From 8aa84f9e6ccc4d9316913367594c70c41c027ac2 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Tue, 29 Jun 2010 23:51:42 +1200
Subject: [PATCH] Add option for explicit permission matching.

---
 inc/DAVResource.php | 18 +++++++++++++-----
 inc/caldav-GET.php  |  4 ++--
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/inc/DAVResource.php b/inc/DAVResource.php
index c9b04655..c197a66d 100644
--- a/inc/DAVResource.php
+++ b/inc/DAVResource.php
@@ -634,13 +634,21 @@ EOQRY;
   /**
   * Is the user has the privileges to do what is requested.
   * @param $do_what mixed The request privilege name, or array of privilege names, to be checked.
+  * @param $any boolean Whether we accept any of the privileges. The default is true, unless the requested privilege is 'all', when it is false.
   * @return boolean Whether they do have one of those privileges against this resource.
   */
-  function HavePrivilegeTo( $do_what ) {
+  function HavePrivilegeTo( $do_what, $any = null ) {
     if ( !isset($this->privileges) ) $this->FetchPrivileges();
+    if ( !isset($any) ) $any = ($do_what != 'all');
     $test_bits = privilege_to_bits( $do_what );
-    dbg_error_log( 'DAVResource', 'Testing privileges of "%s" (%s) against allowed "%s" => "%s" (%s)', $do_what, decbin($test_bits), decbin($this->privileges), ($this->privileges & $test_bits), decbin($this->privileges & $test_bits) );
-    return ($this->privileges & $test_bits) > 0;
+    dbg_error_log( 'DAVResource', 'Testing %s privileges of "%s" (%s) against allowed "%s" => "%s" (%s)', ($any?'any':'exactly'),
+        $do_what, decbin($test_bits), decbin($this->privileges), ($this->privileges & $test_bits), decbin($this->privileges & $test_bits) );
+    if ( $any ) {
+      return ($this->privileges & $test_bits) > 0;
+    }
+    else {
+      return ($this->privileges & $test_bits) == $test_bits;
+    }
   }
 
 
@@ -652,7 +660,7 @@ EOQRY;
   function NeedPrivilege( $privilege ) {
     global $request;
 
-    if ( $this->HavePrivilegeTo($privilege) ) return;
+    if ( $this->HavePrivilegeTo($privilege, false) ) return;
 
     $request->NeedPrivilege( $privilege, $this->dav_name );
     exit(0);  // Unecessary, but might clarify things
@@ -665,7 +673,7 @@ EOQRY;
   function BuildPrivileges( $privilege_names=null, &$xmldoc=null ) {
     if ( $privilege_names == null ) {
       if ( !isset($this->privileges) ) $this->FetchPrivileges();
-      $privilege_names = bits_to_privilege($this->privileges, ($this->_is_collection ? $this->collection->type : 'resource') );
+      $privilege_names = bits_to_privilege($this->privileges, ($this->_is_collection ? $this->collection->type : null ) );
     }
     return privileges_to_XML( $privilege_names, $xmldoc);
   }
diff --git a/inc/caldav-GET.php b/inc/caldav-GET.php
index 148bf0c6..d6a6dac9 100644
--- a/inc/caldav-GET.php
+++ b/inc/caldav-GET.php
@@ -101,7 +101,7 @@ if ( $dav_resource->IsCollection() ) {
       $tzid = $comp->GetPParamValue('DUE',     'TZID');      if ( isset($tzid) && !isset($need_zones[$tzid]) ) $need_zones[$tzid] = 1;
       $tzid = $comp->GetPParamValue('DTEND',   'TZID');      if ( isset($tzid) && !isset($need_zones[$tzid]) ) $need_zones[$tzid] = 1;
 
-      if ( $dav_resource->HavePrivilegeTo('all') || $session->user_no == $event->user_no || $session->user_no == $event->logged_user
+      if ( $dav_resource->HavePrivilegeTo('all',false) || $session->user_no == $event->user_no || $session->user_no == $event->logged_user
             || ( $c->allow_get_email_visibility && $comp->IsAttendee($session->email) ) ) {
         /**
         * These people get to see all of the event, and they should always
@@ -146,7 +146,7 @@ $ic = new iCalComponent( $resource->caldav_data );
 
 /** Default deny... */
 $allowed = false;
-if ( $dav_resource->HavePrivilegeTo('all') || $session->user_no == $resource->user_no || $session->user_no == $resource->logged_user
+if ( $dav_resource->HavePrivilegeTo('all', false) || $session->user_no == $resource->user_no || $session->user_no == $resource->logged_user
       || ( $c->allow_get_email_visibility && $ic->IsAttendee($session->email) ) ) {
   /**
   * These people get to see all of the event, and they should always