform] -menu=rights -target=addacl -action=object - -[addacl] -goto=rights - -[delacl] -goto=rights - - diff --git a/action/PageelementAction.class.php b/action/PageelementAction.class.php @@ -29,6 +29,8 @@ */ class PageelementAction extends Action { + public $security = SECURITY_USER; + var $defaultSubAction = 'edit'; diff --git a/action/PageelementAction.ini.php b/action/PageelementAction.ini.php @@ -1,50 +0,0 @@ - -[default] -goto=edit - -[usevalue] -menu=edit -goto=edit - -[doimport] -goto=edit - -[doexport] -direct=true - -[import] -menu=edit - -[link] -menu=edit -target=save - -[export] -menu=edit - -[diff] -menu=edit -target=archive - -[archive] -menu=edit -target=diff - -[release] -goto=archive - -[edit] -menu=edit -editable=true - -[prop] -menu=edit - -[save] -goto=edit - -[menu] -menu=edit,prop,link,archive - -;import/export haben wir noch nicht -;menu=edit,prop,link,import,export,archive- \ No newline at end of file diff --git a/action/ProfileAction.class.php b/action/ProfileAction.class.php @@ -29,6 +29,8 @@ */ class ProfileAction extends Action { + public $security = SECURITY_USER; + var $user; var $defaultSubAction = 'edit'; diff --git a/action/ProfileAction.ini.php b/action/ProfileAction.ini.php @@ -1,12 +0,0 @@ - -[edit] - -[memberships] - -[pw] - -[mail] - -[confirmmail] - -[settings] diff --git a/action/ProjectAction.class.php b/action/ProjectAction.class.php @@ -25,6 +25,8 @@ */ class ProjectAction extends Action { + public $security = SECURITY_ADMIN; + var $project; var $defaultSubAction = 'listing'; diff --git a/action/ProjectAction.ini.php b/action/ProjectAction.ini.php @@ -1,28 +0,0 @@ - -; Only admins are allowed to change project settings -admin=true - -[phpinfo] -direct=true - -[default] -goto=listing - -[maintenance] -menu=edit -write=true - -[export] -menu=edit -write=true - -[edit] -menu=edit -editable=true -write=true - -[info] -menu=edit - -[menu] -menu=listing,add,edit,remove,info,export,maintenance diff --git a/action/ProjectlistAction.class.php b/action/ProjectlistAction.class.php @@ -25,6 +25,8 @@ */ class ProjectlistAction extends Action { + public $security = SECURITY_ADMIN; + function ProjectlistAction() { $this->requireAdmin(); diff --git a/action/ProjectlistAction.ini.php b/action/ProjectlistAction.ini.php diff --git a/action/SearchAction.class.php b/action/SearchAction.class.php @@ -30,6 +30,8 @@ class SearchAction extends Action { + public $security = SECURITY_USER; + /** * leerer Kontruktor */ diff --git a/action/SearchAction.ini.php b/action/SearchAction.ini.php @@ -1,25 +0,0 @@ - -[default] -goto=prop - -[quicksearch] -async=true -;goto=result - -[result] -menu=search - -[prop] -menu=search - -[content] -menu=search - -[searchcontent] -goto=result - -[searchprop] -goto=result - -[menu] -menu=prop,content diff --git a/action/StartAction.class.php b/action/StartAction.class.php @@ -32,6 +32,8 @@ if ( !defined('PROJECTID_ADMIN') ) class StartAction extends Action { + public $security = SECURITY_USER; + var $mustChangePassword = false; function setDb( $dbid ) diff --git a/action/StartAction.ini.php b/action/StartAction.ini.php @@ -1,19 +0,0 @@ - -admin=false - -[default] -goto=projectmenu - -[applications] -menu=menu - -[userinfo] -direct=true - -[projectmenu] -menu=menu -clear=tree -write=true - -[menu] -menu=projectmenu,applications diff --git a/action/TemplateAction.class.php b/action/TemplateAction.class.php @@ -25,6 +25,8 @@ class TemplateAction extends Action { + public $security = SECURITY_USER; + var $defaultSubAction = 'show'; var $template; var $element; diff --git a/action/TemplateAction.ini.php b/action/TemplateAction.ini.php @@ -1,51 +0,0 @@ -[add] -menu=listing - -[addtemplate] -goto=listing - -[show] -direct=true - -[prop] -goto=name - -[el] -menu=el - -[addel] -menu=el - -[addelement] -goto=el - -[src] -menu=edit -editable=true - -[srcelement] -menu=edit - -[srcaddelement] -goto=src - -[savesrc] -goto=src - -[name] -menu=prop - -[extension] -menu=prop - -[remove] -menu=prop - -[delete] -goto=listing - -[pages] -menu=prop - -[menu] -menu=listing,name,extension,pages,remove,el,src- \ No newline at end of file diff --git a/action/TemplatelistAction.class.php b/action/TemplatelistAction.class.php @@ -25,6 +25,8 @@ class TemplatelistAction extends Action { + public $security = SECURITY_USER; + function TemplatelistAction() { } diff --git a/action/TitleAction.class.php b/action/TitleAction.class.php @@ -25,6 +25,8 @@ */ class TitleAction extends Action { + public $security = SECURITY_GUEST; + /** * Fuellen der Variablen und Anzeigen der Titelleiste */ diff --git a/action/TitleAction.ini.php b/action/TitleAction.ini.php @@ -1,13 +0,0 @@ - - -[default] -goto=show - -[show] -guest=true - -[ping] -async=true - -[history] -async=true diff --git a/action/TreeAction.class.php b/action/TreeAction.class.php @@ -27,6 +27,8 @@ class TreeAction extends Action { + public $security = SECURITY_USER; + var $tree; diff --git a/action/TreeAction.ini.php b/action/TreeAction.ini.php @@ -1,45 +0,0 @@ - -[default] -goto=show - -[show] -menu=true - -[content] -menu=true - -[settings] -menu=true - -[load] -;write=get -goto=show -clear=content - -[openall] -call=true -goto=show - -[open] -call=true -goto=show - -[close] -call=true -goto=show - -;[refresh] -;goto=show - -[loadEntry] -async=true - -[loadAll] -async=true - -[loadBranch] -async=true - -[menu] -menu=content,settings - diff --git a/action/UserAction.class.php b/action/UserAction.class.php @@ -28,6 +28,8 @@ */ class UserAction extends Action { + public $security = SECURITY_ADMIN; + var $user; var $defaultSubAction = 'edit'; diff --git a/action/UserAction.ini.php b/action/UserAction.ini.php @@ -1,38 +0,0 @@ - -admin=true - -[default] -goto=listing - -[listing] -menu=listing - -[add] -menu=listing -write=true - -[edit] -menu=edit -editable=true -write=true - -[remove] -menu=edit -write=true - -; Gruppenzugehoerigkeiten -[memberships] -menu=memberships -editable=true -write=yes - -[pw] -menu=pw -write=true - -[rights] -menu=rights - -[menu] -menu=listing,add,edit,remove,groups,pw,rights -;info=show,mail diff --git a/action/UserlistAction.class.php b/action/UserlistAction.class.php @@ -28,6 +28,8 @@ */ class UserlistAction extends Action { + public $security = SECURITY_ADMIN; + function UserlistAction() { $this->requireAdmin(); diff --git a/action/WebdavAction.class.php b/action/WebdavAction.class.php @@ -22,6 +22,8 @@ class WebdavAction extends Action { + public $security = SECURITY_USER; + // Zahlreiche Instanzvariablen, die im Konstruktor // beim Zerlegen der Anfrag gef�llt werden. var $defaultSubAction = 'show'; diff --git a/action/WebdavAction.ini.php b/action/WebdavAction.ini.php @@ -1,53 +0,0 @@ - -[default] -goto=none -guest=true - -[get] -direct=true -guest=true - -[head] -direct=true -guest=true - -[put] -direct=true -guest=true - -[mkcol] -direct=true -guest=true - -[delete] -direct=true -guest=true - -[copy] -direct=true -guest=true - -[move] -direct=true -guest=true - -[options] -direct=true -guest=true - -[propfind] -direct=true -guest=true - -[proppatch] -direct=true -guest=true - -[lock] -direct=true -guest=true - -[unlock] -direct=true -guest=true - diff --git a/action/WorkbenchAction.class.php b/action/WorkbenchAction.class.php @@ -1,13 +1,13 @@ <?php /** - * Action-Klasse zum Bearbeiten einer Datei + * Action-Klasse zum Anzeigen der Workbench * @author Jan Dankert * @package openrat.actions */ class WorkbenchAction extends Action { - var $defaultSubAction = 'show'; + public $security = SECURITY_GUEST; private $perspective; @@ -19,7 +19,14 @@ class WorkbenchAction extends Action $this->perspective = Session::get('perspective'); if ( empty($this->perspective) ) { - $this->perspective = 'login'; + global $conf; + $guestConf = $conf['security']['guest']; + + if ( $guestConf['enable'] ) + $this->perspective = 'start'; + else + $this->perspective = 'login'; + Session::set('perspective',$this->perspective); } } @@ -35,6 +42,7 @@ class WorkbenchAction extends Action require_once('themes/default/layout/perspective/header.php'); require_once('themes/default/layout/perspective/normal.php'); // Ausgabe fertig. + exit; } } diff --git a/action/WorkbenchAction.ini.php b/action/WorkbenchAction.ini.php @@ -1,7 +0,0 @@ - -[default] -goto=show - -[show] -guest=true -direct=true- \ No newline at end of file diff --git a/dispatcher.php b/dispatcher.php @@ -60,13 +60,9 @@ if ( !is_array( $conf ) || $conf['config']['auto_reload'] && Preferences::lastMo session_unset(); $conf = Preferences::load(); - #echo "<code><tt>"; - #print_r($conf); - #echo "</tt></code>"; - $conf['action'] = Preferences::loadDirectory(OR_ACTIONCLASSES_DIR); $conf['build'] = parse_ini_file('build.ini'); - // Sprache lesen und zur Konfiguration hinzufuegen + // Sprache lesen if ( $conf['i18n']['use_http'] ) // Die vom Browser angeforderten Sprachen ermitteln @@ -168,67 +164,46 @@ $actionClassName = ucfirst($action).'Action'; require_once( OR_ACTIONCLASSES_DIR.'/'.$actionClassName.'.class.php' ); -$sConf = @$conf['action'][$actionClassName][$subaction]; - // Erzeugen der Action-Klasse $do = new $actionClassName; -// TODO: ActionConfig entfernen. -$do->actionConfig = @$conf['action'][$actionClassName]; -//$do->actionConfig = array(); - $do->actionClassName = $actionClassName; $do->actionName = $action; -if ( $subaction == '' ) - $subaction = $do->actionConfig['default']['goto']; - $do->subActionName = $subaction; - $do->init(); -if ( !isset($do->actionConfig[$subaction]) && false ) -{ - Logger::warn( "Action $action has no configured method named $subaction"); - Http::serverError("Action '$action' has no accessable method '$subaction'."); - exit; -} - - -$subactionConfig = @$do->actionConfig[$subaction]; - -// Eine Subaktion ohne "guest=true" verlangt einen angemeldeten Benutzer. -if ( !isset($subactionConfig['guest']) || !$subactionConfig['guest'] ) - if ( !is_object($do->currentUser) ) - { - Logger::debug('No session and no guest action occured, maybe session expired'); - Http::notAuthorized( lang('SESSION_EXPIRED'),'login required' ); - $do->templateVars['error'] = 'not logged in'; - exit; - } - -// Eine Aktion mit "admin=true" verlangt einen Administrator als Benutzer. -if ( isset($do->actionConfig['admin']) && $do->actionConfig['admin'] ) - if ( !$do->currentUser->isAdmin ) - { - Logger::debug('Admin action, but user '.$do->currentUser->name.' is not an admin'); - Http::notAuthorized( lang('SESSION_EXPIRED'),'intrusion detection' ); - $do->templateVars['error'] = 'no admin'; - exit; - } - - - -// Alias-Methode aufrufen. -if ( isset($do->actionConfig[$do->subActionName]['alias']) ) +switch( @$do->security ) { - $subaction = $do->actionConfig[$do->subActionName]['alias']; + case SECURITY_GUEST: + // Ok. + break; + case SECURITY_USER: + if ( !is_object($do->currentUser) ) + { + Logger::debug('No session and no guest action occured, maybe session expired'); + Http::notAuthorized( lang('SESSION_EXPIRED'),'login required' ); + $do->templateVars['error'] = 'not logged in'; + exit; + } + break; + case SECURITY_ADMIN: + if ( !$do->currentUser->isAdmin ) + { + Logger::debug('Admin action, but user '.$do->currentUser->name.' is not an admin'); + Http::notAuthorized( lang('SESSION_EXPIRED'),'intrusion detection' ); + $do->templateVars['error'] = 'no admin'; + exit; + } + break; + default: + Http::notAuthorized( lang('SESSION_EXPIRED'),'no security information for this action' ); } -$isAction = $_SERVER['REQUEST_METHOD'] == 'POST' || (isset($sConf['write']) && $sConf['write']=='get'); +$isAction = $_SERVER['REQUEST_METHOD'] == 'POST'; if ( $isAction ) $subactionMethodName = $subaction.'Post'; @@ -238,18 +213,11 @@ else Logger::debug("Executing $actionClassName::$subactionMethodName"); if ( ! method_exists($do,$subactionMethodName) ) -{ Http::sendStatus(404,"Method not found","Method '".$subactionMethodName."' does not exist in this context" ); - -} // Jetzt wird die Aktion aus der Actionklasse aufgerufen. $do->$subactionMethodName(); -if ( isset($do->actionConfig[$do->subActionName]['direct']) ) - exit; - - $do->forward(); // fertig :) diff --git a/init.php b/init.php @@ -48,6 +48,9 @@ define('OR_TMP_DIR' ,'./tmp/' ); define('OR_CONTROLLER_FILE' ,defined('OR_EXT_CONTROLLER_FILE')?OR_EXT_CONTROLLER_FILE:'dispatcher'); define('START_TIME' ,time() ); +define('SECURITY_GUEST',1); +define('SECURITY_USER' ,2); +define('SECURITY_ADMIN',3); define('REQ_PARAM_TOKEN' ,'token' ); define('REQ_PARAM_ACTION' ,'action' ); diff --git a/util/Http.class.php b/util/Http.class.php @@ -418,9 +418,8 @@ class Http * * @param String $message Eigener Hinweistext */ - function notAuthorized($message) + function notAuthorized($text,$message) { - Http::sendStatus(403,'Not Authorized',$message); } diff --git a/util/Preferences.class.php b/util/Preferences.class.php @@ -108,55 +108,5 @@ class Preferences $conf['config']['read' ] = date('r'); return $conf; } - - - - - /** - * Liest die Konfigurationsdateien im angegebenen Ordner. - * - * @param $dir Verzeichnis, welche gelesen wird. Optional. Falls nicht gesetzt, wird - * das Standard-Konfigurationsverzeichnis verwendet. - * @return Array - */ - public static function loadDirectory( $dir='' ) - { - if ( !defined('QUOTE') ) - define('QUOTE','"'); - - $values = array(); - - // Bei erstem (nicht-rekursiven) Aufruf der Methoden das Konfigurationsverzeichnis voreinstellen - if ( empty($dir) ) - { - if ( isset($_GET['config']) ) - $dir = basename( $_GET['config'] ).'/'; - else - $dir = OR_PREFERENCES_DIR; - } - - if ( !is_dir($dir) ) - { - Http::sendStatus(501,'Internal Server Error','not a directory: '.$dir); - exit; - } - - $dateien = FileUtils::readDir($dir); - - foreach( $dateien as $datei ) - { - $filename = $dir.$datei; - - if ( is_file($filename) && eregi('\.(ini.*|ini|conf)$',$datei) ) - { - $nameBestandteile = explode('.',$datei); - $values[$nameBestandteile[0]] = parse_ini_file( $filename,true ); - } - } - - ksort($values); - - return $values; - } } ?> \ No newline at end of file