harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement permission checking for OAuth clients using the xperm table. Currently 'all' permissions are applied to OAuth clients which gives them the same rights as the channel owner and full access to API functions as the channel owner. However, individual permissions can now be created. These mirror the permission names from the normal permission table (although it isn't required that they do so). Lack of an xp_perm entry for the specified permission and lack of an 'all' override indicates permission denied.

Browse Source
This commit is contained in:
redmatrix
2015-05-17 18:14:50 -07:00
parent a7071b17c0
commit 3b859aa9ef
5 changed files with 106 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
include/permissions.php
View File

@@ -65,6 +65,10 @@ function get_perms() {
*/
function get_all_perms($uid, $observer_xchan, $internal_use = true) {
$api = get_app()->get_oauth_key();
if($api)
return get_all_api_perms($uid,$api);
$global_perms = get_perms();
// Save lots of individual lookups
@@ -265,6 +269,10 @@ function get_all_perms($uid, $observer_xchan, $internal_use = true) {
*/
function perm_is_allowed($uid, $observer_xchan, $permission) {
$api = get_app()->get_oauth_key();
if($api)
return api_perm_is_allowed($uid,$api,$permission);
$arr = array(
'channel_id' => $uid,
'observer_hash' => $observer_xchan,
@@ -388,6 +396,82 @@ function perm_is_allowed($uid, $observer_xchan, $permission) {
return false;
}
function get_all_api_perms($uid,$api) {
$global_perms = get_perms();
$ret = array();
$r = q("select * from xperm where xp_client = '%s' and xp_channel = %d",
dbesc($api),
intval($uid)
);
if(! $r)
return false;
$allow_all = false;
$allowed = array();
foreach($r as $rr) {
if($rr['xp_perm'] === 'all')
$allow_all = true;
if(! in_array($rr['xp_perm'],$allowed))
$allowed[] = $rr['xp_perm'];
}
foreach($global_perms as $perm_name => $permission) {
if($allow_all || in_array($perm_name,$allowed))
$ret[$perm_name] = true;
else
$ret[$perm_name] = false;
}
$arr = array(
'channel_id' => $uid,
'observer_hash' => $observer_xchan,
'permissions' => $ret);
call_hooks('get_all_api_perms',$arr);
return $arr['permissions'];
}
function api_perm_is_allowed($uid,$api,$permission) {
$arr = array(
'channel_id' => $uid,
'observer_hash' => $observer_xchan,
'permission' => $permission,
'result' => false
);
call_hooks('api_perm_is_allowed', $arr);
if($arr['result'])
return true;
$r = q("select * from xperm where xp_client = '%s' and xp_channel = %d and ( xp_perm = 'all' OR xp_perm = '%s' )",
dbesc($api),
intval($uid),
dbesc($permission)
);
if(! $r)
return false;
foreach($r as $rr) {
if($rr['xp_perm'] === 'all' || $rr['xp_perm'] === $permission)
return true;
}
return false;
}
// Check a simple array of observers against a permissions
// return a simple array of those with permission