Multilingual site: adding additional policy restrictions

Author Message

Sebastiaan van der Vliet

Thursday 07 May 2009 8:26:46 am

Hi,

I'm running two languages (siteaccesses) on a single ezp installation, single database, same set of templates. I want editors for both languages to be able to see the content in the other language, but not able to change 'anything'. I have set up two user groups, one for each language.

Unlike content/edit, the following functions: restore, cleantrash, remove and manage_locations, hide, move and versionread do not have the option to restrict access by used language. In my opinion this is a 'security' risk, and I would like to correct this.

The obvious place to start is the kernel/content/module.php file, by changing lines like:

$FunctionList['cleantrash'] = array();

to

$FunctionList['cleantrash'] = array('Language' => $Language);

Can someone point out the other kernel files that would need to be modified to further restrict access by language?

Certified eZ publish developer with over 9 years of eZ publish experience. Available for challenging eZ publish projects as a technical consultant, project manager, trouble shooter or strategic advisor.

Sebastiaan van der Vliet

Tuesday 12 May 2009 4:49:16 am

For example, in a multilingual setup problems may arise with the 'hide' functionality. I don't want editors in one language to be able to hide items that have a translation in another language. So I want to restrict the ability to hide thing by language: only allow hiding items if there are no translations:

In kernel/content/module.php:

$FunctionList['hide'] = array( 'Subtree' => $Subtree,'Language' => $Language );

in kernel/content/hide.php

$curNode = eZContentObjectTreeNode::fetch( $NodeID );

//start hack
$obj = $curNode->object();
$availableLanguages = $obj->availableLanguages();
foreach ($availableLanguages as $availableLanguage)
{
	$moduleAccessAllowed = $obj->checkAccess( 'hide', false, false, false, $availableLanguage );
	if (!$moduleAccessAllowed)
		return $Module->handleError( eZError::KERNEL_ACCESS_DENIED, 'kernel' );
}
//end hack

Probably better if it goes to a page explaining the restriction, rather than serving a page with 'access denied'.

And yes, I know. Don't touch the kernel.

Certified eZ publish developer with over 9 years of eZ publish experience. Available for challenging eZ publish projects as a technical consultant, project manager, trouble shooter or strategic advisor.

Powered by eZ Publish™ CMS Open Source Web Content Management. Copyright © 1999-2014 eZ Systems AS (except where otherwise noted). All rights reserved.

eZ debug

Timing: Jan 18 2025 15:10:21
Script start
Timing: Jan 18 2025 15:10:21
Module start 'layout'
Timing: Jan 18 2025 15:10:21
Module start 'content'
Timing: Jan 18 2025 15:10:22
Module end 'content'
Timing: Jan 18 2025 15:10:22
Script end

Main resources:

Total runtime1.1319 sec
Peak memory usage4,096.0000 KB
Database Queries52

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0043 589.2891152.6563
Module start 'layout' 0.00430.0024 741.945339.5078
Module start 'content' 0.00671.1237 781.4531496.1094
Module end 'content' 1.13030.0015 1,277.562512.0938
Script end 1.1319  1,289.6563 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00290.2583160.0002
Check MTime0.00120.1066160.0001
Mysql Total
Database connection0.00050.040410.0005
Mysqli_queries1.090096.3014520.0210
Looping result0.00040.0388500.0000
Template Total1.106197.720.5530
Template load0.00200.177320.0010
Template processing1.104097.538920.5520
Template load and register function0.00010.007810.0001
states
state_id_array0.00070.065410.0007
state_identifier_array0.00120.103020.0006
Override
Cache load0.00160.1441210.0001
Sytem overhead
Fetch class attribute can translate value0.00050.040910.0005
Fetch class attribute name0.00090.075430.0003
XML
Image XML parsing0.00070.057610.0007
class_abstraction
Instantiating content class attribute0.00000.000640.0000
General
dbfile0.00080.0676170.0000
String conversion0.00000.000440.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
2content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
2content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
6content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
4content/datatype/view/ezxmltags/literal.tpl<No override>extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tplEdit templateOverride template
1print_pagelayout.tpl<No override>extension/community/design/community/templates/print_pagelayout.tplEdit templateOverride template
 Number of times templates used: 16
 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs