DataObjectRequiredPolicy.inc.php

<?php
import('lib.pkp.classes.security.authorization.AuthorizationPolicy');
 
class DataObjectRequiredPolicy extends AuthorizationPolicy {
   var $_request;
 
   var $_args;
 
   var $_parameterName;
 
   var $_operations;
 
   //
   // Getters and Setters
   //
   function &getRequest() {
      return $this->_request;
   }
 
   function &getArgs() {
      return $this->_args;
   }
 
   function __construct($request, &$args, $parameterName, $message = null, $operations = null) {
      parent::__construct($message);
      $this->_request = $request;
      assert(is_array($args));
      $this->_args =& $args;
      $this->_parameterName = $parameterName;
      $this->_operations = $operations;
   }
 
   //
   // Implement template methods from AuthorizationPolicy
   //
   function effect() {
      // Check if the object is required for the requested Op. (No operations means check for all.)
      if (is_array($this->_operations) && !in_array($this->_request->getRequestedOp(), $this->_operations)) {
         return AUTHORIZATION_PERMIT;
      } else {
         return $this->dataObjectEffect();
      }
   }
 
   //
   // Protected helper method
   //
   function dataObjectEffect() {
      // Deny by default. Must be implemented by subclass.
      return AUTHORIZATION_DENY;
   }
 
   function getDataObjectId($lookOnlyByParameterName = false) {
      // Identify the data object id.
      $router = $this->_request->getRouter();
      switch(true) {
         case is_a($router, 'PKPPageRouter'):
            if ( ctype_digit((string) $this->_request->getUserVar($this->_parameterName)) ) {
               // We may expect a object id in the user vars
               return (int) $this->_request->getUserVar($this->_parameterName);
            } else if (!$lookOnlyByParameterName && isset($this->_args[0]) && ctype_digit((string) $this->_args[0])) {
               // Or the object id can be expected as the first path in the argument list
               return (int) $this->_args[0];
            }
            break;
 
         case is_a($router, 'PKPComponentRouter'):
            // We expect a named object id argument.
            if (isset($this->_args[$this->_parameterName])
                  && ctype_digit((string) $this->_args[$this->_parameterName])) {
               return (int) $this->_args[$this->_parameterName];
            }
            break;
 
         case is_a($router, 'APIRouter'):
            $handler = $router->getHandler();
            return $handler->getParameter($this->_parameterName);
            break;
 
         default:
            assert(false);
      }
 
      return false;
   }
}