Home » Authentication » LiveUser » Bug #2922

[2004-12-08 16:27 UTC] michael dot caplan at lechateau dot ca

Description:
------------
Hi,

There is an error in .13.3 admin MDB2 container (and possibly others) which results in group rights not being deleted (and possibly incorrect group rights being deleted instead). revokeGroupRight() from removeRight() is incorrectly called. A patch is required to revokeGroupRight() to allow the deletion of rights (where the group is not known).

===================================================================
RCS file: /prod/cvs/intranet_3/lib/LiveUser/Admin/Perm/Container/MDB2_Medium.php,v
retrieving revision 1.1
retrieving revision 1.2
diff -p --unified=3 -r1.1 -r1.2
--- MDB2_Medium.php 2004/10/25 18:40:35 1.1
+++ MDB2_Medium.php 2004/12/08 16:16:11 1.2
@@ -51,7 +51,7 @@ require_once 'LiveUser/Admin/Perm/Contai
* @author Markus Wolff <wolff@21st.de>
* @author Matt Scifo <mscifo@php.net>
* @author Arnaud Limbourg <arnaud@php.net>
- * @version $Id: MDB2_Medium.php,v 1.1 2004/10/25 18:40:35 intranet Exp $
+ * @version $Id: MDB2_Medium.php,v 1.2 2004/12/08 16:16:11 michael Exp $
* @package LiveUser
*/
class LiveUser_Admin_Perm_Container_MDB2_Medium extends LiveUser_Admin_Perm_Container_MDB2_Simple
@@ -401,7 +401,7 @@ class LiveUser_Admin_Perm_Container_MDB2
*/
function removeRight($rightId)
{
- $res = $this->revokeGroupRight($rightId);
+ $res = $this->revokeGroupRight(null, $rightId);

if (!$res) {
return false;
@@ -418,19 +418,26 @@ class LiveUser_Admin_Perm_Container_MDB2
* @param integer id of right
* @return boolean true on success or false on failure
*/
- function revokeGroupRight($groupId, $rightId = null)
+ function revokeGroupRight($groupId = null, $rightId = null)
{
+ if (is_null($groupId) && is_null($rightId)) {
+ return false;
+ }
$query = 'DELETE FROM
' . $this->prefix . 'grouprights
- WHERE
- ' . $this->groupTableCols['required']['group_id']['name'] . ' = '
- . $this->dbc->quote($groupId, $this->groupTableCols['required']['group_id']['type']);
+ WHERE ';
+
+ $where = array();
+ if (!is_null($groupId)) {
+ $where[] = $this->groupTableCols['required']['group_id']['name'] . ' = '
+ . $this->dbc->quote($groupId, $this->groupTableCols['required']['group_id']['type']);
+ }
+
if (!is_null($rightId)) {
- $query .= ' AND
- right_id = ' . $this->dbc->quote($rightId, 'integer');
+ $where[] = 'right_id = ' . $this->dbc->quote($rightId, 'integer');
}

- $result = $this->dbc->query($query);
+ $result = $this->dbc->query($query . implode(' AND ', $where));

if (MDB2::isError($result)) {
return false;

[2004-12-08 16:33 UTC] smith at backendmedia dot com

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.

Since we have reworked the admin API from the ground up this bug should not be around in the next release. We dont plan to make another release in the 0.13.x release cycle. However this means its great that you have provided this patch so that other people can benefit from this fix. I will however mark this bug as fixed in CVS.