/**

*

* @package acp

* @version $Id: acp_permissions.php 8710 2008-07-29 13:35:49Z acydburn $

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-license.php GNU Public License

*

*/

/**

* @ignore

*/

if (!defined('IN_PHPBB'))

{

	exit;

}

/**

* @package acp

*/

class acp_permissions

{

	var $u_action;

	var $permission_dropdown;

	function main($id, $mode)

	{

		global $db, $user, $auth, $template, $cache;

		global $config, $phpbb_root_path, $phpbb_admin_path, $phpEx;

		include_once($phpbb_root_path . 'includes/functions_user.' . $phpEx);

		include_once($phpbb_root_path . 'includes/acp/auth.' . $phpEx);

		$auth_admin = new auth_admin();

		$user->add_lang('acp/permissions');

		add_permission_language();

		$this->tpl_name = 'acp_permissions';

		// Trace has other vars

		if ($mode == 'trace')

		{

			$user_id = request_var('u', 0);

			$forum_id = request_var('f', 0);

			$permission = request_var('auth', '');

			$this->tpl_name = 'permission_trace';

			if ($user_id && isset($auth_admin->acl_options['id'][$permission]) && $auth->acl_get('a_viewauth'))

			{

				$this->page_title = sprintf($user->lang['TRACE_PERMISSION'], $user->lang['acl_' . $permission]['lang']);

				$this->permission_trace($user_id, $forum_id, $permission);

				return;

			}

			trigger_error('NO_MODE', E_USER_ERROR);

		}

		// Set some vars

		$action = request_var('action', array('' => 0));

		$action = key($action);

		$action = (isset($_POST['psubmit'])) ? 'apply_permissions' : $action;

		$all_forums = request_var('all_forums', 0);

		$subforum_id = request_var('subforum_id', 0);

		$forum_id = request_var('forum_id', array(0));

		$username = request_var('username', array(''), true);

		$usernames = request_var('usernames', '', true);

		$user_id = request_var('user_id', array(0));

		$group_id = request_var('group_id', array(0));

		$select_all_groups = request_var('select_all_groups', 0);

		$form_name = 'acp_permissions';

		add_form_key($form_name);

		// If select all groups is set, we pre-build the group id array (this option is used for other screens to link to the permission settings screen)

		if ($select_all_groups)

		{

			// Add default groups to selection

			$sql_and = (!$config['coppa_enable']) ? " AND group_name <> 'REGISTERED_COPPA'" : '';

			$sql = 'SELECT group_id

				FROM ' . GROUPS_TABLE . '

				WHERE group_type = ' . GROUP_SPECIAL . "

				$sql_and";

			$result = $db->sql_query($sql);

			while ($row = $db->sql_fetchrow($result))

			{

				$group_id[] = $row['group_id'];

			}

			$db->sql_freeresult($result);

		}

		// Map usernames to ids and vice versa

		if ($usernames)

		{

			$username = explode("\n", $usernames);

		}

		unset($usernames);

		if (sizeof($username) && !sizeof($user_id))

		{

			user_get_id_name($user_id, $username);

			if (!sizeof($user_id))

			{

				trigger_error($user->lang['SELECTED_USER_NOT_EXIST'] . adm_back_link($this->u_action), E_USER_WARNING);

			}

		}

		unset($username);

		// Build forum ids (of all forums are checked or subforum listing used)

		if ($all_forums)

		{

			$sql = 'SELECT forum_id

				FROM ' . FORUMS_TABLE . '

				ORDER BY left_id';

			$result = $db->sql_query($sql);

			$forum_id = array();

			while ($row = $db->sql_fetchrow($result))

			{

				$forum_id[] = (int) $row['forum_id'];

			}

			$db->sql_freeresult($result);

		}

		else if ($subforum_id)

		{

			$forum_id = array();

			foreach (get_forum_branch($subforum_id, 'children') as $row)

			{

				$forum_id[] = (int) $row['forum_id'];

			}

		}

		// Define some common variables for every mode

		$error = array();

		$permission_scope = (strpos($mode, '_global') !== false) ? 'global' : 'local';

		// Showing introductionary page?

		if ($mode == 'intro')

		{

			$this->page_title = 'ACP_PERMISSIONS';

			$template->assign_vars(array(

				'S_INTRO'		=> true)

			);

			return;

		}

		switch ($mode)

		{

			case 'setting_user_global':

			case 'setting_group_global':

				$this->permission_dropdown = array('u_', 'm_', 'a_');

				$permission_victim = ($mode == 'setting_user_global') ? array('user') : array('group');

				$this->page_title = ($mode == 'setting_user_global') ? 'ACP_USERS_PERMISSIONS' : 'ACP_GROUPS_PERMISSIONS';

			break;

			case 'setting_user_local':

			case 'setting_group_local':

				$this->permission_dropdown = array('f_', 'm_');

				$permission_victim = ($mode == 'setting_user_local') ? array('user', 'forums') : array('group', 'forums');

				$this->page_title = ($mode == 'setting_user_local') ? 'ACP_USERS_FORUM_PERMISSIONS' : 'ACP_GROUPS_FORUM_PERMISSIONS';

			break;

			case 'setting_admin_global':

			case 'setting_mod_global':

				$this->permission_dropdown = (strpos($mode, '_admin_') !== false) ? array('a_') : array('m_');

				$permission_victim = array('usergroup');

				$this->page_title = ($mode == 'setting_admin_global') ? 'ACP_ADMINISTRATORS' : 'ACP_GLOBAL_MODERATORS';

			break;

			case 'setting_mod_local':

			case 'setting_forum_local':

				$this->permission_dropdown = ($mode == 'setting_mod_local') ? array('m_') : array('f_');

				$permission_victim = array('forums', 'usergroup');

				$this->page_title = ($mode == 'setting_mod_local') ? 'ACP_FORUM_MODERATORS' : 'ACP_FORUM_PERMISSIONS';

			break;

			case 'view_admin_global':

			case 'view_user_global':

			case 'view_mod_global':

				$this->permission_dropdown = ($mode == 'view_admin_global') ? array('a_') : (($mode == 'view_user_global') ? array('u_') : array('m_'));

				$permission_victim = array('usergroup_view');

				$this->page_title = ($mode == 'view_admin_global') ? 'ACP_VIEW_ADMIN_PERMISSIONS' : (($mode == 'view_user_global') ? 'ACP_VIEW_USER_PERMISSIONS' : 'ACP_VIEW_GLOBAL_MOD_PERMISSIONS');

			break;

			case 'view_mod_local':

			case 'view_forum_local':

				$this->permission_dropdown = ($mode == 'view_mod_local') ? array('m_') : array('f_');

				$permission_victim = array('forums', 'usergroup_view');

				$this->page_title = ($mode == 'view_mod_local') ? 'ACP_VIEW_FORUM_MOD_PERMISSIONS' : 'ACP_VIEW_FORUM_PERMISSIONS';

			break;

			default:

				trigger_error('NO_MODE', E_USER_ERROR);

			break;

		}

		$template->assign_vars(array(

			'L_TITLE'		=> $user->lang[$this->page_title],

			'L_EXPLAIN'		=> $user->lang[$this->page_title . '_EXPLAIN'])

		);

		// Get permission type

		$permission_type = request_var('type', $this->permission_dropdown[0]);

		if (!in_array($permission_type, $this->permission_dropdown))

		{

			trigger_error($user->lang['WRONG_PERMISSION_TYPE'] . adm_back_link($this->u_action), E_USER_WARNING);

		}

		// Handle actions

		if (strpos($mode, 'setting_') === 0 && $action)

		{

			switch ($action)

			{

				case 'delete':

					if (!check_form_key($form_name))

					{

						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);

					}

					// All users/groups selected?

					$all_users = (isset($_POST['all_users'])) ? true : false;

					$all_groups = (isset($_POST['all_groups'])) ? true : false;

					if ($all_users || $all_groups)

					{

						$items = $this->retrieve_defined_user_groups($permission_scope, $forum_id, $permission_type);

						if ($all_users && sizeof($items['user_ids']))

						{

							$user_id = $items['user_ids'];

						}

						else if ($all_groups && sizeof($items['group_ids']))

						{

							$group_id = $items['group_ids'];

						}

					}

					if (sizeof($user_id) || sizeof($group_id))

					{

						$this->remove_permissions($mode, $permission_type, $auth_admin, $user_id, $group_id, $forum_id);

					}

					else

					{

						trigger_error($user->lang['NO_USER_GROUP_SELECTED'] . adm_back_link($this->u_action), E_USER_WARNING);

					}

				break;

				case 'apply_permissions':

					if (!isset($_POST['setting']))

					{

						trigger_error($user->lang['NO_AUTH_SETTING_FOUND'] . adm_back_link($this->u_action), E_USER_WARNING);

					}

					if (!check_form_key($form_name))

					{

						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);

					}

					$this->set_permissions($mode, $permission_type, $auth_admin, $user_id, $group_id);

				break;

				case 'apply_all_permissions':

					if (!isset($_POST['setting']))

					{

						trigger_error($user->lang['NO_AUTH_SETTING_FOUND'] . adm_back_link($this->u_action), E_USER_WARNING);

					}

					if (!check_form_key($form_name))

					{

						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);

					}

					$this->set_all_permissions($mode, $permission_type, $auth_admin, $user_id, $group_id);

				break;

			}

		}

		// Setting permissions screen

		$s_hidden_fields = build_hidden_fields(array(

			'user_id'		=> $user_id,

			'group_id'		=> $group_id,

			'forum_id'		=> $forum_id,

			'type'			=> $permission_type)

		);

		// Go through the screens/options needed and present them in correct order

		foreach ($permission_victim as $victim)

		{

			switch ($victim)

			{

				case 'forum_dropdown':

					if (sizeof($forum_id))

					{

						$this->check_existence('forum', $forum_id);

						continue 2;

					}

					$template->assign_vars(array(

						'S_SELECT_FORUM'		=> true,

						'S_FORUM_OPTIONS'		=> make_forum_select(false, false, true, false, false))

					);

				break;

				case 'forums':

					if (sizeof($forum_id))

					{

						$this->check_existence('forum', $forum_id);

						continue 2;

					}

					$forum_list = make_forum_select(false, false, true, false, false, false, true);

					// Build forum options

					$s_forum_options = '';

					foreach ($forum_list as $f_id => $f_row)

					{

						$s_forum_options .= '<option value="' . $f_id . '"' . (($f_row['selected']) ? ' selected="selected"' : '') . (($f_row['disabled']) ? ' disabled="disabled" class="disabled-option"' : '') . '>' . $f_row['padding'] . $f_row['forum_name'] . '</option>';

					}

					// Build subforum options

					$s_subforum_options = $this->build_subforum_options($forum_list);

					$template->assign_vars(array(

						'S_SELECT_FORUM'		=> true,

						'S_FORUM_OPTIONS'		=> $s_forum_options,

						'S_SUBFORUM_OPTIONS'	=> $s_subforum_options,

						'S_FORUM_ALL'			=> true,

						'S_FORUM_MULTIPLE'		=> true)

					);

				break;

				case 'user':

					if (sizeof($user_id))

					{

						$this->check_existence('user', $user_id);

						continue 2;

					}

					$template->assign_vars(array(

						'S_SELECT_USER'			=> true,

						'U_FIND_USERNAME'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=select_victim&field=username&select_single=true'),

					));

				break;

				case 'group':

					if (sizeof($group_id))

					{

						$this->check_existence('group', $group_id);

						continue 2;

					}

					$template->assign_vars(array(

						'S_SELECT_GROUP'		=> true,

						'S_GROUP_OPTIONS'		=> group_select_options(false, false, false), // Show all groups

					));

				break;

				case 'usergroup':

				case 'usergroup_view':

					$all_users = (isset($_POST['all_users'])) ? true : false;

					$all_groups = (isset($_POST['all_groups'])) ? true : false;

					if ((sizeof($user_id) && !$all_users) || (sizeof($group_id) && !$all_groups))

					{

						if (sizeof($user_id))

						{

							$this->check_existence('user', $user_id);

						}

						if (sizeof($group_id))

						{

							$this->check_existence('group', $group_id);

						}

						continue 2;

					}

					// Now we check the users... because the "all"-selection is different here (all defined users/groups)

					$items = $this->retrieve_defined_user_groups($permission_scope, $forum_id, $permission_type);

					if ($all_users && sizeof($items['user_ids']))

					{

						$user_id = $items['user_ids'];

						continue 2;

					}

					if ($all_groups && sizeof($items['group_ids']))

					{

						$group_id = $items['group_ids'];

						continue 2;

					}

					$template->assign_vars(array(

						'S_SELECT_USERGROUP'		=> ($victim == 'usergroup') ? true : false,

						'S_SELECT_USERGROUP_VIEW'	=> ($victim == 'usergroup_view') ? true : false,

						'S_DEFINED_USER_OPTIONS'	=> $items['user_ids_options'],

						'S_DEFINED_GROUP_OPTIONS'	=> $items['group_ids_options'],

						'S_ADD_GROUP_OPTIONS'		=> group_select_options(false, $items['group_ids'], false),	// Show all groups

						'U_FIND_USERNAME'			=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=add_user&field=username&select_single=true'),

					));

				break;

			}

			// The S_ALLOW_SELECT parameter below is a measure to lower memory usage.

			// If there are more than 5 forums selected the admin is not able to select all users/groups too.

			// We need to see if the number of forums can be increased or need to be decreased.

			$template->assign_vars(array(

				'U_ACTION'				=> $this->u_action,

				'ANONYMOUS_USER_ID'		=> ANONYMOUS,

				'S_SELECT_VICTIM'		=> true,

				'S_ALLOW_ALL_SELECT'	=> (sizeof($forum_id) > 5) ? false : true,

				'S_CAN_SELECT_USER'		=> ($auth->acl_get('a_authusers')) ? true : false,

				'S_CAN_SELECT_GROUP'	=> ($auth->acl_get('a_authgroups')) ? true : false,

				'S_HIDDEN_FIELDS'		=> $s_hidden_fields)

			);

			// Let the forum names being displayed

			if (sizeof($forum_id))

			{

				$sql = 'SELECT forum_name

					FROM ' . FORUMS_TABLE . '

					WHERE ' . $db->sql_in_set('forum_id', $forum_id) . '

					ORDER BY left_id ASC';

				$result = $db->sql_query($sql);

				$forum_names = array();

				while ($row = $db->sql_fetchrow($result))

				{

					$forum_names[] = $row['forum_name'];

				}

				$db->sql_freeresult($result);

				$template->assign_vars(array(

					'S_FORUM_NAMES'		=> (sizeof($forum_names)) ? true : false,

					'FORUM_NAMES'		=> implode(', ', $forum_names))

				);

			}

			return;

		}

		// Do not allow forum_ids being set and no other setting defined (will bog down the server too much)

		if (sizeof($forum_id) && !sizeof($user_id) && !sizeof($group_id))

		{

			trigger_error($user->lang['ONLY_FORUM_DEFINED'] . adm_back_link($this->u_action), E_USER_WARNING);

		}

		$template->assign_vars(array(

			'S_PERMISSION_DROPDOWN'		=> (sizeof($this->permission_dropdown) > 1) ? $this->build_permission_dropdown($this->permission_dropdown, $permission_type, $permission_scope) : false,

			'L_PERMISSION_TYPE'			=> $user->lang['ACL_TYPE_' . strtoupper($permission_type)],

			'U_ACTION'					=> $this->u_action,

			'S_HIDDEN_FIELDS'			=> $s_hidden_fields)

		);

		if (strpos($mode, 'setting_') === 0)

		{

			$template->assign_vars(array(

				'S_SETTING_PERMISSIONS'		=> true)

			);

			$hold_ary = $auth_admin->get_mask('set', (sizeof($user_id)) ? $user_id : false, (sizeof($group_id)) ? $group_id : false, (sizeof($forum_id)) ? $forum_id : false, $permission_type, $permission_scope, ACL_NO);

			$auth_admin->display_mask('set', $permission_type, $hold_ary, ((sizeof($user_id)) ? 'user' : 'group'), (($permission_scope == 'local') ? true : false));

		}

		else

		{

			$template->assign_vars(array(

				'S_VIEWING_PERMISSIONS'		=> true)

			);

			$hold_ary = $auth_admin->get_mask('view', (sizeof($user_id)) ? $user_id : false, (sizeof($group_id)) ? $group_id : false, (sizeof($forum_id)) ? $forum_id : false, $permission_type, $permission_scope, ACL_NEVER);

			$auth_admin->display_mask('view', $permission_type, $hold_ary, ((sizeof($user_id)) ? 'user' : 'group'), (($permission_scope == 'local') ? true : false));

		}

	}

	/**

	* Build +subforum options

	*/

	function build_subforum_options($forum_list)

	{

		global $user;

		$s_options = '';

		$forum_list = array_merge($forum_list);

		foreach ($forum_list as $key => $row)

		{

			if ($row['disabled'])

			{

				continue;

			}

			$s_options .= '<option value="' . $row['forum_id'] . '"' . (($row['selected']) ? ' selected="selected"' : '') . '>' . $row['padding'] . $row['forum_name'];

			// We check if a branch is there...

			$branch_there = false;

			foreach (array_slice($forum_list, $key + 1) as $temp_row)

			{

				if ($temp_row['left_id'] > $row['left_id'] && $temp_row['left_id'] < $row['right_id'])

				{

					$branch_there = true;

					break;

				}

				continue;

			}

			if ($branch_there)

			{

				$s_options .= ' [' . $user->lang['PLUS_SUBFORUMS'] . ']';

			}

			$s_options .= '</option>';

		}

		return $s_options;

	}

	/**

	* Build dropdown field for changing permission types

	*/

	function build_permission_dropdown($options, $default_option, $permission_scope)

	{

		global $user, $auth;

		$s_dropdown_options = '';

		foreach ($options as $setting)

		{

			if (!$auth->acl_get('a_' . str_replace('_', '', $setting) . 'auth'))

			{

				continue;

			}

			$selected = ($setting == $default_option) ? ' selected="selected"' : '';

			$l_setting = (isset($user->lang['permission_type'][$permission_scope][$setting])) ? $user->lang['permission_type'][$permission_scope][$setting] : $user->lang['permission_type'][$setting];

			$s_dropdown_options .= '<option value="' . $setting . '"' . $selected . '>' . $l_setting . '</option>';

		}

		return $s_dropdown_options;

	}

	/**

	* Check if selected items exist. Remove not found ids and if empty return error.

	*/

	function check_existence($mode, &$ids)

	{

		global $db, $user;

		switch ($mode)

		{

			case 'user':

				$table = USERS_TABLE;

				$sql_id = 'user_id';

			break;

			case 'group':

				$table = GROUPS_TABLE;

				$sql_id = 'group_id';

			break;

			case 'forum':

				$table = FORUMS_TABLE;

				$sql_id = 'forum_id';

			break;

		}

		if (sizeof($ids))

		{

			$sql = "SELECT $sql_id

				FROM $table

				WHERE " . $db->sql_in_set($sql_id, $ids);

			$result = $db->sql_query($sql);

			$ids = array();

			while ($row = $db->sql_fetchrow($result))

			{

				$ids[] = (int) $row[$sql_id];

			}

			$db->sql_freeresult($result);

		}

		if (!sizeof($ids))

		{

			trigger_error($user->lang['SELECTED_' . strtoupper($mode) . '_NOT_EXIST'] . adm_back_link($this->u_action), E_USER_WARNING);

		}

	}

	/**

	* Apply permissions

	*/

	function set_permissions($mode, $permission_type, &$auth_admin, &$user_id, &$group_id)

	{

		global $user, $auth;

		$psubmit = request_var('psubmit', array(0 => array(0 => 0)));

		// User or group to be set?

		$ug_type = (sizeof($user_id)) ? 'user' : 'group';

		// Check the permission setting again

		if (!$auth->acl_get('a_' . str_replace('_', '', $permission_type) . 'auth') || !$auth->acl_get('a_auth' . $ug_type . 's'))

		{

			trigger_error($user->lang['NO_AUTH_OPERATION'] . adm_back_link($this->u_action), E_USER_WARNING);

		}

		$ug_id = $forum_id = 0;

		// We loop through the auth settings defined in our submit

		list($ug_id, ) = each($psubmit);

		list($forum_id, ) = each($psubmit[$ug_id]);

		if (empty($_POST['setting']) || empty($_POST['setting'][$ug_id]) || empty($_POST['setting'][$ug_id][$forum_id]) || !is_array($_POST['setting'][$ug_id][$forum_id]))

		{

			trigger_error('WRONG_PERMISSION_SETTING_FORMAT', E_USER_WARNING);

		}

		// We obtain and check $_POST['setting'][$ug_id][$forum_id] directly and not using request_var() because request_var()

		// currently does not support the amount of dimensions required. ;)

		//		$auth_settings = request_var('setting', array(0 => array(0 => array('' => 0))));

		$auth_settings = array_map('intval', $_POST['setting'][$ug_id][$forum_id]);

		// Do we have a role we want to set?

		$assigned_role = (isset($_POST['role'][$ug_id][$forum_id])) ? (int) $_POST['role'][$ug_id][$forum_id] : 0;

		// Do the admin want to set these permissions to other items too?

		$inherit = request_var('inherit', array(0 => array(0)));

		$ug_id = array($ug_id);

		$forum_id = array($forum_id);

		if (sizeof($inherit))

		{

			foreach ($inherit as $_ug_id => $forum_id_ary)

			{

				// Inherit users/groups?

				if (!in_array($_ug_id, $ug_id))

				{

					$ug_id[] = $_ug_id;

				}

				// Inherit forums?

				$forum_id = array_merge($forum_id, array_keys($forum_id_ary));

			}

		}

		$forum_id = array_unique($forum_id);

		// If the auth settings differ from the assigned role, then do not set a role...

		if ($assigned_role)

		{

			if (!$this->check_assigned_role($assigned_role, $auth_settings))

			{

				$assigned_role = 0;

			}

		}

		// Update the permission set...

		$auth_admin->acl_set($ug_type, $forum_id, $ug_id, $auth_settings, $assigned_role);

		// Do we need to recache the moderator lists?

		if ($permission_type == 'm_')

		{

			cache_moderators();

		}

		// Remove users who are now moderators or admins from everyones foes list

		if ($permission_type == 'm_' || $permission_type == 'a_')

		{

			update_foes($group_id, $user_id);

		}

		$this->log_action($mode, 'add', $permission_type, $ug_type, $ug_id, $forum_id);

		trigger_error($user->lang['AUTH_UPDATED'] . adm_back_link($this->u_action));

	}

	/**

	* Apply all permissions

	*/

	function set_all_permissions($mode, $permission_type, &$auth_admin, &$user_id, &$group_id)

	{

		global $user, $auth;

		// User or group to be set?

		$ug_type = (sizeof($user_id)) ? 'user' : 'group';

		// Check the permission setting again

		if (!$auth->acl_get('a_' . str_replace('_', '', $permission_type) . 'auth') || !$auth->acl_get('a_auth' . $ug_type . 's'))

		{

			trigger_error($user->lang['NO_AUTH_OPERATION'] . adm_back_link($this->u_action), E_USER_WARNING);

		}

		$auth_settings = (isset($_POST['setting'])) ? $_POST['setting'] : array();

		$auth_roles = (isset($_POST['role'])) ? $_POST['role'] : array();