owasp / rbac Goto Github PK

    use PhpRbac;

    $rbac = new Rbac();

    $rbac = new PhpRbac\Rbac();

    $rbac = new \PhpRbac\Rbac();

static function SQL_pdo($Query)
{
    $args = func_get_args ();
    if (count ( $args ) == 1)
    {
        $result = self::$Db->query ( $Query );

        /* --- OLD ---
        if ($result===false)
            return null;
        $res=$result->fetchAll ( PDO::FETCH_ASSOC );
        if ($res===array())
            return null;
        return $res;
        //--- OLD --- */

        // --- FIX ---
        $type = substr ( trim ( strtoupper ( $Query ) ), 0, 6 );
        if ($type == "INSERT")
        {
            if ($result===false)
                return null;
            $res = self::$Db->lastInsertId ();
            if ($res == 0)
                return $result->rowCount ();
            return $res;
        }
        elseif ($type == "DELETE" or $type == "UPDATE" or $type == "REPLAC")
            return $result->rowCount ();
        elseif ($type == "SELECT")
        {
            $res=$result->fetchAll ( PDO::FETCH_ASSOC );
            if ($res===array())
                return null;
            else
                return $res;
        }
        // --- FIX ---

    }
    else
    {
        if (! $stmt = self::$Db->prepare ( $Query ))
        {
            return false;
        }
        array_shift ( $args ); // remove $Query from args
        $i = 0;
        foreach ( $args as &$v )
            $stmt->bindValue ( ++ $i, $v );

        $success=$stmt->execute ();

        $type = substr ( trim ( strtoupper ( $Query ) ), 0, 6 );
        if ($type == "INSERT")
        {
            if (!$success)
                return null;
            $res = self::$Db->lastInsertId ();
            if ($res == 0)
                return $stmt->rowCount ();
            return $res;
        }
        elseif ($type == "DELETE" or $type == "UPDATE" or $type == "REPLAC")
            return $stmt->rowCount ();
        elseif ($type == "SELECT")
        {
            $res=$stmt->fetchAll ( PDO::FETCH_ASSOC );
            if ($res===array())
                return null;
            else
                return $res;
        }
    }
}

    // $row_count = jf::SQL ( "SELECT count(*) FROM " . $this->tablePrefix() . $this->type());
    // $separator_count = --$row_count[0]['count(*)'];
    // $total_char_count = $query_char_count + $separator_count;

    // if ((int) $total_char_count >= 1024)
    //     throw new Exception ( "Path exceeds character count limit" );

require_once 'rbac/PhpRbac/autoload.php';
$rbac = new PhpRbac\Rbac();

$rbac->reset(true);

    Warning: mysqli::mysqli() [mysqli.mysqli]: (42000/1049): Unknown database 'test_database' in path\to\PhpRbac\src\PhpRbac\core\setup.php on line 27

    header("Location: index.php");

$rbac->Assign(5, 5);

RoleID = 5, PermissionID = 5

elseif ($type == "DELETE" or $type == "UPDATE" or $type == "REPLAC") 

        $index += 1;

Success: User 1 has the 'intent to leave' permission.
Success: User 1 has the 'profile-blocks-1' permission.
Failure! User 1 has the 'profile-blocks-2' permission.
Success! 'survey items-3' is an unknown/invalid permission.
Success: User 2 has the 'intent to leave' permission.
Failure! User 2 has the 'profile-blocks-1' permission.
Success: User 2 has the 'profile-blocks-n' permission.
Success! 'survey items-3' is an unknown/invalid permission.

<?php
// PHP-RBAC Proof of Concept

require_once 'PhpRbac/autoload.php';
header('Content-Type: text/plain');

$rbac = new PhpRbac\Rbac();

$commonPerms = [
    'intent-to-leave',
    'referrals-public-view',
    'referrals-teams-view',
];

$role1Perms = [
    'access level-individual_aggregate'.
    'risk-indicator',
    'profile-blocks-1',
    'profile-blocks-4',
    'profile-blocks-n',
    'profile-items-2',
    'profile-items-n',
    'survey-blocks-2',
    'survey-blocks-4',
    'survey-blocks-n',
    'survey-items-2',
    'survey-items-n',
    'notes-public-view',
    'notes-teams-view',
    'contacts-public-view',
    'contacts-teams-view',
    'booking-public-view',
    'booking-teams-view',
];

$role2Perms = [
     'access-level_aggregate',
     'profile-blocks-2',
     'profile-blocks-4',
     'profile-blocks-n',
     'profile-items-2',
     'profile-items-n',
     'survey-blocks-2',
     'survey-blocks-4',
     'survey-blocks-n',
     'survey-items-2',
     'survey-items-n',
     'notes-public-create',
     'notes-teams-create',
     'contacts-public-view',
     'contacts-private-create',
     'contacts-teams-view',
     'booking-public-create',
     'booking-teams-create',
     'referrals-private-create',
];

$role3Perms = [
    'access-level_individual_aggregate',
    'risk-indicator',
    'referrals-public-create',
    'referrals-private-create',
    'referrals-teams-create',
    'receive-referrals',
];

$commonRoleId = $rbac->Roles->add('common_role', 'Common permissions for all users');

foreach ($commonPerms as $info) {
    $permId = $rbac->Permissions->add($info, 'Default description', $commonRoleId);
    $rbac->Roles->assign('common_role', $permId);
}

$role1Id = $rbac->Roles->add('role1', 'Role 1', $commonRoleId);

foreach ($role1Perms as $permName) {
    $rbac->Permissions->add($permName, 'Default description', $role1Id);
    $rbac->Roles->assign('role1', $permName);
}

$role2Id = $rbac->Roles->add('role2', 'Role 2', $commonRoleId);

foreach ($role2Perms as $permName) {
    $rbac->Permissions->add($permName, 'Default description', $role2Id);
    $rbac->Roles->assign('role2', $permName);
}

// Create User
$users = [
    [
        'id' => 1,
        'username' => 'admin',
        'roles' => [
            'role1'
        ]
    ],
    [
        'id' => 2,
        'username' => 'editor',
        'roles' => [
            'common_role',
            'role2'
        ]
    ],
];

// Assign the proper roles.
foreach ($users as $user) {
    if (!empty($user['roles']) && is_array($user['roles'])) {
        foreach ($user['roles'] as $role) {
            $rbac->Users->assign($role, $user['id']);
        }
    }
}

$tests = [
    $users[0]['id'] => [
        'intent to leave' => true,
        'profile-blocks-1' => true,
        'profile-blocks-2' => false,
        'survey items-3' => false,
    ],
    $users[1]['id'] => [
        'intent to leave' => true,
        'profile-blocks-1' => false,
        'profile-blocks-n' => true,
        'survey items-3' => false,
    ],
];

// Validate if a user has a particular permission.
foreach ($tests as $userId => $test) {
    foreach ($test as $permission => $hasPermission) {
        $permissionVerb = $hasPermission ? 'has' : 'doesn\'t have';
        $noPermissionVerb = $hasPermission ? 'doesn\'t have' : 'has';
        try {
            if ($rbac->check($permission, $userId) === $hasPermission) {
                echo "Success: User {$userId} $permissionVerb the '{$permission}' permission.\n";
            } else {
                echo "Failure! User {$userId} $noPermissionVerb the '{$permission}' permission.\n";
            }
        }
        catch(Exception $e) {
            $status = $hasPermission ? 'Failure' : 'Success';
            echo "$status! '{$permission}' is an unknown/invalid permission.\n";
        }
    }
}

truncate table permissions
truncate table rolepermissions
truncate table roles
INSERT INTO `phprbac_permissions` (`ID`, `Lft`, `Rght`, `Title`, `Description`) VALUES (1, 0, 1, "root", "root");
INSERT INTO `phprbac_rolepermissions` (`RoleID`, `PermissionID`, `AssignmentDate`) VALUES (1, 1, UNIX_TIMESTAMP());
INSERT INTO `phprbac_roles` (`ID`, `Lft`, `Rght`, `Title`, `Description`) VALUES (1, 0, 1, "root", "root");

created role 'member' with description 'Registered User' and parent ''. New id: '2'

created permission 'write_site_review' with description 'Write review for a site' and parent ''. New id: '2'
assigned permission '2' to role '2'

created role 'collaborator' with description 'Collaborator user' and parent '2'. New id: '3'

created permission 'access_admin' with description 'Access the admin panel' and parent ''. New id: '3'
assigned permission '3' to role '3'

created role 'admin' with description 'Admin user' and parent '3'. New id: '4'

created permission 'view_stats' with description 'View stats' and parent ''. New id: '4'
assigned permission '4' to role '4'

created permission 'manage_users' with description 'Manage Users' and parent ''. New id: '5'
assigned permission '5' to role '4'

created permission 'edit_users' with description 'Edit Users' and parent '5'. New id: '6'
assigned permission '6' to role '4'

created permission 'export_users' with description 'Export Users as CSV' and parent '5'. New id: '7'
assigned permission '7' to role '4'

INSERT INTO `phprbac_userroles` (`UserID`, `RoleID`, `AssignmentDate`) VALUES (123, 2, UNIX_TIMESTAMP()); /*member*/
INSERT INTO `phprbac_userroles` (`UserID`, `RoleID`, `AssignmentDate`) VALUES (456, 3, UNIX_TIMESTAMP()); /*collaborator*/
INSERT INTO `phprbac_userroles` (`UserID`, `RoleID`, `AssignmentDate`) VALUES (789, 4, UNIX_TIMESTAMP()); /*admin*/

member can access admin? true //should be false
collaborator can access admin? true //ok
admin can access admin? false //should be true
member can write site reviews? true //ok
collaborator can write site reviews? false //should be true
admin can write site reviews? false //should be true

ID Lft Rght Title Description
1   0   13  root    root
2   1   2   write_site_review   Write review for a site
3   3   4   access_admin    Access the admin panel
4   5   6   view_stats  View stats
5   7   12  manage_users    Manage Users
6   8   9   edit_users  Edit Users
7   10  11  export_users    Export Users as CSV

ID Lft Rght Title Description
1   0   7   root    root
2   1   6   member  Registered User
3   2   5   collaborator    Collaborator user
4   3   4   admin   Admin user

RoleID PermissionID AssignmentDate
1   1   1413214573
2   2   1413214573
3   3   1413214573
4   4   1413214573
4   5   1413214573
4   6   1413214573
4   7   1413214573

member can access admin? false //ok
collaborator can access admin? true //ok
admin can access admin? false //should be true
member can write site reviews? true //ok
collaborator can write site reviews? false //should be true
admin can write site reviews? false //should be true

if (! is_numeric ( $Permission ))
    $Permission = $this->Permission_ID ( $Permission );

* @param integer $UserID
*           optional

function AllRoles($UserID)

function AllRoles($UserID = null)

function Edit($ID, $NewTitle = null, $NewDescription = null)
{
    $Data = array ();
    if ($NewTitle !== null)
        $Data ['Title'] = $NewTitle;
    if ($NewDescription !== null)
        $Data ['Description'] = $NewDescription;
    return $this->{$this->Type ()}->EditData ( $Data, "ID=?", $ID ) == 1;
}

function Edit($ID, $NewTitle = null, $NewDescription = null)
{
    $Data = array ();
    if ($NewTitle !== null)
        $Data ['Title'] = $NewTitle;
    if ($NewDescription !== null)
        $Data ['Description'] = $NewDescription;

    if (!empty($Data))
        return $this->{$this->Type ()}->EditData ( $Data, "ID=?", $ID ) == 1;

    return false;
}

$res=$result->fetchAll ( PDO::FETCH_ASSOC );

static function CurrentUser() {
    return 0; // Guest
}

owasp / rbac Goto Github PK

rbac's Introduction

rbac's People

Stargazers

Watchers

Forkers

rbac's Issues

Tests:

Results:

Notes:

Recommend Projects

Recommend Topics

Recommend Org