Slightly refactored Aegir attachment server
"Henri Bergius" <henri.bergius-ZpG/[email protected]> Mon, 20 Feb 2006 11:22:54 +0200 (EET)
| Newsgroups | gmane.comp.web.midgard.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi! I was visiting a client who wanted to use the Aegir ViewerGroups feature with attachments. The Aegir image pop-up provides this functionality but it didn't work in practice. First suspected cause was that since the client was using NTLM, the attachment server didn't get authentication info. I switched the attachment host to "auth required", and now $midgard->user was populated. However, the attachment server still didn't see the permissions properly. The problem was that the authentication information was never passed to the display_default_image() function that actually does the ViewerGroup checks. To fix this, I refactored it a bit, resulting to the file that is attached. I regard this as a temporary fix because soon we will want to switch to MidCOM 2.5 and start using regular midgard:read ACLs for this. But before there is MidCOM-aware attachment pop-up this is impossible. /Bergie -- Henri Bergius Consultant Partner, Nemein henri.bergius-ZpG/[email protected] Midgard CMS www.midgard-project.org --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscribe-b5ZhpPVuLA+tlBvVaVFjCkB+6BGkLq7r@public.gmane.org For additional commands, e-mail: [email protected]
aegir-attachments.php
(application/octet-stream, 6.2 KB)
<?php
/*
* Updated 2003-08-20 to include caching support from
* The Wilderness Society - Australia
*/
$debug=1;
function display_default_image($id=0, $errormessage="")
{
global $HTTP_HOST, $mgduser, $info, $debug, $HTTP_IF_NONE_MATCH, $HTTP_IF_MODIFIED_SINCE, $SERVER_PORT;
// default image is $info->id;
if ($id)
{
// I only want to cache images on port 80
if($SERVER_PORT == 80)
{
?><(caching_headers_attachments)><?php
}
$att=mgd_get_attachment($id);
// Auth required?
if ($att->parameter("Auth","required") == 'Y')
{
$authreq = true;
}
else
{
$authreq = false;
}
// Auth required and user auth'ed
if ($authreq && $mgduser)
{
$allow = false;
// Get viewer groups
if($tmppar=$att->listparameters("Auth"))
{
while($tmppar->fetch())
{
if ($tmppar->name=="required")
{
continue;
}
if ($tmppar->name=="all")
{
$allow = true;
break;
}
$vg[]=$tmppar->name;
}
}
// If group is not "all"
if (!$allow)
{
// Get $Mgduser membership
if ($ms = mgd_list_memberships( $mgduser->id))
{
while ($ms->fetch())
{
if($tmpgrp=mgd_get_group($ms->gid))
{
if (in_array($tmpgrp->guid(), $vg))
{
$allow = true;
}
}
}
}
// Perhaps $mgduser is $att owner?
if (!$allow && $att->author==$mgduser->id)
{
$allow = true;
}
}
}
elseif($authreq)
{
// Auth required but no user auth'ed
$allow = false;
}
else
{
// Auth not required dont bother the user
$allow = true;
}
if ($allow)
{
mgd_serve_attachment($id);
exit;
}
else
{
header("HTTP/1.1 403 Forbidden");
exit;
}
}
if ($debug)
{
echo "ATTACHMENT SERVING ERROR: {$errormessage}, ".mgd_errstr();
}
else
{
header("location: http://".$HTTP_HOST."/images/error.gif");
}
exit;
}
if ($GLOBALS['midgard']->user)
{
$mgduser = mgd_get_person($GLOBALS['midgard']->user);
}
else
{
// Check auth via NemeinAuth
// Include the NemeinAuthentication library
mgd_include_snippet("/Nemein_Authentication/init");
$mgduser = 0;
if (auth_by_cookies())
{
$mgduser = mgd_get_person($midgard->user);
}
}
$defaultid= 0;
// A. DEAL WITH direct guid label
// if it matches name +
if ($images)
{
unset($images);
}
if ($argv[0] != "find")
{
$argv[3]=$argv[1];
if (function_exists("mgd_get_object_by_guid"))
{
if ($info = mgd_get_object_by_guid($argv[0]))
{
// this should do the resize test!!!!
if ($argv[1] == $info->name)
{
if (eregi("_[0-9]+x[0-9]+\.jpg",$argv[1]) && $midgardauth)
{
$images[$info->name] = $info->id;
}
else
{
// exact match!
display_default_image($info->id,"failed to serve image - $info->name | ".$argv[1]);
break;
}
}
}
$defaultid = $info->id;
if (!$info)
{
display_default_image(0,"guid broken does not point to valid object");
}
$argv[1]=$info->ptable;
$argv[2]=$info->pid;
}
}
else
{
// if it is a find condition!
// attempt to find it!
$attempted=0;
$mgd_get="mgd_get_".$argv[1];
$object = $mgd_get($argv[2]);
$argv[3] = trim(strtolower($argv[3]));
if (!$object)
{
display_default_image(0,"find does not point to valid object");
}
if (eregi("_[0-9]+x[0-9]+\.jpg",$argv[3]))
{
$shortname = ereg_replace("_[0-9]+x[0-9]+\.jpg",".jpg",$argv[3]);
}
// loop to find the object
if ($shortname)
{
if ($attobj = $object->getattachment($shortname))
{
$images[$shortname] = $attobj->id;
$defaultid=$attobj->id;
}
if ($attobj = $object->getattachment($argv[3]))
{
display_default_image($attobj->id,"failed to serve image - midgard problem");
}
}
}
// have now attempted both versions!
// attempt to make a resized version!
if ($args)
{
unset($args);
}
if (!eregi("^(.*)_([0-9]+)x([0-9]+)\.jpg$",$argv[3],$args))
{
display_default_image($defaultid,"not a 00x00" );
}
// find out the image is in our store?
if (!$images[$args[1].".jpg"])
{
display_default_image($defaultid,"not jpg".serialize($images));
}
if (($args[2] > 0) && (($args[2] < 5) || ($args[3] < 5)))
{
display_default_image($defaultid,"smaller than 5 or not jpg");
}
if (!function_exists("imagetypes"))
{
display_default_image($defaultid,"no libgd extension");
}
if (!(ImageTypes() & IMG_JPG))
{
display_default_image($defaultid,"no jpeg support in libgd extension");
}
$imagedebug=$debug;
mgd_include_snippet("AegirCore_host/lib/auth");
$debug=$imagedebug;
// assume that auth has worked!!!
// we may need to check the sitegroup matches later!
// see if the image
// now create a scaled down version of the image!
mgd_include_snippet("AegirCore/lib/image_resize");
$id = resize_attachment($images[$args[1].".jpg"] , $args[2],$args[3]);
if ($id) display_default_image($id,"resized image display failure");
{
display_default_image($defaultid,"resized image failed to return value");
}
?>