| @@ -1,82 +1,142 @@ | ||
| 1 | 1 | <?php |
| 2 | - | |
| 3 | -declare(strict_types=1); | |
| 4 | - | |
| 2 | +/** | |
| 3 | + * UserHandler.php | |
| 4 | + * | |
| 5 | + * The UserHandler class file. | |
| 6 | + * | |
| 7 | + * PHP versions 5 | |
| 8 | + * | |
| 9 | + * @author Alexander Schneider <[email protected]> | |
| 10 | + * @copyright 2008-2017 Alexander Schneider | |
| 11 | + * @license http://www.gnu.org/licenses/gpl-2.0.html GNU General Public License, version 2 | |
| 12 | + * @version SVN: $id$ | |
| 13 | + * @link http://wordpress.org/extend/plugins/user-access-manager/ | |
| 14 | + */ | |
| 5 | 15 | namespace UserAccessManager\User; |
| 6 | 16 | |
| 7 | 17 | use UserAccessManager\Config\MainConfig; |
| 8 | 18 | use UserAccessManager\Database\Database; |
| 9 | 19 | use UserAccessManager\Object\ObjectHandler; |
| 10 | -use UserAccessManager\UserGroup\AbstractUserGroup; | |
| 20 | +use UserAccessManager\UserGroup\UserGroup; | |
| 11 | 21 | use UserAccessManager\Wrapper\Wordpress; |
| 12 | -use WP_User; | |
| 13 | 22 | |
| 23 | +/** | |
| 24 | + * Class UserHandler | |
| 25 | + * | |
| 26 | + * @package UserAccessManager\UserHandler | |
| 27 | + */ | |
| 14 | 28 | class UserHandler |
| 15 | 29 | { |
| 16 | - public const MANAGE_USER_GROUPS_CAPABILITY = 'manage_user_groups'; | |
| 30 | + const MANAGE_USER_GROUPS_CAPABILITY = 'manage_user_groups'; | |
| 17 | 31 | |
| 18 | - private const ROLES_BY_ASCENDING_RIGHTS = [ | |
| 19 | - AbstractUserGroup::NONE_ROLE, | |
| 20 | - 'subscriber', | |
| 21 | - 'contributor', | |
| 22 | - 'author', | |
| 23 | - 'editor', | |
| 24 | - 'administrator' | |
| 25 | - ]; | |
| 32 | + /** | |
| 33 | + * @var Wordpress | |
| 34 | + */ | |
| 35 | + private $wordpress; | |
| 26 | 36 | |
| 37 | + /** | |
| 38 | + * @var MainConfig | |
| 39 | + */ | |
| 40 | + private $config; | |
| 41 | + | |
| 42 | + /** | |
| 43 | + * @var Database | |
| 44 | + */ | |
| 45 | + private $database; | |
| 46 | + | |
| 47 | + /** | |
| 48 | + * @var ObjectHandler | |
| 49 | + */ | |
| 50 | + private $objectHandler; | |
| 51 | + | |
| 52 | + /** | |
| 53 | + * The constructor | |
| 54 | + * | |
| 55 | + * @param Wordpress $wordpress | |
| 56 | + * @param MainConfig $config | |
| 57 | + * @param Database $database | |
| 58 | + * @param ObjectHandler $objectHandler | |
| 59 | + */ | |
| 27 | 60 | public function __construct( |
| 28 | - private Wordpress $wordpress, | |
| 29 | - private MainConfig $config, | |
| 30 | - private Database $database, | |
| 31 | - private ObjectHandler $objectHandler | |
| 61 | + Wordpress $wordpress, | |
| 62 | + MainConfig $config, | |
| 63 | + Database $database, | |
| 64 | + ObjectHandler $objectHandler | |
| 32 | 65 | ) { |
| 66 | + $this->wordpress = $wordpress; | |
| 67 | + $this->config = $config; | |
| 68 | + $this->database = $database; | |
| 69 | + $this->objectHandler = $objectHandler; | |
| 33 | 70 | } |
| 34 | 71 | |
| 35 | - private function calculateIp(string $ip): bool|string | |
| 72 | + /** | |
| 73 | + * Converts the ip to an integer. | |
| 74 | + * | |
| 75 | + * @param string $ip | |
| 76 | + * | |
| 77 | + * @return string|false | |
| 78 | + */ | |
| 79 | + private function calculateIp($ip) | |
| 36 | 80 | { |
| 37 | 81 | if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) { |
| 38 | - return base_convert((string) ip2long($ip), 10, 2); | |
| 39 | - } | |
| 40 | - | |
| 41 | - if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false) { | |
| 82 | + return base_convert(ip2long($ip), 10, 2); | |
| 83 | + } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false) { | |
| 42 | 84 | return false; |
| 43 | 85 | } |
| 44 | 86 | |
| 87 | + $packedIp = inet_pton($ip); | |
| 88 | + $bits = 15; // 16 x 8 bit = 128bit (ipv6) | |
| 45 | 89 | $binaryIp = ''; |
| 46 | 90 | |
| 47 | - foreach (str_split(inet_pton($ip)) as $byte) { | |
| 48 | - $binaryIp .= sprintf('%08b', ord($byte)); | |
| 91 | + while ($bits >= 0) { | |
| 92 | + $binaryIp = sprintf('%08b', (ord($packedIp[$bits]))).$binaryIp; | |
| 93 | + $bits--; | |
| 49 | 94 | } |
| 50 | 95 | |
| 51 | 96 | return $binaryIp; |
| 52 | 97 | } |
| 53 | 98 | |
| 54 | - private function getCalculatedRange(string $ipRange): array | |
| 99 | + /** | |
| 100 | + * Calculates the ip range. | |
| 101 | + * | |
| 102 | + * @param string $ipRange | |
| 103 | + * | |
| 104 | + * @return array | |
| 105 | + */ | |
| 106 | + private function getCalculatedRange($ipRange) | |
| 55 | 107 | { |
| 56 | - $rangeBounds = explode('-', $ipRange); | |
| 108 | + $ipRange = explode('-', $ipRange); | |
| 109 | + $rangeBegin = $ipRange[0]; | |
| 110 | + $rangeEnd = isset($ipRange[1]) ? $ipRange[1] : $ipRange[0]; | |
| 57 | 111 | |
| 58 | 112 | return [ |
| 59 | - $this->calculateIp($rangeBounds[0]), | |
| 60 | - $this->calculateIp($rangeBounds[1] ?? $rangeBounds[0]) | |
| 113 | + $this->calculateIp($rangeBegin), | |
| 114 | + $this->calculateIp($rangeEnd) | |
| 61 | 115 | ]; |
| 62 | 116 | } |
| 63 | 117 | |
| 64 | - public function isIpInRange(string $currentIp, array $ipRanges): bool | |
| 118 | + /** | |
| 119 | + * Checks if the given ip matches with the range. | |
| 120 | + * | |
| 121 | + * @param string $currentIp The ip of the current user. | |
| 122 | + * @param array $ipRanges The ip ranges. | |
| 123 | + * | |
| 124 | + * @return bool | |
| 125 | + */ | |
| 126 | + public function isIpInRange($currentIp, array $ipRanges) | |
| 65 | 127 | { |
| 66 | - $calculatedCurrentIp = $this->calculateIp($currentIp); | |
| 128 | + $currentIp = $this->calculateIp($currentIp); | |
| 67 | 129 | |
| 68 | - if ($calculatedCurrentIp === false) { | |
| 69 | - return false; | |
| 70 | - } | |
| 130 | + if ($currentIp !== false) { | |
| 131 | + foreach ($ipRanges as $ipRange) { | |
| 132 | + $calculatedIpRange = $this->getCalculatedRange($ipRange); | |
| 71 | 133 | |
| 72 | - foreach ($ipRanges as $ipRange) { | |
| 73 | - [$rangeBegin, $rangeEnd] = $this->getCalculatedRange($ipRange); | |
| 74 | - | |
| 75 | - if ($rangeBegin !== false && $rangeEnd !== false | |
| 76 | - && $rangeBegin <= $calculatedCurrentIp && $calculatedCurrentIp <= $rangeEnd | |
| 77 | - ) { | |
| 78 | - return true; | |
| 134 | + if ($calculatedIpRange[0] !== false && $calculatedIpRange[1] !== false | |
| 135 | + && $calculatedIpRange[0] <= $currentIp && $currentIp <= $calculatedIpRange[1] | |
| 136 | + ) { | |
| 137 | + return true; | |
| 138 | + } | |
| 79 | 139 | } |
| 80 | 140 | } |
| 81 | 141 | |
| 82 | 142 | return false; |
| @@ -81,25 +141,35 @@ | ||
| 81 | 141 | |
| 82 | 142 | return false; |
| 83 | 143 | } |
| 84 | 144 | |
| 85 | - public function getUserRole(WP_User|bool $user): array | |
| 145 | + /** | |
| 146 | + * Return the role of the user. | |
| 147 | + * | |
| 148 | + * @param \WP_User|false $user The user. | |
| 149 | + * | |
| 150 | + * @return array | |
| 151 | + */ | |
| 152 | + public function getUserRole($user) | |
| 86 | 153 | { |
| 87 | - $capabilitiesProperty = $this->database->getPrefix() . 'capabilities'; | |
| 88 | - $capabilities = ($user instanceof WP_User && isset($user->{$capabilitiesProperty}) === true) | |
| 89 | - ? (array) $user->{$capabilitiesProperty} | |
| 90 | - : []; | |
| 154 | + if ($user instanceof \WP_User && isset($user->{$this->database->getPrefix().'capabilities'}) === true) { | |
| 155 | + $capabilities = (array)$user->{$this->database->getPrefix().'capabilities'}; | |
| 156 | + } else { | |
| 157 | + $capabilities = []; | |
| 158 | + } | |
| 91 | 159 | |
| 92 | - return ($capabilities !== []) ? array_keys($capabilities) : [AbstractUserGroup::NONE_ROLE]; | |
| 160 | + return (count($capabilities) > 0) ? array_keys($capabilities) : [UserGroup::NONE_ROLE]; | |
| 93 | 161 | } |
| 94 | 162 | |
| 95 | - private function getRolesMap(WP_User|bool $user): array | |
| 163 | + /** | |
| 164 | + * Checks the user access by user level. | |
| 165 | + * | |
| 166 | + * @param bool|string $allowedCapability If set check also for the capability. | |
| 167 | + * | |
| 168 | + * @return bool | |
| 169 | + */ | |
| 170 | + public function checkUserAccess($allowedCapability = false) | |
| 96 | 171 | { |
| 97 | - return array_flip($this->getUserRole($user)); | |
| 98 | - } | |
| 99 | - | |
| 100 | - public function checkUserAccess(bool|string $allowedCapability = false): bool | |
| 101 | - { | |
| 102 | 172 | $currentUser = $this->wordpress->getCurrentUser(); |
| 103 | 173 | |
| 104 | 174 | if ($this->wordpress->isSuperAdmin($currentUser->ID) === true |
| 105 | 175 | || $allowedCapability !== false && $currentUser->has_cap($allowedCapability) === true |
| @@ -106,22 +176,35 @@ | ||
| 106 | 176 | ) { |
| 107 | 177 | return true; |
| 108 | 178 | } |
| 109 | 179 | |
| 110 | - $rolesMap = $this->getRolesMap($currentUser); | |
| 111 | - $rightsLevelByRole = array_flip(self::ROLES_BY_ASCENDING_RIGHTS); | |
| 112 | - $userRightsLevels = array_intersect_key($rightsLevelByRole, $rolesMap); | |
| 113 | - $rightsLevel = ($userRightsLevels !== []) ? end($userRightsLevels) : -1; | |
| 180 | + $roles = $this->getUserRole($currentUser); | |
| 181 | + $rolesMap = array_flip($roles); | |
| 182 | + | |
| 183 | + $orderedRoles = [UserGroup::NONE_ROLE, 'subscriber', 'contributor', 'author', 'editor', 'administrator']; | |
| 184 | + $orderedRolesMap = array_flip($orderedRoles); | |
| 185 | + | |
| 186 | + $userRoles = array_intersect_key($orderedRolesMap, $rolesMap); | |
| 187 | + $rightsLevel = (count($userRoles) > 0) ? end($userRoles) : -1; | |
| 114 | 188 | $fullAccessRole = $this->config->getFullAccessRole(); |
| 115 | 189 | |
| 116 | - return isset($rightsLevelByRole[$fullAccessRole]) === true | |
| 117 | - && $rightsLevel >= $rightsLevelByRole[$fullAccessRole] | |
| 118 | - || isset($rolesMap['administrator']) === true; | |
| 190 | + return (isset($orderedRolesMap[$fullAccessRole]) === true && $rightsLevel >= $orderedRolesMap[$fullAccessRole] | |
| 191 | + || isset($rolesMap['administrator']) === true | |
| 192 | + ); | |
| 119 | 193 | } |
| 120 | 194 | |
| 121 | - public function userIsAdmin(int|string|null $userId): bool | |
| 195 | + /** | |
| 196 | + * Checks if the user is an admin user | |
| 197 | + * | |
| 198 | + * @param integer $userId The user id. | |
| 199 | + * | |
| 200 | + * @return bool | |
| 201 | + */ | |
| 202 | + public function userIsAdmin($userId) | |
| 122 | 203 | { |
| 123 | - $rolesMap = $this->getRolesMap($this->objectHandler->getUser($userId)); | |
| 204 | + $user = $this->objectHandler->getUser($userId); | |
| 205 | + $roles = $this->getUserRole($user); | |
| 206 | + $rolesMap = array_flip($roles); | |
| 124 | 207 | |
| 125 | - return isset($rolesMap['administrator']) === true || $this->wordpress->isSuperAdmin($userId) === true; | |
| 208 | + return (isset($rolesMap['administrator']) === true || $this->wordpress->isSuperAdmin($userId) === true); | |
| 126 | 209 | } |
| 127 | 210 | } |
