diff options
Diffstat (limited to 'modules/gallery')
48 files changed, 935 insertions, 741 deletions
diff --git a/modules/gallery/controllers/admin.php b/modules/gallery/controllers/admin.php index b92a32cd..24eebe7d 100644 --- a/modules/gallery/controllers/admin.php +++ b/modules/gallery/controllers/admin.php @@ -21,7 +21,7 @@ class Admin_Controller extends Controller { private $theme; public function __construct($theme=null) { - if (!(user::active()->admin)) { + if (!(Session::active_user()->admin)) { access::forbidden(); } diff --git a/modules/gallery/controllers/admin_identity.php b/modules/gallery/controllers/admin_identity.php new file mode 100644 index 00000000..9d756a5c --- /dev/null +++ b/modules/gallery/controllers/admin_identity.php @@ -0,0 +1,75 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ +class Admin_Identity_Controller extends Admin_Controller { + public function index() { + $view = new Admin_View("admin.html"); + $view->content = new View("admin_identity.html"); + $view->content->available = Identity::providers(); + $view->content->active = module::get_var("gallery", "identity_provider", "user"); + print $view; + } + + public function confirm() { + access::verify_csrf(); + + $v = new View("admin_identity_confirm.html"); + $v->new_provider = $this->input->post("provider"); + + print $v; + } + + public function change() { + access::verify_csrf(); + + $active_provider = module::get_var("gallery", "identity_provider", "user"); + $providers = Identity::providers(); + + $new_provider = $this->input->post("provider"); + + if ($new_provider != $active_provider) { + + module::event("pre_identity_change", $active_provider, $new_provider); + + Identity::deactivate(); + + // Switch authentication + module::set_var("gallery", "identity_provider", $new_provider); + Identity::reset(); + + Identity::activate(); + + // @todo this type of collation is questionable from an i18n perspective + message::success(t("Changed to %description", + array("description" => $providers->$new_provider))); + + try { + Session::instance()->destroy(); + } catch (Exception $e) { + // We don't care if there was a problem destroying the session. + } + url::redirect(item::root()->abs_url()); + } + + message::info(t("The selected provider \"%description\" is already active.", + array("description" => $providers->$new_provider))); + url::redirect("admin/identity"); + } +} + diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php index ae4ad395..9480a037 100644 --- a/modules/gallery/controllers/albums.php +++ b/modules/gallery/controllers/albums.php @@ -29,7 +29,7 @@ class Albums_Controller extends Items_Controller { $view = new Theme_View("page.html", "login"); $view->page_title = t("Log in to Gallery"); $view->content = new View("login_ajax.html"); - $view->content->form = user::get_login_form("login/auth_html"); + $view->content->form = login::get_login_form("login/auth_html"); print $view; return; } else { @@ -111,7 +111,7 @@ class Albums_Controller extends Items_Controller { $this->input->post("name"), $this->input->post("title", $this->input->post("name")), $this->input->post("description"), - user::active()->id, + Session::active_user()->id, $this->input->post("slug")); log::success("content", "Created an album", @@ -146,7 +146,7 @@ class Albums_Controller extends Items_Controller { $_FILES["file"]["name"], $this->input->post("title", $this->input->post("name")), $this->input->post("description"), - user::active()->id); + Session::active_user()->id); log::success("content", "Added a photo", html::anchor("photos/$photo->id", "view photo")); message::success(t("Added photo %photo_title", diff --git a/modules/gallery/controllers/l10n_client.php b/modules/gallery/controllers/l10n_client.php index 6fdbb3a1..2ab73102 100644 --- a/modules/gallery/controllers/l10n_client.php +++ b/modules/gallery/controllers/l10n_client.php @@ -20,7 +20,7 @@ class L10n_Client_Controller extends Controller { public function save() { access::verify_csrf(); - if (!user::active()->admin) { + if (!Session::active_user()->admin) { access::forbidden(); } @@ -85,7 +85,7 @@ class L10n_Client_Controller extends Controller { public function toggle_l10n_mode() { access::verify_csrf(); - if (!user::active()->admin) { + if (!Session::active_user()->admin) { access::forbidden(); } diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php index 2c4bd557..4c83d647 100644 --- a/modules/gallery/controllers/login.php +++ b/modules/gallery/controllers/login.php @@ -21,7 +21,7 @@ class Login_Controller extends Controller { public function ajax() { $view = new View("login_ajax.html"); - $view->form = user::get_login_form("login/auth_ajax"); + $view->form = login::get_login_form("login/auth_ajax"); print $view; } @@ -40,7 +40,7 @@ class Login_Controller extends Controller { } public function html() { - print user::get_login_form("login/auth_html"); + print login::get_login_form("login/auth_html"); } public function auth_html() { @@ -53,12 +53,13 @@ class Login_Controller extends Controller { print $form; } } + private function _auth($url) { - $form = user::get_login_form($url); + $form = login::get_login_form($url); $valid = $form->validate(); if ($valid) { - $user = user::lookup_by_name($form->login->inputs["name"]->value); - if (empty($user) || !user::is_correct_password($user, $form->login->password->value)) { + $user = Identity::lookup_user_by_name($form->login->inputs["name"]->value); + if (empty($user) || !Identity::is_correct_password($user, $form->login->password->value)) { log::warning( "user", t("Failed login for %name", @@ -69,7 +70,12 @@ class Login_Controller extends Controller { } if ($valid) { - user::login($user); + if (Identity::is_writable()) { + $user->login_count += 1; + $user->last_login = time(); + $user->save(); + } + Session::set_active_user($user); log::info("user", t("User %name logged in", array("name" => $user->name))); } diff --git a/modules/gallery/controllers/logout.php b/modules/gallery/controllers/logout.php index 45d397ad..058860fa 100644 --- a/modules/gallery/controllers/logout.php +++ b/modules/gallery/controllers/logout.php @@ -19,10 +19,15 @@ */ class Logout_Controller extends Controller { public function index() { - //access::verify_csrf(); - - $user = user::active(); - user::logout(); + $user = Session::active_user(); + if (!$user->guest) { + try { + Session::instance()->destroy(); + } catch (Exception $e) { + Kohana::log("error", $e); + } + module::event("user_logout", $user); + } log::info("user", t("User %name logged out", array("name" => $user->name)), html::anchor("user/$user->id", html::clean($user->name))); if ($continue_url = $this->input->get("continue")) { diff --git a/modules/gallery/controllers/password.php b/modules/gallery/controllers/password.php deleted file mode 100644 index e8b08960..00000000 --- a/modules/gallery/controllers/password.php +++ /dev/null @@ -1,133 +0,0 @@ -<?php defined("SYSPATH") or die("No direct script access."); -/** - * Gallery - a web based photo album viewer and editor - * Copyright (C) 2000-2009 Bharat Mediratta - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or (at - * your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. - */ -class Password_Controller extends Controller { - public function reset() { - if (request::method() == "post") { - // @todo separate the post from get parts of this function - access::verify_csrf(); - $this->_send_reset(); - } else { - print $this->_reset_form(); - } - } - - public function do_reset() { - if (request::method() == "post") { - $this->_change_password(); - } else { - $user = user::lookup_by_hash(Input::instance()->get("key")); - if (!empty($user)) { - print $this->_new_password_form($user->hash); - } else { - throw new Exception("@todo FORBIDDEN", 503); - } - } - } - - private function _send_reset() { - $form = $this->_reset_form(); - - $valid = $form->validate(); - if ($valid) { - $user = user::lockup_by_name($form->reset->inputs["name"]->value); - if (!$user->loaded || empty($user->email)) { - $form->reset->inputs["name"]->add_error("no_email", 1); - $valid = false; - } - } - - if ($valid) { - $user->hash = md5(rand()); - $user->save(); - $message = new View("reset_password.html"); - $message->confirm_url = url::abs_site("password/do_reset?key=$user->hash"); - $message->user = $user; - - Sendmail::factory() - ->to($user->email) - ->subject(t("Password Reset Request")) - ->header("Mime-Version", "1.0") - ->header("Content-type", "text/html; charset=iso-8859-1") - ->message($message->render()) - ->send(); - - log::success( - "user", - t("Password reset email sent for user %name", array("name" => $user->name))); - } else { - // Don't include the username here until you're sure that it's XSS safe - log::warning( - "user", "Password reset email requested for bogus user"); - } - - message::success(t("Password reset email sent")); - print json_encode( - array("result" => "success")); - } - - private function _reset_form() { - $form = new Forge(url::current(true), "", "post", array("id" => "g-reset-form")); - $group = $form->group("reset")->label(t("Reset Password")); - $group->input("name")->label(t("Username"))->id("g-name")->class(null)->rules("required"); - $group->inputs["name"]->error_messages("no_email", t("No email, unable to reset password")); - $group->submit("")->value(t("Reset")); - - return $form; - } - - private function _new_password_form($hash=null) { - $template = new Theme_View("page.html", "reset"); - - $form = new Forge("password/do_reset", "", "post", array("id" => "g-change-password-form")); - $group = $form->group("reset")->label(t("Change Password")); - $hidden = $group->hidden("hash"); - if (!empty($hash)) { - $hidden->value($hash); - } - $group->password("password")->label(t("Password"))->id("g-password") - ->rules("required|length[1,40]"); - $group->password("password2")->label(t("Confirm Password"))->id("g-password2") - ->matches($group->password); - $group->inputs["password2"]->error_messages( - "mistyped", t("The password and the confirm password must match")); - $group->submit("")->value(t("Update")); - - $template->content = $form; - return $template; - } - - private function _change_password() { - $view = $this->_new_password_form(); - if ($view->content->validate()) { - $user = user::lookup_by_hash(Input::instance()->get("key")); - if (empty($user)) { - throw new Exception("@todo FORBIDDEN", 503); - } - - $user->password = $view->content->reset->password->value; - $user->hash = null; - $user->save(); - message::success(t("Password reset successfully")); - url::redirect(item::root()->abs_url()); - } else { - print $view; - } - } -}
\ No newline at end of file diff --git a/modules/gallery/controllers/permissions.php b/modules/gallery/controllers/permissions.php index 8d75862e..58c5b816 100644 --- a/modules/gallery/controllers/permissions.php +++ b/modules/gallery/controllers/permissions.php @@ -51,13 +51,13 @@ class Permissions_Controller extends Controller { function change($command, $group_id, $perm_id, $item_id) { access::verify_csrf(); - $group = ORM::factory("group", $group_id); + $group = Identity::lookup_group($group_id); $perm = ORM::factory("permission", $perm_id); $item = ORM::factory("item", $item_id); access::required("view", $item); access::required("edit", $item); - if ($group->loaded && $perm->loaded && $item->loaded) { + if (!empty($group) && $perm->loaded && $item->loaded) { switch($command) { case "allow": access::allow($group, $perm->name, $item); @@ -74,7 +74,7 @@ class Permissions_Controller extends Controller { // If the active user just took away their own edit permissions, give it back. if ($perm->name == "edit") { - if (!access::user_can(user::active(), "edit", $item)) { + if (!access::user_can(Session::active_user(), "edit", $item)) { access::allow($group, $perm->name, $item); } } @@ -84,7 +84,7 @@ class Permissions_Controller extends Controller { private function _get_form($item) { $view = new View("permissions_form.html"); $view->item = $item; - $view->groups = ORM::factory("group")->find_all(); + $view->groups = Identity::groups(); $view->permissions = ORM::factory("permission")->find_all(); return $view; } diff --git a/modules/gallery/controllers/upgrader.php b/modules/gallery/controllers/upgrader.php index 0f6cbc2c..e0c5d340 100644 --- a/modules/gallery/controllers/upgrader.php +++ b/modules/gallery/controllers/upgrader.php @@ -40,7 +40,7 @@ class Upgrader_Controller extends Controller { } $view = new View("upgrader.html"); - $view->can_upgrade = user::active()->admin || $session->get("can_upgrade"); + $view->can_upgrade = Session::active_user()->admin || $session->get("can_upgrade"); $view->upgrade_token = $upgrade_token; $view->available = module::available(); $view->done = ($available_upgrades == 0); @@ -52,7 +52,7 @@ class Upgrader_Controller extends Controller { // @todo this may screw up some module installers, but we don't have a better answer at // this time. $_SERVER["HTTP_HOST"] = "example.com"; - } else if (!user::active()->admin && !Session::instance()->get("can_upgrade", false)) { + } else if (!Session::active_user()->admin && !Session::instance()->get("can_upgrade", false)) { access::forbidden(); } diff --git a/modules/gallery/controllers/welcome_message.php b/modules/gallery/controllers/welcome_message.php index 8fd1e0a0..cfdc3976 100644 --- a/modules/gallery/controllers/welcome_message.php +++ b/modules/gallery/controllers/welcome_message.php @@ -19,12 +19,12 @@ */ class Welcome_Message_Controller extends Controller { public function index() { - if (!user::active()->admin) { + if (!Session::active_user()->admin) { url::redirect(item::root()->abs_url()); } $v = new View("welcome_message.html"); - $v->user = user::active(); + $v->user = Session::active_user(); print $v; } } diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php index 949aea84..4e7491e3 100644 --- a/modules/gallery/helpers/access.php +++ b/modules/gallery/helpers/access.php @@ -79,7 +79,7 @@ class access_Core { * @return boolean */ static function can($perm_name, $item) { - return self::user_can(user::active(), $perm_name, $item); + return self::user_can(Session::active_user(), $perm_name, $item); } /** @@ -197,8 +197,8 @@ class access_Core { * @param Item_Model $item * @param boolean $value */ - private static function _set(Group_Model $group, $perm_name, $album, $value) { - if (get_class($group) != "Group_Model") { + private static function _set(Group_Definition $group, $perm_name, $album, $value) { + if (!($group instanceof Group_Definition)) { throw new Exception("@todo PERMISSIONS_ONLY_WORK_ON_GROUPS"); } if (!$album->loaded) { @@ -419,10 +419,11 @@ class access_Core { * @return ORM_Iterator */ private static function _get_all_groups() { - // When we build the gallery package, it's possible that the user module is not installed yet. + // When we build the gallery package, it's possible that there is no identity provider installed yet. // This is ok at packaging time, so work around it. - if (module::is_active("user")) { - return ORM::factory("group")->find_all(); + $config = module::get_var("gallery", "identity_provider"); + if (!empty($config)) { + return Identity::groups(); } else { return array(); } diff --git a/modules/gallery/helpers/gallery.php b/modules/gallery/helpers/gallery.php index 50e2c43b..18bb2609 100644 --- a/modules/gallery/helpers/gallery.php +++ b/modules/gallery/helpers/gallery.php @@ -27,7 +27,7 @@ class gallery_Core { static function maintenance_mode() { $maintenance_mode = Kohana::config("core.maintenance_mode", false, false); - if (Router::$controller != "login" && !empty($maintenance_mode) && !user::active()->admin) { + if (Router::$controller != "login" && !empty($maintenance_mode) && !Session::active_user()->admin) { Router::$controller = "maintenance"; Router::$controller_path = MODPATH . "gallery/controllers/maintenance.php"; Router::$method = "index"; diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php index e0de2152..95be4813 100644 --- a/modules/gallery/helpers/gallery_event.php +++ b/modules/gallery/helpers/gallery_event.php @@ -23,7 +23,11 @@ class gallery_event_Core { * Initialization. */ static function gallery_ready() { - user::load_user(); + // Call Identity::instance() now to force the load of the user interface classes. + // Session::load_user will attempt to load the active user from the session and needs + // the user definition class, which can't be reached by Kohana's heiracrchical lookup. + Identity::instance(); + Session::load_user(); locales::set_request_locale(); } @@ -135,7 +139,7 @@ class gallery_event_Core { } } - if (user::active()->admin) { + if (Session::active_user()->admin) { $menu->append($admin_menu = Menu::factory("submenu") ->id("admin_menu") ->label(t("Admin"))); @@ -186,11 +190,19 @@ class gallery_event_Core { ->append(Menu::factory("link") ->id("sidebar") ->label(t("Manage Sidebar")) - ->url(url::site("admin/sidebar")))) - ->append(Menu::factory("link") - ->id("users_groups") - ->label(t("Users/Groups")) - ->url(url::site("admin/users"))) + ->url(url::site("admin/sidebar")))); + if (count(Identity::providers()) > 1) { + $menu + ->append(Menu::factory("submenu") + ->id("identity_menu") + ->label(t("Identity Management")) + ->append(Menu::factory("link") + ->id("identity_drivers") + ->label(t("Identity Drivers")) + ->url(url::site("admin/identity")))); + } + + $menu ->append(Menu::factory("submenu") ->id("statistics_menu") ->label(t("Statistics"))) diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php index b1ea1f19..10e796fd 100644 --- a/modules/gallery/helpers/gallery_installer.php +++ b/modules/gallery/helpers/gallery_installer.php @@ -317,7 +317,7 @@ class gallery_installer { } if ($version == 7) { - $groups = ORM::factory("group")->find_all(); + $groups = Identity::groups(); $permissions = ORM::factory("permission")->find_all(); foreach($groups as $group) { foreach($permissions as $permission) { diff --git a/modules/gallery/helpers/gallery_theme.php b/modules/gallery/helpers/gallery_theme.php index a342b4bd..d21cb124 100644 --- a/modules/gallery/helpers/gallery_theme.php +++ b/modules/gallery/helpers/gallery_theme.php @@ -54,7 +54,7 @@ class gallery_theme_Core { static function header_top($theme) { if ($theme->page_type != "login") { $view = new View("login.html"); - $view->user = user::active(); + $view->user = Session::active_user(); return $view->render(); } } diff --git a/modules/gallery/helpers/group.php b/modules/gallery/helpers/group.php deleted file mode 100644 index 1702fb87..00000000 --- a/modules/gallery/helpers/group.php +++ /dev/null @@ -1,120 +0,0 @@ -<?php defined("SYSPATH") or die("No direct script access."); -/** - * Gallery - a web based photo album viewer and editor - * Copyright (C) 2000-2009 Bharat Mediratta - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or (at - * your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. - */ - -/** - * This is the API for handling groups. - * - * Note: by design, this class does not do any permission checking. - */ -class group_Core { - /** - * Create a new group. - * - * @param string $name - * @return Group_Model - */ - static function create($name) { - $group = ORM::factory("group")->where("name", $name)->find(); - if ($group->loaded) { - throw new Exception("@todo GROUP_ALREADY_EXISTS $name"); - } - - $group->name = $name; - $group->save(); - - return $group; - } - - /** - * The group of all possible visitors. This includes the guest user. - * - * @return Group_Model - */ - static function everybody() { - return model_cache::get("group", 1); - } - - /** - * The group of all logged-in visitors. This does not include guest users. - * - * @return Group_Model - */ - static function registered_users() { - return model_cache::get("group", 2); - } - - /** - * Look up a user by id. - * @param integer $id the user id - * @return User_Model the user object, or null if the id was invalid. - */ - static function lookup($id) { - return self::_lookup_group_by_field("id", $id); - } - - /** - * Look up a group by name. - * @param integer $id the group name - * @return Group_Model the group object, or null if the name was invalid. - */ - static function lookup_by_name($name) { - return self::_lookup_group_by_field("name", $name); - } - - /** - * Look up a user by field value. - * @param string search field - * @param string search value - * @return Group_Model the user object, or null if the name was invalid. - */ - private static function _lookup_group_by_field($field_name, $value) { - try { - $user = model_cache::get("group", $value, $field_name); - if ($user->loaded) { - return $user; - } - } catch (Exception $e) { - if (strpos($e->getMessage(), "MISSING_MODEL") === false) { - throw $e; - } - } - return null; - } - - /** - * List the users - * @param mixed filters (@see Database.php - * @return array the group list. - */ - static function get_group_list($filter=array()) { - $group = ORM::factory("group"); - - foreach($filter as $method => $args) { - switch ($method) { - case "in": - $group->in($args[0], $args[1]); - break; - default: - $group->$method($args); - } - } - return $group->find_all(); - } -} diff --git a/modules/gallery/helpers/item.php b/modules/gallery/helpers/item.php index 084bbc15..3d36a324 100644 --- a/modules/gallery/helpers/item.php +++ b/modules/gallery/helpers/item.php @@ -158,8 +158,8 @@ class item_Core { */ static function viewable($model) { $view_restrictions = array(); - if (!user::active()->admin) { - foreach (user::group_ids() as $id) { + if (!Session::active_user()->admin) { + foreach (Session::group_ids_for_active_user() as $id) { // Separate the first restriction from the rest to make it easier for us to formulate // our where clause below if (empty($view_restrictions)) { diff --git a/modules/gallery/helpers/locales.php b/modules/gallery/helpers/locales.php index f0807c99..f80fce03 100644 --- a/modules/gallery/helpers/locales.php +++ b/modules/gallery/helpers/locales.php @@ -136,6 +136,23 @@ class locales_Core { return in_array($language, array("he", "fa", "ar")); } + static function set_request_locale() { + // 1. Check the session specific preference (cookie) + $locale = self::cookie_locale(); + // 2. Check the user's preference + if (!$locale) { + $locale = Session::active_user()->locale; + } + // 3. Check the browser's / OS' preference + if (!$locale) { + $locale = self::locale_from_http_request(); + } + // If we have any preference, override the site's default locale + if ($locale) { + I18n::instance()->locale($locale); + } + } + /** * Returns the best match comparing the HTTP accept-language header * with the installed locales. @@ -220,23 +237,6 @@ class locales_Core { return array(null, 0); } - static function set_request_locale() { - // 1. Check the session specific preference (cookie) - $locale = self::cookie_locale(); - // 2. Check the user's preference - if (!$locale) { - $locale = user::active()->locale; - } - // 3. Check the browser's / OS' preference - if (!$locale) { - $locale = locales::locale_from_http_request(); - } - // If we have any preference, override the site's default locale - if ($locale) { - I18n::instance()->locale($locale); - } - } - static function cookie_locale() { $cookie_data = Input::instance()->cookie("g_locale"); $locale = null; diff --git a/modules/gallery/helpers/log.php b/modules/gallery/helpers/log.php index c8e94b45..d1b34e3a 100644 --- a/modules/gallery/helpers/log.php +++ b/modules/gallery/helpers/log.php @@ -80,7 +80,7 @@ class log_Core { $log->url = substr(url::abs_current(true), 0, 255); $log->referer = request::referrer(null); $log->timestamp = time(); - $log->user_id = user::active()->id; + $log->user_id = Session::active_user()->id; $log->save(); } diff --git a/modules/gallery/helpers/login.php b/modules/gallery/helpers/login.php new file mode 100644 index 00000000..d44153ad --- /dev/null +++ b/modules/gallery/helpers/login.php @@ -0,0 +1,31 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ +class login_Core { + static function get_login_form($url) { + $form = new Forge($url, "", "post", array("id" => "g-login-form")); + $form->set_attr('class', "g-narrow"); + $group = $form->group("login")->label(t("Login")); + $group->input("name")->label(t("Username"))->id("g-username")->class(null); + $group->password("password")->label(t("Password"))->id("g-password")->class(null); + $group->inputs["name"]->error_messages("invalid_login", t("Invalid name or password")); + $group->submit("")->value(t("Login")); + return $form; + } +}
\ No newline at end of file diff --git a/modules/gallery/helpers/module.php b/modules/gallery/helpers/module.php index 77ec6f63..fb298959 100644 --- a/modules/gallery/helpers/module.php +++ b/modules/gallery/helpers/module.php @@ -103,7 +103,8 @@ class module_Core { // Lock certain modules $modules->gallery->locked = true; - $modules->user->locked = true; + $identity_module = self::get_var("gallery", "identity_provider", "user"); + $modules->$identity_module->locked = true; $modules->ksort(); self::$available = $modules; } diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php index 9ca28fe6..9541f20e 100644 --- a/modules/gallery/helpers/movie.php +++ b/modules/gallery/helpers/movie.php @@ -77,7 +77,7 @@ class movie_Core { $movie->title = $title; $movie->description = $description; $movie->name = $name; - $movie->owner_id = $owner_id ? $owner_id : user::active(); + $movie->owner_id = $owner_id ? $owner_id : Session::active_user()->id; $movie->width = $movie_info[0]; $movie->height = $movie_info[1]; $movie->mime_type = strtolower($pi["extension"]) == "mp4" ? "video/mp4" : "video/x-flv"; diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php index d1d8fb1f..193293e8 100644 --- a/modules/gallery/helpers/photo.php +++ b/modules/gallery/helpers/photo.php @@ -76,7 +76,7 @@ class photo_Core { $photo->title = $title; $photo->description = $description; $photo->name = $name; - $photo->owner_id = $owner_id ? $owner_id : user::active(); + $photo->owner_id = $owner_id ? $owner_id : Session::active_user()->id; $photo->width = $image_info[0]; $photo->height = $image_info[1]; $photo->mime_type = empty($image_info['mime']) ? "application/unknown" : $image_info['mime']; diff --git a/modules/gallery/helpers/site_status.php b/modules/gallery/helpers/site_status.php index b7c6de9a..06b29fda 100644 --- a/modules/gallery/helpers/site_status.php +++ b/modules/gallery/helpers/site_status.php @@ -95,7 +95,7 @@ class site_status_Core { * @return html text */ static function get() { - if (!user::active()->admin) { + if (!Session::active_user()->admin) { return; } $buf = array(); diff --git a/modules/gallery/helpers/task.php b/modules/gallery/helpers/task.php index 9fa04305..f84fd10e 100644 --- a/modules/gallery/helpers/task.php +++ b/modules/gallery/helpers/task.php @@ -42,7 +42,7 @@ class task_Core { $task->percent_complete = 0; $task->status = ""; $task->state = "started"; - $task->owner_id = user::active()->id; + $task->owner_id = Session::active_user()->id; $task->context = serialize($context); $task->save(); diff --git a/modules/gallery/helpers/user.php b/modules/gallery/helpers/user.php deleted file mode 100644 index e7e75d64..00000000 --- a/modules/gallery/helpers/user.php +++ /dev/null @@ -1,279 +0,0 @@ -<?php defined("SYSPATH") or die("No direct script access."); -/** - * Gallery - a web based photo album viewer and editor - * Copyright (C) 2000-2009 Bharat Mediratta - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or (at - * your option) any later version. - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. - */ - -/** - * This is the API for handling users. - * - * Note: by design, this class does not do any permission checking. - */ -class user_Core { - static function get_login_form($url) { - $form = new Forge($url, "", "post", array("id" => "g-login-form")); - $form->set_attr('class', "g-narrow"); - $group = $form->group("login")->label(t("Login")); - $group->input("name")->label(t("Username"))->id("g-username")->class(null); - $group->password("password")->label(t("Password"))->id("g-password")->class(null); - $group->inputs["name"]->error_messages("invalid_login", t("Invalid name or password")); - $group->submit("")->value(t("Login")); - return $form; - } - - /** - * Make sure that we have a session and group_ids cached in the session. - */ - static function load_user() { - $session = Session::instance(); - if (!($user = $session->get("user"))) { - $session->set("user", $user = user::guest()); - } - - // The installer cannot set a user into the session, so it just sets an id which we should - // upconvert into a user. - if ($user === 2) { - $user = model_cache::get("user", 2); - user::login($user); - $session->set("user", $user); - } - - if (!$session->get("group_ids")) { - $ids = array(); - foreach ($user->groups as $group) { - $ids[] = $group->id; - } - $session->set("group_ids", $ids); - } - } - - /** - * Return the array of group ids this user belongs to - * - * @return array - */ - static function group_ids() { - return Session::instance()->get("group_ids", array(1)); - } - - /** - * Return the active user. If there's no active user, return the guest user. - * - * @return User_Model - */ - static function active() { - // @todo (maybe) cache this object so we're not always doing session lookups. - $user = Session::instance()->get("user", null); - if (!isset($user)) { - // Don't do this as a fallback in the Session::get() call because it can trigger unnecessary - // work. - $user = user::guest(); - } - return $user; - } - - /** - * Return the guest user. - * - * @todo consider caching - * - * @return User_Model - */ - static function guest() { - return model_cache::get("user", 1); - } - - /** - * Change the active user. - * - * @return User_Model - */ - static function set_active($user) { - $session = Session::instance(); - $session->set("user", $user); - $session->delete("group_ids"); - self::load_user(); - } - - /** - * Create a new user. - * - * @param string $name - * @param string $full_name - * @param string $password - * @return User_Model - */ - static function create($name, $full_name, $password) { - $user = ORM::factory("user")->where("name", $name)->find(); - if ($user->loaded) { - throw new Exception("@todo USER_ALREADY_EXISTS $name"); - } - - $user->name = $name; - $user->full_name = $full_name; - $user->password = $password; - - // Required groups - $user->add(group::everybody()); - $user->add(group::registered_users()); - - $user->save(); - return $user; - } - - /** - * Is the password provided correct? - * - * @param user User Model - * @param string $password a plaintext password - * @return boolean true if the password is correct - */ - static function is_correct_password($user, $password) { - $valid = $user->password; - - // Try phpass first, since that's what we generate. - if (strlen($valid) == 34) { - require_once(MODPATH . "user/lib/PasswordHash.php"); - $hashGenerator = new PasswordHash(10, true); - return $hashGenerator->CheckPassword($password, $valid); - } - - $salt = substr($valid, 0, 4); - // Support both old (G1 thru 1.4.0; G2 thru alpha-4) and new password schemes: - $guess = (strlen($valid) == 32) ? md5($password) : ($salt . md5($salt . $password)); - if (!strcmp($guess, $valid)) { - return true; - } - - // Passwords with <&"> created by G2 prior to 2.1 were hashed with entities - $sanitizedPassword = html::specialchars($password, false); - $guess = (strlen($valid) == 32) ? md5($sanitizedPassword) - : ($salt . md5($salt . $sanitizedPassword)); - if (!strcmp($guess, $valid)) { - return true; - } - - return false; - } - - /** - * Create the hashed passwords. - * @param string $password a plaintext password - * @return string hashed password - */ - static function hash_password($password) { - require_once(MODPATH . "user/lib/PasswordHash.php"); - $hashGenerator = new PasswordHash(10, true); - return $hashGenerator->HashPassword($password); - } - - /** - * Log in as a given user. - * @param object $user the user object. - */ - static function login($user) { - $user->login_count += 1; - $user->last_login = time(); - $user->save(); - - user::set_active($user); - module::event("user_login", $user); - } - - /** - * Log out the active user and destroy the session. - * @param object $user the user object. - */ - static function logout() { - $user = user::active(); - if (!$user->guest) { - try { - Session::instance()->destroy(); - } catch (Exception $e) { - Kohana::log("error", $e); - } - module::event("user_logout", $user); - } - } - - /** - * Look up a user by id. - * @param integer $id the user id - * @return User_Model the user object, or null if the id was invalid. - */ - static function lookup($id) { - return self::_lookup_user_by_field("id", $id); - } - - /** - * Look up a user by name. - * @param integer $name the user name - * @return User_Model the user object, or null if the name was invalid. - */ - static function lookup_by_name($name) { - return self::_lookup_user_by_field("name", $name); - } - - /** - * Look up a user by hash. - * @param integer $hash the user hash value - * @return User_Model the user object, or null if the name was invalid. - */ - static function lookup_by_hash($hash) { - return self::_lookup_user_by_field("hash", $hash); - } - - /** - * List the users - * @param mixed filters (@see Database.php - * @return array the user list. - */ - static function get_user_list($filter=array()) { - $user = ORM::factory("user"); - - foreach($filter as $method => $args) { - switch ($method) { - case "in": - $user->in($args[0], $args[1]); - break; - default: - $user->$method($args); - } - } - return $user->find_all(); - } - - /** - * Look up a user by field value. - * @param string search field - * @param string search value - * @return User_Core the user object, or null if the name was invalid. - */ - private static function _lookup_user_by_field($field_name, $value) { - try { - $user = model_cache::get("user", $value, $field_name); - if ($user->loaded) { - return $user; - } - } catch (Exception $e) { - if (strpos($e->getMessage(), "MISSING_MODEL") === false) { - throw $e; - } - } - return null; - } -}
\ No newline at end of file diff --git a/modules/gallery/libraries/Admin_View.php b/modules/gallery/libraries/Admin_View.php index fa6d1dd3..74a08c77 100644 --- a/modules/gallery/libraries/Admin_View.php +++ b/modules/gallery/libraries/Admin_View.php @@ -36,12 +36,12 @@ class Admin_View_Core extends Gallery_View { parent::__construct($name); $this->theme_name = module::get_var("gallery", "active_admin_theme"); - if (user::active()->admin) { + if (Session::active_user()->admin) { $this->theme_name = Input::instance()->get("theme", $this->theme_name); } $this->sidebar = ""; $this->set_global("theme", $this); - $this->set_global("user", user::active()); + $this->set_global("user", Session::active_user()); } public function admin_menu() { diff --git a/modules/gallery/libraries/Identity.php b/modules/gallery/libraries/Identity.php new file mode 100644 index 00000000..1dd5d23b --- /dev/null +++ b/modules/gallery/libraries/Identity.php @@ -0,0 +1,222 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ + +/** + * Provides a driver-based interface for managing users and groups. + */ +class Identity_Core { + protected static $instance; + + protected static $active; + + // Configuration + protected $config; + + // Driver object + protected $driver; + + /** + * Returns a singleton instance of Identity. + * There can only be one Identity driver configured at a given point + * + * @param string configuration + * @return Identity_Core + */ + static function & instance() { + if (!isset(self::$instance)) { + // Create a new instance + self::$instance = new Identity(); + } + + return self::$instance; + } + + /** + * Returns a singleton instance of Identity. + * There can only be one Identity driver configured at a given point + * + * @param string configuration + * @return Identity_Core + */ + static function reset() { + self::$instance = new Identity(); + } + + /** + * Loads the configured driver and validates it. + * + * @return void + */ + public function __construct() { + $config = module::get_var("gallery", "identity_provider", "user"); + + // Test the config group name + if (($this->config = Kohana::config("identity.".$config)) === NULL) { + throw new Exception("@todo NO USER LIBRARY CONFIGURATION FOR: $config"); + } + + // Set driver name + $driver = "Identity_".ucfirst($this->config["driver"])."_Driver"; + + // Load the driver + if ( ! Kohana::auto_load($driver)) { + throw new Kohana_Exception("core.driver_not_found", $this->config["driver"], + get_class($this)); + } + + // Initialize the driver + $this->driver = new $driver($this->config["params"]); + + // Validate the driver + if ( !($this->driver instanceof Identity_Driver)) { + throw new Kohana_Exception("core.driver_implements", $this->config["driver"], + get_class($this), "Identity_Driver"); + } + + Kohana::log("debug", "Identity Library initialized"); + } + + /** + * Return a list of installed Identity Drivers. + * + * @return boolean true if the driver supports updates; false if read only + */ + static function providers() { + if (empty(self::$active)) { + $drivers = new ArrayObject(array(), ArrayObject::ARRAY_AS_PROPS); + foreach (module::active() as $module) { + $module_name = $module->name; + if (file_exists(MODPATH . "{$module->name}/config/identity.php") && + ($info = module::info($module_name))) { + $drivers->$module_name = $info->description; + } + } + self::$active = $drivers; + } + return self::$active; + } + + /** + * @see Identity_Driver::activate. + */ + static function activate() { + self::instance()->driver->activate(); + } + + /** + * @see Identity_Driver::deactivate. + */ + static function deactivate() { + self::instance()->driver->deactivate(); + } + + /** + * Determine if if the current driver supports updates. + * + * @return boolean true if the driver supports updates; false if read only + */ + static function is_writable() { + return !empty(self::instance()->config["allow_updates"]); + } + + /** + * @see Identity_Driver::guest. + */ + static function guest() { + return self::instance()->driver->guest(); + } + + /** + * @see Identity_Driver::create_user. + */ + static function create_user($name, $full_name, $password) { + return self::instance()->driver->create_user($name, $full_name, $password); + } + + /** + * @see Identity_Driver::is_correct_password. + */ + static function is_correct_password($user, $password) { + return self::instance()->driver->is_correct_password($user, $password); + } + + /** + * @see Identity_Driver::lookup_user. + */ + static function lookup_user($id) { + return self::instance()->driver->lookup_user($id); + } + + /** + * @see Identity_Driver::lookup_user_by_name. + */ + static function lookup_user_by_name($name) { + return self::instance()->driver->lookup_user_by_name($name); + } + + /** + * @see Identity_Driver::create_group. + */ + static function create_group($name) { + return self::instance()->driver->create_group($name); + } + + /** + * @see Identity_Driver::everybody. + */ + static function everybody() { + return self::instance()->driver->everybody(); + } + + /** + * @see Identity_Driver::registered_users. + */ + static function registered_users() { + return self::instance()->driver->everybody(); + } + + /** + * @see Identity_Driver::lookup_group. + */ + static function lookup_group($id) { + return self::instance()->driver->lookup_group($id); + } + + /** + * @see Identity_Driver::lookup_group_by_name. + */ + static function lookup_group_by_name($name) { + return self::instance()->driver->lookup_group_by_name($name); + } + + /** + * @see Identity_Driver::get_user_list. + */ + static function get_user_list($ids) { + return self::instance()->driver->get_user_list($ids); + } + + /** + * @see Identity_Driver::groups. + */ + static function groups() { + return self::instance()->driver->groups(); + } +} // End Identity diff --git a/modules/gallery/libraries/MY_Session.php b/modules/gallery/libraries/MY_Session.php new file mode 100644 index 00000000..1a3ae801 --- /dev/null +++ b/modules/gallery/libraries/MY_Session.php @@ -0,0 +1,93 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ + +class Session extends Session_Core { + /** + * Make sure that we have a session and group_ids cached in the session. + */ + static function load_user() { + try { + $session = Session::instance(); + if (!($user = $session->get("user"))) { + $session->set("user", $user = Identity::guest()); + } + + // The installer cannot set a user into the session, so it just sets an id which we should + // upconvert into a user. + // @todo set the user name into the session instead of 2 and then use it to get the user object + if ($user === 2) { + $user = Instance::lookup_user_by_name("admin"); + self::set_active_user($user); + $session->set("user", $user); + } + + if (!$session->get("group_ids")) { + $ids = array(); + foreach ($user->groups as $group) { + $ids[] = $group->id; + } + $session->set("group_ids", $ids); + } + } catch (Exception $e) { + try { + Session::instance()->destroy(); + } catch (Exception $e) { + // We don't care if there was a problem destroying the session. + } + url::redirect(item::root()->abs_url()); + } + } + + /** + * Return the array of group ids this user belongs to + * + * @return array + */ + static function group_ids_for_active_user() { + return self::instance()->get("group_ids", array(1)); + } + + /** + * Return the active user. If there's no active user, return the guest user. + * + * @return User_Definition + */ + static function active_user() { + // @todo (maybe) cache this object so we're not always doing session lookups. + $user = self::instance()->get("user", null); + if (!isset($user)) { + // Don't do this as a fallback in the Session::get() call because it can trigger unnecessary + // work. + $user = Identity::guest(); + } + return $user; + } + + /** + * Change the active user. + * @param User_Definition $user + */ + static function set_active_user($user) { + $session = Session::instance(); + $session->set("user", $user); + $session->delete("group_ids"); + self::load_user(); + } +}
\ No newline at end of file diff --git a/modules/gallery/libraries/Theme_View.php b/modules/gallery/libraries/Theme_View.php index cba436e8..2fdc7531 100644 --- a/modules/gallery/libraries/Theme_View.php +++ b/modules/gallery/libraries/Theme_View.php @@ -37,13 +37,13 @@ class Theme_View_Core extends Gallery_View { parent::__construct($name); $this->theme_name = module::get_var("gallery", "active_site_theme"); - if (user::active()->admin) { + if (Session::active_user()->admin) { $this->theme_name = Input::instance()->get("theme", $this->theme_name); } $this->item = null; $this->tag = null; $this->set_global("theme", $this); - $this->set_global("user", user::active()); + $this->set_global("user", Session::active_user()); $this->set_global("page_type", $page_type); $this->set_global("page_title", null); if ($page_type == "album") { @@ -158,7 +158,7 @@ class Theme_View_Core extends Gallery_View { */ public function sidebar_blocks() { $sidebar = block_manager::get_html("site.sidebar", $this); - if (empty($sidebar) && user::active()->admin) { + if (empty($sidebar) && Session::active_user()->admin) { $sidebar = new View("no_sidebar.html"); } return $sidebar; diff --git a/modules/gallery/libraries/drivers/Identity.php b/modules/gallery/libraries/drivers/Identity.php new file mode 100644 index 00000000..39b2a9c7 --- /dev/null +++ b/modules/gallery/libraries/drivers/Identity.php @@ -0,0 +1,123 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ +interface Identity_Driver { + /** + * Initialize the provider so it is ready to use + */ + public function activate(); + + /** + * Cleanup up this provider so it is unavailable for use and won't conflict with the current driver + */ + public function deactivate(); + + /** + * Return the guest user. + * + * @return User_Definition the user object + */ + public function guest(); + + /** + * Create a new user. + * + * @param string $name + * @param string $full_name + * @param string $password + * @return User_Definition the user object + */ + public function create_user($name, $full_name, $password); + + /** + * Is the password provided correct? + * + * @param user User_Definition the user object + * @param string $password a plaintext password + * @return boolean true if the password is correct + */ + public function is_correct_password($user, $password); + + /** + * Look up a user by id. + * @param integer id + * @return User_Definition the user object, or null if the name was invalid. + */ + public function lookup_user($id); + + /** + * Look up a user by name. + * @param string name + * @return User_Definition the user object, or null if the name was invalid. + */ + public function lookup_user_by_name($name); + + /** + * Create a new group. + * + * @param string $name + * @return Group_Definition the group object + */ + public function create_group($name); + + /** + * The group of all possible visitors. This includes the guest user. + * + * @return Group_Definition the group object + */ + public function everybody(); + + /** + * The group of all logged-in visitors. This does not include guest users. + * + * @return Group_Definition the group object + */ + public function registered_users(); + + /** + * List the users + * @param array array of ids to return the user objects for + * @return array the user list. + */ + public function get_user_list($ids); + + /** + * Look up a group by id. + * @param integer id + * @return Group_Definition the user object, or null if the name was invalid. + */ + public function lookup_group($id); + + /** + * Look up the group by name. + * @param string $name the name of the group to locate + * @return Group_Definition + */ + public function lookup_group_by_name($name); + + /** + * List the groups defined in the Identity Provider + */ + public function groups(); + +} // End Identity Driver Definition + +interface Group_Definition {} + +interface User_Definition {} diff --git a/modules/gallery/models/item.php b/modules/gallery/models/item.php index 6f0e3525..ba44709f 100644 --- a/modules/gallery/models/item.php +++ b/modules/gallery/models/item.php @@ -333,7 +333,7 @@ class Item_Model extends ORM_MPTT { // This relationship depends on an outside module, which may not be present so handle // failures gracefully. try { - return user::lookup($this->owner_id); + return Identity::lookup_user($this->owner_id); } catch (Exception $e) { return null; } diff --git a/modules/gallery/models/log.php b/modules/gallery/models/log.php index d143d7bd..1d639857 100644 --- a/modules/gallery/models/log.php +++ b/modules/gallery/models/log.php @@ -26,7 +26,7 @@ class Log_Model extends ORM { // This relationship depends on an outside module, which may not be present so handle // failures gracefully. try { - return user::lookup($this->user_id); + return Identity::lookup_user($this->user_id); } catch (Exception $e) { return null; } diff --git a/modules/gallery/models/task.php b/modules/gallery/models/task.php index b7e255a2..548e5f9c 100644 --- a/modules/gallery/models/task.php +++ b/modules/gallery/models/task.php @@ -46,7 +46,7 @@ class Task_Model extends ORM { } public function owner() { - return user::lookup($this->owner_id); + return Identity::lookup_user($this->owner_id); } /** diff --git a/modules/gallery/tests/Access_Helper_Test.php b/modules/gallery/tests/Access_Helper_Test.php index 72d7e04c..dac431a7 100644 --- a/modules/gallery/tests/Access_Helper_Test.php +++ b/modules/gallery/tests/Access_Helper_Test.php @@ -22,8 +22,8 @@ class Access_Helper_Test extends Unit_Test_Case { public function teardown() { try { - $group = ORM::factory("group")->where("name", "access_test")->find(); - if ($group->loaded) { + $group = Identity::lookup_group_by_name("access_test"); + if (!empty($group)) { $group->delete(); } } catch (Exception $e) { } @@ -33,24 +33,24 @@ class Access_Helper_Test extends Unit_Test_Case { } catch (Exception $e) { } try { - $user = user::lookup_by_name("access_test"); - if ($user->loaded) { + $user = Identity::lookup_user_by_name("access_test"); + if (!empty($user)) { $user->delete(); } } catch (Exception $e) { } // Reset some permissions that we mangle below $root = ORM::factory("item", 1); - access::allow(group::everybody(), "view", $root); + access::allow(Identity::everybody(), "view", $root); } public function setup() { - user::set_active(user::guest()); + Session::set_active_user(Identity::guest()); } public function groups_and_permissions_are_bound_to_columns_test() { access::register_permission("access_test", "Access Test"); - $group = group::create("access_test"); + $group = Identity::create_group("access_test"); // We have a new column for this perm / group combo $fields = Database::instance()->list_fields("access_caches"); @@ -65,17 +65,17 @@ class Access_Helper_Test extends Unit_Test_Case { } public function user_can_access_test() { - $access_test = group::create("access_test"); + $access_test = Identity::create_group("access_test"); $root = ORM::factory("item", 1); access::allow($access_test, "view", $root); $item = album::create($root, rand(), "test album"); - access::deny(group::everybody(), "view", $item); - access::deny(group::registered_users(), "view", $item); + access::deny(Identity::everybody(), "view", $item); + access::deny(Identity::registered_users(), "view", $item); - $user = user::create("access_test", "Access Test", ""); + $user = Identity::create_user("access_test", "Access Test", ""); foreach ($user->groups as $group) { $user->remove($group); } @@ -89,10 +89,10 @@ class Access_Helper_Test extends Unit_Test_Case { $root = ORM::factory("item", 1); $item = album::create($root, rand(), "test album"); - access::deny(group::everybody(), "view", $item); - access::deny(group::registered_users(), "view", $item); + access::deny(Identity::everybody(), "view", $item); + access::deny(Identity::registered_users(), "view", $item); - $user = user::create("access_test", "Access Test", ""); + $user = Identity::create_user("access_test", "Access Test", ""); foreach ($user->groups as $group) { $user->remove($group); } @@ -121,14 +121,11 @@ class Access_Helper_Test extends Unit_Test_Case { $root = ORM::factory("item", 1); $album = album::create($root, rand(), "test album"); - access::allow(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $album); - $photo = ORM::factory("item"); - $photo->type = "photo"; - $photo->add_to_parent($album); - access::add_item($photo); + $photo = photo::create($album, MODPATH . "gallery/images/gallery.png", "", ""); - $this->assert_true($photo->__get("view_" . group::everybody()->id)); + $this->assert_true($photo->__get("view_" . Identity::everybody()->id)); } public function can_allow_deny_and_reset_intent_test() { @@ -137,23 +134,23 @@ class Access_Helper_Test extends Unit_Test_Case { $intent = ORM::factory("access_intent")->where("item_id", $album)->find(); // Allow - access::allow(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $album); $this->assert_same(access::ALLOW, $intent->reload()->view_1); // Deny - access::deny(group::everybody(), "view", $album); + access::deny(Identity::everybody(), "view", $album); $this->assert_same( access::DENY, ORM::factory("access_intent")->where("item_id", $album)->find()->view_1); // Allow again. If the initial value was allow, then the first Allow clause above may not // have actually changed any values. - access::allow(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $album); $this->assert_same( access::ALLOW, ORM::factory("access_intent")->where("item_id", $album)->find()->view_1); - access::reset(group::everybody(), "view", $album); + access::reset(Identity::everybody(), "view", $album); $this->assert_same( null, ORM::factory("access_intent")->where("item_id", $album)->find()->view_1); @@ -161,7 +158,7 @@ class Access_Helper_Test extends Unit_Test_Case { public function cant_reset_root_item_test() { try { - access::reset(group::everybody(), "view", ORM::factory("item", 1)); + access::reset(Identity::everybody(), "view", ORM::factory("item", 1)); } catch (Exception $e) { return; } @@ -170,17 +167,17 @@ class Access_Helper_Test extends Unit_Test_Case { public function can_view_item_test() { $root = ORM::factory("item", 1); - access::allow(group::everybody(), "view", $root); - $this->assert_true(access::group_can(group::everybody(), "view", $root)); + access::allow(Identity::everybody(), "view", $root); + $this->assert_true(access::group_can(Identity::everybody(), "view", $root)); } public function can_always_fails_on_unloaded_items_test() { $root = ORM::factory("item", 1); - access::allow(group::everybody(), "view", $root); - $this->assert_true(access::group_can(group::everybody(), "view", $root)); + access::allow(Identity::everybody(), "view", $root); + $this->assert_true(access::group_can(Identity::everybody(), "view", $root)); $bogus = ORM::factory("item", -1); - $this->assert_false(access::group_can(group::everybody(), "view", $bogus)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $bogus)); } public function cant_view_child_of_hidden_parent_test() { @@ -188,21 +185,21 @@ class Access_Helper_Test extends Unit_Test_Case { $album = album::create($root, rand(), "test album"); $root->reload(); - access::deny(group::everybody(), "view", $root); - access::reset(group::everybody(), "view", $album); + access::deny(Identity::everybody(), "view", $root); + access::reset(Identity::everybody(), "view", $album); $album->reload(); - $this->assert_false(access::group_can(group::everybody(), "view", $album)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $album)); } public function view_permissions_propagate_down_test() { $root = ORM::factory("item", 1); $album = album::create($root, rand(), "test album"); - access::allow(group::everybody(), "view", $root); - access::reset(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $root); + access::reset(Identity::everybody(), "view", $album); $album->reload(); - $this->assert_true(access::group_can(group::everybody(), "view", $album)); + $this->assert_true(access::group_can(Identity::everybody(), "view", $album)); } public function can_toggle_view_permissions_propagate_down_test() { @@ -217,18 +214,18 @@ class Access_Helper_Test extends Unit_Test_Case { $album3->reload(); $album4->reload(); - access::allow(group::everybody(), "view", $root); - access::deny(group::everybody(), "view", $album1); - access::reset(group::everybody(), "view", $album2); - access::reset(group::everybody(), "view", $album3); - access::reset(group::everybody(), "view", $album4); + access::allow(Identity::everybody(), "view", $root); + access::deny(Identity::everybody(), "view", $album1); + access::reset(Identity::everybody(), "view", $album2); + access::reset(Identity::everybody(), "view", $album3); + access::reset(Identity::everybody(), "view", $album4); $album4->reload(); - $this->assert_false(access::group_can(group::everybody(), "view", $album4)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $album4)); - access::allow(group::everybody(), "view", $album1); + access::allow(Identity::everybody(), "view", $album1); $album4->reload(); - $this->assert_true(access::group_can(group::everybody(), "view", $album4)); + $this->assert_true(access::group_can(Identity::everybody(), "view", $album4)); } public function revoked_view_permissions_cant_be_allowed_lower_down_test() { @@ -237,29 +234,29 @@ class Access_Helper_Test extends Unit_Test_Case { $album2 = album::create($album1, rand(), "test album"); $root->reload(); - access::deny(group::everybody(), "view", $root); - access::allow(group::everybody(), "view", $album2); + access::deny(Identity::everybody(), "view", $root); + access::allow(Identity::everybody(), "view", $album2); $album1->reload(); - $this->assert_false(access::group_can(group::everybody(), "view", $album1)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $album1)); $album2->reload(); - $this->assert_false(access::group_can(group::everybody(), "view", $album2)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $album2)); } public function can_edit_item_test() { $root = ORM::factory("item", 1); - access::allow(group::everybody(), "edit", $root); - $this->assert_true(access::group_can(group::everybody(), "edit", $root)); + access::allow(Identity::everybody(), "edit", $root); + $this->assert_true(access::group_can(Identity::everybody(), "edit", $root)); } public function non_view_permissions_propagate_down_test() { $root = ORM::factory("item", 1); $album = album::create($root, rand(), "test album"); - access::allow(group::everybody(), "edit", $root); - access::reset(group::everybody(), "edit", $album); - $this->assert_true(access::group_can(group::everybody(), "edit", $album)); + access::allow(Identity::everybody(), "edit", $root); + access::reset(Identity::everybody(), "edit", $album); + $this->assert_true(access::group_can(Identity::everybody(), "edit", $album)); } public function non_view_permissions_can_be_revoked_lower_down_test() { @@ -279,36 +276,36 @@ class Access_Helper_Test extends Unit_Test_Case { $outer->reload(); $inner->reload(); - access::allow(group::everybody(), "edit", $root); - access::deny(group::everybody(), "edit", $outer); - access::allow(group::everybody(), "edit", $inner); + access::allow(Identity::everybody(), "edit", $root); + access::deny(Identity::everybody(), "edit", $outer); + access::allow(Identity::everybody(), "edit", $inner); // Outer album is not editable, inner one is. - $this->assert_false(access::group_can(group::everybody(), "edit", $outer_photo)); - $this->assert_true(access::group_can(group::everybody(), "edit", $inner_photo)); + $this->assert_false(access::group_can(Identity::everybody(), "edit", $outer_photo)); + $this->assert_true(access::group_can(Identity::everybody(), "edit", $inner_photo)); } public function i_can_edit_test() { // Create a new user that belongs to no groups - $user = user::create("access_test", "Access Test", ""); + $user = Identity::create_user("access_test", "Access Test", ""); foreach ($user->groups as $group) { $user->remove($group); } $user->save(); - user::set_active($user); + Session::set_active_user($user); // This user can't edit anything $root = ORM::factory("item", 1); $this->assert_false(access::can("edit", $root)); // Now add them to a group that has edit permission - $group = group::create("access_test"); + $group = Identity::create_group("access_test"); $group->add($user); $group->save(); access::allow($group, "edit", $root); - $user = user::lookup($user->id); // reload() does not flush related columns - user::set_active($user); + $user = Identity::lookup_user($user->id); // reload() does not flush related columns + Session::set_active_user($user); // And verify that the user can edit. $this->assert_true(access::can("edit", $root)); @@ -320,16 +317,16 @@ class Access_Helper_Test extends Unit_Test_Case { $this->assert_false(file_exists($album->file_path() . "/.htaccess")); - access::deny(group::everybody(), "view", $album); + access::deny(Identity::everybody(), "view", $album); $this->assert_true(file_exists($album->file_path() . "/.htaccess")); - access::allow(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $album); $this->assert_false(file_exists($album->file_path() . "/.htaccess")); - access::deny(group::everybody(), "view", $album); + access::deny(Identity::everybody(), "view", $album); $this->assert_true(file_exists($album->file_path() . "/.htaccess")); - access::reset(group::everybody(), "view", $album); + access::reset(Identity::everybody(), "view", $album); $this->assert_false(file_exists($album->file_path() . "/.htaccess")); } @@ -341,44 +338,44 @@ class Access_Helper_Test extends Unit_Test_Case { $this->assert_false(file_exists($album->resize_path() . "/.htaccess")); $this->assert_false(file_exists($album->thumb_path() . "/.htaccess")); - access::deny(group::everybody(), "view_full", $album); + access::deny(Identity::everybody(), "view_full", $album); $this->assert_true(file_exists($album->file_path() . "/.htaccess")); $this->assert_false(file_exists($album->resize_path() . "/.htaccess")); $this->assert_false(file_exists($album->thumb_path() . "/.htaccess")); - access::allow(group::everybody(), "view_full", $album); + access::allow(Identity::everybody(), "view_full", $album); $this->assert_false(file_exists($album->file_path() . "/.htaccess")); $this->assert_false(file_exists($album->resize_path() . "/.htaccess")); $this->assert_false(file_exists($album->thumb_path() . "/.htaccess")); - access::deny(group::everybody(), "view_full", $album); + access::deny(Identity::everybody(), "view_full", $album); $this->assert_true(file_exists($album->file_path() . "/.htaccess")); $this->assert_false(file_exists($album->resize_path() . "/.htaccess")); $this->assert_false(file_exists($album->thumb_path() . "/.htaccess")); - access::reset(group::everybody(), "view_full", $album); + access::reset(Identity::everybody(), "view_full", $album); $this->assert_false(file_exists($album->file_path() . "/.htaccess")); $this->assert_false(file_exists($album->resize_path() . "/.htaccess")); $this->assert_false(file_exists($album->thumb_path() . "/.htaccess")); } public function moved_items_inherit_new_permissions_test() { - user::set_active(user::lookup_by_name("admin")); + Session::set_active_user(Identity::lookup_user_by_name("admin")); $root = ORM::factory("item", 1); $public_album = album::create($root, rand(), "public album"); $public_photo = photo::create($public_album, MODPATH . "gallery/images/gallery.png", "", ""); - access::allow(group::everybody(), "view", $public_album); + access::allow(Identity::everybody(), "view", $public_album); $root->reload(); // Account for MPTT changes $private_album = album::create($root, rand(), "private album"); - access::deny(group::everybody(), "view", $private_album); + access::deny(Identity::everybody(), "view", $private_album); $private_photo = photo::create($private_album, MODPATH . "gallery/images/gallery.png", "", ""); // Make sure that we now have a public photo and private photo. - $this->assert_true(access::group_can(group::everybody(), "view", $public_photo)); - $this->assert_false(access::group_can(group::everybody(), "view", $private_photo)); + $this->assert_true(access::group_can(Identity::everybody(), "view", $public_photo)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $private_photo)); // Swap the photos item::move($public_photo, $private_album); @@ -394,7 +391,7 @@ class Access_Helper_Test extends Unit_Test_Case { $public_photo->reload(); // Make sure that the public_photo is now private, and the private_photo is now public. - $this->assert_false(access::group_can(group::everybody(), "view", $public_photo)); - $this->assert_true(access::group_can(group::everybody(), "view", $private_photo)); + $this->assert_false(access::group_can(Identity::everybody(), "view", $public_photo)); + $this->assert_true(access::group_can(Identity::everybody(), "view", $private_photo)); } } diff --git a/modules/gallery/tests/Albums_Controller_Test.php b/modules/gallery/tests/Albums_Controller_Test.php index d65946c7..fa46d924 100644 --- a/modules/gallery/tests/Albums_Controller_Test.php +++ b/modules/gallery/tests/Albums_Controller_Test.php @@ -43,8 +43,9 @@ class Albums_Controller_Test extends Unit_Test_Case { $_POST["column"] = "weight"; $_POST["direction"] = "ASC"; $_POST["csrf"] = access::csrf_token(); + $_POST["slug"] = "new_name"; $_POST["_method"] = "put"; - access::allow(group::everybody(), "edit", $root); + access::allow(Identity::everybody(), "edit", $root); ob_start(); $controller->_update($this->_album); @@ -68,7 +69,7 @@ class Albums_Controller_Test extends Unit_Test_Case { $_POST["name"] = "new name"; $_POST["title"] = "new title"; $_POST["description"] = "new description"; - access::allow(group::everybody(), "edit", $root); + access::allow(Identity::everybody(), "edit", $root); try { $controller->_update($this->_album); diff --git a/modules/gallery/tests/File_Structure_Test.php b/modules/gallery/tests/File_Structure_Test.php index 9018f4c6..327b6be8 100644 --- a/modules/gallery/tests/File_Structure_Test.php +++ b/modules/gallery/tests/File_Structure_Test.php @@ -17,6 +17,8 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. */ +require_once(dirname(__FILE__) . "/Gallery_Filters.php"); + class File_Structure_Test extends Unit_Test_Case { public function no_trailing_closing_php_tag_test() { $dir = new GalleryCodeFilterIterator( @@ -233,7 +235,9 @@ class File_Structure_Test extends Unit_Test_Case { foreach ($info_files as $file) { foreach (file($file) as $line) { $parts = explode("=", $line, 2); - $values[trim($parts[0])] = trim($parts[1]); + if (isset($parts[1])) { + $values[trim($parts[0])] = trim($parts[1]); + } } $module = dirname($file); @@ -261,33 +265,3 @@ class File_Structure_Test extends Unit_Test_Case { } } } - -class PhpCodeFilterIterator extends FilterIterator { - public function accept() { - $path_name = $this->getInnerIterator()->getPathName(); - return substr($path_name, -4) == ".php"; - } -} - -class GalleryCodeFilterIterator extends FilterIterator { - public function accept() { - // Skip anything that we didn"t write - $path_name = $this->getInnerIterator()->getPathName(); - return !( - strpos($path_name, ".svn") || - strpos($path_name, DOCROOT . "test") !== false || - strpos($path_name, DOCROOT . "var") !== false || - strpos($path_name, MODPATH . "forge") !== false || - strpos($path_name, MODPATH . "gallery/views/kohana_error_page.php") !== false || - strpos($path_name, MODPATH . "gallery/views/kohana_profiler.php") !== false || - strpos($path_name, MODPATH . "gallery_unit_test/views/kohana_error_page.php") !== false || - strpos($path_name, MODPATH . "gallery_unit_test/views/kohana_unit_test_cli.php") !== false || - strpos($path_name, MODPATH . "unit_test") !== false || - strpos($path_name, MODPATH . "exif/lib") !== false || - strpos($path_name, MODPATH . "user/lib/PasswordHash") !== false || - strpos($path_name, DOCROOT . "lib/swfupload") !== false || - strpos($path_name, SYSPATH) !== false || - strpos($path_name, MODPATH . "gallery/libraries/HTMLPurifier") !== false || - substr($path_name, -1, 1) == "~"); - } -} diff --git a/modules/gallery/tests/Gallery_Filters.php b/modules/gallery/tests/Gallery_Filters.php new file mode 100644 index 00000000..d1bc2cfa --- /dev/null +++ b/modules/gallery/tests/Gallery_Filters.php @@ -0,0 +1,48 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ +class PhpCodeFilterIterator extends FilterIterator { + public function accept() { + $path_name = $this->getInnerIterator()->getPathName(); + return substr($path_name, -4) == ".php"; + } +} + +class GalleryCodeFilterIterator extends FilterIterator { + public function accept() { + // Skip anything that we didn"t write + $path_name = $this->getInnerIterator()->getPathName(); + return !( + strpos($path_name, ".svn") || + strpos($path_name, DOCROOT . "test") !== false || + strpos($path_name, DOCROOT . "var") !== false || + strpos($path_name, MODPATH . "forge") !== false || + strpos($path_name, MODPATH . "gallery/views/kohana_error_page.php") !== false || + strpos($path_name, MODPATH . "gallery/views/kohana_profiler.php") !== false || + strpos($path_name, MODPATH . "gallery_unit_test/views/kohana_error_page.php") !== false || + strpos($path_name, MODPATH . "gallery_unit_test/views/kohana_unit_test_cli.php") !== false || + strpos($path_name, MODPATH . "unit_test") !== false || + strpos($path_name, MODPATH . "exif/lib") !== false || + strpos($path_name, MODPATH . "user/lib/PasswordHash") !== false || + strpos($path_name, DOCROOT . "lib/swfupload") !== false || + strpos($path_name, SYSPATH) !== false || + strpos($path_name, MODPATH . "gallery/libraries/HTMLPurifier") !== false || + substr($path_name, -1, 1) == "~"); + } +} diff --git a/modules/gallery/tests/Item_Helper_Test.php b/modules/gallery/tests/Item_Helper_Test.php index 33fcdb73..fc01db91 100644 --- a/modules/gallery/tests/Item_Helper_Test.php +++ b/modules/gallery/tests/Item_Helper_Test.php @@ -23,16 +23,16 @@ class Item_Helper_Test extends Unit_Test_Case { $root = ORM::factory("item", 1); $album = album::create($root, rand(), rand(), rand()); $item = self::_create_random_item($album); - user::set_active(user::guest()); + Session::set_active_user(Identity::guest()); // We can see the item when permissions are granted - access::allow(group::everybody(), "view", $album); + access::allow(Identity::everybody(), "view", $album); $this->assert_equal( 1, ORM::factory("item")->viewable()->where("id", $item->id)->count_all()); // We can't see the item when permissions are denied - access::deny(group::everybody(), "view", $album); + access::deny(Identity::everybody(), "view", $album); $this->assert_equal( 0, ORM::factory("item")->viewable()->where("id", $item->id)->count_all()); diff --git a/modules/gallery/tests/No_Direct_Access_Test.php b/modules/gallery/tests/No_Direct_Access_Test.php new file mode 100644 index 00000000..c6d8df95 --- /dev/null +++ b/modules/gallery/tests/No_Direct_Access_Test.php @@ -0,0 +1,77 @@ +<?php defined("SYSPATH") or die("No direct script access."); +/** + * Gallery - a web based photo album viewer and editor + * Copyright (C) 2000-2009 Bharat Mediratta + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or (at + * your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. + */ +require_once("Gallery_Filters.php"); + +class No_Direct_Access_Test extends Unit_Test_Case { + public function no_access_to_users_table_test() { + $dir = new UserModuleFilterIterator( + new PhpCodeFilterIterator( + new GalleryCodeFilterIterator( + new RecursiveIteratorIterator( + new RecursiveDirectoryIterator(DOCROOT))))); + $errors = array(); + foreach ($dir as $file) { + //if (basename(dirname($file)) == "helpers") { + $file_as_string = file_get_contents($file); + if (preg_match("/ORM::factory\\(\"user\"/", $file_as_string)) { + foreach (split("\n", $file_as_string) as $l => $line) { + if (preg_match('/ORM::factory\\(\"user\"/', $line)) { + $errors[] = "$file($l) => $line"; + } + } + } + $file_as_string = null; + } + if ($errors) { + $this->assert_false(true, "Direct access to the users table found:\n" . join("\n", $errors)); + } + } + + public function no_access_to_groups_table_test() { + $dir = new UserModuleFilterIterator( + new PhpCodeFilterIterator( + new GalleryCodeFilterIterator( + new RecursiveIteratorIterator( + new RecursiveDirectoryIterator(DOCROOT))))); + $errors = array(); + foreach ($dir as $file) { + $file_as_string = file_get_contents($file); + if (preg_match("/ORM::factory\\(\"group\"/", $file_as_string)) { + foreach (split("\n", $file_as_string) as $l => $line) { + if (preg_match('/ORM::factory\\(\"group\"/', $line)) { + $errors[] = "$file($l) => $line"; + } + } + } + $file_as_string = null; + } + if ($errors) { + $this->assert_false(true, "Direct access to the groups table found:\n" . join("\n", $errors)); + } + } + +} + +class UserModuleFilterIterator extends FilterIterator { + public function accept() { + $path_name = $this->getInnerIterator()->getPathName(); + return strpos($path_name, "/modules/user") === false; + } +} diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php index 0159b420..59c3f78a 100644 --- a/modules/gallery/tests/Photos_Controller_Test.php +++ b/modules/gallery/tests/Photos_Controller_Test.php @@ -31,7 +31,7 @@ class Photos_Controller_Test extends Unit_Test_Case { $root = ORM::factory("item", 1); $photo = photo::create( $root, MODPATH . "gallery/tests/test.jpg", "test.jpeg", - "test", "test", user::active(), "slug"); + "test", "test", Session::active_user()->id, "slug"); $orig_name = $photo->name; $_POST["filename"] = "test.jpeg"; @@ -40,7 +40,7 @@ class Photos_Controller_Test extends Unit_Test_Case { $_POST["description"] = "new description"; $_POST["slug"] = "new-slug"; $_POST["csrf"] = access::csrf_token(); - access::allow(group::everybody(), "edit", $root); + access::allow(Identity::everybody(), "edit", $root); ob_start(); $controller->_update($photo); @@ -64,7 +64,7 @@ class Photos_Controller_Test extends Unit_Test_Case { $_POST["name"] = "new name"; $_POST["title"] = "new title"; $_POST["description"] = "new description"; - access::allow(group::everybody(), "edit", $root); + access::allow(Identity::everybody(), "edit", $root); try { $controller->_update($photo); diff --git a/modules/gallery/views/admin_identity.html.php b/modules/gallery/views/admin_identity.html.php new file mode 100644 index 00000000..1405cacb --- /dev/null +++ b/modules/gallery/views/admin_identity.html.php @@ -0,0 +1,61 @@ +<?php defined("SYSPATH") or die("No direct script access.") ?> +<script type="text/javascript"> + $(document).ready(function() { + $("#g-modules form").submit(function() { + var eDialog = '<div id="g-dialog"></div>'; + var params = $(this).serialize(); + var url = $(this).attr("action"); + $("body").append(eDialog); + $.post($(this).attr("action"), $(this).serialize(), function(data, textStatus) { + $("#g-dialog").html(data); + $("#g-dialog").dialog({ + bgiframe: true, + title: "<?= t("Confirm Change Identity Provider") ?>", + resizable: false, + height:165, + modal: true, + overlay: { + backgroundColor: '#000', + opacity: 0.5 + }, + buttons: { + "Continue": function() { + $("##g-dialog form").submit(); + }, + Cancel: function() { + $(this).dialog('close'); + } + } + }); + }); + return false; + }); + }); + +</script> +<div id="g-modules"> + <h1> <?= t("Gallery Identity Management") ?> </h1> + <p> + <?= t("Choose a different user/group management provider.") ?> + </p> + + <form method="post" action="<?= url::site("admin/identity/confirm") ?>"> + <?= access::csrf_form_field() ?> + <table> + <tr> + <th> <?= t("Active") ?> </th> + <th> <?= t("Description") ?> </th> + </tr> + <? $i = 0 ?> + <? foreach ($available as $module_name => $description): ?> + <tr class="<?= ($i % 2 == 0) ? "g-odd" : "g-even" ?>"> + <? $data = array("name" => "provider"); ?> + <td> <?= form::radio($data, $module_name, $module_name == $active) ?> </td> + <td> <?= t($description) ?> </td> + </tr> + <? $i++ ?> + <? endforeach ?> + </table> + <input type="submit" value="<?= t("Change")->for_html_attr() ?>" /> + </form> +</div> diff --git a/modules/gallery/views/admin_identity_confirm.html.php b/modules/gallery/views/admin_identity_confirm.html.php new file mode 100644 index 00000000..e14525b5 --- /dev/null +++ b/modules/gallery/views/admin_identity_confirm.html.php @@ -0,0 +1,10 @@ +<?php defined("SYSPATH") or die("No direct script access.") ?> +<form method="post" action="<?= url::site("admin/identity/change") ?>"> + <?= access::csrf_form_field() ?> + <?= form::hidden("provider", $new_provider) ?> + + <p><span class="ui-icon ui-icon-alert" style="float: left; margin:0 7px 20px 0;"></span> + <?= t("Do you really want to switch Identity providers? Continuing will delete all existing users.") ?> + </p> +</form> + diff --git a/modules/gallery/views/kohana_error_page.php b/modules/gallery/views/kohana_error_page.php index 314a9923..0256fabb 100644 --- a/modules/gallery/views/kohana_error_page.php +++ b/modules/gallery/views/kohana_error_page.php @@ -57,7 +57,7 @@ <title><?= t("Something went wrong!") ?></title> </head> <body> - <? try { $user = user::active(); } catch (Exception $e) { } ?> + <? try { $user = Session::active_user(); } catch (Exception $e) { } ?> <? $admin = php_sapi_name() == "cli" || isset($user) && $user->admin ?> <div class="big_box" id="framework_error"> <h1> diff --git a/modules/gallery/views/login.html.php b/modules/gallery/views/login.html.php index 9be218c0..6695d564 100644 --- a/modules/gallery/views/login.html.php +++ b/modules/gallery/views/login.html.php @@ -8,11 +8,15 @@ </li> <? else: ?> <li class="first"> + <? if (Identity::is_writable()): ?> <?= t('Logged in as %name', array('name' => html::mark_clean( '<a href="' . url::site("form/edit/users/{$user->id}") . '" title="' . t("Edit Your Profile")->for_html_attr() . '" id="g-user-profile-link" class="g-dialog-link">' . html::clean($user->display_name()) . '</a>'))) ?> + <? else: ?> + <?= t('Logged in as %name', array('name' => html::clean($user->display_name()))) ?> + <? endif ?> </li> <li> <a href="<?= url::site("logout?csrf=$csrf&continue=" . urlencode(url::current(true))) ?>" diff --git a/modules/gallery/views/login_ajax.html.php b/modules/gallery/views/login_ajax.html.php index d3364b46..6ed40571 100644 --- a/modules/gallery/views/login_ajax.html.php +++ b/modules/gallery/views/login_ajax.html.php @@ -36,8 +36,10 @@ <li id="g-login-form"> <?= $form ?> </li> + <? if (Identity::is_writable()): ?> <li> <a href="#" id="g-password-reset" class="g-right g-txt-small"><?= t("Forgot Your Password?") ?></a> </li> + <? endif ?> </ul> </div> diff --git a/modules/gallery/views/maintenance.html.php b/modules/gallery/views/maintenance.html.php index f80b6e7a..0aeaaec2 100644 --- a/modules/gallery/views/maintenance.html.php +++ b/modules/gallery/views/maintenance.html.php @@ -43,7 +43,7 @@ <p> <?= t("This site is currently only accessible by site administrators.") ?> </p> - <?= user::get_login_form("login/auth_html") ?> + <?= login::get_login_form("login/auth_html") ?> </body> </html> diff --git a/modules/gallery/views/reset_password.html.php b/modules/gallery/views/reset_password.html.php deleted file mode 100644 index 92ca4917..00000000 --- a/modules/gallery/views/reset_password.html.php +++ /dev/null @@ -1,17 +0,0 @@ -<?php defined("SYSPATH") or die("No direct script access.") ?> -<html> - <head> - <title><?= t("Password Reset Request") ?> </title> - </head> - <body> - <h2><?= t("Password Reset Request") ?> </h2> - <p> - <?= t("Hello, %name,", array("name" => $user->full_name ? $user->full_name : $user->name)) ?> - </p> - <p> - <?= t("We received a request to reset your password for <a href=\"%site_url\">%site_url</a>. If you made this request, you can confirm it by <a href=\"%confirm_url\">clicking this link</a>. If you didn't request this password reset, it's ok to ignore this mail.", - array("site_url" => html::mark_clean(url::base(false, "http")), - "confirm_url" => $confirm_url)) ?> - </p> - </body> -</html> |