<?php
// Content Management System module for PHProjekt (CMS4P).
// Copyright Š2002-2005 by Mario A. Valdez-Ramirez
// http://www.mariovaldez.net/

// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 2 of the License, or
// (at your option) any later version.

// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.

// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, 
// Boston, MA 02111-1307, USA.

// You can contact Mario A. Valdez-Ramirez by email 
// at mario@mariovaldez.org or paper mail at 
// Olmos 809, San Nicolas, NL. 66495, Mexico.


/*
In this file are defined the main OPERATIONS, OBJECTS categories and USER ROLES used
to grant permissions. Because in this role-based schema roles are not combined, we
also define a weight to decide what role's permissions will be considered for a 
given set of conditions (operation, object, user).
The cm_security array is a constraint matrix made from the defined constants for
operations, objects and roles.
Note that some combinations are invalid (for example, grant permission to delete 
the root page) and will produce an error when executed.

The fcm_load_defsec load cm_restrictions into cm_security.
The cm_restrictions array is just the default matrix. The working matrix is 
stored in the database.

There are two copies of the cm_restrictions matrix; the first one will enable the following
by default:
Only superuser can create first-level dirs.
Superuser cannot post comments anywhere.
Admins can delete and change content only of pages they can view (but they cannot create pages).
Normal users can edit and delete pages they own, no matter if they belong to the viewer group, 
   and they can create pages under their directories.

The second copy of the constraint matrix is commented out by default. It's the 
representation of the permissions for previous versions of the CM module. If you
uncomment that matrix you will get:
Admins can create, delete and change content everywhere.
Admins can post only if they belong to the page's viewer group.
Normal users can edit and delete pages they own, no matter if they belong to the viewer group.
This is just in case you want to keep the old behavior.

*/


// Operation
define ("CM_SEC_CREATE", 1);                    // Create page
define ("CM_SEC_DELETE", 2);                    // Delete page
define ("CM_SEC_CHANGE", 3);                    // Edit page
define ("CM_SEC_DISPLA", 4);                    // View page
define ("CM_SEC_COMMEN", 5);                    // Comment on page
// Object
define ("CM_SEC_ROOT", 1);                      // Root directory
define ("CM_SEC_SDIR", 2);                      // Subdirectory
// User status
define ("CM_SEC_SUPERUSER", 1);                 // User is the SuperUser (global role).
define ("CM_SEC_ADMINUSER", 2);                 // User is Administrator of any group (global role).
define ("CM_SEC_ADMINGROU", 3);                 // User is Administrator and member of the viewer group (object dependent).
define ("CM_SEC_USERGROUP", 4);                 // User is member of the viewer group (object dependent).
define ("CM_SEC_USEROWNER", 5);                 // User is owner of the page (object dependent).
define ("CM_SEC_DEFAULTUS", 6);                   // User is something else (default).
define ("CM_SEC_SUPERUSER_W", 100);             // Priority of the user being the SuperUser
define ("CM_SEC_ADMINUSER_W", 20);              // Priority of the user being Administrator of any group.
define ("CM_SEC_ADMINGROU_W", 60);              // Priority of the user being Administrator and member of the viewer group.
define ("CM_SEC_USERGROUP_W", 40);              // Priority of the user being member of the viewer group.
define ("CM_SEC_USEROWNER_W", 80);              // Priority of the user being owner of the page.
define ("CM_SEC_DEFAULTUS_W", 1);               // Priority of the user being something else (default).

$cm_security = array();


function fcm_load_defsec (&$cm_restrictions) {
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_SUPERUSER] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_SUPERUSER] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_SUPERUSER] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_ADMINUSER] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_ADMINGROU] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_ADMINGROU] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_ADMINGROU] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_ADMINGROU] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_ADMINGROU] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_USERGROUP] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_USEROWNER] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_USEROWNER] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_USEROWNER] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_USEROWNER] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_ROOT][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_ROOT][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_ROOT][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_ROOT][CM_SEC_DEFAULTUS] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_ROOT][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_SUPERUSER] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_SUPERUSER] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_ADMINUSER] = false;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_ADMINGROU] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_ADMINGROU] = true;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_ADMINGROU] = true;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_ADMINGROU] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_ADMINGROU] = true;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_USERGROUP] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_USERGROUP] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_USERGROUP] = true;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_USEROWNER] = true;
  $cm_restrictions[CM_SEC_CREATE][CM_SEC_SDIR][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_DELETE][CM_SEC_SDIR][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_CHANGE][CM_SEC_SDIR][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_DISPLA][CM_SEC_SDIR][CM_SEC_DEFAULTUS] = false;
  $cm_restrictions[CM_SEC_COMMEN][CM_SEC_SDIR][CM_SEC_DEFAULTUS] = false;
}


function fcm_load_secdb (&$cm_restrictions) {
  $cm_total_rtsec = 0;
  $result1 = db_query("select * from " . CM_DB_PREFIX . "cmrestrict3") or db_die();
  while ($row1 = db_fetch_row($result1)) {
    $cm_restrictions[$row1[2]][$row1[1]][$row1[3]] = $row1[4];
    $cm_total_rtsec++;
  }
  if ($cm_total_rtsec < 60) {
    fcm_add_logentry ("", $user_kurz, CM_APPLOG_INFO, "Cannot load incomplete restriction/permission matrix.");
    fcm_load_defsec ($cm_restrictions);
    fcm_add_logentry ("", $user_kurz, CM_APPLOG_INFO, "Loaded default restriction/permission matrix.");
    return (0);
  }
  else {
    return ($cm_total_rtsec);
  }
}


function fcm_save_secdb (&$cm_restrictions) {
  global $dbIDnull;
  $result1 = db_query("delete from " . CM_DB_PREFIX . "cmrestrict3") or db_die();
  for ($cm_csop = 1; $cm_csop <= 5; $cm_csop++)  {
    for ($cm_csob = 1; $cm_csob <= 2; $cm_csob++)  {
      for ($cm_csro = 1; $cm_csro <= 5; $cm_csro++)  {
        if ($cm_restrictions[$cm_csop][$cm_csob][$cm_csro]) {
          $cm_perm = 1;
        }
        else {
          $cm_perm = 0;
        }
        $result2 = db_query("insert into " . CM_DB_PREFIX . "cmrestrict3 values($dbIDnull, $cm_csob, $cm_csop, $cm_csro, $cm_perm)") or db_die();
      }
    }
  }
  // repeat again for the default role, to store the data in the same order as previous versions...
  for ($cm_csop = 1; $cm_csop <= 5; $cm_csop++)  {
    for ($cm_csob = 1; $cm_csob <= 2; $cm_csob++)  {
      if ($cm_restrictions[$cm_csop][$cm_csob][CM_SEC_DEFAULTUS]) {
        $cm_perm = 1;
      }
      else {
        $cm_perm = 0;
      }
      $result2 = db_query("insert into " . CM_DB_PREFIX . "cmrestrict3 values($dbIDnull, $cm_csob, $cm_csop, $cm_csro, $cm_perm)") or db_die();
    }
  }
  fcm_add_logentry ("", $user_kurz, CM_APPLOG_EDIT_SECURITY, "Saved restriction/permission matrix.");
}


// fcm_check_constraints
// Lookups the contraints matrix looking for a given combination of
// conditions. Since we don't know a priori the role of the user
// this function will check what is the role of the user.
function fcm_check_constraints ($cm_operation, $cm_username, $cm_path) {
  global $cm_security, $cm_superuser;
  $cm_location = "";
  $cm_user_status = "";
  $cm_user_status_w = 0;
  if (!$cm_operation)
    $cm_operation = CM_SEC_DISPLA;
  if (!$cm_path) {
    $cm_path = "/";
  }
  if ($cm_path == "/") {
    $cm_location = CM_SEC_ROOT;
  }
  else {
    $cm_location = CM_SEC_SDIR;
  }
  $cm_userisadmin = fcm_user_is_admin ($cm_username);
  $cm_userisingroup = fcm_user_is_ingroup2 ($cm_username, $cm_path);
  if (($cm_username == $cm_superuser) && ($cm_user_status_w < CM_SEC_SUPERUSER_W)) {
    $cm_user_status = CM_SEC_SUPERUSER;
    $cm_user_status_w = CM_SEC_SUPERUSER_W;
  }
  if (($cm_userisadmin) && ($cm_user_status_w < CM_SEC_ADMINUSER_W)) {
    $cm_user_status = CM_SEC_ADMINUSER;
    $cm_user_status_w = CM_SEC_ADMINUSER_W;
  }
  if (($cm_userisingroup) && ($cm_user_status_w < CM_SEC_USERGROUP_W)) {
    $cm_user_status = CM_SEC_USERGROUP;
    $cm_user_status_w = CM_SEC_USERGROUP_W;
  }
  if (($cm_userisingroup && $cm_userisadmin) && ($cm_user_status_w < CM_SEC_ADMINGROU_W)) {
    $cm_user_status = CM_SEC_ADMINGROU;
    $cm_user_status_w = CM_SEC_ADMINGROU_W;
  }
  if ((fcm_user_is_owner ($cm_username, $cm_path)) && ($cm_user_status_w < CM_SEC_USEROWNER_W)) {
    $cm_user_status = CM_SEC_USEROWNER;
    $cm_user_status_w = CM_SEC_USEROWNER_W;
  }
  if ($cm_user_status_w == 0) {
    $cm_user_status = CM_SEC_DEFAULTUS;
    $cm_user_status_w = CM_SEC_DEFAULTUS_W;
  }
  return ($cm_security[$cm_operation][$cm_location][$cm_user_status]);
};


// fcm_check_validops
// Returns an array with the permissions for the basic operations for
// a given user and location.
function fcm_check_validops ($cm_username, $cm_path) {
  $cm_validops = array ();
  $cm_validops[CM_SEC_CREATE] = fcm_check_constraints (CM_SEC_CREATE, $cm_username, $cm_path);
  $cm_validops[CM_SEC_DELETE] = fcm_check_constraints (CM_SEC_DELETE, $cm_username, $cm_path);
  $cm_validops[CM_SEC_CHANGE] = fcm_check_constraints (CM_SEC_CHANGE, $cm_username, $cm_path);
  $cm_validops[CM_SEC_DISPLA] = fcm_check_constraints (CM_SEC_DISPLA, $cm_username, $cm_path);
  $cm_validops[CM_SEC_COMMEN] = fcm_check_constraints (CM_SEC_COMMEN, $cm_username, $cm_path);
  return ($cm_validops);
};


// fcm_check_anyglobal
// Returns true or false, checking if the user has permissions for a given operation
// using only its global roles (not location dependent) in a generic location.
function fcm_check_anyglobal ($cm_operation, $cm_username, $cm_generic_loc) {
  global $cm_security, $cm_superuser;
  if (($cm_username == $cm_superuser) && ($cm_security[$cm_operation][$cm_generic_loc][CM_SEC_SUPERUSER])) {
    return (true);
  }
  if ((fcm_user_is_admin ($cm_username)) && ($cm_security[$cm_operation][$cm_generic_loc][CM_SEC_ADMINUSER])) {
    return (true);
  }
  return (false);
};


// fcm_user_is_admin
// Check if the user is Administrator.
function fcm_user_is_admin ($cm_username) {
  $result2 = db_query("select kurz, acc from " . CM_PP_PREFIX . "users where kurz = '$cm_username' and acc like '%a%'") or db_die();
  $row2 = db_fetch_row($result2);
  return ($row2[0] <> '');
};


// fcm_user_is_superuser
// Check if the user is the superuser.
function fcm_user_is_superuser ($cm_username) {
  global $cm_superuser;
  return ($cm_username == $cm_superuser);
};


// fcm_user_is_ingroup2
// Check if user is in the group of given a page.
function fcm_user_is_ingroup2 ($cm_username, $cm_path) {
  global $groups;
  if ($groups) {
    $result3 = db_query("select cmdb_directory, cmdb_viewer_group, cmdb_type from " . CM_DB_PREFIX . "content3 where cmdb_directory like '$cm_path' and cmdb_type like '%" . CM_HITTYPE_PAGE . "%'") or db_die();
    $row3 = db_fetch_row($result3);
    $result2 = db_query("select ID, kurz from " . CM_PP_PREFIX . "users where kurz = '$cm_username'") or db_die();
    $row2 = db_fetch_row($result2);
    $result1 = db_query("select user_ID, " . CM_PP_PREFIX . "gruppen.kurz from " . CM_PP_PREFIX . "grup_user, " . CM_PP_PREFIX . "gruppen where " . CM_PP_PREFIX . "grup_user.user_ID = '$row2[0]' and " . CM_PP_PREFIX . "grup_user.grup_ID = " . CM_PP_PREFIX . "gruppen.ID and " . CM_PP_PREFIX . "gruppen.kurz = '$row3[1]'") or db_die();
    $row1 = db_fetch_row($result1);
    return ($row1[0] <> '');
  }
  else {
    return (true);
  }
};


// fcm_user_is_owner
// Check if the user is the owner of the page.
function fcm_user_is_owner ($cm_username, $cm_path) {
  $result2 = db_query("select cmdb_directory, cmdb_owner_user, cmdb_type from " . CM_DB_PREFIX . "content3 where cmdb_directory like '$cm_path' and cmdb_owner_user = '$cm_username' and cmdb_type like '%" . CM_HITTYPE_PAGE . "%'") or db_die();
  $row2 = db_fetch_row($result2);
  return ($row2[0] <> '');
};


?>