[otrs-cvs] ITSMCore/Kernel/System/LinkObject Service.pm, 1.10, 1.10.2.1

Comments:
Update of /home/cvs/ITSMCore/Kernel/System/LinkObject
In directory lancelot:/tmp/cvs-serv16460/Kernel/System/LinkObject

Modified Files:
      Tag: rel-3_0
	Service.pm 
Log Message:
Improved permission checks in LinkObject.

Author: ub

Index: Service.pm
===================================================================
RCS file: /home/cvs/ITSMCore/Kernel/System/LinkObject/Service.pm,v
retrieving revision 1.10
retrieving revision 1.10.2.1
diff -2 -u -d -r1.10 -r1.10.2.1
--- Service.pm	14 Dec 2010 11:08:56 -0000	1.10
+++ Service.pm	25 Mar 2013 19:08:08 -0000	1.10.2.1
@@ -1,5 +1,5 @@
 # --
 # Kernel/System/LinkObject/Service.pm - to link service objects
-# Copyright (C) 2001-2010 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -15,4 +15,5 @@
 use warnings;
 
+use Kernel::System::Group;
 use Kernel::System::Service;
 
@@ -33,4 +34,5 @@
 
     # create additional objects
+    $Self->{GroupObject}   = Kernel::System::Group->new( %{$Self} );
     $Self->{ServiceObject} = Kernel::System::Service->new( %{$Self} );
 
@@ -100,4 +102,75 @@
 }
 
+=item ObjectPermission()
+
+checks read permission for a given object and UserID.
+
+    $Permission = $LinkObject->ObjectPermission(
+        Object  => 'Service',
+        Key     => 123,
+        UserID  => 1,
+    );
+
+=cut
+
+sub ObjectPermission {
+    my ( $Self, %Param ) = @_;
+
+    # check needed stuff
+    for my $Argument (qw(Object Key UserID)) {
+        if ( !$Param{$Argument} ) {
+            $Self->{LogObject}->Log(
+                Priority => 'error',
+                Message  => "Need $Argument!",
+            );
+            return;
+        }
+    }
+
+    # check module registry of AgentITSMServiceZoom
+    my $ModuleReg = $Self->{ConfigObject}->Get('Frontend::Module')->{AgentITSMServiceZoom};
+
+    # do not grant access if frontend module is not registered
+    return if !$ModuleReg;
+
+    # grant access if module permisson has no Group or GroupRo defined
+    if ( !$ModuleReg->{GroupRo} && !$ModuleReg->{Group} ) {
+        return 1;
+    }
+
+    PERMISSION:
+    for my $Permission (qw(GroupRo Group)) {
+
+        next PERMISSION if !$ModuleReg->{$Permission};
+        next PERMISSION if ref $ModuleReg->{$Permission} ne 'ARRAY';
+
+        for my $Group ( @{ $ModuleReg->{$Permission} } ) {
+
+            # get the group id
+            my $GroupID = $Self->{GroupObject}->GroupLookup( Group => $Group );
+
+            my $Type;
+            if ( $Permission eq 'GroupRo' ) {
+                $Type = 'ro';
+            }
+            elsif ( $Permission eq 'Group' ) {
+                $Type = 'rw';
+            }
+
+            # get user groups, where the user has the appropriate privilege
+            my %Groups = $Self->{GroupObject}->GroupMemberList(
+                UserID => $Param{UserID},
+                Type   => $Type,
+                Result => 'HASH',
+            );
+
+            # grant access if agent is a member in the group
+            return 1 if $Groups{$GroupID};
+        }
+    }
+
+    return;
+}
+
 =item ObjectDescriptionGet()
 
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log