user-access-manager / class / UserAccessManager.class.php

UserAccessManager.class.php in User Access Manager 1.1, at class/UserAccessManager.class.php

2,067 lines 59.1 KB

Raw Download Zip

1	<?php
2	/**
3	* UserAccessManager.class.php
4	*
5	* The UserAccessManager class file.
6	*
7	* PHP versions 5
8	*
9	* @category UserAccessManager
10	* @package UserAccessManager
11	* @author Alexander Schneider <alexanderschneider85@googlemail.com>
12	* @copyright 2008-2010 Alexander Schneider
13	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU General Public License, version 2
14	* @version SVN: $Id$
15	* @link http://wordpress.org/extend/plugins/user-access-manager/
16	*/
17
18	/**
19	* The user user access manager class.
20	*
21	* @category UserAccessManager
22	* @package UserAccessManager
23	* @author Alexander Schneider <alexanderschneider85@gmail.com>
24	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU General Public License, version 2
25	* @link http://wordpress.org/extend/plugins/user-access-manager/
26	*/
27
28	class UserAccessManager
29	{
30	var $atAdminPanel = false;
31	protected $adminOptionsName = "uamAdminOptions";
32	protected $uamVersion = 1.1;
33	protected $uamDbVersion = 1.2;
34	protected $adminOptions;
35	protected $accessHandler = null;
36	protected $postUrls = array();
37
38	/**
39	* Consturctor
40	*
41	* @return null
42	*/
43	public function __construct()
44	{
45	do_action('uam_init', $this);
46	}
47
48	/**
49	* Creates the needed tables at the database
50	*
51	* @return null;
52	*/
53	public function install()
54	{
55	global $wpdb;
56	$uamDbVersion = $this->uamDbVersion;
57
58	include_once ABSPATH . 'wp-admin/includes/upgrade.php';
59
60	$charsetCollate = $this->_getCharset();
61
62	$dbUserGroup = $wpdb->get_var(
63	"SHOW TABLES
64	LIKE '".DB_ACCESSGROUP."'"
65	);
66
67	if ($dbUserGroup != DB_ACCESSGROUP) {
68	$sql = "CREATE TABLE ".DB_ACCESSGROUP." (
69	ID int(11) NOT NULL auto_increment,
70	groupname tinytext NOT NULL,
71	groupdesc text NOT NULL,
72	read_access tinytext NOT NULL,
73	write_access tinytext NOT NULL,
74	ip_range mediumtext NULL,
75	PRIMARY KEY (ID)
76	) $charsetCollate;";
77	dbDelta($sql);
78	}
79
80	$dbUserGroupToObject = $wpdb->get_var(
81	"SHOW TABLES
82	LIKE '".DB_ACCESSGROUP_TO_OBJECT."'"
83	);
84
85	if ($dbUserGroupToObject != DB_ACCESSGROUP_TO_OBJECT) {
86	$sql = "CREATE TABLE " . DB_ACCESSGROUP_TO_OBJECT . " (
87	object_id VARCHAR(11) NOT NULL,
88	object_type varchar(255) NOT NULL,
89	group_id int(11) NOT NULL,
90	PRIMARY KEY (object_id,object_type,group_id)
91	) $charsetCollate;";
92	dbDelta($sql);
93	}
94
95	add_option("uam_db_version", $this->uamDbVersion);
96	}
97
98	/**
99	* Checks if a database update is necessary.
100	*
101	* @return boolean
102	*/
103	public function isDatabaseUpdateNecessary()
104	{
105	$currentDbVersion = get_option("uam_db_version");
106	return version_compare($currentDbVersion, $this->uamDbVersion, '<');
107	}
108
109	/**
110	* Updates the user access manager if an old version was installed.
111	*
112	* @return null;
113	*/
114	public function update()
115	{
116	global $wpdb;
117	$currentDbVersion = get_option("uam_db_version");
118
119	if (empty($currentDbVersion)) {
120	$this->install();
121	}
122
123	if (!get_option('uam_version')
124	\|\| get_option('uam_version') < 1.0
125	) {
126	delete_option('allow_comments_locked');
127	}
128
129	$dbUserGroup = $wpdb->get_var(
130	"SHOW TABLES
131	LIKE '" . DB_ACCESSGROUP . "'"
132	);
133
134	if ($currentDbVersion < $this->uamDbVersion) {
135	if ($currentDbVersion == 1.0) {
136	if ($dbUserGroup == DB_ACCESSGROUP) {
137	$wpdb->query(
138	"ALTER TABLE ".DB_ACCESSGROUP."
139	ADD read_access TINYTEXT NOT NULL DEFAULT '',
140	ADD write_access TINYTEXT NOT NULL DEFAULT '',
141	ADD ip_range MEDIUMTEXT NULL DEFAULT ''"
142	);
143
144	$wpdb->query(
145	"UPDATE ".DB_ACCESSGROUP."
146	SET read_access = 'group',
147	write_access = 'group'"
148	);
149
150	$dbIpRange = $wpdb->get_var(
151	"SHOW columns
152	FROM ".DB_ACCESSGROUP."
153	LIKE 'ip_range'"
154	);
155
156	if ($dbIpRange != 'ip_range') {
157	$wpdb->query(
158	"ALTER TABLE ".DB_ACCESSGROUP."
159	ADD ip_range MEDIUMTEXT NULL DEFAULT ''"
160	);
161	}
162	}
163
164	$currentDbVersion = 1.1;
165	}
166
167	if ($currentDbVersion == 1.1) {
168	define('DB_ACCESSGROUP_TO_POST', $wpdb->prefix . 'uam_accessgroup_to_post');
169	define('DB_ACCESSGROUP_TO_USER', $wpdb->prefix . 'uam_accessgroup_to_user');
170	define('DB_ACCESSGROUP_TO_CATEGORY', $wpdb->prefix . 'uam_accessgroup_to_category');
171	define('DB_ACCESSGROUP_TO_ROLE', $wpdb->prefix . 'uam_accessgroup_to_role');
172
173	$charsetCollate = $this->_getCharset();
174
175	$wpdb->query(
176	"ALTER TABLE 'wp_uam_accessgroup_to_object'
177	CHANGE 'object_id' 'object_id' VARCHAR(11)
178	$charsetCollate;"
179	);
180
181	$objectTypes = $this->getAccessHandler()->getObjectTypes();
182
183	foreach ($objectTypes as $objectType) {
184	$addition = '';
185
186	if ($objectType == 'post'
187	\|\| $objectType == 'page'
188	\|\| $objectType == 'attachment'
189	) {
190	$dbIdName = 'post_id';
191	$database = DB_ACCESSGROUP_TO_POST.', '.$wpdb->posts;
192	$addition = " WHERE post_id = ID
193	AND post_type = '".$objectType."'";
194	} elseif ($objectType == 'category') {
195	$dbIdName = 'category_id';
196	$database = DB_ACCESSGROUP_TO_CATEGORY;
197	} elseif ($objectType == 'user') {
198	$dbIdName = 'user_id';
199	$database = DB_ACCESSGROUP_TO_USER;
200	} elseif ($objectType == 'role') {
201	$dbIdName = 'role_name';
202	$database = DB_ACCESSGROUP_TO_ROLE;
203	}
204
205	$sql = "SELECT ".$dbIdName." as id, group_id as groupId
206	FROM ".$database.$addition;
207
208	$dbObjects = $wpdb->get_results($sql);
209
210	foreach ($dbObjects as $dbObject) {
211	$sql = "INSERT INTO ".DB_ACCESSGROUP_TO_OBJECT." (
212	group_id,
213	object_id,
214	object_type
215	)
216	VALUES(
217	'".$dbObject->groupId."',
218	'".$dbObject->id."',
219	'".$objectType."'
220	)";
221
222	$wpdb->query($sql);
223	}
224	}
225
226	$wpdb->query(
227	"DROP TABLE ".DB_ACCESSGROUP_TO_POST.",
228	".DB_ACCESSGROUP_TO_USER.",
229	".DB_ACCESSGROUP_TO_CATEGORY.",
230	".DB_ACCESSGROUP_TO_ROLE
231	);
232	}
233
234	update_option('uam_db_version', $this->uamDbVersion);
235	}
236	}
237
238	/**
239	* Clean up wordpress if the plugin will be uninstalled.
240	*
241	* @return null
242	*/
243	public function uninstall()
244	{
245	global $wpdb;
246	$wpdb->query(
247	"DROP TABLE ".DB_ACCESSGROUP.",
248	".DB_ACCESSGROUP_TO_OBJECT
249	);
250
251	delete_option($this->adminOptionsName);
252	delete_option('uam_version');
253	delete_option('uam_db_version');
254	$this->deleteHtaccessFiles();
255	}
256
257	/**
258	* Returns the database charset.
259	*
260	* @return string
261	*/
262	private function _getCharset()
263	{
264	$charsetCollate = '';
265
266	if (version_compare(mysql_get_server_info(), '4.1.0', '>=')) {
267	if (!empty($wpdb->charset)) {
268	$charsetCollate = "DEFAULT CHARACTER SET $wpdb->charset";
269	}
270
271	if (!empty($wpdb->collate)) {
272	$charsetCollate.= " COLLATE $wpdb->collate";
273	}
274	}
275
276	return $charsetCollate;
277	}
278
279	/**
280	* Remove the htaccess file if the plugin is deactivated.
281	*
282	* @return null
283	*/
284	public function deactivate()
285	{
286	$this->deleteHtaccessFiles();
287	}
288
289	/**
290	* Creates a htaccess file.
291	*
292	* @param string $dir The destination directory.
293	*
294	* @return null.
295	*/
296	public function createHtaccess($dir = null)
297	{
298	if ($dir === null) {
299	$wud = wp_upload_dir();
300
301	if (empty($wud['error'])) {
302	$dir = $wud['basedir'] . "/";
303	}
304	}
305
306	if ($dir !== null) {
307	if (!$this->isPermalinksActive()) {
308	$areaname = "WP-Files";
309	$uamOptions = $this->getAdminOptions();
310
311	if ($uamOptions['lock_file_types'] == 'selected') {
312	$fileTypes = $uamOptions['locked_file_types'];
313	} elseif ($uamOptions['lock_file_types'] == 'not_selected') {
314	$fileTypes = $uamOptions['not_locked_file_types'];
315	}
316
317	if (isset($fileTypes)) {
318	$fileTypes = str_replace(",", "\|", $fileTypes);
319	}
320
321	// make .htaccess and .htpasswd
322	$htaccessTxt = "";
323
324	if ($uamOptions['lock_file_types'] == 'selected') {
325	$htaccessTxt .= "<FilesMatch '\.(" . $fileTypes . ")'>\n";
326	} elseif ($uamOptions['lock_file_types'] == 'not_selected') {
327	$htaccessTxt .= "<FilesMatch '^\.(" . $fileTypes . ")'>\n";
328	}
329
330	$htaccessTxt .= "AuthType Basic" . "\n";
331	$htaccessTxt .= "AuthName \"" . $areaname . "\"" . "\n";
332	$htaccessTxt .= "AuthUserFile " . $dir . ".htpasswd" . "\n";
333	$htaccessTxt .= "require valid-user" . "\n";
334
335	if ($uamOptions['lock_file_types'] == 'selected'
336	\|\| $uamOptions['lock_file_types'] == 'not_selected'
337	) {
338	$htaccessTxt.= "</FilesMatch>\n";
339	}
340	} else {
341	$homeRoot = parse_url(home_url());
342	if (isset($homeRoot['path'])) {
343	$homeRoot = trailingslashit($homeRoot['path']);
344	} else {
345	$homeRoot = '/';
346	}
347
348	$htaccessTxt = "<IfModule mod_rewrite.c>\n";
349	$htaccessTxt .= "RewriteEngine On\n";
350	$htaccessTxt .= "RewriteBase ".$homeRoot."\n";
351	$htaccessTxt .= "RewriteRule ^index\.php$ - [L]\n";
352	$htaccessTxt .= "RewriteRule (.*) ";
353	$htaccessTxt .= $homeRoot."index.php?uamfiletype=attachment&uamgetfile=$1 [L]\n";
354	$htaccessTxt .= "</IfModule>\n";
355	}
356
357	// save files
358	$htaccess = fopen($dir . ".htaccess", "w");
359	fwrite($htaccess, $htaccessTxt);
360	fclose($htaccess);
361	}
362	}
363
364	/**
365	* Creates a htpasswd file.
366	*
367	* @param boolean $createNew Force to create new file.
368	* @param string $dir The destination directory.
369	*
370	* @return null
371	*/
372	public function createHtpasswd($createNew = false, $dir = null)
373	{
374	global $current_user;
375	$uamOptions = $this->getAdminOptions();
376
377	// get url
378	if ($dir === null) {
379	$wud = wp_upload_dir();
380
381	if (empty($wud['error'])) {
382	$dir = $wud['basedir'] . "/";
383	}
384	}
385
386	if ($dir !== null) {
387	$curUserdata = get_userdata($current_user->ID);
388
389	if (!file_exists($dir . ".htpasswd") \|\| $createNew) {
390	if ($uamOptions['file_pass_type'] == 'random') {
391	$password = md5($this->getRandomPassword());
392	} elseif ($uamOptions['file_pass_type'] == 'admin') {
393	$password = $curUserdata->user_pass;
394	}
395
396	$user = $curUserdata->user_login;
397
398	// make .htpasswd
399	$htpasswd_txt = "$user:" . $password . "\n";
400
401	// save file
402	$htpasswd = fopen($dir . ".htpasswd", "w");
403	fwrite($htpasswd, $htpasswd_txt);
404	fclose($htpasswd);
405	}
406	}
407	}
408
409	/**
410	* Deletes the htaccess files.
411	*
412	* @param string $dir The destination directory.
413	*
414	* @return null
415	*/
416	public function deleteHtaccessFiles($dir = null)
417	{
418	if ($dir === null) {
419	$wud = wp_upload_dir();
420
421	if (empty($wud['error'])) {
422	$dir = $wud['basedir'] . "/";
423	}
424	}
425
426	if ($dir !== null) {
427	if (file_exists($dir.".htaccess")) {
428	unlink($dir.".htaccess");
429	}
430
431	if (file_exists($dir.".htpasswd")) {
432	unlink($dir.".htpasswd");
433	}
434	}
435	}
436
437	/**
438	* Generates and retruns a randmom password.
439	*
440	* @return string
441	*/
442	public function getRandomPassword()
443	{
444	//create password
445	$array = array();
446	$length = 16;
447	$capitals = true;
448	$specialSigns = false;
449	if ($length < 8) {
450	$length = mt_rand(8, 20);
451	}
452
453	// numbers
454	for ($i = 48; $i < 58; $i++) {
455	$array[] = chr($i);
456	}
457
458	// small
459	for ($i = 97; $i < 122; $i++) {
460	$array[] = chr($i);
461	}
462
463	// capitals
464	if ($capitals) {
465	for ($i = 65; $i < 90; $i++) {
466	$array[] = chr($i);
467	}
468	}
469
470	// specialchar:
471	if ($specialSigns) {
472	for ($i = 33; $i < 47; $i++) {
473	$array[] = chr($i);
474	}
475
476	for ($i = 59; $i < 64; $i++) {
477	$array[] = chr($i);
478	}
479
480	for ($i = 91; $i < 96; $i++) {
481	$array[] = chr($i);
482	}
483
484	for ($i = 123; $i < 126; $i++) {
485	$array[] = chr($i);
486	}
487	}
488
489	mt_srand((double)microtime() * 1000000);
490	$password = '';
491
492	for ($i = 1; $i <= $length; $i++) {
493	$rnd = mt_rand(0, count($array) - 1);
494	$password.= $array[$rnd];
495	}
496
497	return $password;
498	}
499
500	/**
501	* Returns the current settings
502	*
503	* @return array
504	*/
505	public function getAdminOptions()
506	{
507	if (empty($this->adminOptions)) {
508	$uamAdminOptions = array(
509	'hide_post_title' => 'false',
510	'post_title' => __('No rights!', 'user-access-manager'),
511	'post_content' => __(
512	'Sorry you have no rights to view this post!',
513	'user-access-manager'
514	),
515	'hide_post' => 'false',
516	'hide_post_comment' => 'false',
517	'post_comment_content' => __(
518	'Sorry no rights to view comments!',
519	'user-access-manager'
520	),
521	'post_comments_locked' => 'false',
522	'hide_page_title' => 'false',
523	'page_title' => __('No rights!', 'user-access-manager'),
524	'page_content' => __(
525	'Sorry you have no rights to view this page!',
526	'user-access-manager'
527	),
528	'hide_page' => 'false',
529	'hide_page_comment' => 'false',
530	'page_comment_content' => __(
531	'Sorry no rights to view comments!',
532	'user-access-manager'
533	),
534	'page_comments_locked' => 'false',
535	'redirect' => 'false',
536	'redirect_custom_page' => '',
537	'redirect_custom_url' => '',
538	'lock_recursive' => 'true',
539	'authors_has_access_to_own' => 'true',
540	'authors_can_add_posts_to_groups' => 'false',
541	'lock_file' => 'false',
542	'file_pass_type' => 'random',
543	'lock_file_types' => 'all',
544	'download_type' => 'fopen',
545	'locked_file_types' => 'zip,rar,tar,gz,bz2',
546	'not_locked_file_types' => 'gif,jpg,jpeg,png',
547	'blog_admin_hint' => 'true',
548	'blog_admin_hint_text' => '[L]',
549	'hide_empty_categories' => 'true',
550	'protect_feed' => 'true',
551	'show_post_content_before_more' => 'false',
552	'full_access_role' => 'administrator'
553	);
554
555	$uamOptions = get_option($this->adminOptionsName);
556
557	if (!empty($uamOptions)) {
558	foreach ($uamOptions as $key => $option) {
559	$uamAdminOptions[$key] = $option;
560	}
561	}
562
563	update_option($this->adminOptionsName, $uamAdminOptions);
564	$this->adminOptions = $uamAdminOptions;
565	}
566
567	return $this->adminOptions;
568	}
569
570	/**
571	* Retruns the content of the excecuded php file.
572	*
573	* @param string $fileName The file name
574	* @param integer $objectId The id if needed.
575	* @param string $objectType The object type if needed.
576	*
577	* @return string
578	*/
579	public function getIncludeContents($fileName, $objectId = null, $objectType = null)
580	{
581	if (is_file($fileName)) {
582	ob_start();
583	include $fileName;
584	$contents = ob_get_contents();
585	ob_end_clean();
586
587	return $contents;
588	}
589
590	return '';
591	}
592
593	/**
594	* Returns the access handler object.
595	*
596	* @return object
597	*/
598	public function &getAccessHandler()
599	{
600	if ($this->accessHandler == null) {
601	$this->accessHandler = new UamAccessHandler(&$this);
602	}
603
604	return $this->accessHandler;
605	}
606
607
608	/*
609	* Helper functions.
610	*/
611
612	/**
613	* Checks if a string starts with the given needle.
614	*
615	* @param string $haystack The haystack.
616	* @param string $needle The needle
617	*
618	* @return boolean
619	*/
620	public function startsWith($haystack, $needle)
621	{
622	return strpos($haystack, $needle) === 0;
623	}
624
625
626	/*
627	* Functions for the admin panel content.
628	*/
629
630	/**
631	* The function for the wp_print_styles action.
632	*
633	* @return null
634	*/
635	public function addStyles()
636	{
637	wp_enqueue_style(
638	'UserAccessManagerAdmin',
639	UAM_URLPATH . "css/uamAdmin.css",
640	false,
641	'1.0',
642	'screen'
643	);
644
645	wp_enqueue_style(
646	'UserAccessManagerLoginForm',
647	UAM_URLPATH . "css/uamLoginForm.css",
648	false,
649	'1.0',
650	'screen'
651	);
652	}
653
654	/**
655	* The function for the wp_print_scripts action.
656	*
657	* @return null
658	*/
659	public function addScripts()
660	{
661	wp_enqueue_script(
662	'UserAccessManagerJQueryTools',
663	UAM_URLPATH . 'js/jquery.tools.min.js',
664	array('jquery')
665	);
666	wp_enqueue_script(
667	'UserAccessManagerFunctions',
668	UAM_URLPATH . 'js/functions.js',
669	array('jquery', 'UserAccessManagerJQueryTools')
670	);
671	}
672
673	/**
674	* Prints the admin page
675	*
676	* @return null
677	*/
678	public function printAdminPage()
679	{
680	if (isset($_GET['page'])) {
681	$curAdminPage = $_GET['page'];
682	}
683
684	if ($curAdminPage == 'uam_settings') {
685	include UAM_REALPATH."tpl/adminSettings.php";
686	} elseif ($curAdminPage == 'uam_usergroup') {
687	include UAM_REALPATH."tpl/adminGroup.php";
688	} elseif ($curAdminPage == 'uam_setup') {
689	include UAM_REALPATH."tpl/adminSetup.php";
690	} elseif ($curAdminPage == 'uam_about') {
691	include UAM_REALPATH."tpl/about.php";
692	}
693	}
694
695	/**
696	* Shows the error if the user has no rights to edit the content
697	*
698	* @return null
699	*/
700	public function noRightsToEditContent()
701	{
702	$noRights = false;
703
704	if (isset($_GET['post'])
705	&& is_numeric($_GET['post'])
706	) {
707	$post = get_post($_GET['post']);
708
709	$noRights = !$this->getAccessHandler()->checkObjectAccess(
710	$post->post_type,
711	$post->ID
712	);
713	}
714
715	if (isset($_GET['attachment_id'])
716	&& is_numeric($_GET['attachment_id'])
717	&& !$noRights
718	) {
719	$post = get_post($_GET['attachment_id']);
720
721	$noRights = !$this->getAccessHandler()->checkObjectAccess(
722	$post->post_type,
723	$post->ID
724	);
725	}
726
727	if (isset($_GET['tag_ID'])
728	&& is_numeric($_GET['tag_ID'])
729	&& !$noRights
730	) {
731	$noRights = !$this->getAccessHandler()->checkObjectAccess(
732	'category',
733	$_GET['tag_ID']
734	);
735	}
736
737	if ($noRights) {
738	wp_die(TXT_NO_RIGHTS);
739	}
740	}
741
742	/**
743	* The function for the wp_dashboard_setup action.
744	* Removes widgets to which a user should not have access.
745	*
746	* @return null
747	*/
748	public function setupAdminDashboard()
749	{
750	global $wp_meta_boxes;
751
752	if (!$this->getAccessHandler()->checkUserAccess()) {
753	unset($wp_meta_boxes['dashboard']['normal']['core']['dashboard_recent_comments']);
754	}
755	}
756
757	/**
758	* The function for the update_option_permalink_structure action.
759	*
760	* @return null
761	*/
762	public function updatePermalink()
763	{
764	$this->createHtaccess();
765	}
766
767	/*
768	* Meta functions
769	*/
770
771	/**
772	* Saves the object data to the database.
773	*
774	* @param string $objectType The object type.
775	* @param integer $objectId The id of the object.
776	*
777	* @return null
778	*/
779	private function _saveObjectData($objectType, $objectId)
780	{
781	$uamAccessHandler = &$this->getAccessHandler();
782	$uamOptions = $this->getAdminOptions();
783
784	if ($uamAccessHandler->checkUserAccess()
785	\|\| $uamOptions['authors_can_add_posts_to_groups'] == 'true'
786	) {
787	$userGroupsForObject = $uamAccessHandler->getUserGroupsForObject(
788	$objectType,
789	$objectId
790	);
791
792	foreach ($userGroupsForObject as $uamUserGroup) {
793	$uamUserGroup->removeObject($objectType, $objectId);
794	$uamUserGroup->save();
795	}
796
797	if (isset($_POST['uam_usergroups'])) {
798	$userGroups = $_POST['uam_usergroups'];
799	}
800
801	if (isset($userGroups)) {
802	foreach ($userGroups as $userGroupId) {
803	$uamUserGroup = $uamAccessHandler->getUserGroups($userGroupId);
804
805	$uamUserGroup->addObject($objectType, $objectId);
806	$uamUserGroup->save();
807	}
808	}
809	}
810	}
811
812	/*
813	* Functions for the post actions.
814	*/
815
816	/**
817	* The function for the manage_posts_columns and
818	* the manage_pages_columns filter.
819	*
820	* @param array $defaults The table headers.
821	*
822	* @return array
823	*/
824	public function addPostColumnsHeader($defaults)
825	{
826	$defaults['uam_access'] = __('Access');
827	return $defaults;
828	}
829
830	/**
831	* The function for the manage_users_custom_column action.
832	*
833	* @param string $columnName The column name.
834	* @param integer $id The id.
835	*
836	* @return String
837	*/
838	public function addPostColumn($columnName, $id)
839	{
840	if ($columnName == 'uam_access') {
841	$post = get_post($id);
842
843	echo $this->getIncludeContents(
844	UAM_REALPATH.'tpl/objectColumn.php',
845	$post->ID,
846	$post->post_type
847	);
848	}
849	}
850
851	/**
852	* The function for the uma_post_access metabox.
853	*
854	* @param object $post The post.
855	*
856	* @return null;
857	*/
858	public function editPostContent($post)
859	{
860	$objectId = $post->ID;
861
862	include UAM_REALPATH.'tpl/postEditForm.php';
863	}
864
865	/**
866	* The function for the save_post action.
867	*
868	* @param mixed $postParam The post id or a array of a post.
869	*
870	* @return null
871	*/
872	public function savePostData($postParam)
873	{
874	if (is_array($postParam)) {
875	$post = get_post($postParam['ID']);
876	} else {
877	$post = get_post($postParam);
878	}
879
880	$postId = $post->ID;
881	$postType = $post->post_type;
882
883	if ($postType == 'revision') {
884	$postId = $post->post_parent;
885	$parentPost = get_post($postId);
886	$postType = $parentPost->post_type;
887	}
888
889	$this->_saveObjectData($postType, $postId);
890	}
891
892	/**
893	* The function for the attachment_fields_to_save filter.
894	* We have to use this because the attachment actions work
895	* not in the way we need.
896	*
897	* @param object $attachment The attachment id.
898	*
899	* @return object
900	*/
901	public function saveAttachmentData($attachment)
902	{
903	$this->savePostData($attachment['ID']);
904
905	return $attachment;
906	}
907
908	/**
909	* The function for the delete_post action.
910	*
911	* @param integer $postId The post id.
912	*
913	* @return null
914	*/
915	public function removePostData($postId)
916	{
917	global $wpdb;
918
919	$wpdb->query(
920	"DELETE FROM " . DB_ACCESSGROUP_TO_POST . "
921	WHERE post_id = ".$postId
922	);
923	}
924
925	/**
926	* The function for the media_meta action.
927	*
928	* @param string $meta The meta.
929	* @param object $post The post.
930	*
931	* @return string
932	*/
933	public function showMediaFile($meta = '', $post = null)
934	{
935	$content = $meta;
936	$content .= '</td></tr><tr>';
937	$content .= '<th class="label">';
938	$content .= '<label>'.TXT_SET_UP_USERGROUPS.'</label>';
939	$content .= '</th>';
940	$content .= '<td class="field">';
941	$content .= $this->getIncludeContents(
942	UAM_REALPATH.'tpl/postEditForm.php',
943	$post->ID
944	);
945
946	return $content;
947	}
948
949
950	/*
951	* Functions for the user actions.
952	*/
953
954	/**
955	* The function for the manage_users_columns filter.
956	*
957	* @param array $defaults The table headers.
958	*
959	* @return array
960	*/
961	public function addUserColumnsHeader($defaults)
962	{
963	$defaults['uam_access'] = __('uam user groups');
964	return $defaults;
965	}
966
967	/**
968	* The function for the manage_users_custom_column action.
969	*
970	* @param unknown $empty An empty string from wordpress? What the hell?!?
971	* @param string $columnName The column name.
972	* @param integer $id The id.
973	*
974	* @return String
975	*/
976	public function addUserColumn($empty, $columnName, $id)
977	{
978	if ($columnName == 'uam_access') {
979	return $this->getIncludeContents(
980	UAM_REALPATH.'tpl/userColumn.php',
981	$id,
982	'user'
983	);
984	}
985	}
986
987	/**
988	* The function for the edit_user_profile action.
989	*
990	* @return null
991	*/
992	public function showUserProfile()
993	{
994	echo $this->getIncludeContents(UAM_REALPATH.'tpl/userProfileEditForm.php');
995	}
996
997	/**
998	* The function for the profile_update action.
999	*
1000	* @param integer $userId The user id.
1001	*
1002	* @return null
1003	*/
1004	public function saveUserData($userId)
1005	{
1006	$this->_saveObjectData('user', $userId);
1007	}
1008
1009	/**
1010	* The function for the delete_user action.
1011	*
1012	* @param integer $userId The user id.
1013	*
1014	* @return null
1015	*/
1016	public function removeUserData($userId)
1017	{
1018	global $wpdb;
1019
1020	$wpdb->query(
1021	"DELETE FROM " . DB_ACCESSGROUP_TO_USER . "
1022	WHERE user_id = ".$userId
1023	);
1024	}
1025
1026
1027	/*
1028	* Functions for the category actions.
1029	*/
1030
1031	/**
1032	* The function for the manage_categories_columns filter.
1033	*
1034	* @param array $defaults The table headers.
1035	*
1036	* @return array
1037	*/
1038	public function addCategoryColumnsHeader($defaults)
1039	{
1040	$defaults['uam_access'] = __('Access');
1041	return $defaults;
1042	}
1043
1044	/**
1045	* The function for the manage_categories_custom_column action.
1046	*
1047	* @param unknown $empty An empty string from wordpress? What the hell?!?
1048	* @param string $columnName The column name.
1049	* @param integer $id The id.
1050	*
1051	* @return String
1052	*/
1053	public function addCategoryColumn($empty, $columnName, $id)
1054	{
1055	if ($columnName == 'uam_access') {
1056	return $this->getIncludeContents(
1057	UAM_REALPATH.'tpl/objectColumn.php',
1058	$id,
1059	'category'
1060	);
1061	}
1062	}
1063
1064	/**
1065	* The function for the edit_category_form action.
1066	*
1067	* @param object $category The category.
1068	*
1069	* @return null
1070	*/
1071	public function showCategoryEditForm($category)
1072	{
1073	include UAM_REALPATH.'tpl/categoryEditForm.php';
1074	}
1075
1076	/**
1077	* The function for the edit_category action.
1078	*
1079	* @param integer $categoryId The category id.
1080	*
1081	* @return null
1082	*/
1083	public function saveCategoryData($categoryId)
1084	{
1085	$this->_saveObjectData('category', $categoryId);
1086	}
1087
1088	/**
1089	* The function for the delete_category action.
1090	*
1091	* @param integer $categoryId The id of the category.
1092	*
1093	* @return null
1094	*/
1095	public function removeCategoryData($categoryId)
1096	{
1097	global $wpdb;
1098
1099	$wpdb->query(
1100	"DELETE FROM " . DB_ACCESSGROUP_TO_CATEGORY . "
1101	WHERE category_id = ".$categoryId
1102	);
1103	}
1104
1105
1106	/*
1107	* Functions for the pluggable object actions.
1108	*/
1109
1110	/**
1111	* The function for the pluggable save action.
1112	*
1113	* @param string $objectName The name of the pluggable object.
1114	* @param integer $objectId The pluggable object id.
1115	*
1116	* @return null
1117	*/
1118	public function savePlObjectData($objectName, $objectId)
1119	{
1120	$this->_saveObjectData($objectName, $objectId);
1121	}
1122
1123	/**
1124	* The function for the pluggable remove action.
1125	*
1126	* @param string $objectName The name of the pluggable object.
1127	* @param integer $objectId The pluggable object id.
1128	*
1129	* @return null
1130	*/
1131	public function removePlObjectData($objectName, $objectId)
1132	{
1133	global $wpdb;
1134
1135	$wpdb->query(
1136	"DELETE FROM " . DB_ACCESSGROUP_TO_OBJECT . "
1137	WHERE user_id = ".$userId."
1138	AND object_type = ".$objectName
1139	);
1140	}
1141
1142	/**
1143	* Returns the group selection form for pluggable objects.
1144	*
1145	* @param string $objectType The object type.
1146	* @param integer $objectId The id of the object.
1147	*
1148	* @return string;
1149	*/
1150	public function showPlGroupSelectionForm($objectType, $objectId)
1151	{
1152	$fileName = UAM_REALPATH.'tpl/groupSelectionForm.php';
1153	$uamUserGroups = $this->getAccessHandler()->getUserGroups();
1154	$userGroupsForObject = $this->getAccessHandler()->getUserGroupsForObject(
1155	$objectType,
1156	$objectId
1157	);
1158
1159	if (is_file($fileName)) {
1160	ob_start();
1161	include $fileName;
1162	$contents = ob_get_contents();
1163	ob_end_clean();
1164
1165	return $contents;
1166	}
1167
1168	return '';
1169	}
1170
1171
1172	/*
1173	* Functions for the blog content.
1174	*/
1175
1176	/**
1177	* Manipulates the wordpress query object to filter content.
1178	*
1179	* @param object $wpQuery The wordpress query object.
1180	*
1181	* @return null
1182	*/
1183	public function parseQuery($wpQuery)
1184	{
1185	$wpQuery->query_vars['post__not_in']
1186	+= $this->_getExcludedPosts();
1187	}
1188
1189	/**
1190	* Modifies the content of the post by the given settings.
1191	*
1192	* @param object $post The current post.
1193	*
1194	* @return object
1195	*/
1196	private function _getPost($post)
1197	{
1198	$uamOptions = $this->getAdminOptions();
1199	$uamAccessHandler = &$this->getAccessHandler();
1200
1201	$postType = $post->post_type;
1202
1203	if ($postType == 'attachment') {
1204	$postType = 'post';
1205	} elseif ($postType != 'post' && $postType != 'page') {
1206	return $post;
1207	}
1208
1209	if ($uamOptions['hide_'.$postType] == 'true'
1210	\|\| $this->atAdminPanel
1211	) {
1212	if ($uamAccessHandler->checkObjectAccess($post->post_type, $post->ID)) {
1213	$post->post_title .= $this->adminOutput($post->ID);
1214
1215	return $post;
1216	}
1217	} else {
1218	if (!$uamAccessHandler->checkObjectAccess($post->post_type, $post->ID)) {
1219	$post->isLocked = true;
1220
1221	$uamPostContent = $uamOptions[$postType.'_content'];
1222	$uamPostContent = str_replace(
1223	"[LOGIN_FORM]",
1224	$this->getLoginBarHtml(),
1225	$uamPostContent
1226	);
1227
1228	if ($uamOptions['hide_'.$postType.'_title'] == 'true') {
1229	$post->post_title = $uamOptions[$postType.'_title'];
1230	}
1231
1232	if ($uamOptions[$postType.'_comments_locked'] == 'false') {
1233	$post->comment_status = 'close';
1234	}
1235
1236	if ($uamOptions['show_post_content_before_more'] == 'true'
1237	&& $postType == "post"
1238	&& preg_match('/<!--more(.*?)?-->/', $post->post_content, $matches)
1239	) {
1240	$post->post_content = explode(
1241	$matches[0],
1242	$post->post_content,
1243	2
1244	);
1245	$uamPostContent
1246	= $post->post_content[0] . " " . $uamPostContent;
1247	}
1248
1249	$post->post_content = $uamPostContent;
1250	}
1251
1252	$post->post_title .= $this->adminOutput($post->ID);
1253
1254	return $post;
1255	}
1256
1257	return null;
1258	}
1259
1260	/**
1261	* The function for the the_posts filter.
1262	*
1263	* @param arrray $posts The posts.
1264	*
1265	* @return array
1266	*/
1267	public function showPost($posts = array())
1268	{
1269	$showPosts = array();
1270	$uamOptions = $this->getAdminOptions();
1271
1272	if (!is_feed()
1273	\|\| ($uamOptions['protect_feed'] == 'true' && is_feed())
1274	) {
1275	foreach ($posts as $post) {
1276	$post = $this->_getPost($post);
1277
1278	if ($post !== null) {
1279	$showPosts[] = $post;
1280	}
1281	}
1282
1283	$posts = $showPosts;
1284	}
1285
1286	return $posts;
1287	}
1288
1289	/**
1290	* Returns the excluded posts.
1291	*
1292	* @return array
1293	*/
1294	private function _getExcludedPosts()
1295	{
1296	$uamAccessHandler = &$this->getAccessHandler();
1297
1298	if ($uamAccessHandler->checkUserAccess()) {
1299	return array();
1300	}
1301
1302	global $current_user, $wpdb;
1303	//Force user infos
1304	wp_get_current_user();
1305
1306	$userUserGroups = $uamAccessHandler->getUserGroupsForObject(
1307	'user',
1308	$current_user->ID,
1309	false
1310	);
1311
1312	$userUserGroupArray = array();
1313
1314	foreach ($userUserGroups as $userUserGroup) {
1315	$userUserGroupArray[] = $userUserGroup->getId();
1316	}
1317
1318	if ($userUserGroupArray !== array()) {
1319	$userUserGroupString = implode(', ', $userUserGroupArray);
1320	} else {
1321	$userUserGroupString = 'NULL';
1322	}
1323
1324	$postSql = "SELECT DISTINCT p.ID
1325	FROM $wpdb->posts AS p
1326	INNER JOIN $wpdb->term_relationships AS tr
1327	ON p.ID = tr.object_id
1328	INNER JOIN $wpdb->term_taxonomy tt
1329	ON tr.term_taxonomy_id = tt.term_taxonomy_id
1330	WHERE tt.taxonomy = 'category'
1331	AND tt.term_id IN (
1332	SELECT gc.object_id
1333	FROM ".DB_ACCESSGROUP_TO_OBJECT." gc
1334	WHERE gc.object_type = 'category'
1335	AND gc.object_id NOT IN (
1336	SELECT igc.object_id
1337	FROM ".DB_ACCESSGROUP_TO_OBJECT." igc
1338	WHERE igc.object_type = 'category'
1339	AND igc.group_id IN (".$userUserGroupString.")
1340	)
1341	) AND p.ID NOT IN (
1342	SELECT igp.object_id
1343	FROM ".DB_ACCESSGROUP_TO_OBJECT." igp
1344	WHERE (igp.object_type = 'post' OR igp.object_type = 'page')
1345	AND igp.group_id IN (".$userUserGroupString.")
1346	)
1347	UNION
1348	SELECT DISTINCT gp.object_id
1349	FROM ".DB_ACCESSGROUP_TO_OBJECT." gp
1350	INNER JOIN $wpdb->term_relationships AS tr
1351	ON gp.object_id = tr.object_id
1352	INNER JOIN $wpdb->term_taxonomy tt
1353	ON tr.term_taxonomy_id = tt.term_taxonomy_id
1354	WHERE (gp.object_type = 'post' OR gp.object_type = 'page')
1355	AND gp.object_id NOT IN (
1356	SELECT igp.object_id
1357	FROM ".DB_ACCESSGROUP_TO_OBJECT." igp
1358	WHERE (igp.object_type = 'post' OR igp.object_type = 'page')
1359	AND igp.group_id IN (".$userUserGroupString.")
1360	) AND tt.term_id NOT IN (
1361	SELECT igc.object_id
1362	FROM ".DB_ACCESSGROUP_TO_OBJECT." igc
1363	WHERE igc.object_type = 'category'
1364	AND igc.group_id IN (".$userUserGroupString.")
1365	)";
1366
1367	$excludedPosts = $wpdb->get_col($postSql);
1368
1369	return $excludedPosts;
1370	}
1371
1372	/**
1373	* The function for the posts_where_paged filter.
1374	*
1375	* @param string $sql The where sql statment.
1376	*
1377	* @return string
1378	*/
1379	public function showPostSql($sql)
1380	{
1381	$uamAccessHandler = &$this->getAccessHandler();
1382	$uamOptions = $this->getAdminOptions();
1383
1384	if ($uamOptions['hide_post'] == 'true'
1385	&& !$uamAccessHandler->checkUserAccess()
1386	) {
1387	global $wpdb;
1388	$excludedPosts = $this->_getExcludedPosts();
1389
1390	if (count($excludedPosts) > 0) {
1391	$excludedPostsStr = implode(",", $excludedPosts);
1392	$sql .= " AND $wpdb->posts.ID NOT IN($excludedPostsStr) ";
1393	}
1394	}
1395
1396	return $sql;
1397	}
1398
1399	/**
1400	* The function for the wp_get_nav_menu_items filter.
1401	*
1402	* @param array $items The menu item.
1403	*
1404	* @return array
1405	*/
1406	public function showCustomMenu($items)
1407	{
1408	$showItems = array();
1409
1410	foreach ($items as $item) {
1411	if ($item->object == 'post'
1412	\|\| $item->object == 'page'
1413	) {
1414	$object = get_post($item->object_id);
1415	$post = $this->_getPost($object);
1416
1417	if ($post !== null) {
1418	if (isset($post->isLocked)) {
1419	$item->title = $post->post_title;
1420	}
1421
1422	$showItems[] = $item;
1423	}
1424	} elseif ($item->object == 'category') {
1425	$object = get_category($item->object_id);
1426	$category = $this->_getCategory($object);
1427
1428	if ($category !== null
1429	&& !$category->isEmpty
1430	) {
1431	$showItems[] = $item;
1432	}
1433	} else {
1434	$showItems[] = $item;
1435	}
1436	}
1437
1438	return $showItems;
1439	}
1440
1441	/**
1442	* The function for the comments_array filter.
1443	*
1444	* @param array $comments The comments.
1445	*
1446	* @return array
1447	*/
1448	public function showComment($comments = array())
1449	{
1450	$showComments = array();
1451	$uamOptions = $this->getAdminOptions();
1452	$uamAccessHandler = &$this->getAccessHandler();
1453
1454	foreach ($comments as $comment) {
1455	$post = get_post($comment->comment_post_ID);
1456	$postType = $post->post_type;
1457
1458	if ($uamOptions['hide_'.$postType.'_comment'] == 'true'
1459	\|\| $uamOptions['hide_'.$postType] == 'true'
1460	\|\| $this->atAdminPanel
1461	) {
1462	if ($uamAccessHandler->checkObjectAccess($post->post_type, $post->ID)) {
1463	$showComments[] = $comment;
1464	}
1465	} else {
1466	if (!$uamAccessHandler->checkObjectAccess($post->post_type, $post->ID)) {
1467	$comment->comment_content
1468	= $uamOptions[$postType.'_comment_content'];
1469	}
1470
1471	$showComments[] = $comment;
1472	}
1473	}
1474
1475	$comments = $showComments;
1476
1477	return $comments;
1478	}
1479
1480	/**
1481	* The function for the get_pages filter.
1482	*
1483	* @param array $pages The pages.
1484	*
1485	* @return array
1486	*/
1487	public function showPage($pages = array())
1488	{
1489	$showPages = array();
1490	$uamOptions = $this->getAdminOptions();
1491	$uamAccessHandler = &$this->getAccessHandler();
1492
1493	foreach ($pages as $page) {
1494	if ($uamOptions['hide_page'] == 'true'
1495	\|\| $this->atAdminPanel
1496	) {
1497	if ($uamAccessHandler->checkObjectAccess($page->post_type, $page->ID)) {
1498	$page->post_title.= $this->adminOutput($page->ID);
1499	$showPages[] = $page;
1500	}
1501	} else {
1502	if (!$uamAccessHandler->checkObjectAccess($page->post_type, $page->ID)) {
1503	if ($uamOptions['hide_page_title'] == 'true') {
1504	$page->post_title = $uamOptions['page_title'];
1505	}
1506
1507	$page->post_content = $uamOptions['page_content'];
1508	}
1509
1510	$page->post_title.= $this->adminOutput($page->ID);
1511	$showPages[] = $page;
1512	}
1513	}
1514
1515	$pages = $showPages;
1516
1517	return $pages;
1518	}
1519
1520	/**
1521	* Modifies the content of the category by the given settings.
1522	*
1523	* @param object $category The current category.
1524	*
1525	* @return object
1526	*/
1527	private function _getCategory($category)
1528	{
1529	$uamOptions = $this->getAdminOptions();
1530	$uamAccessHandler = &$this->getAccessHandler();
1531
1532	$category->isEmpty = false;
1533
1534	if ($uamAccessHandler->checkObjectAccess('category', $category->term_id)) {
1535	if ($this->atAdminPanel == false
1536	&& ($uamOptions['hide_post'] == 'true'
1537	\|\| $uamOptions['hide_page'] == 'true')
1538	) {
1539	$args = array(
1540	'numberposts' => - 1,
1541	'category' => $category->term_id
1542	);
1543
1544	$categoryPosts = get_posts($args);
1545	$category->count = count($categoryPosts);
1546
1547	if (isset($categoryPosts)) {
1548	foreach ($categoryPosts as $post) {
1549	if ($uamOptions['hide_'.$post->post_type] == 'true'
1550	&& !$uamAccessHandler->checkObjectAccess($post->post_type, $post->ID)
1551	) {
1552	$category->count--;
1553	}
1554	}
1555	}
1556
1557	if ($category->count <= 0
1558	&& $uamOptions['hide_empty_categories'] == 'true'
1559	&& $category->taxonomy == "category"
1560	) {
1561	$category->isEmpty = true;
1562	}
1563
1564	if ($uamOptions['lock_recursive'] == 'false') {
1565	$curCategory = $category;
1566
1567	while ($curCategory->parent != 0) {
1568	$curCategory = get_category($curCategory->parent);
1569
1570	if ($uamAccessHandler->checkObjectAccess('category', $curCategory->term_id)) {
1571	$category->parent = $curCategory->term_id;
1572	break;
1573	}
1574	}
1575	}
1576
1577	return $category;
1578	} else {
1579	return $category;
1580	}
1581	}
1582
1583	return null;
1584	}
1585
1586	/**
1587	* The function for the get_terms filter.
1588	*
1589	* @param array $categories The categories.
1590	* @param array $args The given arguments.
1591	*
1592	* @return array
1593	*/
1594	public function showCategory($categories = array(), $args = array())
1595	{
1596	$uamOptions = $this->getAdminOptions();
1597	$uamAccessHandler = &$this->getAccessHandler();
1598
1599	$showCategories = array();
1600
1601	$uamOptions = $this->getAdminOptions();
1602
1603	foreach ($categories as $category) {
1604	if (!is_object($category)) {
1605	return $categories;
1606	}
1607
1608	$category = $this->_getCategory($category);
1609
1610	if ($category !== null) {
1611	if (!$category->isEmpty) {
1612	$showCategories[$category->term_id] = $category;
1613	}
1614	}
1615	}
1616
1617	foreach ($categories as $key => $category) {
1618	if (!array_key_exists($category->term_id, $showCategories)) {
1619	unset($categories[$key]);
1620	}
1621	}
1622
1623	return $categories;
1624	}
1625
1626	/**
1627	* The function for the get_previous_post_where and
1628	* the get_next_post_where filter.
1629	*
1630	* @param string $sql The current sql string.
1631	*
1632	* @return string
1633	*/
1634	public function showNextPreviousPost($sql)
1635	{
1636	$uamAccessHandler = &$this->getAccessHandler();
1637	$uamOptions = $this->getAdminOptions();
1638
1639	if ($uamOptions['hide_post'] == 'true'
1640	&& !$uamAccessHandler->checkUserAccess()
1641	) {
1642	$excludedPosts = $this->_getExcludedPosts();
1643
1644	if (count($excludedPosts) > 0) {
1645	$excludedPostsStr = implode(",", $excludedPosts);
1646	$sql.= " AND p.ID NOT IN($excludedPostsStr) ";
1647	}
1648	}
1649
1650	return $sql;
1651	}
1652
1653	/**
1654	* Returns the admin hint.
1655	*
1656	* @param integer $postId The post id we want to check.
1657	*
1658	* @return string
1659	*/
1660	public function adminOutput($postId)
1661	{
1662	$output = "";
1663
1664	if (!$this->atAdminPanel) {
1665	$uamOptions = $this->getAdminOptions();
1666
1667	if ($uamOptions['blog_admin_hint'] == 'true') {
1668	global $current_user;
1669
1670	$curUserdata = get_userdata($current_user->ID);
1671
1672	if (!isset($curUserdata->user_level)) {
1673	return $output;
1674	}
1675
1676	$uamAccessHandler = &$this->getAccessHandler();
1677
1678	$post = get_post($postId);
1679
1680	if ($uamAccessHandler->userIsAdmin($current_user->ID)
1681	&& count($uamAccessHandler->getUserGroupsForObject($post->post_type, $post->ID)) > 0
1682	) {
1683	$output .= $uamOptions['blog_admin_hint_text'];
1684	}
1685	}
1686	}
1687
1688	return $output;
1689	}
1690
1691	/**
1692	* The function for the edit_post_link filter.
1693	*
1694	* @param string $link The edit link.
1695	* @param integer $postId The id of the post.
1696	*
1697	* @return string
1698	*/
1699	public function showGroupMembership($link, $postId)
1700	{
1701	$uamAccessHandler = &$this->getAccessHandler();
1702	$groups = $uamAccessHandler->getUserGroupsForObject('post', $postId);
1703
1704	if (count($groups) > 0) {
1705	$link .= ' \| '.TXT_ASSIGNED_GROUPS.': ';
1706
1707	foreach ($groups as $group) {
1708	$link .= $group->getGroupName().', ';
1709	}
1710
1711	$link = rtrim($link, ', ');
1712	}
1713
1714	return $link;
1715	}
1716
1717	/**
1718	* Returns the login bar.
1719	*
1720	* @return string
1721	*/
1722	public function getLoginBarHtml()
1723	{
1724	if (!is_user_logged_in()) {
1725	return $this->getIncludeContents(UAM_REALPATH.'tpl/loginBar.php');
1726	}
1727
1728	return '';
1729	}
1730
1731
1732	/*
1733	* Functions for the redirection and files.
1734	*/
1735
1736	/**
1737	* Returns ture if permalinks are active otherwise false.
1738	*
1739	* @return boolean
1740	*/
1741	public function isPermalinksActive()
1742	{
1743	$permaStruc = get_option('permalink_structure');
1744
1745	if (empty($permaStruc)) {
1746	return false;
1747	} else {
1748	return true;
1749	}
1750	}
1751
1752	/**
1753	* Redirects to a page or to content.
1754	*
1755	* @param string $headers The headers which are given from wordpress.
1756	* @param object $pageParams The params of the current page.
1757	*
1758	* @return null
1759	*/
1760	public function redirect($headers, $pageParams)
1761	{
1762	$uamOptions = $this->getAdminOptions();
1763
1764	if (isset($_GET['uamgetfile'])
1765	&& isset($_GET['uamfiletype'])
1766	) {
1767	$fileUrl = $_GET['uamgetfile'];
1768	$fileType = $_GET['uamfiletype'];
1769	$this->getFile($fileType, $fileUrl);
1770	} elseif (!$this->atAdminPanel && $uamOptions['redirect'] != 'false') {
1771	$object = null;
1772
1773	if (isset($pageParams->query_vars['p'])) {
1774	$object = get_post($pageParams->query_vars['p']);
1775	$objectType = $object->post_type;
1776	$objectId = $object->ID;
1777	} elseif (isset($pageParams->query_vars['page_id'])) {
1778	$object = get_post($pageParams->query_vars['page_id']);
1779	$objectType = $object->post_type;
1780	$objectId = $object->ID;
1781	} elseif (isset($pageParams->query_vars['cat_id'])) {
1782	$object = get_category($pageParams->query_vars['cat_id']);
1783	$objectType = 'category';
1784	$objectId = $object->term_id;
1785	}
1786
1787	if ($object === null
1788	\|\|$object !== null
1789	&& !$this->getAccessHandler()->checkObjectAccess($objectType, $objectId)
1790	) {
1791	$this->redirectUser($object);
1792	}
1793	}
1794	}
1795
1796	/**
1797	* Redirects the user to his destination.
1798	*
1799	* @param object $object The current object we want to access.
1800	*
1801	* @return null
1802	*/
1803	public function redirectUser($object = null)
1804	{
1805	global $wp_query;
1806
1807	$postToShow = false;
1808	$posts = $wp_query->get_posts();
1809
1810	if ($object === null
1811	&& isset($posts)
1812	) {
1813	foreach ($posts as $post) {
1814	if ($this->getAccessHandler()->checkObjectAccess($post->post_type, $post->ID)) {
1815	$postToShow = true;
1816	break;
1817	}
1818	}
1819	}
1820
1821	if (!$postToShow) {
1822	$uamOptions = $this->getAdminOptions();
1823
1824	if ($uamOptions['redirect'] == 'blog') {
1825	$url = home_url('/');
1826	} elseif ($uamOptions['redirect'] == 'custom_page') {
1827	$post = get_post($uamOptions['redirect_custom_page']);
1828	$url = $post->guid;
1829	} elseif ($uamOptions['redirect'] == 'custom_url') {
1830	$url = $uamOptions['redirect_custom_url'];
1831	}
1832
1833	if ($url != "http://".$_SERVER['HTTP_HOST'].$_SERVER["REQUEST_URI"]) {
1834	wp_redirect($url);
1835	exit;
1836	}
1837	}
1838	}
1839
1840	/**
1841	* Delivers the content of the requestet file.
1842	*
1843	* @param string $objectType The type of the requested file.
1844	* @param string $objectUrl The file url.
1845	*
1846	* @return null
1847	*/
1848	public function getFile($objectType, $objectUrl)
1849	{
1850	$object = $this->_getFileSettingsByType($objectType, $objectUrl);
1851
1852	if ($object === null) {
1853	return null;
1854	}
1855
1856	$file = null;
1857
1858	if ($this->getAccessHandler()->checkObjectAccess($object->type, $object->id)) {
1859	$file = $object->file;
1860	} elseif ($object->isImage) {
1861	$file = UAM_REALPATH.'gfx/noAccessPic.png';
1862	} else {
1863	wp_die(TXT_NO_RIGHTS);
1864	}
1865
1866	//Deliver content
1867	if (file_exists($file)) {
1868	$fileName = basename($file);
1869
1870	/*
1871	* This only for compatibility
1872	* mime_content_type has been deprecated as the PECL extension Fileinfo
1873	* provides the same functionality (and more) in a much cleaner way.
1874	*/
1875	if (function_exists('finfo_open')) {
1876	$finfo = finfo_open(FILEINFO_MIME);
1877	$fileMimeType = finfo_file($finfo, $file);
1878	finfo_close($finfo);
1879	} else {
1880	$fileMimeType = mime_content_type($file);
1881	}
1882
1883	header('Content-Description: File Transfer');
1884	header('Content-Type: '.$fileMimeType);
1885
1886	if (!$object->isImage) {
1887	$baseName = str_replace(' ', '_', basename($file));
1888
1889	header('Content-Disposition: attachment; filename="'.$baseName.'"');
1890	}
1891
1892	header('Content-Transfer-Encoding: binary');
1893	header('Content-Length: '.filesize($file));
1894
1895	$uamOptions = $this->getAdminOptions();
1896
1897	if ($uamOptions['download_type'] == 'fopen'
1898	&& !$objectIsImage
1899	) {
1900	$fp = fopen($file, 'r');
1901
1902	//TODO find better solution (prevent '\n' / '0A')
1903	ob_clean();
1904	flush();
1905
1906	while (!feof($fp)) {
1907	set_time_limit(30);
1908	$buffer = fread($fp, 1024);
1909	echo $buffer;
1910	}
1911
1912	exit;
1913	} else {
1914	ob_clean();
1915	flush();
1916	readfile($file);
1917	exit;
1918	}
1919	} else {
1920	wp_die(TXT_FILE_NOT_FOUND_ERROR);
1921	}
1922	}
1923
1924	/**
1925	* Returns the file object by the given type and url.
1926	*
1927	* @param string $objectType The type of the requested file.
1928	* @param string $objectUrl The file url.
1929	*
1930	* @return object\|null
1931	*/
1932	private function _getFileSettingsByType($objectType, $objectUrl)
1933	{
1934	$object = null;
1935
1936	if ($objectType == 'attachment') {
1937	$uploadDir = wp_upload_dir();
1938
1939	if ($this->isPermalinksActive()) {
1940	$objectUrl = $uploadDir['baseurl'].'/'.$objectUrl;
1941	}
1942
1943	$post = get_post($this->getPostIdByUrl($objectUrl));
1944
1945	if ($post !== null
1946	&& $post->post_type == 'attachment'
1947	) {
1948	$object->id = $post->ID;
1949	$object->isImage = wp_attachment_is_image($post->ID);
1950	$object->type = $objectType;
1951
1952	$object->file = $uploadDir['basedir'].str_replace(
1953	$uploadDir['baseurl'],
1954	'',
1955	$objectUrl
1956	);
1957	}
1958	} else {
1959	$plObject = $this->getAccessHandler()->getPlObject($objectType);
1960
1961	if (isset($plObject)
1962	&& isset($plObject['getFileObject'])
1963	) {
1964	$object = $plObject['reference']->{$plObject['getFileObject']}(
1965	$objectUrl
1966	);
1967	}
1968	}
1969
1970	return $object;
1971	}
1972
1973	/**
1974	* Returns the url for a locked file.
1975	*
1976	* @param string $url The base url.
1977	* @param integer $id The id of the file.
1978	*
1979	* @return string
1980	*/
1981	public function getFileUrl($url, $id)
1982	{
1983	$uamOptions = $this->getAdminOptions();
1984
1985	if (!$this->isPermalinksActive()
1986	&& $uamOptions['lock_file'] == 'true'
1987	) {
1988	$post = &get_post($id);
1989
1990	$type = explode("/", $post->post_mime_type);
1991	$type = $type[1];
1992
1993	$fileTypes = explode(
1994	",",
1995	$uamOptions['locked_file_types']
1996	);
1997
1998	if ($uamOptions['lock_file_types'] == 'all'
1999	\|\| in_array($type, $fileTypes)
2000	) {
2001	$url = home_url('/').'?uamfiletype=attachment&uamgetfile='.$url;
2002	}
2003	}
2004
2005	return $url;
2006	}
2007
2008	/**
2009	* Returns the post by the given url.
2010	*
2011	* @param string $url The url of the post(attachment).
2012	*
2013	* @return object The post.
2014	*/
2015	public function getPostIdByUrl($url)
2016	{
2017	if (isset($this->postUrls[$url])) {
2018	return $this->postUrls[$url];
2019	}
2020
2021	//Filter edit string
2022	$newUrl = preg_split("/-e[0-9]*/", $url);
2023
2024	if (count($newUrl) == 2) {
2025	$newUrl = $newUrl[0].$newUrl[1];
2026	} else {
2027	$newUrl = $newUrl[0];
2028	}
2029
2030	//Filter size
2031	$newUrl = preg_split("/-[0-9]x[0-9]/", $newUrl);
2032
2033	if (count($newUrl) == 2) {
2034	$newUrl = $newUrl[0].$newUrl[1];
2035	} else {
2036	$newUrl = $newUrl[0];
2037	}
2038
2039	global $wpdb;
2040	$dbPost = $wpdb->get_row(
2041	"SELECT ID
2042	FROM ".$wpdb->prefix."posts
2043	WHERE guid = '" . $newUrl . "'
2044	LIMIT 1"
2045	);
2046
2047	if ($dbPost) {
2048	return $dbPost->ID;
2049	}
2050
2051	return null;
2052	}
2053
2054	/**
2055	* Caches the urls for the post for a later lookup.
2056	*
2057	* @param string $url The url of the post.
2058	* @param object $post The post object.
2059	*
2060	* @return null
2061	*/
2062	public function cachePostLinks($url, $post)
2063	{
2064	$this->postUrls[$url] = $post->ID;
2065	return $url;
2066	}
2067	}