<commit_before><?php
/*
 * Custom AppController for iPeer
 *
 * @author
 * @version     0.10.6.1865
 * @license		OPPL
 *
 */
uses('sanitize');

class AppController extends Controller  {
	var $startpage = 'pages';
	var $components = array('rdAuth','Output','sysContainer', 'globalConstant', 'userPersonalize', 'framework');
	var $beforeFilter =	 array('checkAccess');
	var $access = array ();
	var $actionList = array ();

	function __setAccess()
	{
		$access = $this->sysContainer->getAccessFunctionList();
		if (!empty($access)){
			$this->set('access', $access);
		}
	}

	function __setActions()
	{
		$actionList = $this->sysContainer->getActionList();
		if (!empty($actionList)){
			$this->set('action', $actionList);
		}
	}

	function __setCourses()
	{
		$coursesList = $this->sysContainer->getMyCourseList();

		if (!empty($coursesList)){
			$this->set('coursesList', $coursesList);
		}
	}

	function extractModel($model,$array,$field)
	{
		$return=array();
		foreach ($array as $row)
		array_push($return,$row[$model][$field]);
		return $return;
	}

	function checkAccess()
	{
		$this->rdAuth->loadFromSession();

        // Used when error messasges are displayed, just let cake display them.
        // No controller -> no security risk.
        if (empty($this->params)) {
            return true;
        }

		//set access function list
		$this->__setAccess();
		$this->__setActions();
		$this->__setCourses();

		// Enable for debug output
		//$a=print_r($this->rdAuth,true);echo "<pre>$a</pre>";

		//Save the current URL in session
		$pass = (!empty($this->params['pass'])) ? join('/',$this->params['pass']) : null;

        $URL = $this->params['controller'].'/'.$this->params['action'].'/'.$pass;
		//$a=print_r($this->rdAuth,true);echo "<pre>$a</pre>";
		//check if user not logined
		if ($this->params['controller']=='' || $this->params['controller']=="loginout" || $this->params['controller']=="install")
		{
			$this->set('rdAuth',$this->rdAuth);

		} else {
			//Check whether the user is current login yet
			if (!isset($this->rdAuth->role)){
				$this->Session->write('URL', $URL);
				$this->Session->write('AccessErr', 'NO_LOGIN');
				$redirect = 'loginout/login';
				$this->redirect($redirect);
				exit;
			}

			//check permission
			$functions = $this->sysContainer->getActionList();

			$url = $this->params['url']['url'];
            // Cut a trailing shash in url if it exists
            if ($url[strlen($url) - 1] == "/") {
                $url = substr($url, 0, (-1) );
            }

			$allowedExplicitly = false;
			$allowedByEntry = "";
            // First, check that this URL has been explicitly specified in Sys functions table.
            foreach ($functions as $func) {
                if ($func['url_link'] === $url) {
                    $allowedExplicitly = true;
                    $allowedByEntry = $url;
                    break;
                }
            }

            if ($allowedExplicitly) echo "<b style='color:green'>Allowed Explicitly by $allowedByEntry</b>";

			if (!$this->rdAuth->check($this->params['controller'], $this->sysContainer->getActionList()))
			{
				$this->Session->write('URL', $URL);
				$this->Session->write('AccessErr', 'NO_PERMISSION');
				$redirect = 'loginout/login';
				$this->redirect($redirect);
				exit;
			}

			//render the authorized controller
			$this->set('rdAuth',$this->rdAuth);
			$this->set('sysContainer', $this->sysContainer);
			$this->set('Output', $this->Output);

			$this->Session->del('URL');
		}
		return true;
	}


}
?>
<commit_msg>app_controller.php security changes: 1) Put back the "is the controller in sys function list" check to grant access to all previously accessible pages. 2) Whether the url was allowed explicitly by sysfunctions, or indirectly by a controller, this is said on the top of the page. 3) When a page is not allowed to be rendered, a redirect to home/index occurs.<commit_after><?php
/*
 * Custom AppController for iPeer
 *
 * @author
 * @version     0.10.6.1865
 * @license		OPPL
 *
 */
uses('sanitize');

class AppController extends Controller  {
	var $startpage = 'pages';
	var $components = array('rdAuth','Output','sysContainer', 'globalConstant', 'userPersonalize', 'framework');
	var $beforeFilter =	 array('checkAccess');
	var $access = array ();
	var $actionList = array ();

	function __setAccess()
	{
		$access = $this->sysContainer->getAccessFunctionList();
		if (!empty($access)){
			$this->set('access', $access);
		}
	}

	function __setActions()
	{
		$actionList = $this->sysContainer->getActionList();
		if (!empty($actionList)){
			$this->set('action', $actionList);
		}
	}

	function __setCourses()
	{
		$coursesList = $this->sysContainer->getMyCourseList();

		if (!empty($coursesList)){
			$this->set('coursesList', $coursesList);
		}
	}

	function extractModel($model,$array,$field)
	{
		$return=array();
		foreach ($array as $row)
		array_push($return,$row[$model][$field]);
		return $return;
	}

	function checkAccess()
	{
		$this->rdAuth->loadFromSession();

        // Used when error messasges are displayed, just let cake display them.
        // No controller -> no security risk.
        if (empty($this->params)) {
            return true;
        }

		//set access function list
		$this->__setAccess();
		$this->__setActions();
		$this->__setCourses();

		// Enable for debug output
		//$a=print_r($this->rdAuth,true);echo "<pre>$a</pre>";

		//Save the current URL in session
		$pass = (!empty($this->params['pass'])) ? join('/',$this->params['pass']) : null;

        $URL = $this->params['controller'].'/'.$this->params['action'].'/'.$pass;
		//$a=print_r($this->rdAuth,true);echo "<pre>$a</pre>";
		//check if user not logined
		if ($this->params['controller']=='' || $this->params['controller']=="loginout" || $this->params['controller']=="install")
		{
			$this->set('rdAuth',$this->rdAuth);

		} else {
			//Check whether the user is current login yet
			if (!isset($this->rdAuth->role)){
				$this->Session->write('URL', $URL);
				$this->Session->write('AccessErr', 'NO_LOGIN');
				$redirect = 'loginout/login';
				$this->redirect($redirect);
				exit;
			}

			//check permission
			$functions = $this->sysContainer->getActionList();

			$url = $this->params['url']['url'];
            // Cut a trailing shash in url if it exists
            if ($url[strlen($url) - 1] == "/") {
                $url = substr($url, 0, (-1) );
            }

			$allowedExplicitly = false;
			$allowedByEntry = "";
            // First, check that this URL has been explicitly specified in Sys functions table.
            foreach ($functions as $func) {
                if ($func['url_link'] === $url) {
                    $allowedExplicitly = true;
                    $allowedByEntry = $url;
                    break;
                }
            }

            // If not allower explicitly, check in allowed by controller
            $allowedByControllerEntry = false;

            if (!$allowedExplicitly) {
                foreach ($functions as $func) {
                    if ($func['controller_name'] === $this->params['controller']) {
                        $allowedByControllerEntry = true;
                        $allowedByEntry = $this->params['controller'];
                        break;
                    }
                }
            }


            // Debug output: Display how this page was allowed.
            if ($allowedExplicitly)
                echo "<b style='color:green'>Allowed Explicitly by <u>$allowedByEntry</u> entry in SysFunctions. </b>";
            if ($allowedByControllerEntry)
                echo "<b style='color:darkblue'>Allowed Implicitly by a controller <u>$allowedByEntry</u> entry in SysFunctions. </b>";

            // Rdirect the user away if they have no permission to render this page.
			if (!$allowedExplicitly && !$allowedByControllerEntry) {
				$this->redirect('home/index');
				exit;
			}

			//render the authorized controller
			$this->set('rdAuth',$this->rdAuth);
			$this->set('sysContainer', $this->sysContainer);
			$this->set('Output', $this->Output);

			$this->Session->del('URL');
		}
		return true;
	}
}
?>

{'fraction_non_alphanumeric': 0.16998577524893316, 'fraction_numerical': 0.0029634898055950687, 'mean_word_length': 2.518348623853211, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 126, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4973337', 'n_tokens_mistral': 2804, 'n_tokens_neox': 2452, 'n_words': 572}