ionas82

// appmodel.php// ...	function checkModelAccess($id) {		$return = false;		// allow by ownership of session user		$permissions = $this->sessionUserHasOwnership($id);		if(is_array($permissions)) {			foreach($permissions as $permission) {				if($permission == true) {					$return = true;				}			}		}		return $return;	}		var $sessionUserHasOwnershipRecursion = 10;	function sessionUserHasOwnership($id, $recursion = 0) {		// pr('<u>Call from '.$this->name.'</u>');		$return = false;		foreach($this->belongsTo as $belongsTo) {			$className = $belongsTo['className'];			$this->recursive = 0;			// TODO: Optimize following query			$parentsData = $this->find(array($this->name . '.id' => $id));			// pr("Looking on..." . $className);			if(isset($parentsData[$className]['id'])) {				if($recursion < $this->sessionUserHasOwnershipRecursion) {					$permissions = $this->{$className}->sessionUserHasOwnership($parentsData[$className]['id'], $recursion + 1);					if(is_array($permissions)) {						foreach($permissions as $permission) {							$return[] = $permission;						}					}				}				else {					trigger_error("Infinite Loop Protection - Stopped at Level: " . $this->sessionUserHasOwnershipRecursion);				}			}		}		return $return;	}//...// app_controller.php// ...	function beforeFilter() {		$this->_setGlobalVariables();		$this->_setSessionUserId();		$this->_setDefaultRoute(array('controller' => 'pages', 'action' => '/index'));		if($this->checkControllerAccess() == false) {			if('Admin' != $this->User->sessionUserType) {				$this->Session->setFlash($this->msgAccessDenied);				$this->redirect($this->default_route);			}		}	}		// empty prototype to be overwritten/specified by every controller	function checkControllerAccess() {		return true; // TODO: set this to <false> on production mode	}		function _setSessionUserId() {		// Guest / Visitor		$this->User->sessionUserId            = '-1';		$this->User->sessionUserType          = 'Guest';		$this->sessionUserId                  = '-1';		$this->sessionUserType                = 'Guest';		$this->set('sessionUserId',             '-1');		$this->set('sessionUserType',           'Guest');		// Logged in User		if($this->Session->valid()) {			$session_user                 = $this->Session->read('user_data');			if(is_array($session_user)) {				$this->User->sessionUserId    = $session_user['id'];				$this->User->sessionUserType  = $session_user['type'];				$this->sessionUserId          = $session_user['id'];;				$this->sessionUserType        = $session_user['type'];				$this->set('sessionUserId',     $session_user['id']);				$this->set('sessionUserType',   $session_user['type']);			}		}	}// ...// user.php (model)// ...	var $sessionUserId   = -1;	var $sessionUserType = "Guest";		function sessionUserHasOwnership($id) {		if($id == $this->sessionUserId) {			return array(true);		}		else {			return array(false);		}	}// ...// address_controller.php//...	function beforeFilter() {		parent::beforeFilter();	}		function checkControllerAccess() {		// basically we disallow any access,		// and then, by rules specified below, allow it		$hasAccess = false;		switch($this->action) {			case 'view':				if(isset($this->passedArgs['address_id'])) {					$this->id = $this->passedArgs['address_id'];					// check by session user ownership					if($this->Address->checkModelAccess($this->id)) {						$hasAccess = true;					}					// check by session user type					$address = $this->Address->find(array('Address.id' => $this->id), array(), null, -1);					if(('Profile' == $this->User->sessionUserType && empty($address['Address']['profile_id']))					|| ('Company' == $this->User->sessionUserType && empty($address['Address']['company_id']))) {						$hasAccess = true;					}				}				else {					$this->Session->setFlash(__('Invalid Address.', true));				}				break;			case 'add':				if (isset($this->passedArgs['profile_id'])) {					$this->id = $this->passedArgs['profile_id'];					// check by session user ownership					if($this->Profile->checkModelAccess($this->id)) {						$hasAccess = true;					}				}				else if (isset($this->passedArgs['company_id'])) {					$this->id = $this->passedArgs['company_id'];					// check by session user ownership					if($this->Company->checkModelAccess($this->id)) {						$hasAccess = true;					}				}				else {					$this->Session->setFlash(__('Invalid Address.', true));				}				break;			case 'edit':			case 'delete':				if(isset($this->passedArgs['address_id'])) {					$this->id = $this->passedArgs['address_id'];					// check by user session ownership					if($this->Address->checkModelAccess($this->id)) {						$hasAccess = true;					}				}				else {					$this->Session->setFlash(__('Invalid Address.', true));				}				break;			default:				$hasAccess = true;				break;		}		return $hasAccess;	}// ...