/src/typo3_src-4.2.0alpha1/t3lib/class.t3lib_userauthgroup.php

<?php
/***************************************************************
*  Copyright notice
*
*  (c) 1999-2006 Kasper Skaarhoj (kasperYYYY@typo3.com)
*  All rights reserved
*
*  This script is part of the TYPO3 project. The TYPO3 project is
*  free software; you can redistribute it and/or modify
*  it under the terms of the GNU General Public License as published by
*  the Free Software Foundation; either version 2 of the License, or
*  (at your option) any later version.
*
*  The GNU General Public License can be found at
*  http://www.gnu.org/copyleft/gpl.html.
*  A copy is found in the textfile GPL.txt and important notices to the license
*  from the author is found in LICENSE.txt distributed with these scripts.
*
*
*  This script is distributed in the hope that it will be useful,
*  but WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
*  GNU General Public License for more details.
*
*  This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
        // Need this for parsing User TSconfig
require_once (PATH_t3lib.'class.t3lib_tsparser.php');





















class t3lib_userAuthGroup extends t3lib_userAuth {
        var $usergroup_column = 'usergroup';            // Should be set to the usergroup-column (id-list) in the user-record
        var $usergroup_table = 'be_groups';                     // The name of the group-table

                // internal
        var $groupData = Array(                         // This array holds lists of eg. tables, fields and other values related to the permission-system. See fetchGroupData
                'filemounts' => Array()                 // Filemounts are loaded here
        );
        var $workspace = -99;                           // User workspace. -99 is ERROR (none available), -1 is offline, 0 is online, >0 is custom workspaces.
        var $workspaceRec = array();            // Custom workspace record if any

        var $userGroups = Array();                      // This array will hold the groups that the user is a member of
        var $userGroupsUID = Array();           // This array holds the uid's of the groups in the listed order
        var $groupList ='';                                     // This is $this->userGroupsUID imploded to a comma list... Will correspond to the 'usergroup_cached_list'
        var $dataLists=array(                           // Used internally to accumulate data for the user-group. DONT USE THIS EXTERNALLY! Use $this->groupData instead
                'webmount_list'=>'',
                'filemount_list'=>'',
                'modList'=>'',
                'tables_select'=>'',
                'tables_modify'=>'',
                'pagetypes_select'=>'',
                'non_exclude_fields'=>'',
                'explicit_allowdeny'=>'',
                'allowed_languages' => '',
                'workspace_perms' => '',
                'custom_options' => '',
        );
        var $includeHierarchy=array();          // For debugging/display of order in which subgroups are included.
        var $includeGroupArray=array();         // List of group_id's in the order they are processed.

        var $OS='';                                                     // Set to 'WIN', if windows
        var $TSdataArray=array();                       // Used to accumulate the TSconfig data of the user
        var $userTS_text = '';                          // Contains the non-parsed user TSconfig
        var $userTS = array();                          // Contains the parsed user TSconfig
        var $userTSUpdated=0;                           // Set internally if the user TSconfig was parsed and needs to be cached.
        var $userTS_dontGetCached=0;            // Set this from outside if you want the user TSconfig to ALWAYS be parsed and not fetched from cache.

        var $RTE_errors = array();                      // RTE availability errors collected.
        var $errorMsg = '';                                     // Contains last error message

        var $checkWorkspaceCurrent_cache=NULL;  // Cache for checkWorkspaceCurrent()











        /************************************
         *
         * Permission checking functions:
         *
         ************************************/

        function isAdmin()      {
                return (($this->user['admin']&1) ==1);
        }

        function isMemberOfGroup($groupId)      {
                $groupId = intval($groupId);
                if ($this->groupList && $groupId)       {
                        return $this->inList($this->groupList, $groupId);
                }
        }

        function doesUserHaveAccess($row,$perms)        {
                $userPerms = $this->calcPerms($row);
                return ($userPerms & $perms)==$perms;
        }

        function isInWebMount($id,$readPerms='',$exitOnError=0) {
                if (!$GLOBALS['TYPO3_CONF_VARS']['BE']['lockBeUserToDBmounts'] || $this->isAdmin())     return 1;
                $id = intval($id);

                        // Check if input id is an offline version page in which case we will map id to the online version:
                $checkRec = t3lib_beFUnc::getRecord('pages',$id,'pid,t3ver_oid');
                if ($checkRec['pid']==-1)       {
                        $id = intval($checkRec['t3ver_oid']);
                }

                if (!$readPerms)        $readPerms = $this->getPagePermsClause(1);
                if ($id>0)      {
                        $wM = $this->returnWebmounts();
                        $rL = t3lib_BEfunc::BEgetRootLine($id,' AND '.$readPerms);

                        foreach($rL as $v)      {
                                if ($v['uid'] && in_array($v['uid'],$wM))       {
                                        return $v['uid'];
                                }
                        }
                }
                if ($exitOnError)       {
                        t3lib_BEfunc::typo3PrintError ('Access Error','This page is not within your DB-mounts',0);
                        exit;
                }
        }

        function modAccess($conf,$exitOnError)  {
                if (!t3lib_BEfunc::isModuleSetInTBE_MODULES($conf['name']))     {
                        if ($exitOnError)       {
                                t3lib_BEfunc::typo3PrintError ('Fatal Error','This module "'.$conf['name'].'" is not enabled in TBE_MODULES',0);
                                exit;
                        }
                        return FALSE;
                }

                        // Workspaces check:
                if ($conf['workspaces'])        {
                        if (($this->workspace===0 && t3lib_div::inList($conf['workspaces'],'online')) ||
                                ($this->workspace===-1 && t3lib_div::inList($conf['workspaces'],'offline')) ||
                                ($this->workspace>0 && t3lib_div::inList($conf['workspaces'],'custom')))        {
                                        // ok, go on...
                        } else {
                                if ($exitOnError)       {
                                        t3lib_BEfunc::typo3PrintError ('Workspace Error','This module "'.$conf['name'].'" is not available under the current workspace',0);
                                        exit;
                                }
                                return FALSE;
                        }
                }

                        // Returns true if conf[access] is not set at all or if the user is admin
                if (!$conf['access']  ||  $this->isAdmin()) return TRUE;

                        // If $conf['access'] is set but not with 'admin' then we return true, if the module is found in the modList
                if (!strstr($conf['access'],'admin') && $conf['name'])  {
                        $acs = $this->check('modules',$conf['name']);
                }
                if (!$acs && $exitOnError)      {
                        t3lib_BEfunc::typo3PrintError ('Access Error','You don\'t have access to this module.',0);
                        exit;
                } else return $acs;
        }

        function getPagePermsClause($perms)     {
                global $TYPO3_CONF_VARS;
                if (is_array($this->user))      {
                        if ($this->isAdmin())   {
                                return ' 1=1';
                        }

                        $perms = intval($perms);        // Make sure it's integer.
                        $str= ' ('.
                                '(pages.perms_everybody & '.$perms.' = '.$perms.')'.    // Everybody
                                'OR(pages.perms_userid = '.$this->user['uid'].' AND pages.perms_user & '.$perms.' = '.$perms.')';       // User
                        if ($this->groupList)   {
                                $str.= 'OR(pages.perms_groupid in ('.$this->groupList.') AND pages.perms_group & '.$perms.' = '.$perms.')';     // Group (if any is set)
                        }
                        $str.=')';

                        // ****************
                        // getPagePermsClause-HOOK
                        // ****************
                        if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['getPagePermsClause'])) {

                                foreach($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['getPagePermsClause'] as $_funcRef) {
                                        $_params = array('currentClause' => $str, 'perms' => $perms);
                                        $str = t3lib_div::callUserFunction($_funcRef, $_params, $this);
                                }
                        }

                        return $str;
                } else {
                        return ' 1=0';
                }
        }

        function calcPerms($row)        {
                global $TYPO3_CONF_VARS;
                if ($this->isAdmin()) {return 31;}              // Return 31 for admin users.

                $out=0;
                if (isset($row['perms_userid']) && isset($row['perms_user']) && isset($row['perms_groupid']) && isset($row['perms_group']) && isset($row['perms_everybody']) && isset($this->groupList))        {
                        if ($this->user['uid']==$row['perms_userid'])   {
                                $out|=$row['perms_user'];
                        }
                        if ($this->isMemberOfGroup($row['perms_groupid']))      {
                                $out|=$row['perms_group'];
                        }
                        $out|=$row['perms_everybody'];
                }

                // ****************
                // CALCPERMS hook
                // ****************
                if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['calcPerms'])) {
                        foreach($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['calcPerms'] as $_funcRef) {
                                $_params = array(
                                        'row' => $row,
                                        'outputPermissions' => $out
                                );
                                $out = t3lib_div::callUserFunction($_funcRef, $_params, $this);
                        }
                }

                return $out;
        }

        function isRTE()        {
                global $CLIENT;

                        // Start:
                $this->RTE_errors = array();
                if (!$this->uc['edit_RTE'])
                        $this->RTE_errors[] = 'RTE is not enabled for user!';
                if (!$GLOBALS['TYPO3_CONF_VARS']['BE']['RTEenabled'])
                        $this->RTE_errors[] = 'RTE is not enabled in $TYPO3_CONF_VARS["BE"]["RTEenabled"]';


                        // Acquire RTE object:
                $RTE = &t3lib_BEfunc::RTEgetObj();
                if (!is_object($RTE))   {
                        $this->RTE_errors = array_merge($this->RTE_errors, $RTE);
                }

                if (!count($this->RTE_errors))  {
                        return TRUE;
                } else {
                        return FALSE;
                }
        }

        function check($type,$value)    {
                if (isset($this->groupData[$type]))     {
                        if ($this->isAdmin() || $this->inList($this->groupData[$type],$value)) {
                                return 1;
                        }
                }
        }

        function checkAuthMode($table,$field,$value,$authMode)  {
                global $TCA;

                        // Admin users can do anything:
                if ($this->isAdmin())   return TRUE;

                        // Allow all blank values:
                if (!strcmp($value,'')) return TRUE;

                        // Certain characters are not allowed in the value
                if (ereg('[:|,]',$value))       {
                        return FALSE;
                }

                        // Initialize:
                $testValue = $table.':'.$field.':'.$value;
                $out = TRUE;

                        // Checking value:
                switch((string)$authMode)       {
                        case 'explicitAllow':
                                if (!$this->inList($this->groupData['explicit_allowdeny'],$testValue.':ALLOW')) {
                                        $out = FALSE;
                                }
                        break;
                        case 'explicitDeny':
                                if ($this->inList($this->groupData['explicit_allowdeny'],$testValue.':DENY'))   {
                                        $out = FALSE;
                                }
                        break;
                        case 'individual':
                                t3lib_div::loadTCA($table);
                                if (is_array($TCA[$table]) && is_array($TCA[$table]['columns'][$field]))        {
                                        $items = $TCA[$table]['columns'][$field]['config']['items'];
                                        if (is_array($items))   {
                                                foreach($items as $iCfg)        {
                                                        if (!strcmp($iCfg[1],$value) && $iCfg[4])       {
                                                                switch((string)$iCfg[4])        {
                                                                        case 'EXPL_ALLOW':
                                                                                if (!$this->inList($this->groupData['explicit_allowdeny'],$testValue.':ALLOW')) {
                                                                                        $out = FALSE;
                                                                                }
                                                                        break;
                                                                        case 'EXPL_DENY':
                                                                                if ($this->inList($this->groupData['explicit_allowdeny'],$testValue.':DENY'))   {
                                                                                        $out = FALSE;
                                                                                }
                                                                        break;
                                                                }
                                                                break;
                                                        }
                                                }
                                        }
                                }
                        break;
                }

                return $out;
        }

        function checkLanguageAccess($langValue)        {
                if (strcmp($this->groupData['allowed_languages'],''))   {       // The users language list must be non-blank - otherwise all languages are allowed.
                        $langValue = intval($langValue);
                        if ($langValue != -1 && !$this->check('allowed_languages',$langValue))  {       // Language must either be explicitly allowed OR the lang Value be "-1" (all languages)
                                return FALSE;
                        }
                }
                return TRUE;
        }

        function recordEditAccessInternals($table,$idOrRow,$newRecord=FALSE)    {
                global $TCA;

                if (isset($TCA[$table]))        {
                        t3lib_div::loadTCA($table);

                                // Always return true for Admin users.
                        if ($this->isAdmin())   return TRUE;

                                // Fetching the record if the $idOrRow variable was not an array on input:
                        if (!is_array($idOrRow))        {
                                $idOrRow = t3lib_BEfunc::getRecord($table, $idOrRow);
                                if (!is_array($idOrRow))        {
                                        $this->errorMsg = 'ERROR: Record could not be fetched.';
                                        return FALSE;
                                }
                        }

                                // Checking languages:
                        if ($TCA[$table]['ctrl']['languageField'])      {
                                if (isset($idOrRow[$TCA[$table]['ctrl']['languageField']]))     {       // Language field must be found in input row - otherwise it does not make sense.
                                        if (!$this->checkLanguageAccess($idOrRow[$TCA[$table]['ctrl']['languageField']]))       {
                                                $this->errorMsg = 'ERROR: Language was not allowed.';
                                                return FALSE;
                                        }
                                } else {
                                        $this->errorMsg = 'ERROR: The "languageField" field named "'.$TCA[$table]['ctrl']['languageField'].'" was not found in testing record!';
                                        return FALSE;
                                }
                        }

                                // Checking authMode fields:
                        if (is_array($TCA[$table]['columns']))  {
                                foreach($TCA[$table]['columns'] as $fN => $fV)  {
                                        if (isset($idOrRow[$fN]))       {       //
                                                if ($fV['config']['type']=='select' && $fV['config']['authMode'] && !strcmp($fV['config']['authMode_enforce'],'strict')) {
                                                        if (!$this->checkAuthMode($table,$fN,$idOrRow[$fN],$fV['config']['authMode']))  {
                                                                $this->errorMsg = 'ERROR: authMode "'.$fV['config']['authMode'].'" failed for field "'.$fN.'" with value "'.$idOrRow[$fN].'" evaluated';
                                                                return FALSE;
                                                        }
                                                }
                                        }
                                }
                        }

                                // Checking "editlock" feature (doesn't apply to new records)
                        if (!$newRecord && $TCA[$table]['ctrl']['editlock'])    {
                                if (isset($idOrRow[$TCA[$table]['ctrl']['editlock']]))  {
                                        if ($idOrRow[$TCA[$table]['ctrl']['editlock']]) {
                                                $this->errorMsg = 'ERROR: Record was locked for editing. Only admin users can change this state.';
                                                return FALSE;
                                        }
                                } else {
                                        $this->errorMsg = 'ERROR: The "editLock" field named "'.$TCA[$table]['ctrl']['editlock'].'" was not found in testing record!';
                                        return FALSE;
                                }
                        }

                                // Checking record permissions
                        // THIS is where we can include a check for "perms_" fields for other records than pages...

                                // Process any hooks
                        if (is_array($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['recordEditAccessInternals']))    {
                                foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['recordEditAccessInternals'] as $funcRef)     {
                                        $params = array(
                                                'table' => $table,
                                                'idOrRow' => $idOrRow,
                                                'newRecord' => $newRecord
                                        );
                                        if (!t3lib_div::callUserFunction($funcRef, $params, $this)) {
                                                return FALSE;
                                        }
                                }
                        }

                                // Finally, return true if all is well.
                        return TRUE;
                }
        }

        function isPSet($lCP,$table,$type='')   {
                if ($this->isAdmin())   return true;
                if ($table=='pages')    {
                        if ($type=='edit')      return $lCP & 2;
                        if ($type=='new')       return ($lCP & 8) || ($lCP & 16);       // Create new page OR pagecontent
                        if ($type=='delete')    return $lCP & 4;
                        if ($type=='editcontent')       return $lCP & 16;
                } else {
                        return $lCP & 16;
                }
        }

        function mayMakeShortcut()      {
                return $this->getTSConfigVal('options.shortcutFrame') && !$this->getTSConfigVal('options.mayNotCreateEditShortcuts');
        }

        function workspaceCannotEditRecord($table,$recData)     {

                if ($this->workspace!==0)       {       // Only test offline spaces:

                        if (!is_array($recData))        {
                                $recData = t3lib_BEfunc::getRecord($table,$recData,'pid'.($GLOBALS['TCA'][$table]['ctrl']['versioningWS']?',t3ver_wsid,t3ver_stage':''));
                        }

                        if (is_array($recData)) {
                                if ((int)$recData['pid']===-1)  {       // We are testing a "version" (identified by a pid of -1): it can be edited provided that workspace matches and versioning is enabled for the table.
                                        if (!$GLOBALS['TCA'][$table]['ctrl']['versioningWS'])   {       // No versioning, basic error, inconsistency even! Such records should not have a pid of -1!
                                                return 'Versioning disabled for table';
                                        } elseif ((int)$recData['t3ver_wsid']!==$this->workspace)       {       // So does workspace match?
                                                return 'Workspace ID of record didn\'t match current workspace';
                                        } else {        // So what about the stage of the version, does that allow editing for this user?
                                                return $this->workspaceCheckStageForCurrent($recData['t3ver_stage']) ? FALSE : 'Record stage "'.$recData['t3ver_stage'].'" and users access level did not allow for editing';
                                        }
                                } else {        // We are testing a "live" record:
                                        if ($res = $this->workspaceAllowLiveRecordsInPID($recData['pid'], $table)) {    // For "Live" records, check that PID for table allows editing
                                                        // Live records are OK in this branch, but what about the stage of branch point, if any:
                                                return $res>0 ? FALSE : 'Stage for versioning root point and users access level did not allow for editing';     // OK
                                        } else {        // If not offline and not in versionized branch, output error:
                                                return 'Online record was not in versionized branch!';
                                        }
                                }
                        } else return 'No record';
                } else {
                        return FALSE;   // OK because workspace is 0
                }
        }

        function workspaceCannotEditOfflineVersion($table,$recData)     {
                if ($GLOBALS['TCA'][$table]['ctrl']['versioningWS'])    {

                        if (!is_array($recData))        {
                                $recData = t3lib_BEfunc::getRecord($table,$recData,'uid,pid,t3ver_wsid,t3ver_stage');
                        }
                        if (is_array($recData)) {
                                if ((int)$recData['pid']===-1)  {
                                        return $this->workspaceCannotEditRecord($table,$recData);
                                } else return 'Not an offline version';
                        } else return 'No record';
                } else return 'Table does not support versioning.';
        }

        function workspaceAllowLiveRecordsInPID($pid, $table)   {

                        // Always for Live workspace AND if live-edit is enabled and tables are completely without versioning it is ok as well.
                if ($this->workspace===0 || ($this->workspaceRec['live_edit'] && !$GLOBALS['TCA'][$table]['ctrl']['versioningWS']))     {
                        return 2;       // OK to create for this table.
                } elseif (t3lib_BEfunc::isPidInVersionizedBranch($pid, $table)) {       // Check if records from $table can be created with this PID: Either if inside "branch" versioning type or a "versioning_followPages" table on a "page" versioning type.
                                // Now, check what the stage of that "page" or "branch" version type is:
                        $stage = t3lib_BEfunc::isPidInVersionizedBranch($pid, $table, TRUE);
                        return $this->workspaceCheckStageForCurrent($stage) ? 1 : -1;
                } else {
                        return FALSE;   // If the answer is FALSE it means the only valid way to create or edit records in the PID is by versioning
                }
        }

        function workspaceCreateNewRecord($pid, $table) {
                if ($res = $this->workspaceAllowLiveRecordsInPID($pid,$table))  {       // If LIVE records cannot be created in the current PID due to workspace restrictions, prepare creation of placeholder-record
                        if ($res<0)     {
                                return FALSE;   // Stage for versioning root point and users access level did not allow for editing
                        }
                } elseif (!$GLOBALS['TCA'][$table]['ctrl']['versioningWS'])     {       // So, if no live records were allowed, we have to create a new version of this record:
                        return FALSE;
                }
                return TRUE;
        }

        function workspaceAllowAutoCreation($table,$id,$recpid) {
                        // Auto-creation of version: In offline workspace, test if versioning is enabled and look for workspace version of input record. If there is no versionized record found we will create one and save to that.
                if ($this->workspace!==0        // Only in draft workspaces
                        && !$this->workspaceRec['disable_autocreate']   // Auto-creation must not be disabled.
                        && $GLOBALS['TCA'][$table]['ctrl']['versioningWS']      // Table must be versionizable
                        && $recpid >= 0 // The PID of the record must NOT be -1 or less (would indicate that it already was a version!)
                        && !t3lib_BEfunc::getWorkspaceVersionOfRecord($this->workspace, $table, $id, 'uid')     // There must be no existing version of this record in workspace.
                        && !t3lib_BEfunc::isPidInVersionizedBranch($recpid, $table))    {       // PID must NOT be in a versionized branch either
                                return TRUE;
                }
        }

        function workspaceCheckStageForCurrent($stage)  {
                if ($this->isAdmin())   return TRUE;

                if ($this->workspace>0) {
                        $stat = $this->checkWorkspaceCurrent();
                        $memberStageLimit = $this->workspaceRec['review_stage_edit'] ? 1 : 0;
                        if (($stage<=$memberStageLimit && $stat['_ACCESS']==='member') ||
                                ($stage<=1 && $stat['_ACCESS']==='reviewer') ||
                                ($stat['_ACCESS']==='owner')) {
                                        return TRUE;    // OK for these criteria
                        }
                } else return TRUE;     // Always OK for live and draft workspaces.
        }

        function workspacePublishAccess($wsid)  {
                if ($this->isAdmin())   return TRUE;

                        // If no access to workspace, of course you cannot publish!
                $retVal = FALSE;

                $wsAccess = $this->checkWorkspace($wsid);
                if ($wsAccess)  {
                        switch($wsAccess['uid'])        {
                                case 0:         // Live workspace
                                        $retVal =  TRUE;        // If access to Live workspace, no problem.
                                break;
                                case -1:        // Default draft workspace
                                        $retVal =  $this->checkWorkspace(0) ? TRUE : FALSE;     // If access to Live workspace, no problem.
                                break;
                                default:        // Custom workspace
                                        $retVal =  $wsAccess['_ACCESS'] === 'owner' || ($this->checkWorkspace(0) && !($wsAccess['publish_access']&2));  // Either be an adminuser OR have access to online workspace which is OK as well as long as publishing access is not limited by workspace option.
                                break;
                        }
                }
                return $retVal;
        }

        function workspaceSwapAccess()  {
                if ($this->workspace>0 && (int)$this->workspaceRec['swap_modes']===2)   {
                        return FALSE;
                } else return TRUE;
        }

        function workspaceVersioningTypeAccess($type)   {
                $retVal = FALSE;

                $type = t3lib_div::intInRange($type,-1);
                
                        // Check if only element versioning is allowed:
                if ($GLOBALS['TYPO3_CONF_VARS']['BE']['elementVersioningOnly'] && $type!=-1)    {
                        return FALSE;
                }
                
                if ($this->workspace>0 && !$this->isAdmin())    {
                        $stat = $this->checkWorkspaceCurrent();
                        if ($stat['_ACCESS']!=='owner') {

                                switch((int)$type)      {
                                        case -1:
                                                $retVal = $this->workspaceRec['vtypes']&1 ? FALSE : TRUE;
                                        break;
                                        case 0:
                                                $retVal = $this->workspaceRec['vtypes']&2 ? FALSE : TRUE;
                                        break;
                                        default:
                                                $retVal = $this->workspaceRec['vtypes']&4 ? FALSE : TRUE;
                                        break;
                                }
                        } else $retVal = TRUE;
                } else $retVal = TRUE;

                return $retVal;
        }

        function workspaceVersioningTypeGetClosest($type)       {
                $type = t3lib_div::intInRange($type,-1);

                if ($this->workspace>0) {
                        switch((int)$type)      {
                                case -1:
                                        $type = -1;
                                break;
                                case 0:
                                        $type = $this->workspaceVersioningTypeAccess($type) ? $type : -1;
                                break;
                                default:
                                        $type = $this->workspaceVersioningTypeAccess($type) ? $type : ($this->workspaceVersioningTypeAccess(0) ? 0 : -1);
                                break;
                        }
                }
                return $type;
        }










        /*************************************
         *
         * Miscellaneous functions
         *
         *************************************/

        function getTSConfig($objectString,$config='')  {
                if (!is_array($config)) {
                        $config=$this->userTS;  // Getting Root-ts if not sent
                }
                $TSConf=array();
                $parts = explode('.',$objectString,2);
                $key = $parts[0];
                if (trim($key)) {
                        if (count($parts)>1 && trim($parts[1])) {
                                // Go on, get the next level
                                if (is_array($config[$key.'.']))        $TSConf = $this->getTSConfig($parts[1],$config[$key.'.']);
                        } else {
                                $TSConf['value']=$config[$key];
                                $TSConf['properties']=$config[$key.'.'];
                        }
                }
                return $TSConf;
        }

        function getTSConfigVal($objectString)  {
                $TSConf = $this->getTSConfig($objectString);
                return $TSConf['value'];
        }

        function getTSConfigProp($objectString) {
                $TSConf = $this->getTSConfig($objectString);
                return $TSConf['properties'];
        }

        function inList($in_list,$item) {
                return strstr(','.$in_list.',', ','.$item.',');
        }

        function returnWebmounts()      {
                return (string)($this->groupData['webmounts'])!='' ? explode(',',$this->groupData['webmounts']) : Array();
        }

        function returnFilemounts()     {
                return $this->groupData['filemounts'];
        }

         function jsConfirmation($bitmask)      {
                 $alertPopup = $GLOBALS['BE_USER']->getTSConfig('options.alertPopups');
                 if (empty($alertPopup['value']))       {
                         $alertPopup = 255;     // default: show all warnings
                 } else {
                         $alertPopup = (int)$alertPopup['value'];
                 }
                 if(($alertPopup&$bitmask) == $bitmask) { // show confirmation
                         return 1;
                 } else { // don't show confirmation
                         return 0;
                 }
         }









        /*************************************
         *
         * Authentication methods
         *
         *************************************/


        function fetchGroupData()       {
                if ($this->user['uid']) {

                                // Get lists for the be_user record and set them as default/primary values.
                        $this->dataLists['modList'] = $this->user['userMods'];                                  // Enabled Backend Modules
                        $this->dataLists['allowed_languages'] = $this->user['allowed_languages'];                                       // Add Allowed Languages
                        $this->dataLists['workspace_perms'] = $this->user['workspace_perms'];                                   // Set user value for workspace permissions.
                        $this->dataLists['webmount_list'] = $this->user['db_mountpoints'];              // Database mountpoints
                        $this->dataLists['filemount_list'] = $this->user['file_mountpoints'];   // File mountpoints

                                // Setting default User TSconfig:
                        $this->TSdataArray[]=$this->addTScomment('From $GLOBALS["TYPO3_CONF_VARS"]["BE"]["defaultUserTSconfig"]:').
                                                                        $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig'];

                                // Default TSconfig for admin-users
                        if ($this->isAdmin())   {
                                $this->TSdataArray[]=$this->addTScomment('"admin" user presets:').'
                                        admPanel.enable.all = 1
                                        options.shortcutFrame = 1
                                ';
                                if (t3lib_extMgm::isLoaded('sys_note')) {
                                        $this->TSdataArray[]='
                                                // Setting defaults for sys_note author / email...
                                                TCAdefaults.sys_note.author = '.$this->user['realName'].'
                                                TCAdefaults.sys_note.email = '.$this->user['email'].'
                                        ';
                                }
                        }

                                // FILE MOUNTS:
                                // Admin users has the base fileadmin dir mounted
                        if ($this->isAdmin() && $GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'])      {
                                $this->addFileMount($GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'], '', PATH_site.$GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'], 0, '');
                        }

                                // If userHomePath is set, we attempt to mount it
                        if ($GLOBALS['TYPO3_CONF_VARS']['BE']['userHomePath'])  {
                                        // First try and mount with [uid]_[username]
                                $didMount=$this->addFileMount($this->user['username'], '',$GLOBALS['TYPO3_CONF_VARS']['BE']['userHomePath'].$this->user['uid'].'_'.$this->user['username'].$GLOBALS['TYPO3_CONF_VARS']['BE']['userUploadDir'], 0, 'user');
                                if (!$didMount) {
                                                // If that failed, try and mount with only [uid]
                                        $this->addFileMount($this->user['username'], '', $GLOBALS['TYPO3_CONF_VARS']['BE']['userHomePath'].$this->user['uid'].$GLOBALS['TYPO3_CONF_VARS']['BE']['userUploadDir'], 0, 'user');
                                }
                        }

                                // BE_GROUPS:
                                // Get the groups...
#                       $grList = t3lib_BEfunc::getSQLselectableList($this->user[$this->usergroup_column],$this->usergroup_table,$this->usergroup_table);
                        $grList = $GLOBALS['TYPO3_DB']->cleanIntList($this->user[$this->usergroup_column]);     // 240203: Since the group-field never contains any references to groups with a prepended table name we think it's safe to just intExplode and re-implode - which should be much faster than the other function call.
                        if ($grList)    {
                                        // Fetch groups will add a lot of information to the internal arrays: modules, accesslists, TSconfig etc. Refer to fetchGroups() function.
                                $this->fetchGroups($grList);
                        }

                                // Add the TSconfig for this specific user:
                        $this->TSdataArray[] = $this->addTScomment('USER TSconfig field').$this->user['TSconfig'];
                                // Check include lines.
                        $this->TSdataArray = t3lib_TSparser::checkIncludeLines_array($this->TSdataArray);

                                // Parsing the user TSconfig (or getting from cache)
                        $this->userTS_text = implode(chr(10).'[GLOBAL]'.chr(10),$this->TSdataArray);    // Imploding with "[global]" will make sure that non-ended confinements with braces are ignored.
                        $hash = md5('userTS:'.$this->userTS_text);
                        $cachedContent = t3lib_BEfunc::getHash($hash,0);
                        if (isset($cachedContent) && !$this->userTS_dontGetCached)      {
                                $this->userTS = unserialize($cachedContent);
                        } else {
                                $parseObj = t3lib_div::makeInstance('t3lib_TSparser');
                                $parseObj->parse($this->userTS_text);
                                $this->userTS = $parseObj->setup;
                                t3lib_BEfunc::storeHash($hash,serialize($this->userTS),'BE_USER_TSconfig');
                                        // Update UC:
                                $this->userTSUpdated=1;
                        }

                                // Processing webmounts
                        if ($this->isAdmin() && !$this->getTSConfigVal('options.dontMountAdminMounts')) {       // Admin's always have the root mounted
                                $this->dataLists['webmount_list']='0,'.$this->dataLists['webmount_list'];
                        }

                                // Processing filemounts
                        $this->dataLists['filemount_list'] = t3lib_div::uniqueList($this->dataLists['filemount_list']);
                        if ($this->dataLists['filemount_list']) {
                                $res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'sys_filemounts', 'deleted=0 AND hidden=0 AND pid=0 AND uid IN ('.$this->dataLists['filemount_list'].')');
                                while ($row = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($res))      {
                                        $this->addFileMount($row['title'], $row['path'], $row['path'], $row['base']?1:0, '');
                                }
                        }

                                // The lists are cleaned for duplicates
                        $this->groupData['webmounts'] = t3lib_div::uniqueList($this->dataLists['webmount_list']);
                        $this->groupData['pagetypes_select'] = t3lib_div::uniqueList($this->dataLists['pagetypes_select']);
                        $this->groupData['tables_select'] = t3lib_div::uniqueList($this->dataLists['tables_modify'].','.$this->dataLists['tables_select']);
                        $this->groupData['tables_modify'] = t3lib_div::uniqueList($this->dataLists['tables_modify']);
                        $this->groupData['non_exclude_fields'] = t3lib_div::uniqueList($this->dataLists['non_exclude_fields']);
                        $this->groupData['explicit_allowdeny'] = t3lib_div::uniqueList($this->dataLists['explicit_allowdeny']);
                        $this->groupData['allowed_languages'] = t3lib_div::uniqueList($this->dataLists['allowed_languages']);
                        $this->groupData['custom_options'] = t3lib_div::uniqueList($this->dataLists['custom_options']);
                        $this->groupData['modules'] = t3lib_div::uniqueList($this->dataLists['modList']);
                        $this->groupData['workspace_perms'] = $this->dataLists['workspace_perms'];

                                // populating the $this->userGroupsUID -array with the groups in the order in which they were LAST included.!!
                        $this->userGroupsUID = array_reverse(array_unique(array_reverse($this->includeGroupArray)));

                                // Finally this is the list of group_uid's in the order they are parsed (including subgroups!) and without duplicates (duplicates are presented with their last entrance in the list, which thus reflects the order of the TypoScript in TSconfig)
                        $this->groupList = implode(',',$this->userGroupsUID);
                        $this->setCachedList($this->groupList);

                                // Checking read access to webmounts:
                        if (trim($this->groupData['webmounts'])!=='')   {
                                $webmounts = explode(',',$this->groupData['webmounts']);        // Explode mounts
                                $MProws = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows('uid', 'pages', 'deleted=0 AND uid IN ('.$this->groupData['webmounts'].') AND '.$this->getPagePermsClause(1),'','','','uid');        // Selecting all webmounts with permission clause for reading
                                foreach($webmounts as $idx => $mountPointUid)   {
                                        if ($mountPointUid>0 && !isset($MProws[$mountPointUid]))        {       // If the mount ID is NOT found among selected pages, unset it:
                                                unset($webmounts[$idx]);
                                        }
                                }
                                $this->groupData['webmounts'] = implode(',',$webmounts);        // Implode mounts in the end.
                        }

                                // Setting up workspace situation (after webmounts are processed!):
                        $this->workspaceInit();
                }
        }

        function fetchGroups($grList,$idList='')        {
                global $TYPO3_CONF_VARS;

                        // Fetching records of the groups in $grList (which are not blocked by lockedToDomain either):
                $lockToDomain_SQL = ' AND (lockToDomain=\'\' OR lockToDomain IS NULL OR lockToDomain=\''.t3lib_div::getIndpEnv('HTTP_HOST').'\')';
                $whereSQL = 'deleted=0 AND hidden=0 AND pid=0 AND uid IN ('.$grList.')'.$lockToDomain_SQL;

                        // Hook for manipulation of the WHERE sql sentence which controls which BE-groups are included
                if (is_array ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroupQuery'])) {
                    foreach ($GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroupQuery'] as $classRef) {
                        $hookObj = &t3lib_div::getUserObj($classRef);
                        if(method_exists($hookObj,'fetchGroupQuery_processQuery')){
                            $whereSQL = $hookObj->fetchGroupQuery_processQuery($this, $grList, $idList, $whereSQL);
                        }
                    }
                }

                $res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $this->usergroup_table, $whereSQL);

                        // The userGroups array is filled
                while ($row = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($res))      {
                        $this->userGroups[$row['uid']] = $row;
                }

                        // Traversing records in the correct order
                $include_staticArr = t3lib_div::intExplode(',',$grList);
                reset($include_staticArr);
                while(list(,$uid)=each($include_staticArr))     {       // traversing list

                                // Get row:
                        $row=$this->userGroups[$uid];
                        if (is_array($row) && !t3lib_div::inList($idList,$uid)) {       // Must be an array and $uid should not be in the idList, because then it is somewhere previously in the grouplist

                                        // Include sub groups
                                if (trim($row['subgroup']))     {
                                        $theList = implode(',',t3lib_div::intExplode(',',$row['subgroup']));    // Make integer list
                                        $this->fetchGroups($theList, $idList.','.$uid);         // Call recursively, pass along list of already processed groups so they are not recursed again.
                                }
                                        // Add the group uid, current list, TSconfig to the internal arrays.
                                $this->includeGroupArray[]=$uid;
                                $this->includeHierarchy[]=$idList;
                                $this->TSdataArray[] = $this->addTScomment('Group "'.$row['title'].'" ['.$row['uid'].'] TSconfig field:').$row['TSconfig'];

                                        // Mount group database-mounts
                                if (($this->user['options']&1) == 1)    {       $this->dataLists['webmount_list'].= ','.$row['db_mountpoints']; }

                                        // Mount group file-mounts
                                if (($this->user['options']&2) == 2)    {       $this->dataLists['filemount_list'].= ','.$row['file_mountpoints'];      }

                                        // Mount group home-dirs
                                if (($this->user['options']&2) == 2)    {
                                                // If groupHomePath is set, we attempt to mount it
                                        if ($GLOBALS['TYPO3_CONF_VARS']['BE']['groupHomePath']) {
                                                $this->addFileMount($row['title'], '', $GLOBALS['TYPO3_CONF_VARS']['BE']['groupHomePath'].$row['uid'], 0, 'group');
                                        }
                                }

                                        // The lists are made: groupMods, tables_select, tables_modify, pagetypes_select, non_exclude_fields, explicit_allowdeny, allowed_languages, custom_options
                                if ($row['inc_access_lists']==1)        {
                                        $this->dataLists['modList'].= ','.$row['groupMods'];
                                        $this->dataLists['tables_select'].= ','.$row['tables_select'];
                                        $this->dataLists['tables_modify'].= ','.$row['tables_modify'];
                                        $this->dataLists['pagetypes_select'].= ','.$row['pagetypes_select'];
                                        $this->dataLists['non_exclude_fields'].= ','.$row['non_exclude_fields'];
                                        $this->dataLists['explicit_allowdeny'].= ','.$row['explicit_allowdeny'];
                                        $this->dataLists['allowed_languages'].= ','.$row['allowed_languages'];
                                        $this->dataLists['custom_options'].= ','.$row['custom_options'];
                                }

                                        // Setting workspace permissions:
                                $this->dataLists['workspace_perms'] |= $row['workspace_perms'];

                                        // If this function is processing the users OWN group-list (not subgroups) AND if the ->firstMainGroup is not set, then the ->firstMainGroup will be set.
                                if (!strcmp($idList,'') && !$this->firstMainGroup)      {
                                        $this->firstMainGroup=$uid;
                                }
                        }
                }

                // ****************
                // HOOK: fetchGroups_postProcessing
                // ****************
                if (is_array($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroups_postProcessing'])) {
                        foreach($TYPO3_CONF_VARS['SC_OPTIONS']['t3lib/class.t3lib_userauthgroup.php']['fetchGroups_postProcessing'] as $_funcRef) {
                                $_params = array();
                                t3lib_div::callUserFunction($_funcRef, $_params, $this);
                        }
                }
        }

        function setCachedList($cList)  {
                if ((string)$cList != (string)$this->user['usergroup_cached_list'])     {
                        $GLOBALS['TYPO3_DB']->exec_UPDATEquery('be_users', 'uid='.intval($this->user['uid']), array('usergroup_cached_list' => $cList));
                }
        }

        function addFileMount($title, $altTitle, $path, $webspace, $type)       {
                        // Return false if fileadminDir is not set and we try to mount a relative path
                if ($webspace && !$GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'])    return false;

                        // Trimming and pre-processing
                $path=trim($path);
                if ($this->OS=='WIN')   {               // with WINDOWS convert backslash to slash!!
                        $path=str_replace('\\','/',$path);
                }
                        // If the path is true and validates as a valid path string:
                if ($path && t3lib_div::validPathStr($path))    {
                                // normalize path: remove leading '/' and './', and trailing '/' and '/.'
                        $path=trim($path);
                        $path=preg_replace('#^\.?/|/\.?$#','',$path);

                        if ($path)      {       // there must be some chars in the path
                                $fdir=PATH_site.$GLOBALS['TYPO3_CONF_VARS']['BE']['fileadminDir'];      // fileadmin dir, absolute
                                if ($webspace)  {
                                        $path=$fdir.$path;      // PATH_site + fileadmin dir is prepended
                                } else {
                                        if ($this->OS!='WIN')   {               // with WINDOWS no prepending!!
                                                $path='/'.$path;        // root-level is the start...
                                        }
                                }
                                $path.='/';

                                        // We now have a path with slash after and slash before (if unix)
                                if (@is_dir($path) &&
                                        (($GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] && t3lib_div::isFirstPartOfStr($path,$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'])) || t3lib_div::isFirstPartOfStr($path,$fdir)))      {
                                                        // Alternative title?
                                                $name = $title ? $title : $altTitle;
                                                        // Adds the filemount. The same filemount with same name, type and path cannot be set up twice because of the hash string used as key.
                                                $this->groupData['filemounts'][md5($name.'|'.$path.'|'.$type)] = Array('name'=>$name, 'path'=>$path, 'type'=>$type);
                                                        // Return true - went well, success!
                                                return 1;
                                }
                        }
                }
        }

        function addTScomment($str)     {
                $delimiter = '# ***********************************************';

                $out = $delimiter.chr(10);
                $lines = t3lib_div::trimExplode(chr(10),$str);
                foreach($lines as $v)   {
                        $out.= '# '.$v.chr(10);
                }
                $out.= $delimiter.chr(10);
                return $out;
        }












        /************************************
         *
         * Workspaces
         *
         ************************************/

        function workspaceInit()        {

                        // Initializing workspace by evaluating and setting the workspace, possibly updating it in the user record!
                $this->setWorkspace($this->user['workspace_id']);

                        // Setting up the db mount points of the (custom) workspace, if any:
                if ($this->workspace>0 && trim($this->workspaceRec['db_mountpoints'])!=='')     {

                                // Initialize:
                        $newMounts = array();
                        $readPerms = '1=1'; // Notice: We cannot call $this->getPagePermsClause(1); as usual because the group-list is not available at this point. But bypassing is fine because all we want here is check if the workspace mounts are inside the current webmounts rootline. The actual permission checking on page level is done elsewhere as usual anyway before the page tree is rendered.

                                // Traverse mount points of the
                        $mountPoints = t3lib_div::intExplode(',',$this->workspaceRec['db_mountpoints']);
                        foreach($mountPoints as $mpId)  {
                                if ($this->isInWebMount($mpId,$readPerms))      {
                                        $newMounts[] = $mpId;
                                }
                        }

                                // Re-insert webmounts:
                        $this->groupData['webmounts'] = implode(',',array_unique($newMounts));
                }

                        // Setting up the file mount points of the (custom) workspace, if any:
                if ($this->workspace!==0)       $this->groupData['filemounts'] = array();
                if ($this->workspace>0 && trim($this->workspaceRec['file_mountpoints'])!=='')   {

                                // Processing filemounts
                        $res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'sys_filemounts', 'deleted=0 AND hidden=0 AND pid=0 AND uid IN ('.$GLOBALS['TYPO3_DB']->cleanIntList($this->workspaceRec['file_mountpoints']).')');
                        while ($row = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($res))      {
                                $this->addFileMount($row['title'], $row['path'], $row['path'], $row['base']?1:0, '');
                        }
                }
        }

        function checkWorkspace($wsRec,$fields='uid,title,adminusers,members,reviewers,publish_access,stagechg_notification')   {
                $retVal = FALSE;

                        // If not array, look up workspace record:
                if (!is_array($wsRec))  {
                        switch((string)$wsRec)  {
                                case '0':
                                case '-1':
                                        $wsRec = array('uid' => $wsRec);
                                break;
                                default:
                                        list($wsRec) = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows(
                                                $fields,
                                                'sys_workspace',
                                                'pid=0 AND uid='.intval($wsRec).
                                                        t3lib_BEfunc::deleteClause('sys_workspace'),
                                                '',
                                                'title'
                                        );
                                break;
                        }
                }

                        // If wsRec is set to an array, evaluate it:
                if (is_array($wsRec))   {
                        if ($this->isAdmin())   {
                                return array_merge($wsRec,array('_ACCESS' => 'admin'));
                        } else {

                                switch((string)$wsRec['uid'])   {
                                        case '0':
                                                $retVal = ($this->groupData['workspace_perms']&1) ? array_merge($wsRec,array('_ACCESS' => 'online')) : FALSE;
                                        break;
                                        case '-1':
                                                $retVal = ($this->groupData['workspace_perms']&2) ? array_merge($wsRec,array('_ACCESS' => 'offline')) : FALSE;
                                        break;
                                        default:
                                                        // Checking if the guy is admin:
                                                if (t3lib_div::inList($wsRec['adminusers'],$this->user['uid'])) {
                                                        return array_merge($wsRec, array('_ACCESS' => 'owner'));
                                                }
                                                        // Checking if he is reviewer user:
                                                if (t3lib_div::inList($wsRec['reviewers'],'be_users_'.$this->user['uid']))      {
                                                        return array_merge($wsRec, array('_ACCESS' => 'reviewer'));
                                                }
                                                        // Checking if he is reviewer through a user group of his:
                                                foreach($this->userGroupsUID as $groupUid)      {
                                                        if (t3lib_div::inList($wsRec['reviewers'],'be_groups_'.$groupUid))      {
                                                                return array_merge($wsRec, array('_ACCESS' => 'reviewer'));
                                                        }
                                                }
                                                        // Checking if he is member as user:
                                                if (t3lib_div::inList($wsRec['members'],'be_users_'.$this->user['uid']))        {