summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--core/helpers/access.php49
-rw-r--r--core/tests/Access_Helper_Test.php61
2 files changed, 63 insertions, 47 deletions
diff --git a/core/helpers/access.php b/core/helpers/access.php
index 71e085df..36ef9c5c 100644
--- a/core/helpers/access.php
+++ b/core/helpers/access.php
@@ -128,25 +128,32 @@ class access_Core {
* @param Item_Model $item
* @param boolean $value
*/
- private static function _set($group, $perm_name, $item, $value) {
- if (!$item->loaded) {
- throw new Exception("@todo INVALID_ITEM $item->id");
+ private static function _set($group, $perm_name, $album, $value) {
+ if (!$album->loaded) {
+ throw new Exception("@todo INVALID_ALBUM $album->id");
}
- if ($item->type != "album") {
- throw new Exception("@todo INVALID_ITEM_TYPE not an album");
+ if ($album->type != "album") {
+ throw new Exception("@todo INVALID_ALBUM_TYPE not an album");
}
- $access = ORM::factory("access_intent")->where("item_id", $item->id)->find();
+ $access = ORM::factory("access_intent")->where("item_id", $album->id)->find();
if (!$access->loaded) {
- throw new Exception("@todo MISSING_ACCESS for $item->id");
+ throw new Exception("@todo MISSING_ACCESS for $album->id");
}
$access->__set("{$perm_name}_{$group->id}", $value);
$access->save();
if ($perm_name =="view") {
- self::_update_access_view_cache($group, $item);
+ self::_update_access_view_cache($group, $album);
+ if ($group->id == 1) {
+ if ($value) {
+ self::_delete_htaccess_files($album);
+ } else {
+ self::_create_htaccess_files($album);
+ }
+ }
} else {
- self::_update_access_non_view_cache($group, $perm_name, $item);
+ self::_update_access_non_view_cache($group, $perm_name, $album);
}
}
@@ -344,7 +351,7 @@ class access_Core {
* @param Item_Model $item
* @return void
*/
- public static function _update_access_view_cache($group, $item) {
+ private static function _update_access_view_cache($group, $item) {
$access = ORM::factory("access_intent")->where("item_id", $item->id)->find();
$db = Database::instance();
@@ -427,7 +434,7 @@ class access_Core {
* @param Item_Model $item
* @return void
*/
- public static function _update_access_non_view_cache($group, $perm_name, $item) {
+ private static function _update_access_non_view_cache($group, $perm_name, $item) {
$access = ORM::factory("access_intent")->where("item_id", $item->id)->find();
$db = Database::instance();
@@ -471,4 +478,24 @@ class access_Core {
" AND `right` <= $row->right)");
}
}
+
+ /**
+ * Create .htaccess files to prevent direct access to the given album and its hierarchy.
+ */
+ private static function _create_htaccess_files($album) {
+ foreach (array($album->file_path(), dirname($album->resize_path())) as $dir) {
+ $fp = fopen("$dir/.htaccess", "w+");
+ fwrite($fp, "Order Deny,Allow\n");
+ fwrite($fp, "Deny from All\n");
+ fclose($fp);
+ }
+ }
+
+ /**
+ * Delete the .htaccess files that are preventing access to the given album and its hierarchy.
+ */
+ private static function _delete_htaccess_files($album) {
+ @unlink($album->file_path() . "/.htaccess");
+ @unlink(dirname($album->resize_path()) . "/.htaccess");
+ }
}
diff --git a/core/tests/Access_Helper_Test.php b/core/tests/Access_Helper_Test.php
index 4383a35b..4643eb1a 100644
--- a/core/tests/Access_Helper_Test.php
+++ b/core/tests/Access_Helper_Test.php
@@ -44,13 +44,6 @@ class Access_Helper_Test extends Unit_Test_Case {
user::set_active(user::guest());
}
- private function _add_album($parent) {
- $album = ORM::factory("item");
- $album->type = "album";
- $album->add_to_parent($parent);
- return $album;
- }
-
public function groups_and_permissions_are_bound_to_columns_test() {
access::register_permission("access_test");
$group = group::create("access_test");
@@ -91,8 +84,7 @@ class Access_Helper_Test extends Unit_Test_Case {
public function new_photos_inherit_parent_permissions_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
access::allow(group::everybody(), "view", $album);
$photo = ORM::factory("item");
@@ -105,8 +97,7 @@ class Access_Helper_Test extends Unit_Test_Case {
public function can_allow_deny_and_reset_intent_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
$intent = ORM::factory("access_intent")->where("item_id", $album)->find();
// Allow
@@ -158,9 +149,9 @@ class Access_Helper_Test extends Unit_Test_Case {
public function cant_view_child_of_hidden_parent_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
+ $root->reload();
access::deny(group::everybody(), "view", $root);
access::reset(group::everybody(), "view", $album);
@@ -170,8 +161,7 @@ class Access_Helper_Test extends Unit_Test_Case {
public function view_permissions_propagate_down_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
access::allow(group::everybody(), "view", $root);
access::reset(group::everybody(), "view", $album);
@@ -181,17 +171,10 @@ class Access_Helper_Test extends Unit_Test_Case {
public function can_toggle_view_permissions_propagate_down_test() {
$root = ORM::factory("item", 1);
- $album1 = $this->_add_album($root);
- access::add_item($album1);
-
- $album2 = $this->_add_album($album1);
- access::add_item($album2);
-
- $album3 = $this->_add_album($album2);
- access::add_item($album3);
-
- $album4 = $this->_add_album($album3);
- access::add_item($album4);
+ $album1 = album::create($root->id, rand(), "test album");
+ $album2 = album::create($album1->id, rand(), "test album");
+ $album3 = album::create($album2->id, rand(), "test album");
+ $album4 = album::create($album3->id, rand(), "test album");
$album1->reload();
$album2->reload();
@@ -214,9 +197,9 @@ class Access_Helper_Test extends Unit_Test_Case {
public function revoked_view_permissions_cant_be_allowed_lower_down_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
+ $root->reload();
access::deny(group::everybody(), "view", $root);
access::allow(group::everybody(), "view", $album);
@@ -232,8 +215,7 @@ class Access_Helper_Test extends Unit_Test_Case {
public function non_view_permissions_propagate_down_test() {
$root = ORM::factory("item", 1);
- $album = $this->_add_album($root);
- access::add_item($album);
+ $album = album::create($root->id, rand(), "test album");
access::allow(group::everybody(), "edit", $root);
access::reset(group::everybody(), "edit", $album);
@@ -242,15 +224,11 @@ class Access_Helper_Test extends Unit_Test_Case {
public function non_view_permissions_can_be_revoked_lower_down_test() {
$root = ORM::factory("item", 1);
- $outer = $this->_add_album($root);
- access::add_item($outer);
-
+ $outer = album::create($root->id, rand(), "test album");
$outer_photo = ORM::factory("item")->add_to_parent($outer);
access::add_item($outer_photo);
- $inner = $this->_add_album($outer);
- access::add_item($inner);
-
+ $inner = album::create($outer->id, rand(), "test album");
$inner_photo = ORM::factory("item")->add_to_parent($inner);
access::add_item($inner_photo);
@@ -291,4 +269,15 @@ class Access_Helper_Test extends Unit_Test_Case {
// And verify that the user can edit.
$this->assert_true(access::can("edit", $root));
}
+
+ public function everybody_view_permission_maintains_htaccess_files_test() {
+ $root = ORM::factory("item", 1);
+ $album = album::create($root->id, rand(), "test album");
+
+ $this->assert_false(file_exists($album->file_path() . "/.htaccess"));
+ access::deny(group::everybody(), "view", $album);
+ $this->assert_true(file_exists($album->file_path() . "/.htaccess"));
+ access::allow(group::everybody(), "view", $album);
+ $this->assert_false(file_exists($album->file_path() . "/.htaccess"));
+ }
}
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-13 16:45:08 +0000