wpforo / wpf-includes / class-permissions.php

class-permissions.php in wpForo Forum 1.1.1, at wpf-includes/class-permissions.php

253 lines 7.1 KB

Raw Download Zip

1	<?php
2	// Exit if accessed directly
3	if( !defined( 'ABSPATH' ) ) exit;
4
5
6	class wpForoPermissions{
7
8	private $wpforo;
9	private static $cache = array();
10
11	function __construct( $wpForo ){
12	if(!isset($this->wpforo)) $this->wpforo = $wpForo;
13	}
14
15	/**
16	*
17	* @param string $access
18	*
19	* @return array access row by access key
20	*/
21	function get_access($access){
22	$access = sanitize_text_field($access);
23	$sql = "SELECT * FROM `".$this->wpforo->db->prefix."wpforo_accesses` WHERE `access` = '" . esc_sql($access) . "'";
24	return $this->wpforo->db->get_row($sql, ARRAY_A);
25	}
26
27
28	/**
29	* get all accesses from accesses table
30	*
31	* @return assoc array with accesses
32	*/
33	function get_accesses(){
34	$sql = "SELECT * FROM ".$this->wpforo->db->prefix."wpforo_accesses";
35	return $this->wpforo->db->get_results($sql, ARRAY_A);
36	}
37
38	function usergroup_cans_form( $groupid = FALSE ){
39
40	$can_data = array();
41	$cans = $this->wpforo->usergroup_cans;
42
43	if( $groupid == FALSE ){
44	foreach($cans as $can => $name){
45	@$can_data[$can]['value'] = 0;
46	@$can_data[$can]['name'] = $name;
47	}
48	}else{
49	$usegroup = $this->wpforo->usergroup->get_usergroup( $groupid );
50	$ug_cans = unserialize($usegroup['cans']);
51	foreach($cans as $can => $name){
52	@$can_data[$can]['value'] = $ug_cans[$can];
53	@$can_data[$can]['name'] = $name;
54	}
55	}
56
57	return $can_data;
58	}
59
60	function forum_cans_form( $access = FALSE ){
61
62	$can_data = array();
63	$cans = $this->wpforo->forum_cans;
64
65	if( !$access ){
66	foreach($cans as $can => $name){
67	@$can_data[$can]['value'] = 0;
68	@$can_data[$can]['name'] = $name;
69	}
70	}else{
71	$access = $this->get_access( $access );
72	$access_cans = unserialize($access['cans']);
73	foreach($cans as $can => $name){
74	@$can_data[$can]['value'] = $access_cans[$can];
75	@$can_data[$can]['name'] = $name;
76	}
77	}
78
79	return $can_data;
80	}
81
82
83	/**
84	*
85	* @param string (required)
86	* @param array
87	* @param int
88	*
89	* @return affected rows count or false
90	*/
91	function add( $title, $cans = array(), $key = '' ){
92	$default = array_map('intval', $this->wpforo->forum_cans);
93	$cans = wpforo_parse_args($cans, $default);
94	if(!$key) $key = $title;
95
96	$i = 2;
97	while( $this->wpforo->db->get_var("SELECT `access` FROM ".$this->wpforo->db->prefix."wpforo_accesses WHERE `access` = '". esc_sql(sanitize_text_field($key)) . "'") ){
98	$key = $key . '-' . $i;
99	$i++;
100	}
101
102	if( $this->wpforo->db->insert(
103	$this->wpforo->db->prefix . 'wpforo_accesses',
104	array(
105	'title' => sanitize_text_field($title),
106	'access' => sanitize_text_field($key),
107	'cans' => serialize($cans)
108	),
109	array(
110	'%s',
111	'%s',
112	'%s'
113	)
114	)
115	){
116	$this->wpforo->notice->add( sprintf( __('%s access successfully added', 'wpforo') , esc_html($title)) , 'success');
117	return $this->wpforo->db->insert_id;
118	}
119
120	$this->wpforo->notice->add('Access add error', 'error');
121	return FALSE;
122	}
123
124	function edit( $title, $cans, $key ){
125	$default = array_map('intval', $this->wpforo->forum_cans);
126	$cans = wpforo_parse_args($cans, $default);
127
128	if( FALSE !== $this->wpforo->db->update(
129	$this->wpforo->db->prefix . 'wpforo_accesses',
130	array(
131	'title' => sanitize_text_field($title),
132	'cans' => serialize( $cans ),
133	),
134	array( 'access' => sanitize_text_field($key) ),
135	array(
136	'%s',
137	'%s'
138	),
139	array( '%s' ))
140	){
141	$this->wpforo->notice->add( sprintf( __('%s access successfully edited', 'wpforo'), esc_html($title)) , 'success');
142	return $key;
143	}
144
145	$this->wpforo->notice->add('Access edit error', 'error');
146	return FALSE;
147	}
148
149	function delete($accessid){
150
151	$accessid = intval($accessid);
152
153	if(!$accessid){
154	$this->wpforo->notice->add('Access delete error', 'error');
155	return FALSE;
156	}
157
158	if( FALSE !== $this->wpforo->db->delete( $this->wpforo->db->prefix.'wpforo_accesses', array( 'accessid' => $accessid ), array( '%d' ) ) ){
159	$this->wpforo->notice->add('Access successfully deleted', 'success');
160	return $accessid;
161	}
162
163	$this->wpforo->notice->add('Access delete error', 'error');
164	return FALSE;
165	}
166
167	function forum_can( $do, $forumid = NULL ){
168	$can = 0;
169	if( is_null($forumid) && isset($this->wpforo->current_object['forumid']) )
170	$forumid = intval($this->wpforo->current_object['forumid']);
171	$forumid = intval($forumid);
172	if( !$this->wpforo->current_user_groupid ) return 0;
173	if( $forum = $this->wpforo->forum->get_forum($forumid, true) ){
174	$permissions = unserialize($forum['permissions']);
175	if( isset($permissions[$this->wpforo->current_user_groupid]) ){
176	$access = $permissions[$this->wpforo->current_user_groupid];
177	$access_arr = $this->get_access($access);
178	$cans = unserialize($access_arr['cans']);
179	$can = ( isset($cans[$do]) ? $cans[$do] : 0 );
180	}
181	}
182	return $can;
183	}
184
185	function usergroup_can( $usergroupid, $do ){
186	$usergroupid = intval($usergroupid);
187	$usergroup = $this->wpforo->usergroup->get_usergroup( $usergroupid );
188	$cans = unserialize($usergroup['cans']);
189	return ( isset($cans[$do]) ? $cans[$do] : 0 );
190	}
191
192	function user_can_manage_user( $user_id, $managing_user_id ){
193
194	if( !$user_id \|\| !$managing_user_id ) return false;
195	if( $user_id == $managing_user_id ) return true;
196
197	$user = new WP_User( $user_id );
198	$user_level = $this->user_wp_level( $user );
199	if( !empty($user->roles) && is_array($user->roles) ) $user_role = array_shift($user->roles);
200
201	$managing_user = new WP_User( $managing_user_id );
202	$managing_user_level = $this->user_wp_level( $managing_user );
203	if( !empty($managing_user->roles) && is_array($managing_user->roles) ) $managing_user_role = array_shift($managing_user->roles);
204
205	if( (int)$user_level > (int)$managing_user_level ){
206	return true;
207	}
208	elseif( $user_id == 1 && $user_role == 'administrator' ){
209	return true;
210	}
211	elseif( (int)$user_level == (int)$managing_user_level ){
212	$member = $this->wpforo->member->get_member( $user_id );
213	$managing_member = $this->wpforo->member->get_member( $managing_user_id );
214	$user_wpforo_can = $this->usergroup_can( $member['groupid'], 'em' );
215	$managing_user_wpforo_can = $this->usergroup_can( $managing_member['groupid'], 'em' );
216	if( $user_wpforo_can && !$managing_user_wpforo_can ){
217	return true;
218	}
219	else{
220	return false;
221	}
222	}
223	elseif( $user_id != 1 && $managing_user_id == 1 && $managing_user_role == 'administrator' ){
224	return false;
225	}
226	else{
227	return false;
228	}
229	}
230
231	function user_wp_level( $user_object ){
232	$level = 0;
233	$levels = array();
234	if( is_int($user_object) ){
235	$user_object = new WP_User( $user_object );
236	}
237	if( isset($user_object->allcaps) && is_array($user_object->allcaps) && !empty($user_object->allcaps) ){
238	foreach($user_object->allcaps as $level_key => $level_value){
239	if( strpos($level_key, 'level_') !== FALSE && $level_value == 1 ){
240	$levels[] = intval(str_replace('level_', '', $level_key));
241	}
242	}
243	if(!empty($levels)){
244	$level = max($levels);
245	}
246	}
247	return $level;
248	}
249
250
251	}
252
253	?>