Subversion Repositories DevTools

<%
'=============================================================
'//
'//                                             Access Control
'//
'// version:            0.10
'//     last modified:  14-Jul-2004 15:48 by Sasha Vukovic
'=============================================================
%>
<%
'--------------- Global Constants ----------------
Const enumSESSION_TIMEOUT = 60
Const enumLOGIN_TOKEN_SESSION = "AM_LOGIN_TOKEN"
Const enumUSER_ID_SESSION = "AM_USER_ID"
Const enumUSER_DETAILS_SESSION = "AM_USER_DETAILS"
Const enumUSER_APPLICATIONS_SESSION = "AM_USER_APPLICATIONS"
Const enumACCESS_MANAGER_EVENT_LOGON_SUCCESS  = 1
Const enumACCESS_MANAGER_EVENT_LOGON_FAIL         = -1
Const enumACCESS_MANAGER_EVENT_LOGOFF             = 0
Const enumACCESS_MANAGER_EVENT_SESSION_EXPIRE = 2
'-------------------------------------------------

Class AccessControl
        
        Private mobjStaticControl
        Private mobjRowPermissions
        Private mobjTablePermissions
        Private sSEPARATOR
        
        Public Property Get UserLogedIn ()
                UserLogedIn = FALSE
                
                ' Check for Session Token
                If (Session(enumLOGIN_TOKEN_SESSION) <> "") AND NOT IsNull(Session(enumLOGIN_TOKEN_SESSION)) Then  
                        UserLogedIn = TRUE
                End If
                
        End Property
        
        Public Property Get UserId ()
                UserId = Session(enumUSER_ID_SESSION)
        End Property
        
        Public Property Get UserName ()
                UserName = Extract( "user_name", Session(enumUSER_DETAILS_SESSION) )
        End Property
        
        Public Property Get FullName ()
                FullName = Extract( "full_name", Session(enumUSER_DETAILS_SESSION) )
        End Property
        
        Public Property Get UserEmail ()
                UserEmail = Extract( "user_email", Session(enumUSER_DETAILS_SESSION) )
        End Property
        
        Public Property Get LastVisit ()
                LastVisit = Extract( "last_visit", Session(enumUSER_DETAILS_SESSION) )
        End Property
        
   Public Property Get Domain ()
      Domain = Extract( "domain", Session(enumUSER_DETAILS_SESSION) )
   End Property

   Public Property Get isDevSystem()
      isDevSystem = InStr(OraDatabase.DatabaseName,"RELMANU1") > 0
   End Property

        '-----------------------------------------------------------------------------------------------------------------
        Public Function UserApplication ( nAppId )
                UserApplication = FALSE
                
                If InStr( sSEPARATOR & Session(enumUSER_APPLICATIONS_SESSION) & sSEPARATOR,  sSEPARATOR & nAppId & sSEPARATOR)  Then
                        UserApplication = TRUE
                End If
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function BeginRegion ( sControlObjName )
                Response.write "<table width='100%'  border='0' cellspacing='0' cellpadding='1'>"
                Response.write "  <tr>"
                Response.write "    <td bgcolor='#FF0000'>&nbsp;<a href='#' class='body_linkw'><b>"& sControlObjName &"</b></a>&nbsp;</td>"
                Response.write "  </tr>"
                Response.write "  <tr>"
                Response.write "    <td bgcolor='#FF0000'>"
                Response.write "                <table width='100%'  border='0' cellspacing='0' cellpadding='0'>"
                Response.write "                        <tr><td bgcolor='#FFFFFF'>"
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function EndRegion ( sControlObjName )
                Response.write "        </td></tr></table>"
                Response.write " </td></tr>"
                Response.write "</table>"
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Private Function Extract( sField, sString )
                Dim tempArr, tempSTR
                
                tempArr = Split( sString, sSEPARATOR )
                tempSTR = Join( Filter( tempArr, sField &"=" ) )        ' Append "=" to field name to get e.g. "user_name="
                
                Extract = Right( tempSTR, Len(tempSTR) - Len( sField &"=" ))    ' Strip the filed name from value
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Private Function GetDataPermission ( sTableName, nRowId, nPermissionType )
                Dim cPermissionValue
                
                '--- Get Row Permission ---
                cPermissionValue = mobjRowPermissions.Item ( Cstr( sTableName &"_"& nRowId &"_"& nPermissionType ) )
                
                
                'Response.write " VALUE="& cPermissionValue &" for "& sTableName &" "& nRowId &" "& nPermissionType &", "
                
                
                If IsNull( cPermissionValue )  OR  ( cPermissionValue = "" ) Then
                        
                        '--- Get Default Table Permission ---
                        cPermissionValue = mobjTablePermissions.Item ( Cstr( sTableName &"_"& nPermissionType ) )
                        
                        '--- Raise Exception if Table Default is not found ---
                        If IsNull( cPermissionValue )  OR  ( cPermissionValue = "" ) Then
                                Err.Raise 8, "Default Table Permission is Not Found.", "sTableName="& sTableName &", nPermissionType="& nPermissionType
                                Exit Function
                        End If
                        
                        
                        'Response.write " VALUE="& cPermissionValue &" for "& sTableName &" "& nRowId &" "& nPermissionType &", "
                        
                End If
                
                
                '--- Return TRUE / FALSE ---
                GetDataPermission = FALSE
                If cPermissionValue = enumDB_YES Then
                        GetDataPermission = TRUE
                End If
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function IsDataVisible ( sTableName, nRowId )
                IsDataVisible = GetDataPermission ( sTableName, nRowId, enumDB_PERMISSION_TYPE_VISIBLE )
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function IsDataActive ( sTableName, nRowId, sControlObjName )
                IsDataActive = FALSE
                
                If IsActive ( sControlObjName ) Then
                        IsDataActive = GetDataPermission ( sTableName, nRowId, enumDB_PERMISSION_TYPE_ACTIVE )
                End If
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function IsActive ( sControlObjName )
                If mobjStaticControl.Item (Cstr( sControlObjName &"_"&  enumDB_PERMISSION_TYPE_ACTIVE )) = enumDB_YES Then
                        IsActive = TRUE
                Else
                        IsActive = FALSE
                End If
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Function IsVisible ( sControlObjName )
                If mobjStaticControl.Item (Cstr( sControlObjName &"_"& enumDB_PERMISSION_TYPE_VISIBLE )) = enumDB_YES Then
                        IsVisible = TRUE
                Else
                        IsVisible = FALSE
                End If
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Sub LoadDataPermissions ( aRows )
                Dim numOfRows, rowNum
                Dim InxTableName, InxRefColumnVal, InxPermissionType, InxPermission
                
                InxTableName            = 0
                InxRefColumnVal         = 1
                InxPermissionType       = 2
                InxPermission           = 3
                
                numOfRows = UBound( aRows, 2 )
                
                For rowNum = 0 To numOfRows
                        
                        
                        If aRows( InxRefColumnVal, rowNum ) = 0 Then
                                '--- Set Table Default Permission (i.e. "0" wildcard for "all records") ---
                                mobjTablePermissions.Item ( aRows( InxTableName, rowNum ) &"_"& aRows( InxPermissionType, rowNum ) ) = aRows( InxPermission, rowNum )
                                
                        Else
                                '--- Set Row Permission ---
                                mobjRowPermissions.Item ( aRows( InxTableName, rowNum ) &"_"& aRows( InxRefColumnVal, rowNum ) &"_"& aRows( InxPermissionType, rowNum ) ) = aRows( InxPermission, rowNum )
                                
                        End If
                        
                        
                Next
                
                'Response.write "mobjRowPermissions.Keys="& Join ( mobjRowPermissions.Keys, ", ") &"<br>"
                'Response.write "mobjRowPermissions.Items="& Join ( mobjRowPermissions.Items, ", ") &"<br>"
                'Response.write "mobjTablePermissions.Keys="& Join ( mobjTablePermissions.Keys, ", ") &"<br>"
                'Response.write "mobjTablePermissions.Items="& Join ( mobjTablePermissions.Items, ", ") &"<br>"
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Public Sub LoadDataPermissionVariations ( aRows )
                Dim numOfRows, rowNum
                Dim InxTableName, InxRefColumnVal, InxPermissionType, InxPermission
                
                InxTableName            = 0
                InxRefColumnVal         = 1
                InxPermissionType       = 2
                InxPermission           = 3
                
                numOfRows = UBound( aRows, 2 )
                
                For rowNum = 0 To numOfRows
                        If mobjRowPermissions.Exists ( aRows( InxTableName, rowNum ) &"_"& enumDB_ALL_DATA &"_"& aRows( InxPermissionType, rowNum ) )Then 
                                mobjRowPermissions.Remove ( aRows( InxTableName, rowNum ) &"_"& enumDB_ALL_DATA &"_"& aRows( InxPermissionType, rowNum ) )
                        End If
                        
                        mobjRowPermissions.Item ( aRows( InxTableName, rowNum ) &"_"& aRows( InxRefColumnVal, rowNum ) &"_"& aRows( InxPermissionType, rowNum ) ) = CStr( aRows( InxPermission, rowNum ) )
                        
                        If aRows( InxPermission, rowNum ) = enumDB_NO Then
                                mobjTablePermissions.Item ( aRows( InxTableName, rowNum ) &"_"& aRows( InxPermissionType, rowNum ) ) =  enumDB_YES
                        Else
                                mobjTablePermissions.Item ( aRows( InxTableName, rowNum ) &"_"& aRows( InxPermissionType, rowNum ) ) =  enumDB_NO
                                
                        End If
                        
                        
                Next
                'Response.write "mobjRowPermissions.Keys="& Join ( mobjRowPermissions.Keys, ", ")
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Public Sub LoadStaticPermissions ( aRows )
                Dim numOfRows, rowNum
                Dim InxObjName, InxPermissionType, InxPermission
                
                InxObjName                      = 0
                InxPermissionType       = 1
                InxPermission           = 2
                
                numOfRows = UBound( aRows, 2 )
                
                For rowNum = 0 To numOfRows
                        
                        mobjStaticControl.Add ( aRows( InxObjName, rowNum ) &"_"&  aRows( InxPermissionType, rowNum ) ), CStr( aRows( InxPermission, rowNum ) )
                        'Response.write " "& aRows( InxObjName, rowNum ) &"_"&  aRows( InxPermissionType, rowNum ) &"="& CStr( aRows( InxPermission, rowNum ) )
                        
                Next
                
                
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Function AutoLogonUser ( sUserId )
                Dim rsQry, query, is_Online
                AutoLogonUser = FALSE
                
                
                '--- Get if user is loged on from DB ---
                OraDatabase.Parameters.Add "USER_ID",  sUserId, ORAPARM_INPUT, ORATYPE_NUMBER
                
                query = "SELECT usr.IS_ONLINE  FROM USERS usr  WHERE usr.USER_ID = :USER_ID"
                Set rsQry = OraDatabase.DbCreateDynaset( query , ORADYN_DEFAULT )
                
                If (NOT rsQry.BOF) AND (NOT rsQry.EOF) Then
                        is_Online = rsQry("is_online")
                End If
                
                OraDatabase.Parameters.Remove "USER_ID"
                rsQry.Close
                Set rsQry = Nothing
                
                
                '--- Check if User is still Loged on ---
                If is_Online = "Y" Then
                        Call SessionsAndCookieSetup ( sUserId )
                        
                End If
                
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Public Sub LogonUser ( sUserName, sUserPassword, ByRef oDBsession )
                Dim rsQry, query, sMessage
                sMessage = NULL
                
                OraDatabase.Parameters.Add "USER_NAME",         sUserName,              ORAPARM_INPUT, ORATYPE_VARCHAR2
                
                query = "SELECT usr.*  FROM USERS usr  WHERE usr.USER_NAME = :USER_NAME"
                Set rsQry = OraDatabase.DbCreateDynaset( query , ORADYN_DEFAULT )
                
                
                '--- Try Authenticating ---
                If (NOT rsQry.BOF) AND (NOT rsQry.EOF) Then
                        ' User Found !
                        
                        If rsQry("is_disabled") = enumDB_YES  Then
                                ' User Disabled !
                                sMessage = "Account <b>"& sUserName &"</b> is Disabled!"
                                
                                '-- Login Trail --
                                Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_FAIL, sUserName, sMessage )
                                
                                '-- Raise Exception --
                                Err.Raise 8, sMessage, "" 
                                
                        Else
                                
                                ' Proceed with authentication
                                If Authenticated( sUserName, sUserPassword, rsQry("user_password"), rsQry("domain") ) Then
                                        ' Login OK.
                                        Call SessionsAndCookieSetup ( rsQry("user_id") )
                                        
                                        ' Tag user login
                                        Call TagLogon ( rsQry )
                                        
                                End If
                                
                                
                        End If
                        
                Else
                        ' User Not Found !
                        sMessage = "Account <b>"& sUserName &"</b> Not Found!"
                        
                        '-- Login Trail --
                        Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_FAIL, sUserName, sMessage )
                        
                        '-- Raise Exception --
                        Err.Raise 8, sMessage, "Make sure your Username is correct <br>OR <br>Please go back and register if you are new user. " 
                        
                End If
                '--------------------------
                
                
                OraDatabase.Parameters.Remove "USER_NAME"
                
                rsQry.Close()
                Set rsQry = Nothing
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Public Sub LogoffUser ()
                '-- Login Trail --
                Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGOFF, UserName, NULL )
                
                '-- Kill User Session --
                Session.Abandon
                
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub SessionsAndCookieSetup ( nUserId )
                ' Store User details in session
                Call SetUserEnvironment ( nUserId )
                
                ' Aquire Login Token for Single Application
                Session(enumLOGIN_TOKEN_SESSION) = Session.SessionID
                
                Session.Timeout = enumSESSION_TIMEOUT
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Function Authenticated ( ByRef sUserName, ByRef sUserPassword, sDBUserPassword, sDBdomain )
                Dim objLoginAuth, return, sMessage
                sMessage = NULL
                
                Authenticated = FALSE

      ' Hook for testing access control features
      ' Any login allowed to the Test Database
      '
      If isDevSystem() Then
        Authenticated = TRUE

        '-- Login Trail --
        Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_SUCCESS, sUserName, NULL )

      ElseIf NOT IsNull(sDBdomain) Then
                        ' DOMAIN auth.
                        
                        Set objLoginAuth = Server.CreateObject("LoginAdmin.ImpersonateUser")
                        
                        return = -1
                        return = objLoginAuth.AuthenticateUser ( sUserName, sUserPassword, sDBdomain )
                        
                        ' From MSDN System Error Codes
                        ' 0 - The operation completed successfully.
                        ' 1326 - Logon failure: unknown user name or bad password.
                        ' 1385 - Logon failure: the user has not been granted the requested logon type at this computer.
                        ' 1909 - The referenced account is currently locked out and may not be used to log on.
                        
                        Select Case return
                                Case 0, 1385
                                        'Login ok
                                        Authenticated = TRUE
                                        
                                        '-- Login Trail --
                                        Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_SUCCESS, sUserName, NULL )
                                        
                                Case 1909
                                        sMessage = "Account <b>"& sUserName &"</b> at "& sDBdomain &" domain is currently locked!"
                                        
                                        '-- Login Trail --
                                        Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_FAIL, sUserName, sMessage )
                                        
                                        '-- Raise Exception --
                                        Err.Raise 8, sMessage, ""
                                        
                                        
                                Case Else
                                        sMessage = "Password is incorrect for <b>"& sUserName &"</b> at "& sDBdomain &" domain!"
                                        
                                        '-- Login Trail --
                                        Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_FAIL, sUserName, sMessage )
                                        
                                        '-- Raise Exception --
                                        Err.Raise 8, sMessage, sDBdomain &" domain returns system error code "& return
                                        
                        End Select
                        
                        Set objLoginAuth = Nothing
                        
                Else
                        ' LOCAL auth.
                        If sUserPassword = sDBUserPassword Then
                                'Login ok
                                Authenticated = TRUE
                                
                                '-- Login Trail --
                                Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_SUCCESS, sUserName, NULL )
                                
                        Else
                                sMessage = "Password is incorrect for <b>"& sUserName &"</b>!"
                                
                                '-- Login Trail --
                                Call LoginTrail ( enumACCESS_MANAGER_EVENT_LOGON_FAIL, sUserName, sMessage )
                                
                                '-- Raise Exception --
                                Err.Raise 8, sMessage, "Please try again and make sure you do not have Caps Lock on."
                                
                        End If
                        
                End If
                
                
                
        End Function
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub LoginTrail ( nEvent, sUserName, sMessage )
                
                OraDatabase.Parameters.Add "EVENT_ENUM",                nEvent,                 ORAPARM_INPUT, ORATYPE_NUMBER
                OraDatabase.Parameters.Add "LOGIN_USER_NAME",   sUserName,              ORAPARM_INPUT, ORATYPE_VARCHAR2
                OraDatabase.Parameters.Add "CLIENT_IP",                 Request.ServerVariables("REMOTE_ADDR"),                 ORAPARM_INPUT, ORATYPE_VARCHAR2
                OraDatabase.Parameters.Add "APPLICATION_ID",    APPLICATION_ID,                 ORAPARM_INPUT, ORATYPE_NUMBER
                OraDatabase.Parameters.Add "LOGIN_COMMENTS",    sMessage,               ORAPARM_INPUT, ORATYPE_VARCHAR2
                
                
                OraSession.BeginTrans
                
                OraDatabase.ExecuteSQL _
                "BEGIN   pk_AMUtils.Log_Access ( :EVENT_ENUM, :LOGIN_USER_NAME, :CLIENT_IP, :APPLICATION_ID, :LOGIN_COMMENTS );   END;"
                
                OraSession.CommitTrans
                
                
                OraDatabase.Parameters.Remove "EVENT_ENUM"
                OraDatabase.Parameters.Remove "LOGIN_USER_NAME"
                OraDatabase.Parameters.Remove "CLIENT_IP"
                OraDatabase.Parameters.Remove "APPLICATION_ID"
                OraDatabase.Parameters.Remove "LOGIN_COMMENTS"
                
                
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub TagLogon ( oRsQry )
                oRsQry.Edit()
                
                oRsQry("is_online").Value = "Y"
                oRsQry("online_at").Value = Request.ServerVariables("REMOTE_ADDR")
                
                oRsQry.Update()
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub SetUserEnvironment ( nUser_id )
                Dim rsUser, query, tempSTR
                
                OraDatabase.Parameters.Add "USER_ID", nUser_id, ORAPARM_INPUT, ORATYPE_NUMBER
                
                
                
                '---- Get User Details ----
                query = "SELECT usr.*  FROM USERS usr  WHERE usr.USER_ID = :USER_ID"
                Set rsUser = OraDatabase.DbCreateDynaset( query , ORADYN_DEFAULT )
                
                If (NOT rsUser.BOF) AND (NOT rsUser.EOF) Then
                        Session(enumUSER_ID_SESSION) = rsUser("user_id")
                        
                        Session(enumUSER_DETAILS_SESSION) = _
                                "user_name="& rsUser("user_name") & sSEPARATOR &_
                                "full_name="& rsUser("full_name") & sSEPARATOR &_
                                "user_email="& rsUser("user_email") & sSEPARATOR &_
            "last_visit="& rsUser("last_visit") & sSEPARATOR &_
            "domain="& rsUser("domain")
                        
                End If
                
                
                
                '---- Get User Applications ----
                query = "SELECT ua.APP_ID  FROM USER_APPLICATIONS ua  WHERE ua.USER_ID = :USER_ID"
                Set rsUser = OraDatabase.DbCreateDynaset( query , ORADYN_DEFAULT )
                tempSTR = ""
                While (NOT rsUser.BOF) AND (NOT rsUser.EOF) 
                        tempSTR = tempSTR & sSEPARATOR & rsUser("app_id")
                        rsUser.MoveNext()
                WEnd
                
                If tempSTR <> "" Then
                        Session(enumUSER_APPLICATIONS_SESSION) = Right( tempSTR, Len(tempSTR) - Len(sSEPARATOR) )       'Remove first separator
                Else
                        Session(enumUSER_APPLICATIONS_SESSION) = 0
                End If
                
                
                
                OraDatabase.Parameters.Remove "USER_ID"
                
                rsUser.Close()
                Set rsUser = Nothing
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub Class_Initialize()
                '// Perform action on creation of object. e.g. Set myObj = New ThisClassName
                Set mobjStaticControl = CreateObject("Scripting.Dictionary")
                Set mobjTablePermissions = CreateObject("Scripting.Dictionary")
                Set mobjRowPermissions = CreateObject("Scripting.Dictionary")
                
                sSEPARATOR = "||"
                
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
        Private Sub Class_Terminate()
                '// Perform action on object disposal. e.g. Set myObj = Nothing
                Set mobjStaticControl = Nothing
                Set mobjRowPermissions = Nothing
                Set mobjTablePermissions = Nothing
                
        End Sub
        '-----------------------------------------------------------------------------------------------------------------
End Class
%>