RoleBasedHandlerOperationPolicy.inc.php

<?php
import('lib.pkp.classes.security.authorization.HandlerOperationPolicy');
 
class RoleBasedHandlerOperationPolicy extends HandlerOperationPolicy {
   var $_roles = array();
 
   var $_allRoles;
 
   function __construct($request, $roles, $operations,
         $message = 'user.authorization.roleBasedAccessDenied',
         $allRoles = false) {
      parent::__construct($request, $operations, $message);
 
      // Make sure a single role doesn't have to be
      // passed in as an array.
      assert(is_integer($roles) || is_array($roles));
      if (!is_array($roles)) {
         $roles = array($roles);
      }
      $this->_roles = $roles;
      $this->_allRoles = $allRoles;
   }
 
 
   //
   // Implement template methods from AuthorizationPolicy
   //
   function effect() {
      // Check whether the user has one of the allowed roles
      // assigned. If that's the case we'll permit access.
      // Get user roles grouped by context.
      $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES);
      if (empty($userRoles)) return AUTHORIZATION_DENY;
 
      if (!$this->_checkUserRoleAssignment($userRoles)) return AUTHORIZATION_DENY;
      if (!$this->_checkOperationWhitelist()) return AUTHORIZATION_DENY;
 
      $handler = $this->getRequest()->getRouter()->getHandler();
      $handler->markRoleAssignmentsChecked();
 
      return AUTHORIZATION_PERMIT;
   }
 
 
   //
   // Private helper methods
   //
   function _checkUserRoleAssignment($userRoles) {
      // Find matching roles.
      $foundMatchingRole = false;
      foreach($this->_roles as $roleId) {
         $foundMatchingRole = in_array($roleId, $userRoles);
 
         if ($this->_allRoles) {
            if (!$foundMatchingRole) {
               // When the "all roles" flag is switched on then
               // one missing role is enough to fail.
               return false;
            }
         } else {
            if ($foundMatchingRole) {
               // When the "all roles" flag is not set then
               // one matching role is enough to succeed.
               return true;
            }
         }
      }
 
      if ($this->_allRoles) {
         // All roles matched, otherwise we'd have failed before.
         return true;
      } else {
         // None of the roles matched, otherwise we'd have succeeded already.
         return false;
      }
   }
}