1<?php 2// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project 3// 4// All Rights Reserved. See copyright.txt for details and a complete list of authors. 5// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details. 6// $Id: perms.php 39469 2012-01-12 21:13:48Z changi67$ 7 8if (basename($_SERVER['SCRIPT_NAME']) === basename(__FILE__)) { 9 die('This script may only be included.'); 10} 11 12$groupList = null; 13$is_token_access = false; 14if ($prefs['auth_token_access'] == 'y' && isset($_REQUEST['TOKEN'])) { 15 require_once 'lib/auth/tokens.php'; 16 $token = $_REQUEST['TOKEN']; 17 18 unset($_GET['TOKEN']); 19 unset($_POST['TOKEN']); 20 unset($_REQUEST['TOKEN']); 21 $tokenParams = $_GET; 22 23 /** 24 * Shared 'Upload File' case 25 */ 26 if (isset($isUpload) && $isUpload && ! empty($_POST['galleryId']) && empty($_GET['galleryId'])) { 27 foreach ((array) $_POST['galleryId'] as $v) { 28 if (! empty($tokenParams['galleryId'])) { 29 if ($tokenParams['galleryId'] == $v) { 30 continue; 31 } else { 32 unset($tokenParams['galleryId']); 33 break; 34 } 35 } 36 $tokenParams['galleryId'] = $v; 37 } 38 } 39 40 $tokenlib = AuthTokens::build($prefs); 41 if ($groups = $tokenlib->getGroups($token, $_SERVER['PHP_SELF'], $tokenParams)) { 42 $groupList = $groups; 43 $detailtoken = $tokenlib->getToken($token); 44 $is_token_access = true; 45 46 /** 47 * Shared 'File download' case 48 */ 49 if (isset($_GET['fileId']) && $detailtoken['parameters'] == '{"fileId":"' . $_GET['fileId'] . '"}') { 50 $_SESSION['allowed'][$_GET['fileId']] = true; 51 } 52 53 // If notification then alert 54 if ($prefs['share_token_notification'] == 'y') { 55 $nots = $tikilib->get_event_watches('auth_token_called', $detailtoken['tokenId']); 56 $smarty->assign('prefix_url', $base_host); 57 58 // Select in db the tokenId 59 $notificationPage = ''; 60 $smarty->assign_by_ref('page_token', $notificationPage); 61 62 if (is_array($nots)) { 63 include_once('lib/webmail/tikimaillib.php'); 64 $mail = new TikiMail(); 65 66 $mail->setSubject($detailtoken['email'] . ' ' . tra(' has accessed your temporary shared content')); 67 68 foreach ($nots as $i => $not) { 69 $notificationPage = $not['url']; 70 71 // Delete token from url 72 $notificationPage = preg_replace('/[\?&]TOKEN=' . $detailtoken['token'] . '/', '', $notificationPage); 73 74 // If file Gallery 75 $smarty->assign('filegallery', 'n'); 76 if (preg_match("/\btiki-download_file.php\b/i", $notificationPage)) { 77 $filegallib = TikiLib::lib('filegal'); 78 $smarty->assign('filegallery', 'y'); 79 $aParams = (array) json_decode($detailtoken['parameters']); 80 $smarty->assign('fileId', $aParams['fileId']); 81 82 $aFileInfos = $filegallib->get_file_info($aParams['fileId']); 83 $smarty->assign('filegalleryId', $aFileInfos['galleryId']); 84 $smarty->assign('filename', $aFileInfos['name']); 85 } 86 87 $smarty->assign('email_token', $detailtoken['email']); 88 $txt = $smarty->fetch('mail/user_watch_token.tpl'); 89 $mail->setHTML($txt); 90 $mailsent = $mail->send([$not['email']]); 91 } 92 } 93 } 94 95 if (empty($notificationPage)) { 96 $notificationPage = preg_replace('/[\?&]TOKEN=' . $token . '/', '', $_SERVER['REQUEST_URI']); 97 } 98 // Log each token access 99 $logslib->add_log('token', $detailtoken['email'] . ' ' . tra('has accessed the following shared content:') . ' ' . $notificationPage); 100 } else { 101 // Error Token expired 102 $token_error = tra('Your access to this page has expired'); 103 } 104} 105 106$allperms = $userlib->get_enabled_permissions(); 107 108Perms_Context::setPermissionList($allperms); 109 110$builder = new Perms_Builder; 111$perms = $builder 112 ->withCategories($prefs['feature_categories'] == 'y') 113 ->withDefinitions($allperms) 114 ->build(); 115 116Perms::set($perms); 117 118$_permissionContext = new Perms_Context($user, false); 119 120if ($groupList) { 121 $_permissionContext->overrideGroups($groupList); 122} 123 124$_permissionContext->activate(true); 125 126unset($allperms); 127unset($tokenParams); 128