information-system/application/libraries/Accesscheck.php

<?php

if (!defined('BASEPATH'))
    exit('No direct script access allowed');

class Accesscheck extends CI_Controller
{

    function __construct()
    {
        parent::__construct();
        $this->load->model('infoAccessmanage_model','Access_model');
    }
    public function check_access($site_code='',$module=''){
        $userdata=$this->session->userdata('session_admin');
        //如果没有开启权限管理或者是超级管理员则拥有全部权限
        if (!$this->config->item('check_access') or in_array(strtolower($userdata['OPI_Code']), $this->config->item('access_super_manage'))) {
            return true;
        }
        
        if ($this->session->userdata('access_module') === false){
            $this->init_accessdata();
        }
        //用户拥有权限de站点、模块&需要权限认证的模块
        $access_module       = $this->session->userdata('access_module');
        $user_controller     = $access_module['user_controller'];
        $user_action         = $access_module['user_action'];
        $iaa_controller_list = $access_module['iaa_controller_list'];
        $iaa_action_list     = $access_module['iaa_action_list'];
        $user_site_list      = $this->session->userdata('access_sitecode');

        //检测用户是否能访问当前站点,如果不能，则跳转到该用户有权限的站点
        if($site_code=='')$site_code=$this->config->item('site_code');
        if (false===stripos(',' . $user_site_list, $site_code)){
            header('Location: '.$_SERVER['HTTP_REFERER']);
            exit();
        }

        //判断当前操作是否需要认证
        $flag=true;
        if ($module!='') {
            $module_array=explode('/', trim($module));
            $this->router->class= $module_array[0];
            $this->router->method= $module_array[1];
        }
        //判断当前模块是否需要认证
        if (in_array($this->router->class, $iaa_controller_list)) {
            //如果需要认证，判断是否有权限操作当前模块
            if (in_array($this->router->class,$user_controller)) {
                //判断是否能编辑不同省份信息
                /*if($this->router->class=='province'){
                    $province=str_replace('/province/', '', $this->uri->uri_string());
                    $province=trim($province);
                    if (!isset($user_action[$this->router->class]) || !in_array($province, $user_action[$this->router->class])) {
                        $flag = false;//没有权限查看当前省份！
                    }
                }
                //判断当前方法是否需要认证
                else*/
                if (isset($iaa_action_list[$this->router->class]) && in_array($this->router->method, $iaa_action_list[$this->router->class])) {
                    //如果当前方法需要认证，则判断是否有权限
                    if (!isset($user_action[$this->router->class]) || !in_array($this->router->method, $user_action[$this->router->class])) {
                        $flag = false;//没有权限执行当前方法！
                    }
                }
            }else {
                $flag = false;//没有权限执行当前控制器模块！
            }
        }
        if ($module =='' && !$flag) {
            redirect(site_url('Login/refuse'));
            exit();
        }
        return $flag;
    }

    public function init_accessdata(){
        $userdata=$this->session->userdata('session_admin');
        //根据usercode获取用户角色、可读、可写列表
        $user_access=$this->Access_model->get_user_access($userdata['OPI_Code'],$this->config->item('site_code'));
        //根据角色字符串获取用户有权限的操作
        $user_node=$this->Access_model->get_node_list($user_access->iao_role.'0');
        //把用户拥有的所有角色id组装成一个数组集合
        $node_str='';
        foreach ($user_node as $node) {
            $node_str.=$node->ian_iaa_id;
        }
        $node_array=explode(',', substr($node_str, 0,-1));

        //用户拥有权限de站点、模块&需要权限认证的模块
        $user_controller     = array();
        $user_action         = array();
        $iaa_controller_list = array();
        $iaa_action_list     = array();

        //所有需要认证的模块、方法
        $action_list=$this->Access_model->get_action_list();
        foreach ($action_list as $a) {

            //用户拥有的权限模块、方法
            if (in_array($a->iaa_id, $node_array) && $a->iaa_controller!='') {
                $user_controller[] = $a->iaa_controller;
                $user_action[$a->iaa_controller][] = $a->iaa_action;
            }
            //需要认证的控制器和方法
            if(!empty($a->iaa_controller))$iaa_controller_list[]=$a->iaa_controller;
            if(!empty($a->iaa_action))$iaa_action_list[$a->iaa_controller][]=$a->iaa_action;
        }
        $access_module['user_controller']     = $user_controller;
        $access_module['user_action']         = $user_action;
        $access_module['iaa_controller_list'] = $iaa_controller_list;
        $access_module['iaa_action_list']     = $iaa_action_list;
        $this->session->set_userdata('access_read_list', $user_access->iao_read);
        $this->session->set_userdata('access_write_list', $user_access->iao_write);
        $this->session->set_userdata('access_sitecode', $this->Access_model->get_user_site_list($userdata['OPI_Code']));
        $this->session->set_userdata('access_module', $access_module);
    }

    //获取角色等级(角色树形结构的等级)
    public function get_role_level($site_code='',$author=''){
        if (!$this->config->item('check_access')) {
            return 1;
        }
        if ($author=='') {
            $userdata=$this->session->userdata('session_admin');
            $author=$userdata['OPI_Code'];
        }
        if($site_code=='')$site_code=$this->config->item('site_code');
        $ownsite=$this->Access_model->get_user_access($author,$site_code);
        
        if(isset($ownsite->iao_role) && !empty($ownsite->iao_role)){
            $role_str='';
            $role_str=substr(trim($ownsite->iao_role),0,-1);
            $allrole = $this->Access_model->get_role($role_str);
            $rolelevel=array();
            foreach ($allrole as $r) {
                $rolelevel[]=$r->is_level;
            }  
        }
        $level=100;
        if(!empty($rolelevel))$level=min($rolelevel);
        return($level);
    }

    //判断信息节点是可读还是可写 1:可写，0：只读
    public function get_edit_type($is_path){
        if (!$this->config->item('check_access')) {
            return 1;
        }
        $write_list = trim($this->session->userdata('access_write_list'));
        $read_list = trim($this->session->userdata('access_read_list'));
        $is_path   = trim($is_path);
        $path_array = explode(',', $is_path);
        //对全站拥有可写权限
        if (empty($write_list) && empty($read_list)) {
            return 1;
        }
        //对当前节点有可读权限
        if ($read_list!='') {
            $read_array = explode(',', $read_list);
            if (array_intersect($path_array,$read_array)) {
                return 0;
            }
        }
        //对当前节点有可写权限
        if ($write_list!='') {
            $write_array = explode(',', $write_list);
            if (array_intersect($path_array,$write_array)) {
                return 1;
            }
        }
        //如果是有权限的信息节点的父节点则给予可读权限
        return 0;
    }

    //获取信息树形结构
    public function get_info_structure($root_id){
        $this->load->model('InfoStructures_model');
        $this->load->model('Information_model');
        //查询结构列表信息
        $data['informationList'] = $this->Information_model->StructureList($root_id);
        $ori_informationList=$data['informationList'];
        if (!$this->config->item('check_access')) {
            return $data['informationList'];
        }
        
        //权限处理
        $write_list = trim($this->session->userdata('access_write_list'));
        $read_list = trim($this->session->userdata('access_read_list'));
        if(!empty($read_list))$read_list=$read_list.',';
        $nodelist=$read_list.$write_list;
        $nodelist=trim($nodelist);
        if ($this->config->item('check_access') && !empty($nodelist)) {
            $access_ids=explode(',',$nodelist);
            $parent_id_str = '';
            $flag=array();
            $parent=array();
            $parent_is_array=array();
            //获取有权限的节点下的所有子节点
            foreach ($data['informationList'] as $tree) {
                $infopatharr=explode(',', trim($tree->is_path));
                if (in_array($tree->is_id, $access_ids)) {
                    $parent_id_str .= $tree->is_path;
                    $parent_is_array[$tree->is_id] = $tree;
                }elseif (array_intersect($infopatharr,$access_ids)) {
                    $flag[]=$tree;
                }else{
                    $parent_is_array[$tree->is_id] = $tree;
                }
            }
            //获取有权限的节点的父节点
            $parent_id_array=explode(',', $parent_id_str);
            $parent_id_array=array_unique($parent_id_array);
            array_pop($parent_id_array);
            foreach ($parent_id_array as $v) {
                if (isset($parent_is_array[$v]))
                    $parent[] = $parent_is_array[$v];
            }
            //合并父节点和子节点数组
            $data['informationList'] = $flag;
            if (!empty($parent) and !empty($data['informationList'])) {
                $data['informationList'] = array_merge($parent,$flag);
            }else{
                $data['informationList']=$parent;
            }
        }
        elseif ($this->config->item('check_access') && empty($nodelist) && $this->get_role_level()>4)
        {
            $user_province=array();
            $access_module  = $this->session->userdata('access_module');
            if(isset($access_module['user_action']['province']) && !empty($access_module['user_action']['province'])){
                $user_province  = $access_module['user_action']['province'];
                $current_province = $this->Information_model->get_province_by_isid($root_id);
                if ($current_province!==false && !in_array($current_province, $user_province)) {
                    return false;
                }
            }
        }
        //如果该信息不在可读可写列表里面，再检查是否在有权限的某一城市里面，
        //若不在则表示没有权限访问当前信息模块
        if (empty($data['informationList'])) 
        {
            $user_province  = array();
            $access_module  = $this->session->userdata('access_module');
            if(isset($access_module['user_action']['province']) && !empty($access_module['user_action']['province'])){
                $user_province  = $access_module['user_action']['province'];
            }
            $current_province = $this->Information_model->get_province_by_isid($root_id);
            if ($current_province!==false && in_array($current_province, $user_province)) {
                $data['informationList']=$ori_informationList;
            }else{
                return false;
            }
        }

        return $data['informationList'];
    }
}