File Source for ktapi.inc.php

<?
/**
*
* Implements a cleaner wrapper API for KnowledgeTree.
* @license http://www.knowledgetree.com/KPL KnowledgeTree Public License Version 1.1
* @package KTAPI
*/
/*
*
* The contents of this file are subject to the KnowledgeTree Public
* License Version 1.1 ("License"); You may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://www.knowledgetree.com/KPL
*
* Software distributed under the License is distributed on an "AS IS"
* basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is: KnowledgeTree Open Source
*
* The Initial Developer of the Original Code is The Jam Warehouse Software
* (Pty) Ltd, trading as KnowledgeTree.
* Portions created by The Jam Warehouse Software (Pty) Ltd are Copyright
* (C) 2007 The Jam Warehouse Software (Pty) Ltd;
* All Rights Reserved.
*
*/
require_once('../config/dmsDefaults.php');
require_once(KT_LIB_DIR . '/filelike/fsfilelike.inc.php');
require_once(KT_LIB_DIR . '/foldermanagement/folderutil.inc.php');
// Generic error messages used in the API. There may be some others specific to functionality
// directly in the code.
// TODO: Check that they are all relevant.
define('KTAPI_ERROR_SESSION_INVALID', 'The session could not be resolved.');
define('KTAPI_ERROR_PERMISSION_INVALID', 'The permission could not be resolved.');
define('KTAPI_ERROR_FOLDER_INVALID', 'The folder could not be resolved.');
define('KTAPI_ERROR_DOCUMENT_INVALID', 'The document could not be resolved.');
define('KTAPI_ERROR_USER_INVALID', 'The user could not be resolved.');
define('KTAPI_ERROR_KTAPI_INVALID', 'The ktapi could not be resolved.');
define('KTAPI_ERROR_INSUFFICIENT_PERMISSIONS', 'The user does not have sufficient permissions to access the resource.');
define('KTAPI_ERROR_INTERNAL_ERROR', 'An internal error occurred. Please review the logs.');
define('KTAPI_ERROR_DOCUMENT_TYPE_INVALID', 'The document type could not be resolved.');
define('KTAPI_ERROR_DOCUMENT_CHECKED_OUT', 'The document is checked out.');
define('KTAPI_ERROR_DOCUMENT_NOT_CHECKED_OUT', 'The document is not checked out.');
define('KTAPI_ERROR_WORKFLOW_INVALID', 'The workflow could not be resolved.');
define('KTAPI_ERROR_WORKFLOW_NOT_IN_PROGRESS', 'The workflow is not in progress.');
// Mapping of permissions to actions.
// TODO: Check that they are all correct.
// Note, currently, all core actions have permissions that are defined in the plugins.
// As the permissions are currently associated with actions which are quite closely linked
// to the web interface, it is not the nicest way to do things. They should be associated at
// a lower level, such as in the api. probably, better, would be at some stage to assocate
// the permissions to the action/transaction in the database so administrators can really customise
// as required.
define('KTAPI_PERMISSION_DELETE', 'ktcore.permissions.delete');
define('KTAPI_PERMISSION_READ', 'ktcore.permissions.read');
define('KTAPI_PERMISSION_WRITE', 'ktcore.permissions.write');
define('KTAPI_PERMISSION_ADD_FOLDER', 'ktcore.permissions.addFolder');
define('KTAPI_PERMISSION_RENAME_FOLDER', 'ktcore.permissions.folder_rename');
define('KTAPI_PERMISSION_CHANGE_OWNERSHIP', 'ktcore.permissions.security');
define('KTAPI_PERMISSION_DOCUMENT_MOVE', 'ktcore.permissions.write');
define('KTAPI_PERMISSION_WORKFLOW', 'ktcore.permissions.workflow');
//
class KTAPI_Session
{
var $ktapi;
var $user = null;
var $session = '';
var $sessionid = -1;
var $ip = null;
function KTAPI_Session(&$ktapi, &$user, $session, $sessionid, $ip)
{
assert(!is_null($ktapi));
assert(is_a($ktapi,'KTAPI'));
assert(!is_null($user));
assert(is_a($user,'User'));
$this->ktapi = &$ktapi;
$this->user = &$user;
$this->session = $session;
$this->sessionid = $sessionid;
$this->ip = $ip;
// TODO: get documenttransaction to not look at the session variable!
$_SESSION["userID"] = $user->getId();
$_SESSION["sessionID"] = $this->sessionid;
}
/**
* This returns the session string
*
* @return string
*/
function get_session()
{
return $this->session;
}
/**
* This returns the sessionid in the database.
*
* @return int
*/
function get_sessionid()
{
return $this->sessionid;
}
/**
* This returns a user object for the use rassociated with the session.
*
* @return User
*/
function &get_user()
{
return $this->user;
}
/**
* This resolves the user's ip
*
* @access private
* @return string
*/
function resolveIP()
{
if (getenv("REMOTE_ADDR"))
{
$ip = getenv("REMOTE_ADDR");
}
elseif (getenv("HTTP_X_FORWARDED_FOR"))
{
$forwardedip = getenv("HTTP_X_FORWARDED_FOR");
list($ip,$ip2,$ip3,$ip4)= split (",", $forwardedip);
}
elseif (getenv("HTTP_CLIENT_IP"))
{
$ip = getenv("HTTP_CLIENT_IP");
}
if ($ip == '')
{
$ip = '127.0.0.1';
}
return $ip;
}
/**
* This returns a session object based on authentication credentials.
*
* @access private
* @param string $username
* @param string $password
* @return KTAPI_Session
*/
function &start_session(&$ktapi, $username, $password, $ip=null)
{
if ( empty($username) )
{
return new PEAR_Error(_kt('The username is empty.'));
}
$user =& User::getByUsername($username);
if (PEAR::isError($user) || ($user === false))
{
return new PEAR_Error(_kt("The user '$username' cound not be found."));
}
if ($user->isAnonymous())
{
$authenticated = true;
$config = &KTConfig::getSingleton();
$allow_anonymous = $config->get('session/allowAnonymousLogin', false);
if (!$allow_anonymous)
{
return new PEAR_Error(_kt('Anonymous user not allowed'));
}
}
else
{
if ( empty($password) )
{
return new PEAR_Error(_kt('The password is empty.'));
}
$authenticated = KTAuthenticationUtil::checkPassword($user, $password);
if (PEAR::isError($authenticated) || $authenticated === false)
{
return new PEAR_Error(_kt("The password is invalid."));
}
}
if (is_null($ip))
{
$ip = '127.0.0.1';
//$ip = KTAPI_Session::resolveIP();
}
session_start();
$user_id = $user->getId();
$sql = "SELECT count(*) >= u.max_sessions as over_limit FROM active_sessions ass INNER JOIN users u ON ass.user_id=u.id WHERE ass.user_id = $user_id";
$row = DBUtil::getOneResult($sql);
if (PEAR::isError($row))
{
return $row;
}
if (is_null($row))
{
return new PEAR_Error('No record found for user?');
}
if ($row['over_limit'] == 1)
{
return new PEAR_Error('Session limit exceeded. Logout of any active sessions.');
}
$session = session_id();
$sessionid = DBUtil::autoInsert('active_sessions',
array(
'user_id' => $user_id,
'session_id' => session_id(),
'lastused' => date('Y-m-d H:i:s'),
'ip' => $ip
));
if (PEAR::isError($sessionid) )
{
return $sessionid;
}
$session = &new KTAPI_Session($ktapi, $user, $session, $sessionid, $ip);
return $session;
}
/**
* This returns an active session.
*
* @param KTAPI $ktapi
* @param string $session
* @param string $ip
* @return KTAPI_Session
*/
function &get_active_session(&$ktapi, $session, $ip)
{
$sql = "SELECT id, user_id FROM active_sessions WHERE session_id='$session'";
if (!empty($ip))
{
$sql .= " AND ip='$ip'";
}
$row = DBUtil::getOneResult($sql);
if (is_null($row) || PEAR::isError($row))
{
return new PEAR_Error(KTAPI_ERROR_SESSION_INVALID);
}
$sessionid = $row['id'];
$userid = $row['user_id'];
$user = &User::get($userid);
if (is_null($user) || PEAR::isError($user))
{
return new PEAR_Error(KTAPI_ERROR_USER_INVALID);
}
$now=date('Y-m-d H:i:s');
$sql = "UPDATE active_sessions SET last_used='$now' WHERE id=$sessionid";
DBUtil::runQuery($sql);
$session = &new KTAPI_Session($ktapi, $user, $session, $sessionid, $ip);
return $session;
}
/**
* This closes the current session.
*
*/
function logout()
{
$sql = "DELETE FROM active_sessions WHERE id=$this->sessionid";
$result = DBUtil::runQuery($sql);
if (PEAR::isError($result))
{
return $result;
}
$this->user = null;
$this->session = '';
$this->sessionid = -1;
return true;
}
}
class KTAPI_FolderItem
{
/**
* This is a reference to the core KTAPI controller
*
* @access protected
* @var KTAPI
*/
var $ktapi;
function &can_user_access_object_requiring_permission(&$object, $permission)
{
return $this->ktapi->can_user_access_object_requiring_permission($object, $permission);
}
}
class KTAPI_Folder extends KTAPI_FolderItem
{
/**
* This is a reference to a base Folder object.
*
* @access private
* @var Folder
*/
var $folder;
/**
* This is the id of the folder on the database.
*
* @access private
* @var int
*/
var $folderid;
/**
* This is used to get a folder based on a folder id.
*
* @access private
* @param KTAPI $ktapi
* @param int $folderid
* @return KTAPI_Folder
*/
function &get(&$ktapi, $folderid)
{
assert(!is_null($ktapi));
assert(is_a($ktapi, 'KTAPI'));
assert(is_numeric($folderid));
$folderid += 0;
$folder = &Folder::get($folderid);
if (is_null($folder) || PEAR::isError($folder))
{
return new PEAR_Error(KTAPI_ERROR_FOLDER_INVALID);
}
$user = $ktapi->can_user_access_object_requiring_permission($folder, KTAPI_PERMISSION_READ);
if (is_null($user) || PEAR::isError($user))
{
return $user;
}
return new KTAPI_Folder($ktapi, $folder);
}
/**
* This is the constructor for the KTAPI_Folder.
*
* @access private
* @param KTAPI $ktapi
* @param Folder $folder
* @return KTAPI_Folder
*/
function KTAPI_Folder(&$ktapi, &$folder)
{
$this->ktapi = &$ktapi;
$this->folder = &$folder;
$this->folderid = $folder->getId();
}
/**
* This returns a reference to the internal folder object.
*
* @access protected
* @return Folder
*/
function &get_folder()
{
return $this->folder;
}
/**
* This returns detailed information on the document.
*
* @return array
*/
function get_detail()
{
$detail = array(
'id'=>$this->folderid,
'folder_name'=>$this->get_folder_name(),
'parent_id'=>$this->get_parent_folder_id(),
'full_path'=>$this->get_full_path(),
);
return $detail;
}
function get_parent_folder_id()
{
return $this->folder->getParentID();
}
function get_folder_name()
{
return $this->folder->getFolderName($this->folderid);
}
/**
* This returns the folderid.
*
* @return int
*/
function get_folderid()
{
return $this->folderid;
}
/**
* This can resolve a folder relative to the current directy by name
*
* @access public
* @param string $foldername
* @return KTAPI_Folder
*/
function &get_folder_by_name($foldername)
{
$foldername=trim($foldername);
if (empty($foldername))
{
return new PEAR_Error('A valid folder name must be specified.');
}
$split = explode('/', $foldername);
$folderid=$this->folderid;
foreach($split as $foldername)
{
$sql = "SELECT id FROM folders WHERE name='$foldername' and parent_id=$folderid";
$row = DBUtil::getOneResult($sql);
if (is_null($row) || PEAR::isError($row))
{
return new PEAR_Error(KTAPI_ERROR_FOLDER_INVALID);
}
$folderid = $row['id'];
}
return KTAPI_Folder::get($this->ktapi, $folderid);
}
function get_full_path()
{
$path = $this->folder->getFullPath() . '/' . $this->folder->getName();
return $path;
}
/**
* This gets a document by filename or name.
*
* @access private
* @param string $documentname
* @param string $function
* @return KTAPI_Document
*/
function &_get_document_by_name($documentname, $function='getByNameAndFolder')
{
$documentname=trim($documentname);
if (empty($documentname))
{
return new PEAR_Error('A valid document name must be specified.');
}
$foldername = dirname($documentname);
$documentname = basename($documentname);
$ktapi_folder = $this;
if (!empty($foldername) && ($foldername != '.'))
{
$ktapi_folder = $this->get_folder_by_name($foldername);
}
if (is_null($ktapi_folder) || PEAR::isError($ktapi_folder))
{
return new PEAR_Error(KTAPI_ERROR_FOLDER_INVALID);
}
//$folder = $ktapi_folder->get_folder();
$folderid = $ktapi_folder->folderid;
$document = Document::$function($documentname, $folderid);
if (is_null($document) || PEAR::isError($document))
{
return new PEAR_Error(KTAPI_ERROR_DOCUMENT_INVALID);
}
$user = $this->can_user_access_object_requiring_permission($document, KTAPI_PERMISSION_READ);
if (PEAR::isError($user))
{
return $user;
}
return new KTAPI_Document($this->ktapi, $ktapi_folder, $document);
}
/**
* This can resolve a document relative to the current directy by name.
*
* @access public
* @param string $documentname
* @return KTAPI_Document
*/
function &get_document_by_name($documentname)
{
return $this->_get_document_by_name($documentname,'getByNameAndFolder');
}
/**
* This can resolve a document relative to the current directy by filename .
*
* @access public
* @param string $documentname
* @return KTAPI_Document
*/
function &get_document_by_filename($documentname)
{
return $this->_get_document_by_name($documentname,'getByFilenameAndFolder');
}
function get_listing($depth=1, $what='DF'

Source for file ktapi.inc.php