/** * filter the items sent to a list view * * @param type $hook * @param type $type * @param type $return * @param type $params * @return type */ function filter_list_vars($hook, $type, $return, $params) { $filter_river = elgg_get_plugin_setting('hide_old_items', PLUGIN_ID); if ($filter_river == 'no') { // no need to filter return $return; } if ($return['items'] && is_array($return['items'])) { foreach ($return['items'] as $key => $item) { if (!$item instanceof \ElggRiverItem) { continue; } if ($item->type == 'object') { continue; } if ($item->subject_guid == elgg_get_logged_in_user_guid()) { continue; } if (elgg_is_admin_logged_in()) { continue; } if (elgg_get_ignore_access()) { continue; } unset($return['items'][$key]); } } return $return; }
public function getWaitingUsers($count = false) { $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); if ($count) { $result = $this->countEntitiesFromRelationship(EVENT_MANAGER_RELATION_SLOT_REGISTRATION_WAITINGLIST, true); } else { $result = $this->getEntitiesFromRelationship(EVENT_MANAGER_RELATION_SLOT_REGISTRATION_WAITINGLIST, true); } elgg_set_ignore_access($ia); return $result; }
function page_handler_webodf_elgg($page) { // Read the URI parameters based on <siteurl>/gdocspreview/param1/param2 $file_guid = $page[0]; $timestamp = intval($page[1]); if (isset($timestamp)) { // This is a hack, but it works. It will prevent anyone or Google from // storing the public URL to access our private files. There is a 90 // second window in which the file is accessible. After that period, // if you try to access the file from the same URL, it will be denied. $date = new DateTime(); $max = $date->format('U') + 90; $min = $date->format('U') - 90; if ($timestamp > $min && $timestamp < $max) { // keep track of the old access level $old_access = elgg_get_ignore_access(); // temporarily make the access level public elgg_set_ignore_access(true); $file = get_entity($file_guid); if (!$file) { register_error(elgg_echo("file:downloadfailed")); forward(); } $mime = $file->getMimeType(); if (!$mime) { $mime = "application/octet-stream"; } $filename = $file->originalfilename; // fix for IE https issue header("Pragma: public"); header("Content-type: {$mime}"); if (strpos($mime, "image/") !== false || $mime == "application/pdf") { header("Content-Disposition: inline; filename=\"{$filename}\""); } else { header("Content-Disposition: attachment; filename=\"{$filename}\""); } ob_clean(); flush(); readfile($file->getFilenameOnFilestore()); // restore the access level elgg_set_ignore_access($old_access); exit; } else { register_error(elgg_echo("file:downloadfailed")); forward(); } } else { register_error(elgg_echo("file:downloadfailed")); forward(); } }
/** * Cache an entity. * * Stores an entity in $ENTITY_CACHE; * * @param ElggEntity $entity Entity to cache * * @return void * @see _elgg_retrieve_cached_entity() * @see _elgg_invalidate_cache_for_entity() * @access private * @todo Use an ElggCache object */ function _elgg_cache_entity(ElggEntity $entity) { global $ENTITY_CACHE; // Don't cache non-plugin entities while access control is off, otherwise they could be // exposed to users who shouldn't see them when control is re-enabled. if (!$entity instanceof ElggPlugin && elgg_get_ignore_access()) { return; } // Don't store too many or we'll have memory problems // @todo Pick a less arbitrary limit if (count($ENTITY_CACHE) > 256) { $random_guid = array_rand($ENTITY_CACHE); unset($ENTITY_CACHE[$random_guid]); // Purge separate metadata cache. Original idea was to do in entity destructor, but that would // have caused a bunch of unnecessary purges at every shutdown. Doing it this way we have no way // to know that the expunged entity will be GCed (might be another reference living), but that's // OK; the metadata will reload if necessary. elgg_get_metadata_cache()->clear($random_guid); } $ENTITY_CACHE[$entity->guid] = $entity; }
function group_tools_join_site_handler($event, $type, $relationship) { if (!empty($relationship) && $relationship instanceof ElggRelationship) { $user_guid = $relationship->guid_one; $site_guid = $relationship->guid_two; if (($user = get_user($user_guid)) && ($auto_joins = elgg_get_plugin_setting("auto_join", "group_tools"))) { $auto_joins = string_to_tag_array($auto_joins); // ignore access $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); foreach ($auto_joins as $group_guid) { if (($group = get_entity($group_guid)) && $group instanceof ElggGroup) { if ($group->site_guid == $site_guid) { // join the group $group->join($user); } } } // restore access settings elgg_set_ignore_access($ia); } } }
} else { elgg_push_breadcrumb($crumbs_title, "vouchers/owner/{$page_owner->username}"); } $title = $voucher->title; elgg_push_breadcrumb($title); $content = elgg_view_entity($voucher, array('full_view' => true)); if ($voucher->comments_on != 'Off') { $content .= elgg_view_comments($voucher); } $sidebar = ''; // show voucher sales on sidebar if any only for voucher owner if (elgg_is_logged_in()) { $user = elgg_get_logged_in_user_entity(); if ($user && $user->guid == $page_owner->guid) { // set ignore access for loading all sales entries $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); // load list buyers $options = array('type' => 'object', 'subtype' => 'vsales', 'limit' => 0, 'metadata_name_value_pairs' => array(array('name' => 'txn_vguid', 'value' => $voucher->guid, 'operand' => '='))); $buyerslist = elgg_get_entities_from_metadata($options); $sidebar .= '<div style="font-size:90%;">'; $sidebar .= '<h3>' . elgg_echo('vouchers:sales') . '</h3>'; if (is_array($buyerslist)) { foreach ($buyerslist as $b) { //$sidebar .= $b->voucher_guid.' - '.$b->user_guid.' - '.$b->txn_date.'<br/>'; $buyer = get_user($b->txn_buyer_guid); $sidebar .= '<p><a href="' . elgg_get_site_url() . 'profile/' . $buyer->username . '">' . $buyer->username . '</a> - ' . elgg_view_friendly_time($b->time_created); $sidebar .= '<br/>' . elgg_echo('vouchers:transactionid') . ': ' . $b->txn_id; //$sidebar .= '<br/>'.elgg_echo('vouchers:addvoucher:code').': '.get_buyer_code($b->txn_code, $voucher).'</p>'; } }
/** * Function to add custom profile fields to user on register * * @param string $event Event name * @param string $object_type Event type * @param ElggUser $object User being created * * @return array */ public static function create($event, $object_type, $object) { $custom_profile_fields = []; // retrieve all field that were on the register page foreach ($_POST as $key => $value) { if (strpos($key, 'custom_profile_fields_') === 0) { $key = substr($key, 22); $custom_profile_fields[$key] = get_input("custom_profile_fields_{$key}"); } } if (count($custom_profile_fields) > 0) { $categorized_fields = profile_manager_get_categorized_fields(null, true, true); $configured_fields = $categorized_fields['fields']; // set ignore access $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); foreach ($custom_profile_fields as $shortname => $value) { // determine if $value should be an array if (!is_array($value) && !empty($configured_fields)) { // only do something if it not is already an array foreach ($configured_fields as $configured_field) { if ($configured_field->metadata_name == $shortname) { if ($configured_field->metadata_type == 'tags' || $configured_field->output_as_tags == 'yes') { $value = string_to_tag_array($value); // no need to continue this foreach break; } } } } // use create_metadata to listen to default access if (is_array($value)) { $i = 0; foreach ($value as $interval) { $i++; if ($i == 1) { $multiple = false; } else { $multiple = true; } create_metadata($object->guid, $shortname, $interval, 'text', $object->guid, get_default_access($object), $multiple); } } else { create_metadata($object->guid, $shortname, $value, 'text', $object->guid, get_default_access($object)); } } // restore ignore access elgg_set_ignore_access($ia); } if (isset($_FILES['profile_icon'])) { if (!profile_manager_add_profile_icon($object)) { // return false to delete the user return false; } } $terms = elgg_get_plugin_setting('registration_terms', 'profile_manager'); if ($terms) { $object->setPrivateSetting('general_terms_accepted', time()); } elgg_clear_sticky_form('profile_manager_register'); }
<?php $access_level = elgg_get_ignore_access(); elgg_set_ignore_access(); $guid = get_input('group_guid'); $groupName = get_input('name'); function copyGroup($guid, $name, $parentGroupGuid = null, array $options = null) { $inheritMembers = $_POST['inheritMembers']; $inheritFiles = $_POST['inheritFiles']; $inheritForums = $_POST['inheritForums']; $inheritSubGroups = $_POST['subGroups']; if ($options) { $inheritMembers = $options['inheritMembers']; $inheritFiles = $options['inheritFiles']; $inheritForums = $options['inheritForums']; $inheritSubGroups = $options['inheritSubGroups']; } $groupOptions = array('inheritMembers' => $inheritMembers, 'inheritFiles' => $inheritFiles, 'inheritForums' => $inheritForums, 'inheritSubGroups' => $inheritSubGroups); //check if a sub-group when parentGroupGuid is null if (!isset($parentGroupGuid)) { $parentGroup = elgg_get_entities_from_relationship(array("relationship" => "au_subgroup_of", "relationship_guid" => $guid)); $parentGroupGuid = $parentGroup[0]->guid; } //get group $oldGroup = get_entity($guid); //get user $user = get_user($oldGroup->owner_guid); //create new group $newGroup = clone $oldGroup; $newGroup->name = $name;
/** * Get access query for Solr search * * @param int $user_guid GUID of the user accessing content * @return string */ function elgg_solr_get_access_query($user_guid = null) { if (elgg_get_ignore_access()) { return ''; } if (!isset($user_guid)) { $user_guid = elgg_get_logged_in_user_guid(); } if (elgg_is_admin_user($user_guid)) { return ''; } $access_public = elgg_solr_escape_special_chars(ACCESS_PUBLIC); $access_friends = elgg_solr_escape_special_chars(ACCESS_FRIENDS); $user_guid = elgg_solr_escape_special_chars($user_guid); $queries = []; if ($user_guid) { $queries['ors']['collections'] = "access_id:{!join from=access_list_is to=access_id}id:{$user_guid}"; $queries['ors']['is_owner'] = "owner_guid:{$user_guid}"; $queries['ors']['is_friend'] = "access_id:{$access_friends} AND owner_guid:{!join from=friends_of_is to=owner_guid}id:{$user_guid}"; } else { $queries['ors']['collections'] = "access_id:{$access_public}"; } $params = ['user_guid' => $user_guid]; $queries = elgg_trigger_plugin_hook('elgg_solr:access', 'entities', $params, $queries); if (!empty($queries['ors'])) { $ors = []; foreach ($queries['ors'] as $or) { $ors[] = "({$or})"; } $queries['ands'][] = implode(' OR ', $ors); } $query_str = ''; if (!empty($queries['ands'])) { $ands = []; foreach ($queries['ands'] as $and) { $ands[] = "({$and})"; } $query_str = '(' . implode(' AND ', $ands) . ')'; } return $query_str; }
/** * Get the ignore access value * * @return bool */ protected function getIgnoreAccess() { if (null === $this->ignoreAccess) { return elgg_get_ignore_access(); } else { return $this->ignoreAccess; } }
/** * Decides if the access system should be ignored for a user. * * Returns true (meaning ignore access) if either of these 2 conditions are true: * 1) an admin user guid is passed to this function. * 2) {@link elgg_get_ignore_access()} returns true. * * @see elgg_set_ignore_access() * * @param int $user_guid The user to check against. * * @return bool * @since 1.7.0 */ function elgg_check_access_overrides($user_guid = 0) { if (!$user_guid || $user_guid <= 0) { $is_admin = false; } else { $is_admin = elgg_is_admin_user($user_guid); } return $is_admin || elgg_get_ignore_access(); }
function social_connect_handle_authentication($user_profile, $provider) { global $CONFIG; global $HA_SOCIAL_CONNECT_PROVIDERS_CONFIG; $ignore_access = elgg_get_ignore_access(); $provider_name = $HA_SOCIAL_CONNECT_PROVIDERS_CONFIG[$provider]['provider_name']; $user_uid = $user_profile->identifier; // establish the value for the proceeding hook $default_proceed = elgg_get_plugin_setting("ha_settings_{$provider}_hook1_default", 'social_connect'); if (!$default_proceed || $default_proceed == 'global') { $default_proceed = elgg_get_plugin_setting('ha_settings_hook1_default', 'social_connect'); } if (!$default_proceed) { $default_proceed = SOCIAL_CONNECT_DEFAULT_PROCEED; } else { if ($default_proceed == 'true') { $default_proceed = true; } else { if ($default_proceed == 'false') { $default_proceed = false; } } } // the arguments for social connect events and hooks $args = array('mode' => null, 'userid' => $user_uid, 'provider' => $HA_SOCIAL_CONNECT_PROVIDERS_CONFIG[$provider], 'user' => null, 'profile' => $user_profile); // look for users that have already connected via this plugin $options = array('type' => 'user', 'plugin_id' => 'social_connect', 'plugin_user_setting_name_value_pairs' => array("{$provider}/uid" => $user_uid), 'plugin_user_setting_name_value_pairs_operator' => 'AND', 'limit' => 0); $users = elgg_get_entities_from_plugin_user_settings($options); if (!$users) { // user has not connected with plugin before $args['mode'] = 'connect'; elgg_set_ignore_access(true); $proceed = elgg_trigger_plugin_hook('social_connect', 'user', $args, $default_proceed); elgg_set_ignore_access($ignore_access); if ($proceed === false) { // hook prevented social connection return; } else { if ($proceed === 'email' || $proceed === 'emailOnly') { // hook wants to try and connect via email address // check whether the user already exists with the email provided $useremail = $user_profile->email; if ($useremail && ($users = get_user_by_email($useremail))) { social_connect_user($user_uid, $users[0], $user_profile, $provider); system_message(sprintf(elgg_echo('social_connect:connect:ok'), $provider_name)); $args['mode'] = 'email'; $args['user'] = $users[0]; elgg_set_ignore_access(true); elgg_trigger_event('social_connect', 'user', $args); elgg_set_ignore_access($ignore_access); return; } if ($proceed === 'emailOnly') { // hook wants only email address connection or failure register_error(sprintf(elgg_echo('social_connect:connect:emailnotfound'), $proceed)); return; } } } // email connection not required or failed, so register a new user $userlogin = str_replace(' ', '', $user_profile->displayName); if (!$userlogin) { $userlogin = $provider . '_user_' . rand(1000, 9999); } $org_userlogin = $userlogin; while (get_user_by_username($userlogin)) { $userlogin = $org_userlogin . '_' . rand(1000, 9999); } unset($org_userlogin); $password = generate_random_cleartext_password(); $username = $user_profile->displayName; $user = new ElggUser(); $user->username = $userlogin; $user->name = $username; $user->email = $user_profile->email; $user->access_id = ACCESS_PUBLIC; $user->salt = generate_random_cleartext_password(); $user->password = generate_user_password($user, $password); $user->owner_guid = 0; $user->container_guid = 0; if ($user->save()) { if ($user->email && elgg_get_plugin_setting('notify_new_user', 'social_connect')) { $email = elgg_echo('email:social_connect:body', array($userlogin, $password)); set_user_notification_setting($user->getGUID(), 'email', true); notify_user($user->guid, $CONFIG->site->guid, elgg_echo('email:social_connect:subject', array($provider_name)), $email, NULL, 'email'); } } else { register_error(sprintf(elgg_echo('social_connect:register:bad'), $provider_name) . elgg_echo("zhaohu:sorry")); elgg_log("ZHError social_connect:register:bad , userlogin {$userlogin}", "ERROR"); return; } system_message(sprintf(elgg_echo('social_connect:register:ok'), $provider_name)); social_connect_user($user_uid, $user, $user_profile, $provider); $args['mode'] = 'register'; $args['user'] = $user; elgg_set_ignore_access(true); elgg_trigger_event('social_connect', 'user', $args); elgg_set_ignore_access($ignore_access); } elseif (count($users) == 1) { // one user has already been registered on Elgg with this provider $args['mode'] = 'login'; $args['user'] = $users[0]; elgg_set_ignore_access(true); if (elgg_trigger_plugin_hook('social_connect', 'user', $args, (bool) $default_proceed)) { // if not, hook prevented social connection login($users[0]); system_message(sprintf(elgg_echo('social_connect:login:ok'), $provider_name)); } elgg_set_ignore_access($ignore_access); } else { throw new Exception(sprintf(elgg_echo('social_connect:login:bad'), $provider_name)); } }
/** * Can the user change this access collection? * * Use the plugin hook of 'access:collections:write', 'user' to change this. * @see get_write_access_array() for details on the hook. * * Respects access control disabling for admin users and {@link elgg_set_ignore_access()} * * @see get_write_access_array() * * @param int $collection_id The collection id * @param mixed $user_guid The user GUID to check for. Defaults to logged in user. * @return bool */ function canEdit($collection_id, $user_guid = null) { if ($user_guid) { $user = _elgg_services()->entityTable->get((int) $user_guid); } else { $user = _elgg_services()->session->getLoggedInUser(); } $collection = get_access_collection($collection_id); if (!$user instanceof \ElggUser || !$collection) { return false; } $write_access = get_write_access_array($user->getGUID(), 0, true); // don't ignore access when checking users. if ($user_guid) { return array_key_exists($collection_id, $write_access); } else { return elgg_get_ignore_access() || array_key_exists($collection_id, $write_access); } }
function hj_framework_handle_multifile_upload($user_guid) { if (!empty($_FILES)) { $access = elgg_get_ignore_access(); elgg_set_ignore_access(true); $file = $_FILES['Filedata']; $filehandler = new hjFile(); $filehandler->owner_guid = (int) $user_guid; $filehandler->container_guid = (int) $user_guid; $filehandler->access_id = ACCESS_DEFAULT; $filehandler->data_pattern = hj_framework_get_data_pattern('object', 'hjfile'); $filehandler->title = $file['name']; $filehandler->description = ''; $prefix = "hjfile/"; $filestorename = elgg_strtolower($file['name']); $mime = hj_framework_get_mime_type($file['name']); $filehandler->setFilename($prefix . $filestorename); $filehandler->setMimeType($mime); $filehandler->originalfilename = $file['name']; $filehandler->simpletype = hj_framework_get_simple_type($mime); $filehandler->filesize = round($file['size'] / (1024 * 1024), 2) . "Mb"; $filehandler->open("write"); $filehandler->close(); move_uploaded_file($file['tmp_name'], $filehandler->getFilenameOnFilestore()); $file_guid = $filehandler->save(); hj_framework_set_entity_priority($filehandler); elgg_trigger_plugin_hook('hj:framework:file:process', 'object', array('entity' => $filehandler)); if ($file_guid) { $meta_value = $filehandler->getGUID(); } else { $meta_value = $filehandler->getFilenameOnFilestore(); } if ($file_guid && $filehandler->simpletype == "image") { $thumb_sizes = hj_framework_get_thumb_sizes(); foreach ($thumb_sizes as $thumb_type => $thumb_size) { $thumbnail = get_resized_image_from_existing_file($filehandler->getFilenameOnFilestore(), $thumb_size['w'], $thumb_size['h'], $thumb_size['square'], 0, 0, 0, 0, true); if ($thumbnail) { $thumb = new ElggFile(); $thumb->setMimeType($file['type']); $thumb->owner_guid = $user_guid; $thumb->setFilename("{$prefix}{$filehandler->getGUID()}{$thumb_type}.jpg"); $thumb->open("write"); $thumb->write($thumbnail); $thumb->close(); $thumb_meta = "{$thumb_type}thumb"; $filehandler->{$thumb_meta} = $thumb->getFilename(); unset($thumbnail); } } } $response = array('status' => 'OK', 'value' => $meta_value); } else { $response = array('status' => 'FAIL'); } echo json_encode($response); elgg_set_ignore_access($access); return; }
/** * Return an array of all private settings. * * @param int $entity_guid The entity GUID * * @return array|false * @see set_private_setting() * @see get_private_settings() * @see remove_private_setting() * @see remove_all_private_settings() * @link http://docs.elgg.org/DataModel/Entities/PrivateSettings */ function get_all_private_settings($entity_guid) { global $PRIVATE_SETTINGS_CACHE; static $private_setting_memcache; $dbprefix = elgg_get_config("dbprefix"); $entity_guid = (int) $entity_guid; // check if you have access to the entity if (!elgg_get_ignore_access() && !get_entity_as_row($entity_guid)) { return false; } // first check localy if (isset($PRIVATE_SETTINGS_CACHE[$entity_guid])) { return $PRIVATE_SETTINGS_CACHE[$entity_guid]; } if (!isset($private_setting_memcache) && is_memcache_available()) { $private_setting_memcache = new ElggMemcache("private_settings"); } if ($private_setting_memcache) { if ($settings = $private_setting_memcache->load($entity_guid)) { // cache localy $PRIVATE_SETTINGS_CACHE[$entity_guid] = $settings; if (!empty($settings)) { return $settings; } else { return false; } } } $query = "SELECT *"; $query .= " FROM {$dbprefix}private_settings"; $query .= " WHERE entity_guid = {$entity_guid}"; $settings = array(); if ($result = get_data($query)) { foreach ($result as $r) { $settings[$r->name] = $r->value; } } if ($private_setting_memcache) { $private_setting_memcache->save($entity_guid, $settings); } if (!empty($settings)) { // cache localy $PRIVATE_SETTINGS_CACHE[$entity_guid] = $settings; return $settings; } return false; }
/** * Add the subsite ACL to the read access list if on a subsite. * On main site they are provided by Elgg core * * Subsite ACL's have a site_guid of main site * * @param string $hook * @param string $type * @param mixed $returnvalue * @param mixed $params * @return mixed */ function subsite_manager_access_read_hook($hook, $type, $returnvalue, $params) { static $read_cache; $result = $returnvalue; $user_guid = (int) elgg_extract("user_id", $params); $site_guid = (int) elgg_extract("site_id", $params); if (!empty($user_guid) && !empty($site_guid)) { if (!isset($read_cache)) { $read_cache = array(); } $checksum = md5($user_guid . "-" . $site_guid); // check cache if (!isset($read_cache[$checksum])) { $read_cache[$checksum] = false; $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); if (($site = elgg_get_site_entity()) && $site->getGUID() == $site_guid) { if (elgg_instanceof($site, "site", Subsite::SUBTYPE, "Subsite")) { if ($site->isUser($user_guid)) { if (($acl = $site->getACL()) && !in_array($acl, $result)) { $read_cache[$checksum] = $acl; } } } } elgg_set_ignore_access($ia); } // get the result from cache if ($read_cache[$checksum]) { $result[] = $read_cache[$checksum]; } } return $result; }
function event_calendar_generate_listing_params($page_type, $container_guid, $original_start_date, $display_mode, $filter, $region = '-') { $event_calendar_listing_format = elgg_get_plugin_setting('listing_format', 'event_calendar'); $event_calendar_spots_display = trim(elgg_get_plugin_setting('spots_display', 'event_calendar')); $event_calendar_first_date = trim(elgg_get_plugin_setting('first_date', 'event_calendar')); $event_calendar_last_date = trim(elgg_get_plugin_setting('last_date', 'event_calendar')); if (!$original_start_date) { $original_start_date = date('Y-m-d'); } if ($event_calendar_first_date && $original_start_date < $event_calendar_first_date) { $original_start_date = $event_calendar_first_date; } if ($event_calendar_last_date && $original_start_date > $event_calendar_last_date) { $original_start_date = $event_calendar_first_date; } if ($event_calendar_listing_format == 'paged') { $start_ts = strtotime($original_start_date); $start_date = $original_start_date; if ($event_calendar_last_date) { $end_ts = strtotime($event_calendar_last_date); } else { // set to a large number $end_ts = 2000000000; } $mode = 'paged'; } else { // the default interval is one month $day = 60 * 60 * 24; $week = 7 * $day; $month = 31 * $day; $mode = trim($display_mode); if (!$mode) { $mode = 'month'; } if ($mode == "day") { $start_date = $original_start_date; $end_date = $start_date; $start_ts = strtotime($start_date); $end_ts = strtotime($end_date) + $day - 1; } else { if ($mode == "week") { // need to adjust start_date to be the beginning of the week $start_ts = strtotime($original_start_date); $start_ts -= date("w", $start_ts) * $day; $end_ts = $start_ts + 6 * $day; $start_date = date('Y-m-d', $start_ts); $end_date = date('Y-m-d', $end_ts); } else { $start_ts = strtotime($original_start_date); $month = date('m', $start_ts); $year = date('Y', $start_ts); $start_date = $year . '-' . $month . '-1'; $end_date = $year . '-' . $month . '-' . getLastDayOfMonth($month, $year); } } if ($event_calendar_first_date && $start_date < $event_calendar_first_date) { $start_date = $event_calendar_first_date; } if ($event_calendar_last_date && $end_date > $event_calendar_last_date) { $end_date = $event_calendar_last_date; } $start_ts = strtotime($start_date); if ($mode == "day") { $end_ts = strtotime($end_date) + $day - 1; $subtitle = elgg_echo('event_calendar:day_label') . ': ' . date('j F Y', strtotime($start_date)); } else { if ($mode == "week") { // KJ - fix for end date bug //$end_ts = $start_ts + 6*$day; $end_ts = $start_ts + 7 * $day; $subtitle = elgg_echo('event_calendar:week_label') . ': ' . date('j F', $start_ts) . ' - ' . date('j F Y', $end_ts); } else { // KJ - fix for end date bug //$end_ts = strtotime($end_date); $end_ts = strtotime($end_date) + 24 * 60 * 60 - 1; $subtitle = date('F Y', $start_ts); } } } $current_user_guid = elgg_get_logged_in_user_guid(); $access_status = elgg_get_ignore_access(); if ($page_type == 'owner') { $container = get_entity($container_guid); if (elgg_instanceof($container, 'user')) { $auth_token = get_input('auth_token'); if ($auth_token) { $secret_key = event_calendar_get_secret_key(); if ($secret_key && $auth_token === sha1($container->username . $secret_key)) { elgg_set_ignore_access(TRUE); } } if ($container->canEdit()) { $user_guid = $container_guid; $group_guid = 0; } else { register_error('event_calendar:owner:permissions_error'); forward(); exit; } } else { register_error('event_calendar:owner:permissions_error'); forward(); exit; } } else { $user_guid = $current_user_guid; $group_guid = $container_guid; } $offset = get_input('offset'); $limit = get_input('limit', 15); if ($event_calendar_spots_display == 'yes') { if (!$filter) { $filter = 'open'; } } else { if (!$filter) { $filter = 'all'; } } if ($filter == 'all') { $count = event_calendar_get_events_between($start_ts, $end_ts, true, $limit, $offset, $container_guid, $region); $events = event_calendar_get_events_between($start_ts, $end_ts, false, $limit, $offset, $container_guid, $region); } else { if ($filter == 'open') { $count = event_calendar_get_open_events_between($start_ts, $end_ts, true, $limit, $offset, $container_guid, $region); $events = event_calendar_get_open_events_between($start_ts, $end_ts, false, $limit, $offset, $container_guid, $region); } else { if ($filter == 'friends') { $count = event_calendar_get_events_for_friends_between($start_ts, $end_ts, true, $limit, $offset, $user_guid, $container_guid, $region); $events = event_calendar_get_events_for_friends_between($start_ts, $end_ts, false, $limit, $offset, $user_guid, $container_guid, $region); } else { if ($filter == 'mine') { $count = event_calendar_get_events_for_user_between2($start_ts, $end_ts, true, $limit, $offset, $user_guid, $container_guid, $region); $events = event_calendar_get_events_for_user_between2($start_ts, $end_ts, false, $limit, $offset, $user_guid, $container_guid, $region); } } } } $vars = array('original_start_date' => $original_start_date, 'start_date' => $start_date, 'end_date' => $end_date, 'first_date' => $event_calendar_first_date, 'last_date' => $event_calendar_last_date, 'mode' => $mode, 'events' => $events, 'count' => $count, 'offset' => $offset, 'limit' => $limit, 'group_guid' => $group_guid, 'filter' => $filter, 'region' => $region, 'listing_format' => $event_calendar_listing_format); $content = elgg_view('event_calendar/show_events', $vars); if ($page_type == 'owner') { $filter_override = ''; } else { $filter_override = elgg_view('event_calendar/filter_menu', $vars); } if ($event_calendar_listing_format == 'paged') { $title = elgg_echo('event_calendar:upcoming_events_title'); } else { if ($page_type == 'group') { $title = elgg_echo('event_calendar:group') . ' (' . $subtitle . ')'; } else { $title = elgg_echo('event_calendar:listing_title:' . $filter) . ' (' . $subtitle . ')'; } } $params = array('title' => $title, 'content' => $content, 'filter_override' => $filter_override); elgg_set_ignore_access($access_status); return $params; }
/** * handles the extended garbage collection * * @param string $hook hookname * @param string $type hooktype * @param mixed $returnvalue current return value * @param mixed $params original parameters * * @return void */ public static function collect($hook, $type, $returnvalue, $params) { if (elgg_get_plugin_setting('enable_gc', 'garbagecollector_extended') !== 'yes') { return; } elgg_register_plugin_hook_handler('permissions_check', 'all', '\\Elgg\\Values::getTrue'); $dbprefix = elgg_get_config('dbprefix'); // overrule access settigns $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); // cleanup entities if ($entity_guids = garbagecollector_extended_get_orphaned_entities()) { echo elgg_echo('garbagecollector_extended:cleanup', ['entities']); foreach ($entity_guids as $guid) { $entity = get_entity($guid); if ($entity) { $entity->delete(); } } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup access collections if ($acl_ids = garbagecollector_extended_get_orphaned_access_collections()) { echo elgg_echo('garbagecollector_extended:cleanup', ['access collections']); foreach ($acl_ids as $id) { delete_access_collection($id); } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup annotations if ($anno_ids = garbagecollector_extended_get_orphaned_annotations()) { echo elgg_echo('garbagecollector_extended:cleanup', ['annotations']); foreach ($anno_ids as $id) { elgg_delete_annotation_by_id($id); } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup metadata if ($meta_ids = garbagecollector_extended_get_orphaned_metadata()) { echo elgg_echo('garbagecollector_extended:cleanup', ['metadata']); foreach ($meta_ids as $id) { // We need to manualy delete metadata as the Elgg functions don't work because this is orphaned metadata // also we need to delete this one by one because of potential long query strings $sql = 'DELETE FROM ' . $dbprefix . 'metadata'; $sql .= ' WHERE id = ' . $id; delete_data($sql); } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup private settings if ($private_ids = garbagecollector_extended_get_orphaned_private_settings()) { echo elgg_echo('garbagecollector_extended:cleanup', ['private settings']); foreach ($private_ids as $id) { // We need to manualy delete private settings as Elgg doesn't have a function fot this // also we need to delete this one by one because of potential long query strings $sql = 'DELETE FROM ' . $dbprefix . 'private_settings'; $sql .= ' WHERE id = ' . $id; delete_data($sql); } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup relationships if ($rel_ids = garbagecollector_extended_get_orphaned_relationships()) { echo elgg_echo('garbagecollector_extended:cleanup', ['relationships']); foreach ($rel_ids as $id) { delete_relationship($id); } echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // cleanup river if ($river_ids = garbagecollector_extended_get_orphaned_river()) { echo elgg_echo('garbagecollector_extended:cleanup', ['river items']); elgg_delete_river(['ids' => $river_ids]); echo elgg_echo('garbagecollector_extended:done') . '\\n'; } // because we cleaned up a lot, do metastrings again garbagecollector_orphaned_metastrings(); // restore access settings elgg_set_ignore_access($ia); elgg_unregister_plugin_hook_handler('permissions_check', 'all', '\\Elgg\\Values::getTrue'); }
private function updateUser($field, $value) { $status = elgg_get_ignore_access(); elgg_set_ignore_access(); $user = get_entity($this->user->guid); if ($field == 'email') { if (!get_user_by_email($value)) { $user->{$field} = $value; return $user->save(); } else { return false; } } if ($field == 'password') { $user->{$field} = md5($value . $this->user->salt); return $user->save(); } }
public function getAdminGuids() { // need to bypass security $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); $user_guids = $this->getPrivateSetting("admin_guids"); if ($user_guids) { $user_guids = explode(",", $user_guids); if (!is_array($user_guids)) { $user_guids = array($user_guids); } } else { $user_guids = array(); } // restore security elgg_set_ignore_access($ia); return $user_guids; }
/** * function to add custom profile fields to user on register * * @param $event * @param $object_type * @param $object * @return unknown_type */ function profile_manager_create_user_event($event, $object_type, $object) { $custom_profile_fields = array(); // retrieve all field that were on the register page foreach ($_POST as $key => $value) { if (strpos($key, "custom_profile_fields_") === 0) { $key = substr($key, 22); $custom_profile_fields[$key] = get_input("custom_profile_fields_" . $key); } } if (count($custom_profile_fields) > 0) { $categorized_fields = profile_manager_get_categorized_fields(null, true, true); $configured_fields = $categorized_fields['fields']; // set ignore access $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); foreach ($custom_profile_fields as $shortname => $value) { // determine if $value should be an array if (!is_array($value) && !empty($configured_fields)) { // only do something if it not is already an array foreach ($configured_fields as $configured_field) { if ($configured_field->metadata_name == $shortname) { if ($configured_field->metadata_type == "tags" || $configured_field->output_as_tags == "yes") { $value = string_to_tag_array($value); // no need to continue this foreach break; } } } } // use create_metadata to listen to default access if (is_array($value)) { $i = 0; foreach ($value as $interval) { $i++; if ($i == 1) { $multiple = false; } else { $multiple = true; } create_metadata($object->guid, $shortname, $interval, 'text', $object->guid, get_default_access($object), $multiple); } } else { create_metadata($object->guid, $shortname, $value, 'text', $object->guid, get_default_access($object)); } } // restore ignore access elgg_set_ignore_access($ia); } if (isset($_FILES["profile_icon"])) { add_profile_icon($object); } }
/** * Cache an entity. * * Stores an entity in $ENTITY_CACHE; * * @param \ElggEntity $entity Entity to cache * * @return void * @see _elgg_retrieve_cached_entity() * @see _elgg_invalidate_cache_for_entity() * @access private * @todo Use an \ElggCache object */ function _elgg_cache_entity(\ElggEntity $entity) { global $ENTITY_CACHE, $ENTITY_CACHE_DISABLED_GUIDS; // Don't cache non-plugin entities while access control is off, otherwise they could be // exposed to users who shouldn't see them when control is re-enabled. if (!$entity instanceof \ElggPlugin && elgg_get_ignore_access()) { return; } $guid = $entity->getGUID(); if (isset($ENTITY_CACHE_DISABLED_GUIDS[$guid])) { return; } // Don't store too many or we'll have memory problems // @todo Pick a less arbitrary limit if (count($ENTITY_CACHE) > 256) { _elgg_invalidate_cache_for_entity(array_rand($ENTITY_CACHE)); } $ENTITY_CACHE[$guid] = $entity; }
function get_voucher_howmany($voucher) { if (elgg_instanceof($voucher, 'object', 'vouchers')) { if ($voucher->code_type != VOUCHERS_CODE_TYPE_SERIES) { return $voucher->howmany; } else { if (!is_numeric($voucher->code) || !is_numeric($voucher->code_end)) { return 0; } else { if ($voucher->code >= $voucher->code_end) { return 0; } else { // set ignore access for loading all sales entries $ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); // search the codes which have already be given $options = array('type' => 'object', 'subtype' => 'vsales', 'limit' => 0, 'count' => true, 'metadata_name_value_pairs' => array(array('name' => 'txn_vguid', 'value' => $voucher->guid, 'operand' => '='))); $sales_no = elgg_get_entities_from_metadata($options); // restore ignore access elgg_set_ignore_access($ia); // initial no of code vouchers $init_no = $voucher->code_end - $voucher->code + 1; // final howmany no $howmany = $init_no - $sales_no; return $howmany; } } } } return 0; }
/** * Check if the user logged in when the query is run, has access to a given data row * This is a reverse engineered approach to an SQL query generated by AccessCollections::getWhereSql() * * @param \stdClass $row Data row * @return bool */ public function validateRowAccess($row) { if (elgg_get_ignore_access()) { return true; } if ($row->access_id == ACCESS_PUBLIC) { return true; } $user = elgg_get_logged_in_user_entity(); if (!$user) { return false; } if ($row->access_id == ACCESS_LOGGED_IN && elgg_is_logged_in()) { return true; } if ($user->isAdmin()) { return true; } if ($row->owner_guid == $user->guid) { return true; } if ($row->access_id == ACCESS_PRIVATE && $row->owner_guid == $user->guid) { return true; } if ($row->access_id == ACCESS_FRIENDS && check_entity_relationship($row->owner_guid, 'friend', $user->guid)) { return true; } $access_list = _elgg_services()->accessCollections->getAccessList($user->guid); if (in_array($row->access_id, $access_list)) { return true; } }
/** * Function to replace group profile fields * * @param string $hook_name name of the hook * @param string $entity_type type of the hook * @param unknown $return_value return value * @param unknown $parameters hook parameters * * @return array */ public static function getGroupFields($hook_name, $entity_type, $return_value, $parameters) { // get from cache $site_guid = elgg_get_config('site_guid'); $entities = elgg_load_system_cache("profile_manager_group_fields_{$site_guid}"); if ($entities === null) { $options = ['type' => 'object', 'subtype' => CUSTOM_PROFILE_FIELDS_GROUP_SUBTYPE, 'limit' => false, 'owner_guid' => elgg_get_config('site_guid')]; $entities = elgg_get_entities($options); elgg_save_system_cache("profile_manager_group_fields_{$site_guid}", serialize($entities)); } else { $entities = unserialize($entities); } if (empty($entities)) { return; } $guids = []; $translations = []; foreach ($entities as $entity) { $guids[] = $entity->getGUID(); } _elgg_services()->metadataCache->populateFromEntities($guids); $result = []; $ordered = []; // Order the group fields and filter some types out foreach ($entities as $group_field) { if ($group_field->admin_only != 'yes' || (elgg_is_admin_logged_in() || elgg_get_ignore_access())) { $ordered[$group_field->order] = $group_field; } } ksort($ordered); // build the correct list $result['name'] = 'text'; foreach ($ordered as $group_field) { $result[$group_field->metadata_name] = $group_field->metadata_type; // should it be handled as tags? Q: is this still needed? A: Yes it is, it handles presentation of these fields in listing mode if (elgg_get_context() == 'search' && ($group_field->output_as_tags == 'yes' || $group_field->metadata_type == 'multiselect')) { $result[$group_field->metadata_name] = 'tags'; } $translations["groups:{$group_field->metadata_name}"] = $group_field->getTitle(); } $languages = ['en']; $languages[] = get_current_language(); $languages[] = elgg_get_config('language'); array_unique($languages); foreach ($languages as $lang) { add_translation($lang, $translations); } return $result; }
/** * Can the user change this access collection? * * Use the plugin hook of 'access:collections:write', 'user' to change this. * @see get_write_access_array() for details on the hook. * * Respects access control disabling for admin users and {@link elgg_set_ignore_access()} * * @see get_write_access_array() * * @param int $collection_id The collection id * @param mixed $user_guid The user GUID to check for. Defaults to logged in user. * @return bool */ function canEdit($collection_id, $user_guid = null) { try { $user = $this->entities->getUserForPermissionsCheck($user_guid); } catch (UserFetchFailureException $e) { return false; } $collection = $this->get($collection_id); if (!$user || !$collection) { return false; } $write_access = $this->getWriteAccessArray($user->guid, true); // don't ignore access when checking users. if ($user_guid) { return array_key_exists($collection_id, $write_access); } else { return elgg_get_ignore_access() || array_key_exists($collection_id, $write_access); } }
/** * Creates default widgets * * This plugin hook handler is registered for events based on what kinds of * default widgets have been registered. See elgg_default_widgets_init() for * information on registering new default widget contexts. * * @param string $event The event * @param string $type The type of object * @param object $entity The entity being created * @return null * @access private */ function elgg_create_default_widgets($event, $type, $entity) { $default_widget_info = elgg_get_config('default_widget_info'); if (!$default_widget_info || !$entity) { return null; } $type = $entity->getType(); $subtype = $entity->getSubtype(); // event is already guaranteed by the hook registration. // need to check subtype and type. foreach ($default_widget_info as $temp) { if ($temp['entity_type'] == $type) { if ($temp['entity_subtype'] == ELGG_ENTITIES_ANY_VALUE || $temp['entity_subtype'] == $subtype) { $info = $temp; break; } } } // need to be able to access everything $old_ia = elgg_get_ignore_access(true); elgg_push_context('create_default_widgets'); // pull in by widget context with widget owners as the site // not using elgg_get_widgets() because it sorts by columns and we don't care right now. $options = array('type' => 'object', 'subtype' => 'widget', 'owner_guid' => elgg_get_site_entity()->guid, 'private_setting_name' => 'context', 'private_setting_value' => $info['widget_context'], 'limit' => 0); $widgets = elgg_get_entities_from_private_settings($options); foreach ($widgets as $widget) { // change the container and owner $new_widget = clone $widget; $new_widget->container_guid = $entity->guid; $new_widget->owner_guid = $entity->guid; // pull in settings $settings = get_all_private_settings($widget->guid); foreach ($settings as $name => $value) { $new_widget->{$name} = $value; } $new_widget->save(); } elgg_get_ignore_access($old_ia); elgg_pop_context(); // failure here shouldn't stop the event. return null; }
function event_manager_export_waitinglist($event, $file = false) { $old_ia = elgg_get_ignore_access(); elgg_set_ignore_access(true); if ($file) { $EOL = "\r\n"; } else { $EOL = PHP_EOL; } $headerString .= '"' . elgg_echo('guid') . '";"' . elgg_echo('name') . '";"' . elgg_echo('email') . '";"' . elgg_echo('username') . '"'; if ($event->registration_needed) { if ($registration_form = $event->getRegistrationFormQuestions()) { foreach ($registration_form as $question) { $headerString .= ';"' . $question->title . '"'; } } } if ($event->with_program) { if ($eventDays = $event->getEventDays()) { foreach ($eventDays as $eventDay) { $date = date(EVENT_MANAGER_FORMAT_DATE_EVENTDAY, $eventDay->date); if ($eventSlots = $eventDay->getEventSlots()) { foreach ($eventSlots as $eventSlot) { $start_time = $eventSlot->start_time; $end_time = $eventSlot->end_time; $start_time_hour = date('H', $start_time); $start_time_minutes = date('i', $start_time); $end_time_hour = date('H', $end_time); $end_time_minutes = date('i', $end_time); $headerString .= ';"Event activity: \'' . $eventSlot->title . '\' ' . $date . ' (' . $start_time_hour . ':' . $start_time_minutes . ' - ' . $end_time_hour . ':' . $end_time_minutes . ')"'; } } } } } if ($waiters = $event->exportWaiters()) { foreach ($waiters as $waiter) { $answerString = ''; $dataString .= '"' . $waiter->guid . '";"' . $waiter->name . '";"' . $waiter->email . '";"' . $waiter->username . '"'; if ($event->registration_needed) { if ($registration_form = $event->getRegistrationFormQuestions()) { foreach ($registration_form as $question) { $answer = $question->getAnswerFromUser($waiter->getGUID()); $answerString .= '"' . addslashes($answer->value) . '";'; } } $dataString .= ';' . substr($answerString, 0, strlen($answerString) - 1); } if ($event->with_program) { if ($eventDays = $event->getEventDays()) { foreach ($eventDays as $eventDay) { if ($eventSlots = $eventDay->getEventSlots()) { foreach ($eventSlots as $eventSlot) { if (check_entity_relationship($waiter->getGUID(), EVENT_MANAGER_RELATION_SLOT_REGISTRATION, $eventSlot->getGUID())) { $dataString .= ';"V"'; } else { $dataString .= ';""'; } } } } } } $dataString .= $EOL; } } $headerString .= $EOL; elgg_set_ignore_access($old_ia); return $headerString . $dataString; }
function elgg_solr_get_access_query() { if (elgg_is_admin_logged_in() || elgg_get_ignore_access()) { return false; // no access limit } static $return; if ($return) { return $return; } $access = get_access_array(); // access filter query if ($access) { $access_list = implode(' ', $access); } if (elgg_is_logged_in()) { // get friends // @TODO - is there a better way? Not sure if there's a limit on solr if // someone has a whole lot of friends... $friends = elgg_get_entities_from_relationship(array('type' => 'user', 'relationship' => 'friend', 'relationship_guid' => elgg_get_logged_in_user_guid(), 'inverse_relationship' => true, 'limit' => false, 'callback' => false)); $friend_guids = array(); foreach ($friends as $friend) { $friend_guids[] = $friend->guid; } $friends_list = ''; if ($friend_guids) { $friends_list = elgg_solr_escape_special_chars(implode(' ', $friend_guids)); } } //$query->createFilterQuery('access')->setQuery("owner_guid: {guid} OR access_id:({$access_list}) OR (access_id:" . ACCESS_FRIENDS . " AND owner_guid:({$friends}))"); if (elgg_is_logged_in()) { $return = "owner_guid:" . elgg_get_logged_in_user_guid(); } else { $return = ''; } if ($access_list) { if ($return) { $return .= ' OR '; } $return .= "access_id:(" . elgg_solr_escape_special_chars($access_list) . ")"; } $fr_prefix = ''; $fr_suffix = ''; if ($return && $friends_list) { $return .= ' OR '; $fr_prefix = '('; $fr_suffix = ')'; } if ($friends_list) { $return .= $fr_prefix . 'access_id:' . elgg_solr_escape_special_chars(ACCESS_FRIENDS) . ' AND owner_guid:(' . $friends_list . ')' . $fr_suffix; } return $return; }
/** * Get an entity from the in-memory or memcache caches * * @param int $guid GUID * * @return \ElggEntity */ protected function getFromCache($guid) { $entity = $this->entity_cache->get($guid); if ($entity) { return $entity; } $memcache = _elgg_get_memcache('new_entity_cache'); $entity = $memcache->load($guid); if (!$entity instanceof ElggEntity) { return false; } // Validate accessibility if from memcache if (!elgg_get_ignore_access() && !has_access_to_entity($entity)) { return false; } $this->entity_cache->set($entity); return $entity; }