DataObjects/Core_ip_access.php

[Pman.Core] / Images.php

diff --git a/Images.php b/Images.php
index 07c9350..474eb64 100644 (file)
--- a/Images.php
+++ b/Images.php
@@ -37,6 +37,11 @@
 require_once  'Pman.php';
 class Pman_Core_Images extends Pman
 {
+    
+    // tables that do not need authentication checks before serving.
+    var $public_image_tables = array();
+    
+    
     function getAuth()
     {
         parent::getAuth(); // load company!
@@ -44,7 +49,8 @@ class Pman_Core_Images extends Pman
         $au = $this->getAuthUser();
         
         if (!$au) {
-            die("Access denied");
+            $this->authUser = false;
+            return true;//die("Access denied");
         }
         
         $this->authUser = $au;
@@ -54,8 +60,9 @@ class Pman_Core_Images extends Pman
     var $thumb = false;
     var $as_mimetype = false;
     var $method = 'inline';
+    var $page = false;
     
-    function get($s) // determin what to serve!!!!
+    function get($s, $opts=array()) // determin what to serve!!!!
     {
         // for testing only.
         //if (!empty($_GET['_post'])) {
@@ -64,6 +71,8 @@ class Pman_Core_Images extends Pman
         
         $this->as_mimetype = empty($_REQUEST['as']) ? '' : $_REQUEST['as'];
         
+        $this->page = empty($_REQUEST['page']) ? false : (int) $_REQUEST['page'];
+        
         $bits= explode('/', $s);
         $id = 0;
 //        var_dump($bits);die('in');
@@ -85,10 +94,12 @@ class Pman_Core_Images extends Pman
             $id = empty($bits[3]) ? 0 :   $bits[3];
             
         } else if (!empty($bits[0]) && $bits[0] == 'events') {
-            
+            if (!$this->authUser) {
+                $this->imgErr("no-authentication-events",$s);
+            }
             $this->downloadEvent($bits);
+            $this->imgErr("unknown file",$s);
             
-            die ("unknown file?"); 
             
         } else {
         
@@ -96,9 +107,16 @@ class Pman_Core_Images extends Pman
         }
         
         if (strpos($id,':') > 0) {  // id format  tablename:id:-imgtype
+            
+            if (!$this->authUser) {
+                $this->imgErr("not-authenticated-using-colon-format",$s);
+                
+            }
+            
             $onbits = explode(':', $id);
             if ((count($onbits) < 2)   || empty($onbits[1]) || !is_numeric($onbits[1]) || !strlen($onbits[0])) {
-                die("Bad url");
+                $this->imgErr("bad-url",$s);
+                
             }
             //DB_DataObject::debugLevel(1);
             $img = DB_DataObject::factory('Images');
@@ -113,8 +131,8 @@ class Pman_Core_Images extends Pman
             }
             $img->limit(1);
             if (!$img->find(true)) {
-                header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason=' .
-                urlencode("no images for that item: " . htmlspecialchars($id)));
+                $this->imgErr("no images for that item: " . htmlspecialchars($id),$s);
+                
             }
             
             $id = $img->id;
@@ -125,20 +143,20 @@ class Pman_Core_Images extends Pman
         
         // depreciated - should use ontable:onid:type here...
         if (!empty($_REQUEST['ontable'])) {
-
+            
+            if (!$this->authUser) {
+                die("authentication required");
+            }
+            
             //DB_DataObjecT::debugLevel(1);
-            $img = DB_DataObjecT::factory('Images');
+            $img = DB_DataObject::factory('Images');
             $img->setFrom($_REQUEST);
-            // use imgtype now...
-           // if (!empty($_REQUEST['query']['filename'])){
-           //     $img->whereAdd("filename LIKE '". $img->escape($_REQUEST['query']['filename']).".%'");
-           // }
+           
             
             
             $img->limit(1);
             if (!$img->find(true)) {
-                header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason='. 
-                    urlencode("No file exists"));
+                $this->imgErr("No file exists",$s);
             } 
             $id = $img->id;
             
@@ -149,27 +167,48 @@ class Pman_Core_Images extends Pman
         $img = DB_DataObjecT::factory('Images');
          
         if (!$id || !$img->get($id)) {
-             
-            header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason=' .
-                urlencode("image has been removed or deleted."));
+             $this->imgErr("image has been removed or deleted.",$s);
+        }
+        
+        if (!$this->authUser && !in_array($img->ontable,$this->public_image_tables)) {
+           
+            if ($img->ontable != 'core_company') {
+                $this->imgErr("not-authenticated {$img->ontable}",$s);
+            }
+            if ($img->imgtype != 'LOGO') {
+                $this->imgErr("not-logo",$s);
+            }
+            $comp  = $img->object();
+            if ($comp->comptype != 'OWNER') {
+                $this->imgErr("not-owner-company",$s);
+            }
+            return $this->serve($img);
+        
             
         }
         
+        
         if(!$this->hasPermission($img)){
-            header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason=' .
-                urlencode("access to this image/file has been denied."));
+            $this->imgErr("access to this image/file has been denied.",$s);
+            
         }
         
         $this->serve($img);
         exit;
     }
     
+    function imgErr($reason,$path) {
+        header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason=' .
+            urlencode($reason) .'&path='.urlencode($path));
+        exit;
+    }
+    
     function hasPermission($img) 
     {
         return true;
     }
     
-    function post()
+    function post($v)
     {
         
         if (!$this->authUser) {
@@ -263,7 +302,12 @@ class Pman_Core_Images extends Pman
             $this->validateSize();
         }
         
-        $x->convert( $this->as_mimetype, $this->size);
+        if(!empty($this->page) && !is_nan($this->page * 1)){
+            $x->convert( $this->as_mimetype, $this->size, 0, $this->page);
+        } else {
+            $x->convert( $this->as_mimetype, $this->size);
+        }
+        
         $x->serve();
         exit;
         
@@ -307,10 +351,11 @@ class Pman_Core_Images extends Pman
         
         $project = str_replace('/', '_', $project);
          
-         var_dump($project::$Pman_Core_Images_Size);
-        
-        if(isset($project::$Pman_Core_Images_Size)){
-            $sizes = $project::$Pman_Core_Images_Size;
+        $pr_obj = new $project;
+         
+       // var_dump($pr_obj->Pman_Core_Images_Size);
+        if(isset($pr_obj->Pman_Core_Images_Size)){
+            $sizes = $pr_obj->Pman_Core_Images_Size;
             
             
         }