PHP auth_check函数代码示例

 public function __construct()
 {
     parent::__construct();
     $this->load->driver('auth');
     $this->load->helper('auth');
     if (!auth_check()) {
         // put your code here for example: redirect('Testauth/deny');
         // don't fotget to make 'Testauth/deny' allowed for all, else you will have infinte loop ;)
     }
 }

 /**
  * Add a comment
  *
  * This function will add a comment to the database
  * using the credentials passed to it.
  *
  * @access public
  * @param  string $pageUrl  The page url
  * @param  string $userName The user adding the comment
  * @param  string $note     The note to add
  * @param  string $approved Is it approved ? "Default: pending"
  */
 function addComment($pageUrl, $userName, $note, $approved = 'pending')
 {
     $user = isset($GLOBALS['auth_user']) ? $GLOBALS['auth_user']->handle : '';
     if ($user) {
         $sql = "\n                INSERT INTO {$this->notesTableName}\n                (page_url, user_name, user_handle, note_text, note_time,\n                 note_approved, note_approved_by, note_deleted)\n                VALUES (?, ?, ?, ?, NOW(), ?, ?, 0)\n            ";
         // always approve pear.dev account holder comments, moderate others
         $res = $this->dbc->query($sql, array($pageUrl, $userName, $user, $note, auth_check('pear.dev') ? 'yes' : $approved, auth_check('pear.dev') ? $user : ''));
     } else {
         $sql = "\n                INSERT INTO {$this->notesTableName}\n                (page_url, user_name, user_handle, note_text, note_time,\n                 note_approved, note_approved_by, note_deleted)\n                VALUES (?, ?, ?, ?, NOW(), ?, null, 0)\n            ";
         $res = $this->dbc->query($sql, array($pageUrl, $userName, $user, $note, $approved));
     }
     if (PEAR::isError($res)) {
         return $res;
     }
     $this->_compileComment($this->dbc->getOne('SELECT LAST_INSERT_ID()'), $note);
     return true;
 }

function printForm($data = array())
{
    foreach (array('name', 'email', 'copy_me', 'subject', 'text') as $value) {
        if (!isset($data[$value])) {
            $data[$value] = '';
        }
    }
    $form = new HTML_QuickForm2('contect', 'post', array('action' => '/account-mail.php?handle=' . htmlspecialchars($_GET['handle'])));
    $form->removeAttribute('name');
    // Set defaults for the form elements
    $form->addDataSource(new HTML_QuickForm2_DataSource_Array(array('name' => htmlspecialchars($data['name']), 'email' => htmlspecialchars($data['email']), 'copy_me' => htmlspecialchars($data['copy_me']), 'subject' => htmlspecialchars($data['subject']), 'text' => htmlspecialchars($data['text']))));
    $form->addElement('text', 'name', array('required' => 'required'))->setLabel('Y<span class="accesskey">o</span>ur Name:', 'size="40" accesskey="o"');
    $form->addElement('email', 'email', array('required' => 'required'))->setLabel('Email Address:');
    $form->addElement('checkbox', 'copy_me')->setLabel('CC me?:');
    $form->addElement('text', 'subject', array('required' => 'required', 'size' => '80'))->setLabel('Subject:');
    $form->addElement('textarea', 'text', array('cols' => 80, 'rows' => 10, 'required' => 'required'))->setLabel('Text:');
    if (!auth_check('pear.dev')) {
        $numeralCaptcha = new Text_CAPTCHA_Numeral();
        $form->addElement('number', 'captcha', array('maxlength' => 4, 'required' => 'required'))->setLabel("What is " . $numeralCaptcha->getOperation() . '?');
        $_SESSION['answer'] = $numeralCaptcha->getAnswer();
    }
    $form->addElement('submit', 'submit')->setLabel('Send Email');
    print $form;
}

function checkUser($user)
{
    global $dbh;
    // It's a lead or user of the package
    $query = '
        SELECT m.handle
        FROM packages p, maintains m
        WHERE
            m.handle = ? AND
            p.id = m.package AND
            m.role = ?';
    $res = $dbh->getOne($query, array($user, 'lead'));
    if ($res !== null) {
        return true;
    }
    // Try to see if the user is an admin
    return auth_check('pear.qa');
}

<?php

$sub_menu = "200200";
include_once './_common.php';
auth_check($auth[$sub_menu], 'r');
$token = get_token();
$sql_common = " from {$g5['point_table']} ";
$sql_search = " where (1) ";
if ($stx) {
    $sql_search .= " and ( ";
    switch ($sfl) {
        case 'mb_id':
            $sql_search .= " ({$sfl} = '{$stx}') ";
            break;
        default:
            $sql_search .= " ({$sfl} like '%{$stx}%') ";
            break;
    }
    $sql_search .= " ) ";
}
if (!$sst) {
    $sst = "po_id";
    $sod = "desc";
}
$sql_order = " order by {$sst} {$sod} ";
$sql = " select count(*) as cnt\n            {$sql_common}\n            {$sql_search}\n            {$sql_order} ";
$row = sql_fetch($sql);
$total_count = $row['cnt'];
$rows = $config['cf_page_rows'];
$total_page = ceil($total_count / $rows);
// 전체 페이지 계산

    $cols_name[] = array("日期", "類別", "平台/論壇", "評價層級", "問題", "問題網址", "問題回覆/解答者", "問題回覆/解答日期", "關鍵字");
    //$_SESSION['report_value'] = $result;
    /*echo $col++;
    		echo "<pre>";
    		print_r( $_SESSION['report_value'] );
    		echo "</pre>";
    		foreach($_SESSION['report_value'] as $rows){
    			foreach($rows as $key => $val ){
    				print_r( $rows["$key"] );
    				print "Key $key, Value $val\n";
    			}
    		}*/
    export_xls($_SESSION['report_value'], $cols_name, "export", "export");
    exit;
}
auth_check("member", false, false);
$user_id = get_login_id();
$get_member_group_sql = "SELECT group_id,name FROM plu_member WHERE account = '{$user_id}'";
$member_info = $db->get_results($get_member_group_sql, ARRAY_A);
$_SESSION['member_group'] = $member_info[0]['group_id'];
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>CMS後台管理系統-商品服務列表</title>
    <script src="js/jquery.js" type="text/javascript"></script>
    <script src="js/jquery.history_remote.pack.js" type="text/javascript"></script>
    <script src="js/jquery.tabs.pack.js" type="text/javascript"></script>
	
    <script type="text/javascript">

<?php

require_once 'src/db.php';
session_start();
//make sure user is allowed
if ($_SESSION != null) {
    if (!auth_check($_SESSION['email'], $_SESSION['password'])) {
        session_destroy();
        header('Location: index.php');
    }
} else {
    session_destroy();
    header('Location: index.php');
}
//User is allowed!
//Check to see if user posted data
if (isset($_POST['title'])) {
    if (strlen($_POST['title']) > 0) {
        $title = filter_var($_POST["title"], FILTER_SANITIZE_STRING);
        $tags = to_pg_array(explode(" ", filter_var($_POST['tags'], FILTER_SANITIZE_STRING)));
        $visible = isset($_POST['visible']) ? 't' : 'f';
        $is_on_odua = isset($_POST['is_on_odua']) ? 't' : 'f';
        $content = $_POST['content'];
        $name = isset($_GET['p']) ? $_GET['p'] : $title;
        //Data grabed and sanatized, add to database
        $dbconn = post_connect();
        $query = "UPDATE blog SET title='{$title}',entry='{$content}',tags='{$tags}',visible='{$visible}',is_on_odua='{$is_on_odua}' WHERE title='{$name}';\n        INSERT INTO blog (title, entry, tags, visible, is_on_odua) SELECT '{$title}', '{$content}', '{$tags}', '{$visible}', '{$is_on_odua}'\n        WHERE NOT EXISTS (SELECT 1 FROM blog WHERE title='{$title}');";
        $results = pg_query($dbconn, $query) or die('Query failed: ' . pg_last_error());
        pg_close($dbconn);
        if ($results) {
            pg_free_result($results);

    <?php 
    foreach ($inactive_channels as $channel) {
        ?>
      <li>
        <a href="<?php 
        print $channel['project_link'];
        ?>
" title="<?php 
        print $channel['name'];
        ?>
"><?php 
        print $channel['project_label'];
        ?>
</a>
    <?php 
        if (auth_check('pear.admin')) {
            ?>
(<a href="edit.php?channel=<?php 
            print $channel['name'];
            ?>
">edit</a>)<?php 
        }
        ?>
      </li>
    <?php 
    }
    ?>
    </ul>
<?php 
}
?>

/**
 * Generates and returns the notes comments HTML.
 *
 * @param string $uri Manual page id
 *
 * @return string HTML
 */
function getComments($uri)
{
    $output = '';
    require_once 'notes/ManualNotes.class.php';
    $manualNotes = new Manual_Notes();
    $comments = $manualNotes->getPageComments($uri, auth_check('pear.dev'));
    if (empty($comments)) {
        $output .= 'There are no user contributed notes for this page.';
    }
    foreach ($comments as $comment) {
        $manualNotes->display($comment);
    }
    return $output;
}

$maintain = !empty($_GET['maintain']) ? $_GET['maintain'] : '';
$bug_type = !empty($_GET['bug_type']) && $_GET['bug_type'] != 'All' ? $_GET['bug_type'] : '';
$boolean_search = isset($_GET['boolean']) ? (int) $_GET['boolean'] : 0;
define('BOOLEAN_SEARCH', $boolean_search);
$package_name = isset($_GET['package_name']) && is_array($_GET['package_name']) ? $_GET['package_name'] : array();
$package_nname = isset($_GET['package_nname']) && is_array($_GET['package_nname']) ? $_GET['package_nname'] : array();
if (isset($_GET['cmd']) && $_GET['cmd'] == 'display') {
    $query = 'SELECT SQL_CALC_FOUND_ROWS bugdb.*, ' . ' TO_DAYS(NOW())-TO_DAYS(bugdb.ts2) AS unchanged FROM bugdb' . ' LEFT JOIN packages ON packages.name = bugdb.package_name';
    if ($maintain != '' || $handle != '') {
        $query .= ' LEFT JOIN maintains ON packages.id = maintains.package';
        $query .= ' AND maintains.handle = ';
        $query .= $maintain != '' ? $dbh->quoteSmart($maintain) : $dbh->quoteSmart($handle);
        $query .= ' AND maintains.active = 1';
    }
    $where_clause = ' WHERE bugdb.registered IN(';
    $where_clause .= !auth_check('pear.dev') ? '1)' : '1,0)';
    if (!empty($package_name)) {
        $where_clause .= ' AND bugdb.package_name';
        if (count($package_name) > 1) {
            $where_clause .= " IN ('" . join("', '", escapeSQL($package_name)) . "')";
        } else {
            $where_clause .= ' = ' . $dbh->quoteSmart($package_name[0]);
        }
    }
    if (!empty($package_nname)) {
        $where_clause .= ' AND bugdb.package_name';
        if (count($package_nname) > 1) {
            $where_clause .= " NOT IN ('" . join("', '", escapeSQL($package_nname)) . "')";
        } else {
            $where_clause .= ' <> ' . $dbh->quoteSmart($package_nname[0]);
        }

function output_note($com_id, $ts, $email, $comment, $showemail = 1, $handle = null, $comment_name = null, $registered)
{
    global $edit, $id, $user, $dbh;
    echo '<div class="comment">';
    echo '<a name="' . urlencode($ts) . '">&nbsp;</a>';
    echo "<strong>[", format_date($ts), "] ";
    if (!$registered) {
        echo 'User who submitted this comment has not confirmed identity</strong>';
        if (!auth_check('pear.dev')) {
            echo '<pre class="note">If you submitted this note, check your email.';
            echo 'If you do not have a message, <a href="resend-request-email.php?' . 'handle=' . urlencode($handle) . "\">click here to re-send</a>\n", 'MANUAL CONFIRMATION IS NOT POSSIBLE.  Write a message to <a href="mailto:' . PEAR_DEV_EMAIL . '">' . PEAR_DEV_EMAIL . '</a>' . "\n", "to request the confirmation link.  All bugs/comments/patches associated with this\n\nemail address will be deleted within 48 hours if the account request is not confirmed!";
            echo "</pre>\n</div>";
            return;
        }
    } else {
        if ($handle) {
            echo '<a href="/user/' . $handle . '">' . $handle . "</a></strong>\n";
        } else {
            require_once 'bugs/pear-bugs-utils.php';
            $pbu = new PEAR_Bugs_Utils();
            echo $pbu->spamProtect(htmlspecialchars($email)) . "</strong>\n";
        }
    }
    if ($comment_name && $registered) {
        echo '(' . htmlspecialchars($comment_name) . ')';
    }
    if ($edit === 1 && $com_id !== 0 && auth_check('pear.dev')) {
        echo "&nbsp<a href=\"bug.php?id={$id}&amp;edit=1&amp;hide_comment={$com_id}\">[delete]</a>\n";
    }
    echo '<div class="note" style="white-space: pre-wrap; width: 60em; overflow: auto; max-height: 20em; padding: 1.0em; margin: 1.0em; background-color: rgb(240, 240, 240)">';
    // This has to be done so we don't wordwrap the changeset part again
    $fix = $comment;
    $status = "";
    $search = "</div>";
    $needle = strrpos($comment, $search);
    if ($needle !== false) {
        $fix = substr($comment, $needle + strlen($search));
        // Get from last div until end of string
        $status = substr($comment, 0, $needle) . $search;
    }
    $comment = make_ticket_links(addlinks(clean($fix)));
    $comment = $status . $comment;
    echo $comment;
    echo "</div>\n";
    echo '</div>' . "\n";
}

    if (!isset($_POST['admintag'])) {
        $_POST['admintag'] = 0;
    }
    $errors = $manager->validateNewTag($_POST['tag'], $_POST['desc'], $_POST['admintag']);
    if (!count($errors)) {
        try {
            if ($_POST['admintag']) {
                $manager->createAdminTag($_POST['tag'], $_POST['desc']);
            } else {
                $manager->createRegularTag($_POST['tag'], $_POST['desc']);
            }
        } catch (Exception $e) {
            $errors[] = $e->getMessage();
        }
    }
} elseif (isset($_POST['deltag'])) {
    if (isset($_POST['tags']) && is_array($_POST['tags'])) {
        foreach ($_POST['tags'] as $id => $unused) {
            try {
                $manager->deleteTag($id);
            } catch (Exception $e) {
                $errors[] = $e->getMessage();
            }
        }
    }
}
$tags = $manager->getTags();
$tagname = isset($_POST['tag']) ? strip_tags($_POST['tag']) : '';
$desc = isset($_POST['desc']) ? $_POST['desc'] : '';
$admin = auth_check('pear.admin');
require PEARWEB_TEMPLATEDIR . '/tags/admin.tpl.php';

function auth($type, $forum_id, $ug_data, $f_access = array(), $group_perm = UG_PERM_BOTH)
{
    global $lang, $bf, $datastore;
    $is_guest = true;
    $is_admin = false;
    $auth = $auth_fields = $u_access = array();
    $add_auth_type_desc = $forum_id != AUTH_LIST_ALL;
    //
    // Get $auth_fields
    //
    if ($type == AUTH_ALL) {
        $auth_fields = array_keys($bf['forum_perm']);
    } else {
        if ($auth_type = array_search($type, $bf['forum_perm'])) {
            $auth_fields = array($auth_type);
        }
    }
    if (empty($auth_fields)) {
        trigger_error(__FUNCTION__ . '(): empty $auth_fields', E_USER_ERROR);
    }
    //
    // Get $f_access
    //
    // If f_access has been passed, or auth is needed to return an array of forums
    // then we need to pull the auth information on the given forum (or all forums)
    if (empty($f_access)) {
        if (!($forums = $datastore->get('cat_forums'))) {
            $datastore->update('cat_forums');
            $forums = $datastore->get('cat_forums');
        }
        if ($forum_id == AUTH_LIST_ALL) {
            $f_access = $forums['f'];
        } else {
            if (isset($forums['f'][$forum_id])) {
                $f_access[$forum_id] = $forums['f'][$forum_id];
            }
        }
    } else {
        if (isset($f_access['forum_id'])) {
            // Change passed $f_access format for later using in foreach()
            $f_access = array($f_access['forum_id'] => $f_access);
        }
    }
    if (empty($f_access)) {
        trigger_error(__FUNCTION__ . '(): empty $f_access', E_USER_ERROR);
    }
    //
    // Get user or group permissions
    //
    $forum_match_sql = $forum_id != AUTH_LIST_ALL ? "AND aa.forum_id = " . (int) $forum_id : '';
    // GROUP mode
    if (!empty($ug_data['group_id'])) {
        $is_guest = false;
        $is_admin = false;
        $sql = "SELECT aa.forum_id, aa.forum_perm\n\t\t\tFROM " . BB_AUTH_ACCESS . " aa\n\t\t\tWHERE aa.group_id = " . (int) $ug_data['group_id'] . "\n\t\t\t\t{$forum_match_sql}";
        foreach (DB()->fetch_rowset($sql) as $row) {
            $u_access[$row['forum_id']] = $row['forum_perm'];
        }
    } else {
        if (!empty($ug_data['user_id'])) {
            $is_guest = empty($ug_data['session_logged_in']);
            $is_admin = !$is_guest && $ug_data['user_level'] == ADMIN;
            if ($group_perm != UG_PERM_BOTH) {
                $group_single_user = $group_perm == UG_PERM_USER_ONLY ? 1 : 0;
                $sql = "\n\t\t\t\tSELECT\n\t\t\t\t\taa.forum_id, BIT_OR(aa.forum_perm) AS forum_perm\n\t\t\t\tFROM\n\t\t\t\t\t" . BB_USER_GROUP . " ug,\n\t\t\t\t\t" . BB_GROUPS . " g,\n\t\t\t\t\t" . BB_AUTH_ACCESS . " aa\n\t\t\t\tWHERE\n\t\t\t\t\t    ug.user_id = " . (int) $ug_data['user_id'] . "\n\t\t\t\t\tAND ug.user_pending = 0\n\t\t\t\t\tAND g.group_id = ug.group_id\n\t\t\t\t\tAND g.group_single_user = {$group_single_user}\n\t\t\t\t\tAND aa.group_id = g.group_id\n\t\t\t\t\t\t{$forum_match_sql}\n\t\t\t\t\tGROUP BY aa.forum_id\n\t\t\t";
                foreach (DB()->fetch_rowset($sql) as $row) {
                    $u_access[$row['forum_id']] = $row['forum_perm'];
                }
            } else {
                if (!$is_guest && !$is_admin) {
                    $sql = "SELECT SQL_CACHE aa.forum_id, aa.forum_perm\n\t\t\t\t\tFROM " . BB_AUTH_ACCESS_SNAP . " aa\n\t\t\t\t\tWHERE aa.user_id = " . (int) $ug_data['user_id'] . "\n\t\t\t\t\t\t{$forum_match_sql}";
                    foreach (DB()->fetch_rowset($sql) as $row) {
                        $u_access[$row['forum_id']] = $row['forum_perm'];
                    }
                }
            }
        }
    }
    // If the user is logged on and the forum type is either ALL or REG then the user has access
    //
    // If the type if ACL, MOD or ADMIN then we need to see if the user has specific permissions
    // to do whatever it is they want to do ... to do this we pull relevant information for the
    // user (and any groups they belong to)
    //
    // Now we compare the users access level against the forums. We assume here that a moderator
    // and admin automatically have access to an ACL forum, similarly we assume admins meet an
    // auth requirement of MOD
    //
    foreach ($f_access as $f_id => $f_data) {
        $auth[$f_id]['auth_mod'] = auth_check('forum_perm', 'auth_mod', $u_access, $f_id, $is_admin);
        foreach ($auth_fields as $auth_type) {
            if (!isset($f_data[$auth_type])) {
                continue;
            }
            switch ($f_data[$auth_type]) {
                case AUTH_ALL:
                    $auth[$f_id][$auth_type] = true;
                    break;
                case AUTH_REG:
                    $auth[$f_id][$auth_type] = !$is_guest;
//.........这里部分代码省略.........

function auth_require($admin = false)
{
    global $auth_user;
    $res = true;
    if (!is_logged_in()) {
        auth_reject();
        // exits
    }
    $num = func_num_args();
    for ($i = 0; $i < $num; $i++) {
        $arg = func_get_arg($i);
        $res = auth_check($arg);
        if ($res == true) {
            return true;
        }
    }
    if ($res == false) {
        response_header("Insufficient Privileges");
        report_error("Insufficient Privileges");
        response_footer();
        exit;
    }
    return true;
}

function auth_need($domain, $did, $auth, $level = 1)
{
    $flag = auth_check($domain, $did, $auth, $level);
    if ($flag > 0) {
        return true;
    }
    global $_TPL;
    $_TPL['hidemenu'] = true;
    switch ($flag) {
        case -1:
            message('并不拥有指定权限' . $auth, '警告');
            break;
        case -2:
            message('并不拥有指定权限' . $auth . '，该权限已经被取消', '警告');
            break;
        case -3:
            message('并不拥有指定权限' . $auth . '，授权等级不足', '警告');
            break;
        case 0:
            message('授权操作被拒绝', '警告');
            break;
    }
}