classes/security/authorization/OmpPluginAccessPolicy.inc.php

<?php
import('lib.pkp.classes.security.authorization.PolicySet');
import('classes.security.authorization.internal.PluginLevelRequiredPolicy');
import('classes.security.authorization.internal.PluginRequiredPolicy');

define('ACCESS_MODE_MANAGE', 0x01);
define('ACCESS_MODE_ADMIN', 0x02);

class OmpPluginAccessPolicy extends PolicySet {
   function OmpPluginAccessPolicy(&$request, &$args, $roleAssignments, $accessMode = ACCESS_MODE_ADMIN) {
      parent::PolicySet();

      // A valid plugin is required.
      $this->addPolicy(new PluginRequiredPolicy($request));

      // Press managers and site admin have
      // access to plugins. We'll have to define
      // differentiated policies for those roles in a policy set.
      $pluginAccessPolicy = new PolicySet(COMBINING_PERMIT_OVERRIDES);
      $pluginAccessPolicy->setEffectIfNoPolicyApplies(AUTHORIZATION_DENY);

      //
      // Managerial role
      //
      if (isset($roleAssignments[ROLE_ID_PRESS_MANAGER])) {
         if ($accessMode & ACCESS_MODE_MANAGE) {
            // Press managers have edit settings access mode...
            $pressManagerPluginAccessPolicy = new PolicySet(COMBINING_DENY_OVERRIDES);
            $pressManagerPluginAccessPolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_PRESS_MANAGER, $roleAssignments[ROLE_ID_PRESS_MANAGER]));

            // ...only to press level plugins.
            $pressManagerPluginAccessPolicy->addPolicy(new PluginLevelRequiredPolicy($request, CONTEXT_PRESS));

            $pluginAccessPolicy->addPolicy($pressManagerPluginAccessPolicy);
         }
      }

      //
      // Site administrator role
      //
      if (isset($roleAssignments[ROLE_ID_SITE_ADMIN])) {
         // Site admin have access to all plugins...
         $siteAdminPluginAccessPolicy = new PolicySet(COMBINING_DENY_OVERRIDES);
         $siteAdminPluginAccessPolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_SITE_ADMIN, $roleAssignments[ROLE_ID_SITE_ADMIN]));

         if ($accessMode & ACCESS_MODE_MANAGE) {
            // ...of site level only.
            $siteAdminPluginAccessPolicy->addPolicy(new PluginLevelRequiredPolicy($request, CONTEXT_SITE));
         }

         $pluginAccessPolicy->addPolicy($siteAdminPluginAccessPolicy);
      }

      $this->addPolicy($pluginAccessPolicy);
   }
}

?>