Slightly refactored Aegir attachment server

"Henri Bergius" <henri.bergius-ZpG/[email protected]> Mon, 20 Feb 2006 11:22:54 +0200 (EET)
Newsgroups gmane.comp.web.midgard.devel
Message-ID <[email protected]>
Hi!

I was visiting a client who wanted to use the Aegir ViewerGroups feature
with attachments. The Aegir image pop-up provides this functionality but
it didn't work in practice.

First suspected cause was that since the client was using NTLM, the
attachment server didn't get authentication info. I switched the
attachment host to "auth required", and now $midgard->user was populated.

However, the attachment server still didn't see the permissions properly.
The problem was that the authentication information was never passed to
the display_default_image() function that actually does the ViewerGroup
checks. To fix this, I refactored it a bit, resulting to the file that is
attached.

I regard this as a temporary fix because soon we will want to switch to
MidCOM 2.5 and start using regular midgard:read ACLs for this. But before
there is MidCOM-aware attachment pop-up this is impossible.

/Bergie

-- 
Henri Bergius
Consultant Partner, Nemein
henri.bergius-ZpG/[email protected]

Midgard CMS
www.midgard-project.org

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe-b5ZhpPVuLA+tlBvVaVFjCkB+6BGkLq7r@public.gmane.org
For additional commands, e-mail: [email protected]
aegir-attachments.php (application/octet-stream, 6.2 KB)
<?php
/*
* Updated 2003-08-20 to include caching support from
* The Wilderness Society - Australia
*/
$debug=1;

function display_default_image($id=0, $errormessage="") 
{
    global $HTTP_HOST, $mgduser, $info, $debug, $HTTP_IF_NONE_MATCH, $HTTP_IF_MODIFIED_SINCE, $SERVER_PORT;
    // default image is $info->id;
    if ($id)
    {
        // I only want to cache images on port 80
        if($SERVER_PORT == 80)
        {
            ?><(caching_headers_attachments)><?php
        }

        $att=mgd_get_attachment($id);

        // Auth required?
        if ($att->parameter("Auth","required") == 'Y')
        {
            $authreq = true;
        }
        else
        {
            $authreq = false;
        }

        // Auth required and user auth'ed
        if ($authreq && $mgduser)
        {

            $allow = false;

            // Get viewer groups
            if($tmppar=$att->listparameters("Auth"))
            {
                while($tmppar->fetch())
                {
                    if ($tmppar->name=="required")
                    {
                        continue;
                    }

                    if ($tmppar->name=="all") 
                    {
                        $allow = true;
                        break;
                    }

                    $vg[]=$tmppar->name;
                }
            }

            // If group is not "all"
            if (!$allow)
            {

                // Get $Mgduser membership
                if ($ms = mgd_list_memberships( $mgduser->id))
                {
                    while ($ms->fetch())
                    {
                        if($tmpgrp=mgd_get_group($ms->gid)) 
                        {
                            if (in_array($tmpgrp->guid(), $vg))
                            {
                                $allow = true;
                            }
                        }
                    }
                }

                // Perhaps $mgduser is $att owner?
                if (!$allow && $att->author==$mgduser->id)
                {
                    $allow = true;
                }
            }

        }
        elseif($authreq)
        {
            // Auth required but no user auth'ed
            $allow = false;
        }
        else
        {
            // Auth not required dont bother the user
            $allow = true;
        }

        if ($allow)
        {
            mgd_serve_attachment($id);
            exit;
        }
        else
        {
            header("HTTP/1.1 403 Forbidden");
            exit;
        }
    }

    if ($debug) 
    { 
        echo "ATTACHMENT SERVING ERROR: {$errormessage}, ".mgd_errstr(); 
    } 
    else 
    {   
        header("location: http://".$HTTP_HOST."/images/error.gif");
    }  
    exit;
}

if ($GLOBALS['midgard']->user)
{
    $mgduser = mgd_get_person($GLOBALS['midgard']->user);
}
else
{
    // Check auth via NemeinAuth
    // Include the NemeinAuthentication library
    mgd_include_snippet("/Nemein_Authentication/init");
    $mgduser = 0;
    if (auth_by_cookies()) 
    {
        $mgduser = mgd_get_person($midgard->user);
    }
}


$defaultid= 0;

// A. DEAL WITH direct guid label
// if it matches name + 
if ($images) 
{
    unset($images);
}
 
if ($argv[0] != "find") 
{
    $argv[3]=$argv[1];
    if (function_exists("mgd_get_object_by_guid")) 
    {
        if ($info = mgd_get_object_by_guid($argv[0])) 
        {
            // this should do the resize test!!!!
            if ($argv[1] == $info->name)  
            { 
                if (eregi("_[0-9]+x[0-9]+\.jpg",$argv[1]) && $midgardauth)
                {
                    $images[$info->name] = $info->id;
                } 
                    else 
                { 
                    // exact match!
                    display_default_image($info->id,"failed to serve image - $info->name | ".$argv[1]);
                    break;
                }
            }
        }
        $defaultid = $info->id;     
        if (!$info) 
        {
            display_default_image(0,"guid broken does not point to valid object");
        }
        $argv[1]=$info->ptable;
        $argv[2]=$info->pid;
    }
} 
else
{    
    // if it is a find condition!
    // attempt to find it!
    $attempted=0;
    $mgd_get="mgd_get_".$argv[1];
    $object = $mgd_get($argv[2]);
    $argv[3] = trim(strtolower($argv[3]));
    if (!$object)  
    {
        display_default_image(0,"find does not point to valid object");
    }
    if (eregi("_[0-9]+x[0-9]+\.jpg",$argv[3]))   
    {
        $shortname = ereg_replace("_[0-9]+x[0-9]+\.jpg",".jpg",$argv[3]);
    }

    // loop to find the object
    if ($shortname) 
    {
        if ($attobj = $object->getattachment($shortname)) 
        {
            $images[$shortname] = $attobj->id; 
            $defaultid=$attobj->id;
        }
        if ($attobj = $object->getattachment($argv[3])) 
        {
            display_default_image($attobj->id,"failed to serve image - midgard problem");
        }
    }
}

// have now attempted both versions!
// attempt to make a resized version!
if ($args) 
{
    unset($args);
}
if (!eregi("^(.*)_([0-9]+)x([0-9]+)\.jpg$",$argv[3],$args))
{
    display_default_image($defaultid,"not a 00x00" );
}
  
// find out the image is in our store?
if (!$images[$args[1].".jpg"])  
{
    display_default_image($defaultid,"not jpg".serialize($images)); 
}

if (($args[2] > 0) && (($args[2] < 5) || ($args[3] < 5)))  
{
    display_default_image($defaultid,"smaller than 5 or not jpg"); 
}
    
if (!function_exists("imagetypes")) 
{
    display_default_image($defaultid,"no libgd extension"); 
}

if (!(ImageTypes() & IMG_JPG))  
{
    display_default_image($defaultid,"no jpeg support in libgd extension"); 
}

$imagedebug=$debug;  
mgd_include_snippet("AegirCore_host/lib/auth");
$debug=$imagedebug;
// assume that auth has worked!!!
// we may need to check the sitegroup matches later!
 
// see if the image 
// now create a scaled down version of the image!
    
mgd_include_snippet("AegirCore/lib/image_resize");
    
$id = resize_attachment($images[$args[1].".jpg"] , $args[2],$args[3]);
if ($id) display_default_image($id,"resized image display failure"); 
{
    display_default_image($defaultid,"resized image failed to return value"); 
}
?>