PHP access::allow方法代码示例

 static function initialize()
 {
     $db = Database::instance();
     $db->query("CREATE TABLE IF NOT EXISTS {users} (\n                 `id` int(9) NOT NULL auto_increment,\n                 `name` varchar(32) NOT NULL,\n                 `full_name` varchar(255) NOT NULL,\n                 `password` varchar(64) NOT NULL,\n                 `login_count` int(10) unsigned NOT NULL DEFAULT 0,\n                 `last_login` int(10) unsigned NOT NULL DEFAULT 0,\n                 `email` varchar(64) default NULL,\n                 `admin` BOOLEAN default 0,\n                 `guest` BOOLEAN default 0,\n                 `hash` char(32) default NULL,\n                 `url` varchar(255) default NULL,\n                 `locale` char(10) default NULL,\n                 PRIMARY KEY (`id`),\n                 UNIQUE KEY(`hash`),\n                 UNIQUE KEY(`name`))\n               DEFAULT CHARSET=utf8;");
     $db->query("CREATE TABLE IF NOT EXISTS {groups} (\n                 `id` int(9) NOT NULL auto_increment,\n                 `name` char(64) default NULL,\n                 `special` BOOLEAN default 0,\n                 PRIMARY KEY (`id`),\n                 UNIQUE KEY(`name`))\n               DEFAULT CHARSET=utf8;");
     $db->query("CREATE TABLE IF NOT EXISTS {groups_users} (\n                 `group_id` int(9) NOT NULL,\n                 `user_id` int(9) NOT NULL,\n                 PRIMARY KEY (`group_id`, `user_id`),\n                 UNIQUE KEY(`user_id`, `group_id`))\n               DEFAULT CHARSET=utf8;");
     $everybody = ORM::factory("group");
     $everybody->name = "Everybody";
     $everybody->special = true;
     $everybody->save();
     $registered = ORM::factory("group");
     $registered->name = "Registered Users";
     $registered->special = true;
     $registered->save();
     $guest = ORM::factory("user");
     $guest->name = "guest";
     $guest->full_name = "Guest User";
     $guest->password = "";
     $guest->guest = true;
     $guest->save();
     $admin = ORM::factory("user");
     $admin->name = "admin";
     $admin->full_name = "Gallery Administrator";
     $admin->password = "admin";
     $admin->email = "unknown@unknown.com";
     $admin->admin = true;
     $admin->save();
     $root = ORM::factory("item", 1);
     access::allow($everybody, "view", $root);
     access::allow($everybody, "view_full", $root);
     access::allow($registered, "view", $root);
     access::allow($registered, "view_full", $root);
     module::set_version("user", 2);
     module::set_var("user", "mininum_password_length", 5);
 }

 static function install()
 {
     $db = Database::instance();
     $version = module::get_version("user");
     if ($version == 0) {
         $db->query("CREATE TABLE IF NOT EXISTS {users} (\n                   `id` int(9) NOT NULL auto_increment,\n                   `name` varchar(32) NOT NULL,\n                   `full_name` varchar(255) NOT NULL,\n                   `password` varchar(64) NOT NULL,\n                   `login_count` int(10) unsigned NOT NULL DEFAULT 0,\n                   `last_login` int(10) unsigned NOT NULL DEFAULT 0,\n                   `email` varchar(64) default NULL,\n                   `admin` BOOLEAN default 0,\n                   `guest` BOOLEAN default 0,\n                   `hash` char(32) default NULL,\n                   `url` varchar(255) default NULL,\n                   `locale` char(10) default NULL,\n                   PRIMARY KEY (`id`),\n                   UNIQUE KEY(`hash`),\n                   UNIQUE KEY(`name`))\n                 ENGINE=InnoDB DEFAULT CHARSET=utf8;");
         $db->query("CREATE TABLE IF NOT EXISTS {groups} (\n                   `id` int(9) NOT NULL auto_increment,\n                   `name` char(64) default NULL,\n                   `special` BOOLEAN default 0,\n                   PRIMARY KEY (`id`),\n                   UNIQUE KEY(`name`))\n                 ENGINE=InnoDB DEFAULT CHARSET=utf8;");
         $db->query("CREATE TABLE IF NOT EXISTS {groups_users} (\n                   `group_id` int(9) NOT NULL,\n                   `user_id` int(9) NOT NULL,\n                   PRIMARY KEY (`group_id`, `user_id`),\n                   UNIQUE KEY(`user_id`, `group_id`))\n                 ENGINE=InnoDB DEFAULT CHARSET=utf8;");
         $everybody = group::create("Everybody");
         $everybody->special = true;
         $everybody->save();
         $registered = group::create("Registered Users");
         $registered->special = true;
         $registered->save();
         $guest = user::create("guest", "Guest User", "");
         $guest->guest = true;
         $guest->remove($registered);
         $guest->save();
         $admin = user::create("admin", "Gallery Administrator", "admin");
         $admin->admin = true;
         $admin->save();
         // Let the admin own everything
         $db->update("items", array("owner_id" => $admin->id), array("owner_id" => "IS NULL"));
         module::set_version("user", 1);
         $root = ORM::factory("item", 1);
         access::allow($everybody, "view", $root);
         access::allow($everybody, "view_full", $root);
         access::allow($registered, "view", $root);
         access::allow($registered, "view_full", $root);
     }
 }

 /**
  * Create an album for the newly created user and give him view and edit permissions.
  */
 static function user_created($user)
 {
     // Create a group with the same name, if necessary
     $group_name = "auto: {$user->name}";
     $group = identity::lookup_group_by_name($group_name);
     if (!$group) {
         $group = identity::create_group($group_name);
         identity::add_user_to_group($user, $group);
     }
     // Create an album for the user, if it doesn't exist
     $album = ORM::factory("item")->where("parent_id", "=", item::root()->id)->where("name", "=", $user->name)->find();
     if (!$album->loaded()) {
         $album->type = "album";
         $album->name = $user->name;
         $album->title = "{$user->name}'s album";
         $album->parent_id = item::root()->id;
         $album->sort_column = "weight";
         $album->sort_order = "asc";
         $album->save();
         access::allow($group, "view", item::root());
         access::allow($group, "view_full", $album);
         access::allow($group, "edit", $album);
         access::allow($group, "add", $album);
     }
 }

 function change($command, $group_id, $perm_id, $item_id)
 {
     access::verify_csrf();
     $group = identity::lookup_group($group_id);
     $perm = ORM::factory("permission", $perm_id);
     $item = ORM::factory("item", $item_id);
     access::required("view", $item);
     access::required("edit", $item);
     if (!empty($group) && $perm->loaded() && $item->loaded()) {
         switch ($command) {
             case "allow":
                 access::allow($group, $perm->name, $item);
                 break;
             case "deny":
                 access::deny($group, $perm->name, $item);
                 break;
             case "reset":
                 access::reset($group, $perm->name, $item);
                 break;
         }
         // If the active user just took away their own edit permissions, give it back.
         if ($perm->name == "edit") {
             if (!access::user_can(identity::active_user(), "edit", $item)) {
                 access::allow($group, $perm->name, $item);
             }
         }
     }
 }

 public function post_test()
 {
     access::allow(identity::everybody(), "edit", item::root());
     $request = new stdClass();
     $request->params = new stdClass();
     $request->params->name = "test tag";
     $this->assert_equal(array("url" => url::site("rest/tag/1")), tags_rest::post($request));
 }

 static function initialize()
 {
     module::set_version("ldap", 1);
     $root = item::root();
     foreach (IdentityProvider::instance()->groups() as $group) {
         module::event("group_created", $group);
         access::allow($group, "view", $root);
         access::allow($group, "view_full", $root);
     }
 }

 public function post_test()
 {
     $tag = test::random_tag();
     // Create an editable item to be tagged
     $album = test::random_album();
     access::allow(identity::everybody(), "edit", $album);
     // Add the album to the tag
     $request->url = rest::url("tag", $tag);
     $request->params->url = rest::url("item", $album);
     $this->assert_equal_array(array("url" => rest::url("tag_item", $tag, $album)), tag_rest::post($request));
 }

 static function install()
 {
     module::set_version("ldap", 1);
     $root = item::root();
     $ldap_provider = new IdentityProvider("ldap");
     foreach ($ldap_provider->groups() as $group) {
         module::event("group_created", $group);
         access::allow($group, "view", $root);
         access::allow($group, "view_full", $root);
     }
 }

 public function cant_view_comments_for_unviewable_items_test()
 {
     $root = ORM::factory("item", 1);
     $album = album::create($root, rand(), rand(), rand());
     $comment = comment::create($album, user::guest(), "text", "name", "email", "url");
     user::set_active(user::guest());
     // We can see the comment when permissions are granted on the album
     access::allow(group::everybody(), "view", $album);
     $this->assert_equal(1, ORM::factory("comment")->viewable()->where("comments.id", $comment->id)->count_all());
     // We can't see the comment when permissions are denied on the album
     access::deny(group::everybody(), "view", $album);
     $this->assert_equal(0, ORM::factory("comment")->viewable()->where("comments.id", $comment->id)->count_all());
 }

 public function viewable_test()
 {
     $album = test::random_album();
     $item = test::random_photo($album);
     $album->reload();
     identity::set_active_user(identity::guest());
     // We can see the item when permissions are granted
     access::allow(identity::everybody(), "view", $album);
     $this->assert_equal(1, ORM::factory("item")->viewable()->where("id", "=", $item->id)->count_all());
     // We can't see the item when permissions are denied
     access::deny(identity::everybody(), "view", $album);
     $this->assert_equal(0, ORM::factory("item")->viewable()->where("id", "=", $item->id)->count_all());
 }

 public function viewable_test()
 {
     $root = ORM::factory("item", 1);
     $album = album::create($root, rand(), rand(), rand());
     $item = self::_create_random_item($album);
     identity::set_active_user(identity::guest());
     // We can see the item when permissions are granted
     access::allow(identity::everybody(), "view", $album);
     $this->assert_equal(1, ORM::factory("item")->viewable()->where("id", "=", $item->id)->count_all());
     // We can't see the item when permissions are denied
     access::deny(identity::everybody(), "view", $album);
     $this->assert_equal(0, ORM::factory("item")->viewable()->where("id", "=", $item->id)->count_all());
 }

 public function change_album_no_csrf_fails_test()
 {
     $controller = new Albums_Controller();
     $album = test::random_album();
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     access::allow(identity::everybody(), "edit", item::root());
     try {
         $controller->update($album->id);
         $this->assert_true(false, "This should fail");
     } catch (Exception $e) {
         // pass
         $this->assert_same("@todo FORBIDDEN", $e->getMessage());
     }
 }

 public function cant_view_comments_for_unviewable_items_test()
 {
     $album = test::random_album();
     $comment = ORM::factory("comment");
     $comment->item_id = $album->id;
     $comment->author_id = identity::admin_user()->id;
     $comment->text = "text";
     $comment->save();
     identity::set_active_user(identity::guest());
     // We can see the comment when permissions are granted on the album
     access::allow(identity::everybody(), "view", $album);
     $this->assert_true(ORM::factory("comment")->viewable()->where("comments.id", "=", $comment->id)->count_all());
     // We can't see the comment when permissions are denied on the album
     access::deny(identity::everybody(), "view", $album);
     $this->assert_false(ORM::factory("comment")->viewable()->where("comments.id", "=", $comment->id)->count_all());
 }

 public function change_photo_no_csrf_fails_test()
 {
     $controller = new Photos_Controller();
     $root = ORM::factory("item", 1);
     $photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "test", "test", "test");
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     access::allow(group::everybody(), "edit", $root);
     try {
         $controller->_update($photo);
         $this->assert_true(false, "This should fail");
     } catch (Exception $e) {
         // pass
     }
 }

 public function change_album_no_csrf_fails_test()
 {
     $controller = new Albums_Controller();
     $root = ORM::factory("item", 1);
     $this->_album = album::create($root, "test", "test", "test");
     $_POST["name"] = "new name";
     $_POST["title"] = "new title";
     $_POST["description"] = "new description";
     access::allow(group::everybody(), "edit", $root);
     try {
         $controller->_update($this->_album);
         $this->assert_true(false, "This should fail");
     } catch (Exception $e) {
         // pass
     }
 }