PHP AuthService::getRole方法代码示例

function upgradeRootRoleForWelcome()
{
    $rootRole = AuthService::getRole("ROOT_ROLE");
    if (!empty($rootRole)) {
        echo '<br>Upgrading Root Role to let users access the new welcome page<br>';
        $rootRole->setAcl("ajxp_home", "rw");
        $rootRole->setParameterValue("core.conf", "DEFAULT_START_REPOSITORY", "ajxp_home");
        AuthService::updateRole($rootRole);
    }
}

 public function testRolesStorage()
 {
     $r = new \AJXP_Role("phpunit_temporary_role");
     $r->setAcl(0, "rw");
     \AuthService::updateRole($r);
     $r1 = \AuthService::getRole("phpunit_temporary_role");
     $this->assertTrue(is_a($r1, "AJXP_Role"));
     $this->assertEquals("rw", $r1->getAcl(0));
     \AuthService::deleteRole("phpunit_temporary_role");
     $r2 = \AuthService::getRole("phpunit_temporary_role");
     $this->assertFalse($r2);
 }

 /**
  * Specific operations to perform at boot time
  * @static
  * @param array $START_PARAMETERS A HashTable of parameters to send back to the client
  * @return void
  */
 public static function bootSequence(&$START_PARAMETERS)
 {
     if (AJXP_Utils::detectApplicationFirstRun()) {
         return;
     }
     if (file_exists(AJXP_CACHE_DIR . "/admin_counted")) {
         return;
     }
     $rootRole = AuthService::getRole("ROOT_ROLE", false);
     if ($rootRole === false) {
         $rootRole = new AJXP_Role("ROOT_ROLE");
         $rootRole->setLabel("Root Role");
         $rootRole->setAutoApplies(array("standard", "admin"));
         $dashId = "";
         foreach (ConfService::getRepositoriesList("all") as $repositoryId => $repoObject) {
             if ($repoObject->isTemplate) {
                 continue;
             }
             if ($repoObject->getAccessType() == "ajxp_user") {
                 $dashId = $repositoryId;
             }
             $gp = $repoObject->getGroupPath();
             if (empty($gp) || $gp == "/") {
                 if ($repoObject->getDefaultRight() != "") {
                     $rootRole->setAcl($repositoryId, $repoObject->getDefaultRight());
                 }
             }
         }
         if (!empty($dashId)) {
             $rootRole->setParameterValue("core.conf", "DEFAULT_START_REPOSITORY", $dashId);
         }
         $paramNodes = AJXP_PluginsService::searchAllManifests("//server_settings/param[@scope]", "node", false, false, true);
         if (is_array($paramNodes) && count($paramNodes)) {
             foreach ($paramNodes as $xmlNode) {
                 $default = $xmlNode->getAttribute("default");
                 if (empty($default)) {
                     continue;
                 }
                 $parentNode = $xmlNode->parentNode->parentNode;
                 $pluginId = $parentNode->getAttribute("id");
                 if (empty($pluginId)) {
                     $pluginId = $parentNode->nodeName . "." . $parentNode->getAttribute("name");
                 }
                 $rootRole->setParameterValue($pluginId, $xmlNode->getAttribute("name"), $default);
             }
         }
         AuthService::updateRole($rootRole);
     }
     $miniRole = AuthService::getRole("MINISITE", false);
     if ($miniRole === false) {
         $rootRole = new AJXP_Role("MINISITE");
         $rootRole->setLabel("Minisite Users");
         $actions = array("access.fs" => array("ajxp_link", "chmod", "purge"), "meta.watch" => array("toggle_watch"), "conf.serial" => array("get_bookmarks"), "conf.sql" => array("get_bookmarks"), "index.lucene" => array("index"), "action.share" => array("share"), "gui.ajax" => array("bookmark"), "auth.serial" => array("pass_change"), "auth.sql" => array("pass_change"));
         foreach ($actions as $pluginId => $acts) {
             foreach ($acts as $act) {
                 $rootRole->setActionState($pluginId, $act, AJXP_REPO_SCOPE_SHARED, false);
             }
         }
         AuthService::updateRole($rootRole);
     }
     $miniRole = AuthService::getRole("MINISITE_NODOWNLOAD", false);
     if ($miniRole === false) {
         $rootRole = new AJXP_Role("MINISITE_NODOWNLOAD");
         $rootRole->setLabel("Minisite Users - No Download");
         $actions = array("access.fs" => array("download", "download_chunk", "prepare_chunk_dl", "download_all"));
         foreach ($actions as $pluginId => $acts) {
             foreach ($acts as $act) {
                 $rootRole->setActionState($pluginId, $act, AJXP_REPO_SCOPE_SHARED, false);
             }
         }
         AuthService::updateRole($rootRole);
     }
     $miniRole = AuthService::getRole("GUEST", false);
     if ($miniRole === false) {
         $rootRole = new AJXP_Role("GUEST");
         $rootRole->setLabel("Guest user role");
         $actions = array("access.fs" => array("purge"), "meta.watch" => array("toggle_watch"), "index.lucene" => array("index"));
         $rootRole->setAutoApplies(array("guest"));
         foreach ($actions as $pluginId => $acts) {
             foreach ($acts as $act) {
                 $rootRole->setActionState($pluginId, $act, AJXP_REPO_SCOPE_ALL);
             }
         }
         AuthService::updateRole($rootRole);
     }
     $adminCount = AuthService::countAdminUsers();
     if ($adminCount == 0) {
         $authDriver = ConfService::getAuthDriverImpl();
         $adminPass = ADMIN_PASSWORD;
         if ($authDriver->getOption("TRANSMIT_CLEAR_PASS") !== true) {
             $adminPass = md5(ADMIN_PASSWORD);
         }
         AuthService::createUser("admin", $adminPass, true);
         if (ADMIN_PASSWORD == INITIAL_ADMIN_PASSWORD) {
//.........这里部分代码省略.........

//.........这里部分代码省略.........
                     phpCAS::setNoCasServerValidation();
                 }
                 /**
                  * Debug
                  */
                 if ($this->cas_debug_mode) {
                     // logfile name by date:
                     $today = getdate();
                     $file_path = AJXP_DATA_PATH . '/logs/phpcas_' . $today['year'] . '-' . $today['month'] . '-' . $today['mday'] . '.txt';
                     empty($this->cas_debug_file) ? $file_path : ($file_path = $this->cas_debug_file);
                     phpCAS::setDebug($file_path);
                 }
                 phpCAS::forceAuthentication();
             } else {
                 AJXP_Logger::error(__FUNCTION__, "Could not start phpCAS mode CLIENT, please verify the configuration", "");
                 return false;
             }
             break;
         case PHPCAS_MODE_PROXY:
             /**
              * If in login page, user click on login via CAS, the page will be reload with manuallyredirectocas is set.
              * Or force redirect to cas login page even the force redirect is set in configuration of this module
              *
              */
             if ($this->checkConfigurationForProxyMode()) {
                 AJXP_Logger::info(__FUNCTION__, "Start phpCAS mode Proxy: ", "sucessfully");
                 /**
                  * init phpCAS in mode proxy
                  */
                 phpCAS::proxy(CAS_VERSION_2_0, $this->cas_server, $this->cas_port, $this->cas_uri, false);
                 if (!empty($this->cas_certificate_path)) {
                     phpCAS::setCasServerCACert($this->cas_certificate_path);
                 } else {
                     phpCAS::setNoCasServerValidation();
                 }
                 /**
                  * Debug
                  */
                 if ($this->cas_debug_mode) {
                     // logfile name by date:
                     $today = getdate();
                     $file_path = AJXP_DATA_PATH . '/logs/phpcas_' . $today['year'] . '-' . $today['month'] . '-' . $today['mday'] . '.txt';
                     empty($this->cas_debug_file) ? $file_path : ($file_path = $this->cas_debug_file);
                     phpCAS::setDebug($file_path);
                 }
                 if (!empty($this->cas_setFixedCallbackURL)) {
                     phpCAS::setFixedCallbackURL($this->cas_setFixedCallbackURL);
                 }
                 //
                 /**
                  * PTG storage
                  */
                 $this->setPTGStorage();
                 phpCAS::forceAuthentication();
                 /**
                  * Get proxy ticket (PT) for SAMBA to authentication at CAS via pam_cas
                  * In fact, we can use any other service. Of course, it should be enabled in CAS
                  *
                  */
                 $err_code = null;
                 $serviceURL = $this->cas_proxied_service;
                 AJXP_Logger::debug(__FUNCTION__, "Try to get proxy ticket for service: ", $serviceURL);
                 $res = phpCAS::serviceSMB($serviceURL, $err_code);
                 if (!empty($res)) {
                     $_SESSION['PROXYTICKET'] = $res;
                     AJXP_Logger::info(__FUNCTION__, "Get Proxy ticket successfully ", "");
                 } else {
                     AJXP_Logger::info(__FUNCTION__, "Could not get Proxy ticket. ", "");
                 }
                 break;
             } else {
                 AJXP_Logger::error(__FUNCTION__, "Could not start phpCAS mode PROXY, please verify the configuration", "");
                 return false;
             }
         default:
             return false;
             break;
     }
     AJXP_Logger::debug(__FUNCTION__, "Call phpCAS::getUser() after forceAuthentication ", "");
     $cas_user = phpCAS::getUser();
     if (!AuthService::userExists($cas_user) && $this->is_AutoCreateUser) {
         AuthService::createUser($cas_user, openssl_random_pseudo_bytes(20));
     }
     if (AuthService::userExists($cas_user)) {
         $res = AuthService::logUser($cas_user, "", true);
         if ($res > 0) {
             AJXP_Safe::storeCredentials($cas_user, $_SESSION['PROXYTICKET']);
             $_SESSION['LOGGED_IN_BY_CAS'] = true;
             if (!empty($this->cas_additional_role)) {
                 $userObj = ConfService::getConfStorageImpl()->createUserObject($cas_user);
                 $roles = $userObj->getRoles();
                 $cas_RoleID = $this->cas_additional_role;
                 $userObj->addRole(AuthService::getRole($cas_RoleID, true));
                 AuthService::updateUser($userObj);
             }
             return true;
         }
     }
     return false;
 }

//.........这里部分代码省略.........
             $options["META_SOURCES"] = $repository->getOption("META_SOURCES");
             foreach ($options["META_SOURCES"] as $index => $data) {
                 if (isset($data["USE_SESSION_CREDENTIALS"]) && $data["USE_SESSION_CREDENTIALS"] === true) {
                     $options["META_SOURCES"][$index]["ENCODED_CREDENTIALS"] = AJXP_Safe::getEncodedCredentialString();
                 }
             }
         }
         $newRepo = $repository->createSharedChild($label, $options, $repository->id, $loggedUser->id, null);
         $gPath = $loggedUser->getGroupPath();
         if (!empty($gPath) && !ConfService::getCoreConf("CROSSUSERS_ALLGROUPS", "conf")) {
             $newRepo->setGroupPath($gPath);
         }
         $newRepo->setDescription($description);
         ConfService::addRepository($newRepo);
     }
     $file = AJXP_Utils::decodeSecureMagic($httpVars["file"]);
     if (isset($editingRepo)) {
         $currentRights = $this->computeSharedRepositoryAccessRights($httpVars["repository_id"], false, $this->urlBase . $file);
         $originalUsers = array_keys($currentRights["USERS"]);
         $removeUsers = array_diff($originalUsers, $users);
         if (count($removeUsers)) {
             foreach ($removeUsers as $user) {
                 if (AuthService::userExists($user)) {
                     $userObject = $confDriver->createUserObject($user);
                     $userObject->personalRole->setAcl($newRepo->getUniqueId(), "");
                     $userObject->save("superuser");
                 }
             }
         }
         $originalGroups = array_keys($currentRights["GROUPS"]);
         $removeGroups = array_diff($originalGroups, $groups);
         if (count($removeGroups)) {
             foreach ($removeGroups as $groupId) {
                 $role = AuthService::getRole("AJXP_GRP_" . AuthService::filterBaseGroup($groupId));
                 if ($role !== false) {
                     $role->setAcl($newRepo->getUniqueId(), "");
                     AuthService::updateRole($role);
                 }
             }
         }
     }
     foreach ($users as $userName) {
         if (AuthService::userExists($userName, "r")) {
             // check that it's a child user
             $userObject = $confDriver->createUserObject($userName);
         } else {
             if (ConfService::getAuthDriverImpl()->getOption("TRANSMIT_CLEAR_PASS")) {
                 $pass = $uPasses[$userName];
             } else {
                 $pass = md5($uPasses[$userName]);
             }
             $limit = $loggedUser->personalRole->filterParameterValue("core.conf", "USER_SHARED_USERS_LIMIT", AJXP_REPO_SCOPE_ALL, "");
             if (!empty($limit) && intval($limit) > 0) {
                 $count = count(ConfService::getConfStorageImpl()->getUserChildren($loggedUser->getId()));
                 if ($count >= $limit) {
                     $mess = ConfService::getMessages();
                     throw new Exception($mess['483']);
                 }
             }
             AuthService::createUser($userName, $pass);
             $userObject = $confDriver->createUserObject($userName);
             $userObject->personalRole->clearAcls();
             $userObject->setParent($loggedUser->id);
             $userObject->setGroupPath($loggedUser->getGroupPath());
             $userObject->setProfile("shared");
             if (isset($httpVars["minisite"])) {

 /**
  * @param string $parameterName Plugin parameter name
  * @param AbstractAjxpUser|string $userIdOrObject
  * @param string $pluginId Plugin name, core.conf by default
  * @param null $defaultValue
  * @return mixed
  */
 public static function getUserPersonalParameter($parameterName, $userIdOrObject, $pluginId = "core.conf", $defaultValue = null)
 {
     $cacheId = $pluginId . "-" . $parameterName;
     if (!isset(self::$usersParametersCache[$cacheId])) {
         self::$usersParametersCache[$cacheId] = array();
     }
     // Passed an already loaded object
     if (is_a($userIdOrObject, "AbstractAjxpUser")) {
         $value = $userIdOrObject->personalRole->filterParameterValue($pluginId, $parameterName, AJXP_REPO_SCOPE_ALL, $defaultValue);
         self::$usersParametersCache[$cacheId][$userIdOrObject->getId()] = $value;
         if (empty($value) && !empty($defaultValue)) {
             $value = $defaultValue;
         }
         return $value;
     }
     // Already in memory cache
     if (isset(self::$usersParametersCache[$cacheId][$userIdOrObject])) {
         return self::$usersParametersCache[$cacheId][$userIdOrObject];
     }
     // Try to load personal role if it was already loaded.
     $uRole = AuthService::getRole("AJXP_USR_/" . $userIdOrObject);
     if ($uRole === false) {
         $uObject = self::getConfStorageImpl()->createUserObject($userIdOrObject);
         if (isset($uObject)) {
             $uRole = $uObject->personalRole;
         }
     }
     if (empty($uRole)) {
         return $defaultValue;
     }
     $value = $uRole->filterParameterValue($pluginId, $parameterName, AJXP_REPO_SCOPE_ALL, $defaultValue);
     if (empty($value) && !empty($defaultValue)) {
         $value = $userIdOrObject;
     }
     self::$usersParametersCache[$cacheId][$userIdOrObject] = $value;
     return $value;
 }

 public function __wakeup()
 {
     $this->storage = ConfService::getConfStorageImpl();
     if (!is_object($this->personalRole)) {
         $this->personalRole = AuthService::getRole("AJXP_USR_/" . $this->getId());
     }
     $this->recomputeMergedRole();
 }

//.........这里部分代码省略.........
         $newRepo->setDescription($description);
         $newRepo->options["PATH"] = SystemTextEncoding::fromStorageEncoding($newRepo->options["PATH"]);
         if (isset($httpVars["filter_nodes"])) {
             $newRepo->setContentFilter(new ContentFilter($httpVars["filter_nodes"]));
         }
         ConfService::addRepository($newRepo);
         if (!isset($httpVars["minisite"])) {
             $this->getShareStore()->storeShare($repository->getId(), array("REPOSITORY" => $newRepo->getUniqueId(), "OWNER_ID" => $loggedUser->getId()), "repository");
         }
     }
     $sel = new UserSelection($this->repository, $httpVars);
     $file = $sel->getUniqueFile();
     $newRepoUniqueId = $newRepo->getUniqueId();
     if (isset($editingRepo)) {
         $currentRights = $this->computeSharedRepositoryAccessRights($httpVars["repository_id"], false, $this->urlBase . $file);
         $originalUsers = array_keys($currentRights["USERS"]);
         $removeUsers = array_diff($originalUsers, $users);
         if (count($removeUsers)) {
             foreach ($removeUsers as $user) {
                 if (AuthService::userExists($user)) {
                     $userObject = $confDriver->createUserObject($user);
                     $userObject->personalRole->setAcl($newRepoUniqueId, "");
                     $userObject->save("superuser");
                 }
                 if ($this->watcher !== false) {
                     $this->watcher->removeWatchFromFolder(new AJXP_Node($this->urlBase . $file), $user, true);
                 }
             }
         }
         $originalGroups = array_keys($currentRights["GROUPS"]);
         $removeGroups = array_diff($originalGroups, $groups);
         if (count($removeGroups)) {
             foreach ($removeGroups as $groupId) {
                 $role = AuthService::getRole($groupId);
                 if ($role !== false) {
                     $role->setAcl($newRepoUniqueId, "");
                     AuthService::updateRole($role);
                 }
             }
         }
     }
     foreach ($users as $userName) {
         if (AuthService::userExists($userName, "r")) {
             // check that it's a child user
             $userObject = $confDriver->createUserObject($userName);
         } else {
             if (ConfService::getAuthDriverImpl()->getOptionAsBool("TRANSMIT_CLEAR_PASS")) {
                 $pass = $uPasses[$userName];
             } else {
                 $pass = md5($uPasses[$userName]);
             }
             if (!isset($httpVars["minisite"])) {
                 // This is an explicit user creation - check possible limits
                 AJXP_Controller::applyHook("user.before_create", array($userName, null, false, false));
                 $limit = $loggedUser->personalRole->filterParameterValue("core.conf", "USER_SHARED_USERS_LIMIT", AJXP_REPO_SCOPE_ALL, "");
                 if (!empty($limit) && intval($limit) > 0) {
                     $count = count(ConfService::getConfStorageImpl()->getUserChildren($loggedUser->getId()));
                     if ($count >= $limit) {
                         $mess = ConfService::getMessages();
                         throw new Exception($mess['483']);
                     }
                 }
             }
             AuthService::createUser($userName, $pass, false, isset($httpVars["minisite"]));
             $userObject = $confDriver->createUserObject($userName);
             $userObject->personalRole->clearAcls();

 /**
  * @param $userObject AbstractAjxpUser
  * @param $rolePrefix get all roles with prefix
  * @param $includeString get roles in this string
  * @param $excludeString eliminate roles in this string
  * @param bool $byUserRoles
  * @return array
  */
 public function getUserRoleList($userObject, $rolePrefix, $includeString, $excludeString, $byUserRoles = false)
 {
     if ($userObject) {
         if ($byUserRoles) {
             $allUserRoles = $userObject->getRoles();
         } else {
             $allUserRoles = AuthService::getRolesList(array(), true);
         }
         $allRoles = array();
         if (isset($allUserRoles)) {
             // Exclude
             if ($excludeString) {
                 if (strpos($excludeString, "preg:") !== false) {
                     $matchFilterExclude = "/" . str_replace("preg:", "", $excludeString) . "/i";
                 } else {
                     $valueFiltersExclude = array_map("trim", explode(",", $excludeString));
                     $valueFiltersExclude = array_map("strtolower", $valueFiltersExclude);
                 }
             }
             // Include
             if ($includeString) {
                 if (strpos($includeString, "preg:") !== false) {
                     $matchFilterInclude = "/" . str_replace("preg:", "", $includeString) . "/i";
                 } else {
                     $valueFiltersInclude = array_map("trim", explode(",", $includeString));
                     $valueFiltersInclude = array_map("strtolower", $valueFiltersInclude);
                 }
             }
             foreach ($allUserRoles as $roleId => $role) {
                 if (!empty($rolePrefix) && strpos($roleId, $rolePrefix) === false) {
                     continue;
                 }
                 if (isset($matchFilterExclude) && preg_match($matchFilterExclude, substr($roleId, strlen($rolePrefix)))) {
                     continue;
                 }
                 if (isset($valueFiltersExclude) && in_array(strtolower(substr($roleId, strlen($rolePrefix))), $valueFiltersExclude)) {
                     continue;
                 }
                 if (isset($matchFilterInclude) && !preg_match($matchFilterInclude, substr($roleId, strlen($rolePrefix)))) {
                     continue;
                 }
                 if (isset($valueFiltersInclude) && !in_array(strtolower(substr($roleId, strlen($rolePrefix))), $valueFiltersInclude)) {
                     continue;
                 }
                 if (is_a($role, "AJXP_Role")) {
                     $roleObject = $role;
                 } else {
                     $roleObject = AuthService::getRole($roleId);
                 }
                 $label = $roleObject->getLabel();
                 $label = !empty($label) ? $label : substr($roleId, strlen($rolePrefix));
                 $allRoles[$roleId] = $label;
             }
         }
         return $allRoles;
     }
 }

 public function updateUserObject(&$userObject)
 {
     if (!empty($this->separateGroup)) {
         $userObject->setGroupPath("/" . $this->separateGroup);
     }
     // SHOULD BE DEPRECATED
     if (!empty($this->customParamsMapping)) {
         $checkValues = array_values($this->customParamsMapping);
         $prefs = $userObject->getPref("CUSTOM_PARAMS");
         if (!is_array($prefs)) {
             $prefs = array();
         }
         // If one value exist, we consider the mapping has already been done.
         foreach ($checkValues as $val) {
             if (array_key_exists($val, $prefs)) {
                 return;
             }
         }
         $changes = false;
         $entries = $this->getUserEntries($userObject->getId());
         if ($entries["count"]) {
             $entry = $entries[0];
             foreach ($this->customParamsMapping as $key => $value) {
                 if (isset($entry[$key])) {
                     $prefs[$value] = $entry[$key][0];
                     $changes = true;
                 }
             }
         }
         if ($changes) {
             $userObject->setPref("CUSTOM_PARAMS", $prefs);
             $userObject->save();
         }
     }
     if (!empty($this->paramsMapping)) {
         $changes = false;
         $entries = $this->getUserEntries($userObject->getId());
         if ($entries["count"]) {
             $entry = $entries[0];
             foreach ($this->paramsMapping as $params) {
                 $key = strtolower($params['MAPPING_LDAP_PARAM']);
                 if (isset($entry[$key])) {
                     $value = $entry[$key][0];
                     $memberValues = array();
                     if ($key == "memberof") {
                         // get CN from value
                         foreach ($entry[$key] as $possibleValue) {
                             $hnParts = array();
                             $parts = explode(",", ltrim($possibleValue, '/'));
                             foreach ($parts as $part) {
                                 list($att, $attVal) = explode("=", $part);
                                 if (strtolower($att) == "cn") {
                                     $hnParts[] = $attVal;
                                 }
                             }
                             if (count($hnParts)) {
                                 $memberValues[implode(",", $hnParts)] = $possibleValue;
                             }
                         }
                     }
                     switch ($params['MAPPING_LOCAL_TYPE']) {
                         case "role_id":
                             if ($key == "memberof") {
                                 foreach ($memberValues as $uniqValue => $fullDN) {
                                     if (!in_array($uniqValue, array_keys($userObject->getRoles()))) {
                                         $userObject->addRole(AuthService::getRole($uniqValue, true));
                                         $userObject->recomputeMergedRole();
                                         $changes = true;
                                     }
                                 }
                             }
                             break;
                         case "group_path":
                             if ($key == "memberof") {
                                 $filter = $params["MAPPING_LOCAL_PARAM"];
                                 if (strpos($filter, "preg:") !== false) {
                                     $matchFilter = "/" . str_replace("preg:", "", $filter) . "/i";
                                 } else {
                                     if (!empty($filter)) {
                                         $valueFilters = array_map("trim", explode(",", $filter));
                                     }
                                 }
                                 foreach ($memberValues as $uniqValue => $fullDN) {
                                     if (isset($matchFilter) && !preg_match($matchFilter, $uniqValue)) {
                                         continue;
                                     }
                                     if (isset($valueFilters) && !in_array($uniqValue, $valueFilters)) {
                                         continue;
                                     }
                                     if ($userObject->personalRole->filterParameterValue("auth.ldap", "MEMBER_OF", AJXP_REPO_SCOPE_ALL, "") == $fullDN) {
                                         //break;
                                     }
                                     $humanName = $uniqValue;
                                     $branch = array();
                                     $this->buildGroupBranch($uniqValue, $branch);
                                     $parent = "/";
                                     if (count($branch)) {
                                         $parent = "/" . implode("/", array_reverse($branch));
                                     }
                                     AuthService::createGroup($parent, $fullDN, $humanName);
//.........这里部分代码省略.........

<?php

// FORCE bootstrap_repositories copy
if (is_file(AJXP_INSTALL_PATH . "/conf/bootstrap_repositories.php" . ".new-" . date("Ymd"))) {
    rename(AJXP_INSTALL_PATH . "/conf/bootstrap_repositories.php", AJXP_INSTALL_PATH . "/conf/bootstrap_repositories.php.pre-update");
    rename(AJXP_INSTALL_PATH . "/conf/bootstrap_repositories.php" . ".new-" . date("Ymd"), AJXP_INSTALL_PATH . "/conf/bootstrap_repositories.php");
}
// Add new repo to root role
$rootRole = AuthService::getRole("AJXP_GRP_/");
$rootRole->setAcl("inbox", "rw");
AuthService::updateRole($rootRole);

 protected function actionUnshare($remoteId, $token, $parameters)
 {
     $token = \AJXP_Utils::sanitize($token, AJXP_SANITIZE_ALPHANUM);
     $remoteId = \AJXP_Utils::sanitize($remoteId, AJXP_SANITIZE_ALPHANUM);
     $store = new SQLStore();
     $remoteShare = $store->remoteShareForOcsRemoteId($remoteId);
     if (empty($remoteShare)) {
         throw new InvalidArgumentsException();
     }
     if ($token !== $remoteShare->getOcsToken()) {
         throw new InvalidArgumentsException();
     }
     $targetUser = $remoteShare->getUser();
     $store->deleteRemoteShare($remoteShare);
     $response = $this->buildResponse("ok", 200, "Successfully removed share.");
     $this->sendResponse($response, $this->getFormat($parameters));
     $userRole = \AuthService::getRole("AJXP_USR_/" . $targetUser);
     if ($userRole !== false) {
         // Artificially "touch" user role
         // to force repositories reload if he is logged in
         \AuthService::updateRole($userRole);
     }
 }

 function ajxp_gluecode_updateRole($loginData, &$userObject)
 {
     $authPlug = ConfService::getAuthDriverImpl();
     if (property_exists($authPlug, "drivers") && is_array($authPlug->drivers) && $authPlug->drivers["remote"]) {
         $authPlug = $authPlug->drivers["remote"];
     }
     $rolesMap = $authPlug->getOption("ROLES_MAP");
     if (!isset($rolesMap) || strlen($rolesMap) == 0) {
         return;
     }
     // String like {key:value,key2:value2,key3:value3}
     $rolesMap = explode(",", $rolesMap);
     $newMap = array();
     foreach ($rolesMap as $value) {
         $parts = explode(":", trim($value));
         $roleId = trim($parts[1]);
         $roleObject = AuthService::getRole($roleId);
         if ($roleObject != null) {
             $newMap[trim($parts[0])] = $roleObject;
             $userObject->removeRole($roleId);
         }
     }
     $rolesMap = $newMap;
     if (isset($loginData["roles"]) && is_array($loginData["roles"])) {
         foreach ($loginData["roles"] as $role) {
             if (isset($rolesMap[$role])) {
                 $userObject->addRole($rolesMap[$role]);
             }
         }
     }
 }

 function switchAction($action, $httpVars, $fileVars)
 {
     if (!isset($this->actions[$action])) {
         return;
     }
     parent::accessPreprocess($action, $httpVars, $fileVars);
     $loggedUser = AuthService::getLoggedUser();
     if (ENABLE_USERS && !$loggedUser->isAdmin()) {
         return;
     }
     if ($action == "edit") {
         if (isset($httpVars["sub_action"])) {
             $action = $httpVars["sub_action"];
         }
     }
     $mess = ConfService::getMessages();
     switch ($action) {
         //------------------------------------
         //	BASIC LISTING
         //------------------------------------
         case "ls":
             $rootNodes = array("repositories" => array("LABEL" => $mess["ajxp_conf.3"], "ICON" => "folder_red.png"), "users" => array("LABEL" => $mess["ajxp_conf.2"], "ICON" => "yast_kuser.png"), "roles" => array("LABEL" => $mess["ajxp_conf.69"], "ICON" => "user_group_new.png"), "files" => array("LABEL" => $mess["ajxp_shared.3"], "ICON" => "html.png"), "logs" => array("LABEL" => $mess["ajxp_conf.4"], "ICON" => "toggle_log.png"), "diagnostic" => array("LABEL" => $mess["ajxp_conf.5"], "ICON" => "susehelpcenter.png"));
             $dir = isset($httpVars["dir"]) ? $httpVars["dir"] : "";
             $splits = explode("/", $dir);
             if (count($splits)) {
                 if ($splits[0] == "") {
                     array_shift($splits);
                 }
                 if (count($splits)) {
                     $strippedDir = strtolower(urldecode($splits[0]));
                 } else {
                     $strippedDir = "";
                 }
             }
             if (array_key_exists($strippedDir, $rootNodes)) {
                 AJXP_XMLWriter::header();
                 if ($strippedDir == "users") {
                     $this->listUsers();
                 } else {
                     if ($strippedDir == "roles") {
                         $this->listRoles();
                     } else {
                         if ($strippedDir == "repositories") {
                             $this->listRepositories();
                         } else {
                             if ($strippedDir == "logs") {
                                 $this->listLogFiles($dir);
                             } else {
                                 if ($strippedDir == "diagnostic") {
                                     $this->printDiagnostic();
                                 } else {
                                     if ($strippedDir == "files") {
                                         $this->listSharedFiles();
                                     }
                                 }
                             }
                         }
                     }
                 }
                 AJXP_XMLWriter::close();
                 exit(1);
             } else {
                 AJXP_XMLWriter::header();
                 AJXP_XMLWriter::sendFilesListComponentConfig('<columns switchGridMode="filelist"><column messageId="ajxp_conf.1" attributeName="ajxp_label" sortType="String"/></columns>');
                 foreach ($rootNodes as $key => $data) {
                     $src = '';
                     if ($key == "logs") {
                         $src = 'src="content.php?get_action=ls&amp;dir=' . $key . '"';
                     }
                     print '<tree text="' . $data["LABEL"] . '" icon="' . $data["ICON"] . '" filename="/' . $key . '" parentname="/" ' . $src . ' />';
                 }
                 AJXP_XMLWriter::close();
                 exit(1);
             }
             break;
         case "stat":
             header("Content-type:application/json");
             print '{"mode":true}';
             exit(1);
             break;
         case "create_role":
             $roleId = $httpVars["role_id"];
             if (AuthService::getRole($roleId) !== false) {
                 throw new Exception($mess["ajxp_conf.65"]);
             }
             AuthService::updateRole(new AjxpRole($roleId));
             AJXP_XMLWriter::header();
             AJXP_XMLWriter::sendMessage($mess["ajxp_conf.66"], null);
             AJXP_XMLWriter::reloadDataNode("", $httpVars["role_id"]);
             AJXP_XMLWriter::close();
             break;
         case "edit_role":
             $roleId = $httpVars["role_id"];
             $role = AuthService::getRole($roleId);
             AJXP_XMLWriter::header("admin_data");
             print AJXP_XMLWriter::writeRoleRepositoriesData($role);
             AJXP_XMLWriter::close("admin_data");
             break;
         case "update_role_right":
             if (!isset($httpVars["role_id"]) || !isset($httpVars["repository_id"]) || !isset($httpVars["right"])) {
//.........这里部分代码省略.........

 public function updateUserRole($userId, $roleId, $addOrRemove, $updateSubUsers = false)
 {
     $confStorage = ConfService::getConfStorageImpl();
     $user = $confStorage->createUserObject($userId);
     if (!AuthService::canAdministrate($user)) {
         throw new Exception("Cannot update user data for " . $userId);
     }
     if ($addOrRemove == "add") {
         $roleObject = AuthService::getRole($roleId);
         $user->addRole($roleObject);
     } else {
         $user->removeRole($roleId);
     }
     $user->save("superuser");
     $loggedUser = AuthService::getLoggedUser();
     if ($loggedUser->getId() == $user->getId()) {
         AuthService::updateUser($user);
     }
     return $user;
 }