acl_and_auth.go 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125
  1. package tool
  2. import (
  3. "database/sql"
  4. "log"
  5. "strconv"
  6. "strings"
  7. "time"
  8. )
  9. func List_acl(func_type string) []string {
  10. if func_type == "user_document" {
  11. return []string{
  12. "",
  13. "user",
  14. "all",
  15. }
  16. } else {
  17. return []string{
  18. "",
  19. "all",
  20. "user",
  21. "admin",
  22. "owner",
  23. "50_edit",
  24. "email",
  25. "ban",
  26. "before",
  27. "30_day",
  28. "90_day",
  29. "ban_admin",
  30. "not_all",
  31. "up_to_level_3",
  32. "up_to_level_10",
  33. "30_day_50_edit",
  34. }
  35. }
  36. }
  37. func List_auth(db *sql.DB) []string {
  38. stmt, err := db.Prepare(DB_change("select distinct name from alist"))
  39. if err != nil {
  40. log.Fatal(err)
  41. }
  42. defer stmt.Close()
  43. rows, err := stmt.Query()
  44. if err != nil {
  45. log.Fatal(err)
  46. }
  47. defer rows.Close()
  48. data_list := []string{}
  49. for rows.Next() {
  50. var name string
  51. err := rows.Scan(&name)
  52. if err != nil {
  53. log.Fatal(err)
  54. }
  55. data_list = append(data_list, name)
  56. }
  57. return data_list
  58. }
  59. func Do_insert_auth_history(db *sql.DB, ip string, what string) {
  60. var log_off string
  61. err := db.QueryRow(DB_change("select data from other where name = 'auth_history_off'")).Scan(&log_off)
  62. if err != nil {
  63. if err == sql.ErrNoRows {
  64. log_off = ""
  65. } else {
  66. log.Fatal(err)
  67. }
  68. }
  69. if log_off == "" {
  70. stmt, err := db.Prepare(DB_change("insert into re_admin (who, what, time) values (?, ?, ?)"))
  71. if err != nil {
  72. log.Fatal(err)
  73. }
  74. defer stmt.Close()
  75. time := Get_time()
  76. _, err = stmt.Exec(ip, what, time)
  77. if err != nil {
  78. log.Fatal(err)
  79. }
  80. }
  81. }
  82. func Get_user_auth(db *sql.DB, ip string) string {
  83. stmt, err := db.Prepare(DB_change("select data from user_set where id = ? and name = 'acl'"))
  84. if err != nil {
  85. log.Fatal(err)
  86. }
  87. defer stmt.Close()
  88. var auth string
  89. err = stmt.QueryRow(ip).Scan(&auth)
  90. if err != nil {
  91. if err == sql.ErrNoRows {
  92. if !IP_or_user(ip) {
  93. auth = "user"
  94. } else {
  95. auth = "ip"
  96. }
  97. } else {
  98. log.Fatal(err)
  99. }
  100. }
  101. return auth
  102. }
  103. func Get_auth_group_info(db *sql.DB, auth string) map[string]bool {
  104. stmt, err := db.Prepare(DB_change("select acl from alist where name = ?"))
  105. if err != nil {
  106. log.Fatal(err)
  107. }
  108. defer stmt.Close()
  109. rows, err := stmt.Query(auth)
  110. if err != nil {
  111. log.Fatal(err)
  112. }
  113. defer rows.Close()
  114. data_list := map[string]bool{}
  115. for rows.Next() {
  116. var name string
  117. err := rows.Scan(&name)
  118. if err != nil {
  119. log.Fatal(err)
  120. }
  121. data_list[name] = true
  122. }
  123. if len(data_list) == 0 {
  124. data_list["nothing"] = true
  125. }
  126. return Check_auth(data_list)
  127. }
  128. func Auth_include_upper_auth(auth_info map[string]bool) bool {
  129. return auth_info["owner"]
  130. }
  131. func Check_auth(auth_info map[string]bool) map[string]bool {
  132. if _, ok := auth_info["owner"]; ok {
  133. auth_info["admin"] = true
  134. }
  135. admin_auth := []string{"ban", "toron", "check", "acl", "hidel", "give", "bbs", "vote_fix"}
  136. if _, ok := auth_info["admin"]; ok {
  137. for _, v := range admin_auth {
  138. auth_info[v] = true
  139. }
  140. }
  141. if _, ok := auth_info["check"]; ok {
  142. auth_info["view_user_watchlist"] = true
  143. }
  144. check := false
  145. for _, v := range admin_auth {
  146. if _, ok := auth_info[v]; ok {
  147. check = true
  148. break
  149. }
  150. }
  151. if check {
  152. auth_info["admin_default_feature"] = true
  153. }
  154. admin_default_feature := []string{"treat_as_admin", "user_name_bold", "multiple_upload", "slow_edit_pass", "edit_bottom_compulsion_pass", "view_hide_user_name", "doc_watch_list_view", "user"}
  155. if _, ok := auth_info["admin_default_feature"]; ok {
  156. for _, v := range admin_default_feature {
  157. auth_info[v] = true
  158. }
  159. }
  160. user_default := []string{"captcha_pass", "ip"}
  161. if _, ok := auth_info["user"]; ok {
  162. for _, v := range user_default {
  163. auth_info[v] = true
  164. }
  165. }
  166. ip_default := []string{"document", "discuss", "upload", "vote", "bbs_use", "captcha_one_check_five_pass"}
  167. if _, ok := auth_info["ip"]; ok {
  168. for _, v := range ip_default {
  169. auth_info[v] = true
  170. }
  171. }
  172. document_default := []string{"edit", "edit_request", "move", "new_make", "delete"}
  173. if _, ok := auth_info["document"]; ok {
  174. for _, v := range document_default {
  175. auth_info[v] = true
  176. }
  177. }
  178. check = false
  179. for _, v := range document_default {
  180. if _, ok := auth_info[v]; ok {
  181. check = true
  182. break
  183. }
  184. }
  185. if check {
  186. auth_info["view"] = true
  187. }
  188. topic_default := []string{"discuss_view", "discuss_make_new_thread"}
  189. if _, ok := auth_info["discuss"]; ok {
  190. for _, v := range topic_default {
  191. auth_info[v] = true
  192. }
  193. }
  194. bbs_default := []string{"bbs_edit", "bbs_comment"}
  195. if _, ok := auth_info["bbs_use"]; ok {
  196. for _, v := range bbs_default {
  197. auth_info[v] = true
  198. }
  199. }
  200. check = false
  201. for _, v := range bbs_default {
  202. if _, ok := auth_info[v]; ok {
  203. check = true
  204. break
  205. }
  206. }
  207. if check {
  208. auth_info["bbs_view"] = true
  209. }
  210. return auth_info
  211. }
  212. func Check_acl(db *sql.DB, name string, topic_number string, tool string, ip string) bool {
  213. auth_name := Get_user_auth(db, ip)
  214. auth_info := Get_auth_group_info(db, auth_name)
  215. ip_or_user := IP_or_user(ip)
  216. level := "0"
  217. if !ip_or_user {
  218. level = Get_level(db, ip)[0]
  219. }
  220. level_int, _ := strconv.Atoi(level)
  221. get_ban := ""
  222. ban_type := ""
  223. if tool == "document_edit_request" {
  224. temp_arr := Get_user_ban(db, ip, "edit_request")
  225. get_ban = temp_arr[0]
  226. ban_type = temp_arr[1]
  227. } else {
  228. temp_arr := Get_user_ban(db, ip, "")
  229. get_ban = temp_arr[0]
  230. ban_type = temp_arr[1]
  231. }
  232. if ban_type != "" {
  233. ban_type_len := len(ban_type)
  234. if ban_type_len == 1 {
  235. ban_type = string(ban_type[0])
  236. } else if ban_type_len == 2 {
  237. ban_type = string(ban_type[1])
  238. }
  239. }
  240. if tool == "" && name != "" {
  241. if !Check_acl(db, name, "", "render", ip) {
  242. return false
  243. }
  244. if strings.HasPrefix(name, "user:") {
  245. user_page_str := name[5:]
  246. if slash_index := strings.Index(user_page_str, "/"); slash_index != -1 {
  247. user_page_str = user_page_str[:slash_index]
  248. }
  249. if auth_info["acl"] {
  250. return true
  251. }
  252. if get_ban == "true" {
  253. return false
  254. }
  255. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'decu'"))
  256. if err != nil {
  257. log.Fatal(err)
  258. }
  259. defer stmt.Close()
  260. var acl_data string
  261. err = stmt.QueryRow(name).Scan(&acl_data)
  262. if err != nil {
  263. if err == sql.ErrNoRows {
  264. acl_data = ""
  265. } else {
  266. log.Fatal(err)
  267. }
  268. }
  269. if acl_data == "all" {
  270. return true
  271. } else if acl_data == "user" {
  272. if !ip_or_user {
  273. return true
  274. }
  275. } else if ip == user_page_str {
  276. if !ip_or_user {
  277. return true
  278. }
  279. }
  280. return false
  281. }
  282. }
  283. if Arr_in_str([]string{"document_edit", "document_edit_request", "document_move", "document_delete"}, tool) {
  284. if !Check_acl(db, name, topic_number, "", ip) {
  285. return false
  286. }
  287. } else if Arr_in_str([]string{"bbs_edit", "bbs_comment"}, tool) {
  288. if !Check_acl(db, name, topic_number, "bbs_view", ip) {
  289. return false
  290. }
  291. }
  292. if tool == "topic" {
  293. if name == "" {
  294. stmt, err := db.Prepare(DB_change("select title from rd where code = ?"))
  295. if err != nil {
  296. log.Fatal(err)
  297. }
  298. defer stmt.Close()
  299. err = stmt.QueryRow(topic_number).Scan(&name)
  300. if err != nil {
  301. if err == sql.ErrNoRows {
  302. name = "test"
  303. } else {
  304. log.Fatal(err)
  305. }
  306. }
  307. }
  308. }
  309. end_number := 1
  310. for for_a := 0; for_a < end_number; for_a++ {
  311. acl_data := ""
  312. acl_pass_auth := ""
  313. if tool == "all_admin_auth" {
  314. acl_pass_auth = "treat_as_admin"
  315. acl_data = "owner"
  316. } else if tool == "owner_auth" {
  317. acl_pass_auth = "owner"
  318. acl_data = "owner"
  319. } else if tool == "ban_auth" {
  320. acl_pass_auth = "ban"
  321. acl_data = "owner"
  322. } else if tool == "bbs_auth" {
  323. acl_pass_auth = "bbs"
  324. acl_data = "owner"
  325. } else if tool == "toron_auth" {
  326. acl_pass_auth = "toron"
  327. acl_data = "owner"
  328. } else if tool == "check_auth" {
  329. acl_pass_auth = "check"
  330. acl_data = "owner"
  331. } else if tool == "acl_auth" {
  332. acl_pass_auth = "acl"
  333. acl_data = "owner"
  334. } else if tool == "hidel_auth" {
  335. acl_pass_auth = "hidel"
  336. acl_data = "owner"
  337. } else if tool == "give_auth" {
  338. acl_pass_auth = "give"
  339. acl_data = "owner"
  340. } else if tool == "vote_auth" {
  341. acl_pass_auth = "vote_fix"
  342. acl_data = "owner"
  343. } else if tool == "" {
  344. acl_pass_auth = "acl"
  345. if for_a == 0 {
  346. end_number += 1
  347. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'decu'"))
  348. if err != nil {
  349. log.Fatal(err)
  350. }
  351. defer stmt.Close()
  352. err = stmt.QueryRow(name).Scan(&acl_data)
  353. if err != nil {
  354. if err == sql.ErrNoRows {
  355. acl_data = ""
  356. } else {
  357. log.Fatal(err)
  358. }
  359. }
  360. } else {
  361. if auth_info["document"] {
  362. acl_data = ""
  363. } else {
  364. acl_data = "owner"
  365. }
  366. }
  367. } else if tool == "document_move" {
  368. acl_pass_auth = "acl"
  369. if for_a == 0 {
  370. end_number += 1
  371. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'document_move_acl'"))
  372. if err != nil {
  373. log.Fatal(err)
  374. }
  375. defer stmt.Close()
  376. err = stmt.QueryRow(name).Scan(&acl_data)
  377. if err != nil {
  378. if err == sql.ErrNoRows {
  379. acl_data = ""
  380. } else {
  381. log.Fatal(err)
  382. }
  383. }
  384. } else {
  385. if auth_info["move"] {
  386. acl_data = ""
  387. } else {
  388. acl_data = "owner"
  389. }
  390. }
  391. } else if tool == "document_edit" {
  392. acl_pass_auth = "acl"
  393. if for_a == 0 {
  394. end_number += 1
  395. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'document_edit_acl'"))
  396. if err != nil {
  397. log.Fatal(err)
  398. }
  399. defer stmt.Close()
  400. err = stmt.QueryRow(name).Scan(&acl_data)
  401. if err != nil {
  402. if err == sql.ErrNoRows {
  403. acl_data = ""
  404. } else {
  405. log.Fatal(err)
  406. }
  407. }
  408. } else {
  409. if auth_info["edit"] {
  410. acl_data = ""
  411. } else {
  412. acl_data = "owner"
  413. }
  414. }
  415. } else if tool == "document_delete" {
  416. acl_pass_auth = "acl"
  417. if for_a == 0 {
  418. end_number += 1
  419. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'document_delete_acl'"))
  420. if err != nil {
  421. log.Fatal(err)
  422. }
  423. defer stmt.Close()
  424. err = stmt.QueryRow(name).Scan(&acl_data)
  425. if err != nil {
  426. if err == sql.ErrNoRows {
  427. acl_data = ""
  428. } else {
  429. log.Fatal(err)
  430. }
  431. }
  432. } else {
  433. if auth_info["delete"] {
  434. acl_data = ""
  435. } else {
  436. acl_data = "owner"
  437. }
  438. }
  439. } else if tool == "topic" {
  440. acl_pass_auth = "topic"
  441. if for_a == 0 {
  442. end_number += 1
  443. stmt, err := db.Prepare(DB_change("select acl from rd where code = ?"))
  444. if err != nil {
  445. log.Fatal(err)
  446. }
  447. defer stmt.Close()
  448. err = stmt.QueryRow(topic_number).Scan(&acl_data)
  449. if err != nil {
  450. if err == sql.ErrNoRows {
  451. acl_data = ""
  452. } else {
  453. log.Fatal(err)
  454. }
  455. }
  456. } else if for_a == 1 {
  457. end_number += 1
  458. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'dis'"))
  459. if err != nil {
  460. log.Fatal(err)
  461. }
  462. defer stmt.Close()
  463. err = stmt.QueryRow(name).Scan(&acl_data)
  464. if err != nil {
  465. if err == sql.ErrNoRows {
  466. acl_data = ""
  467. } else {
  468. log.Fatal(err)
  469. }
  470. }
  471. } else {
  472. if auth_info["discuss"] {
  473. acl_data = ""
  474. } else {
  475. acl_data = "owner"
  476. }
  477. }
  478. } else if tool == "topic_view" {
  479. acl_pass_auth = "topic"
  480. if auth_info["discuss_view"] {
  481. acl_data = ""
  482. } else {
  483. acl_data = "owner"
  484. }
  485. } else if tool == "upload" {
  486. acl_pass_auth = "admin_default_feature"
  487. if auth_info["upload"] {
  488. acl_data = ""
  489. } else {
  490. acl_data = "owner"
  491. }
  492. } else if tool == "many_upload" {
  493. acl_pass_auth = "admin_default_feature"
  494. if auth_info["multiple_upload"] {
  495. acl_data = ""
  496. } else {
  497. acl_data = "owner"
  498. }
  499. } else if tool == "vote" {
  500. acl_pass_auth = "vote_fix"
  501. if for_a == 0 {
  502. end_number += 1
  503. if topic_number != "" {
  504. stmt, err := db.Prepare(DB_change("select acl from vote where id = ? and user = ''"))
  505. if err != nil {
  506. log.Fatal(err)
  507. }
  508. defer stmt.Close()
  509. err = stmt.QueryRow(topic_number).Scan(&acl_data)
  510. if err != nil {
  511. if err == sql.ErrNoRows {
  512. acl_data = ""
  513. } else {
  514. log.Fatal(err)
  515. }
  516. }
  517. } else {
  518. continue
  519. }
  520. } else {
  521. if auth_info["vote"] {
  522. acl_data = ""
  523. } else {
  524. acl_data = "owner"
  525. }
  526. }
  527. } else if tool == "slow_edit" {
  528. acl_pass_auth = "admin_default_feature"
  529. if auth_info["slow_edit_pass"] {
  530. acl_data = ""
  531. } else {
  532. acl_data = "owner"
  533. }
  534. } else if tool == "edit_bottom_compulsion" {
  535. acl_pass_auth = "admin_default_feature"
  536. if auth_info["edit_bottom_compulsion_pass"] {
  537. acl_data = ""
  538. } else {
  539. acl_data = "owner"
  540. }
  541. } else if tool == "bbs_edit" {
  542. acl_pass_auth = "bbs"
  543. if for_a == 0 {
  544. end_number += 1
  545. stmt, err := db.Prepare(DB_change("select set_data from bbs_set where set_name = 'bbs_edit_acl' and set_id = ?"))
  546. if err != nil {
  547. log.Fatal(err)
  548. }
  549. defer stmt.Close()
  550. err = stmt.QueryRow(name).Scan(&acl_data)
  551. if err != nil {
  552. if err == sql.ErrNoRows {
  553. acl_data = ""
  554. } else {
  555. log.Fatal(err)
  556. }
  557. }
  558. } else if for_a == 1 {
  559. end_number += 1
  560. stmt, err := db.Prepare(DB_change("select set_data from bbs_set where set_name = 'bbs_acl' and set_id = ?"))
  561. if err != nil {
  562. log.Fatal(err)
  563. }
  564. defer stmt.Close()
  565. err = stmt.QueryRow(name).Scan(&acl_data)
  566. if err != nil {
  567. if err == sql.ErrNoRows {
  568. acl_data = ""
  569. } else {
  570. log.Fatal(err)
  571. }
  572. }
  573. } else if for_a == 2 {
  574. end_number += 1
  575. err := db.QueryRow(DB_change("select set_data from bbs_set where set_name = 'bbs_edit_acl_all'")).Scan(&acl_data)
  576. if err != nil {
  577. if err == sql.ErrNoRows {
  578. acl_data = ""
  579. } else {
  580. log.Fatal(err)
  581. }
  582. }
  583. } else {
  584. if auth_info["bbs_edit"] {
  585. acl_data = ""
  586. } else {
  587. acl_data = "owner"
  588. }
  589. }
  590. } else if tool == "bbs_comment" {
  591. acl_pass_auth = "bbs"
  592. if for_a == 0 {
  593. end_number += 1
  594. stmt, err := db.Prepare(DB_change("select set_data from bbs_set where set_name = 'bbs_comment_acl' and set_id = ?"))
  595. if err != nil {
  596. log.Fatal(err)
  597. }
  598. defer stmt.Close()
  599. err = stmt.QueryRow(name).Scan(&acl_data)
  600. if err != nil {
  601. if err == sql.ErrNoRows {
  602. acl_data = ""
  603. } else {
  604. log.Fatal(err)
  605. }
  606. }
  607. } else if for_a == 1 {
  608. end_number += 1
  609. stmt, err := db.Prepare(DB_change("select set_data from bbs_set where set_name = 'bbs_acl' and set_id = ?"))
  610. if err != nil {
  611. log.Fatal(err)
  612. }
  613. defer stmt.Close()
  614. err = stmt.QueryRow(name).Scan(&acl_data)
  615. if err != nil {
  616. if err == sql.ErrNoRows {
  617. acl_data = ""
  618. } else {
  619. log.Fatal(err)
  620. }
  621. }
  622. } else if for_a == 2 {
  623. end_number += 1
  624. err := db.QueryRow(DB_change("select set_data from bbs_set where set_name = 'bbs_comment_acl_all'")).Scan(&acl_data)
  625. if err != nil {
  626. if err == sql.ErrNoRows {
  627. acl_data = ""
  628. } else {
  629. log.Fatal(err)
  630. }
  631. }
  632. } else {
  633. if auth_info["bbs_comment"] {
  634. acl_data = ""
  635. } else {
  636. acl_data = "owner"
  637. }
  638. }
  639. } else if tool == "bbs_view" {
  640. acl_pass_auth = "bbs"
  641. if for_a == 0 {
  642. end_number += 1
  643. stmt, err := db.Prepare(DB_change("select set_data from bbs_set where set_name = 'bbs_view_acl' and set_id = ?"))
  644. if err != nil {
  645. log.Fatal(err)
  646. }
  647. defer stmt.Close()
  648. err = stmt.QueryRow(name).Scan(&acl_data)
  649. if err != nil {
  650. if err == sql.ErrNoRows {
  651. acl_data = ""
  652. } else {
  653. log.Fatal(err)
  654. }
  655. }
  656. } else {
  657. if auth_info["bbs_view"] {
  658. acl_data = ""
  659. } else {
  660. acl_data = "owner"
  661. }
  662. }
  663. } else if tool == "discuss_make_new_thread" {
  664. acl_pass_auth = "toron"
  665. if auth_info["discuss_make_new_thread"] {
  666. acl_data = ""
  667. } else {
  668. acl_data = "owner"
  669. }
  670. } else if tool == "recaptcha" {
  671. acl_pass_auth = "admin_default_feature"
  672. if auth_info["captcha_pass"] {
  673. acl_data = ""
  674. } else {
  675. acl_data = "owner"
  676. }
  677. } else if tool == "recaptcha_five_pass" {
  678. acl_pass_auth = "admin_default_feature"
  679. if auth_info["captcha_one_check_five_pass"] {
  680. acl_data = ""
  681. } else {
  682. acl_data = "owner"
  683. }
  684. } else if tool == "view_hide_user_name" {
  685. acl_pass_auth = "admin_default_feature"
  686. if auth_info["view_hide_user_name"] {
  687. acl_data = ""
  688. } else {
  689. acl_data = "owner"
  690. }
  691. } else if tool == "user_name_bold" {
  692. acl_pass_auth = "admin_default_feature"
  693. if auth_info["user_name_bold"] {
  694. acl_data = ""
  695. } else {
  696. acl_data = "owner"
  697. }
  698. } else if tool == "doc_watch_list_view" {
  699. acl_pass_auth = "admin_default_feature"
  700. if auth_info["doc_watch_list_view"] {
  701. acl_data = ""
  702. } else {
  703. acl_data = "owner"
  704. }
  705. } else if tool == "document_edit_request" {
  706. acl_pass_auth = "acl"
  707. if for_a == 0 {
  708. end_number += 1
  709. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'document_edit_request_acl'"))
  710. if err != nil {
  711. log.Fatal(err)
  712. }
  713. defer stmt.Close()
  714. err = stmt.QueryRow(name).Scan(&acl_data)
  715. if err != nil {
  716. if err == sql.ErrNoRows {
  717. acl_data = ""
  718. } else {
  719. log.Fatal(err)
  720. }
  721. }
  722. } else {
  723. if auth_info["edit_request"] {
  724. acl_data = ""
  725. } else {
  726. acl_data = "owner"
  727. }
  728. }
  729. } else if tool == "document_make_acl" {
  730. acl_pass_auth = "acl"
  731. if auth_info["new_make"] {
  732. acl_data = ""
  733. } else {
  734. acl_data = "owner"
  735. }
  736. } else {
  737. // tool == "render"
  738. acl_pass_auth = "acl"
  739. if for_a == 0 {
  740. end_number += 1
  741. stmt, err := db.Prepare(DB_change("select data from acl where title = ? and type = 'view'"))
  742. if err != nil {
  743. log.Fatal(err)
  744. }
  745. defer stmt.Close()
  746. err = stmt.QueryRow(name).Scan(&acl_data)
  747. if err != nil {
  748. if err == sql.ErrNoRows {
  749. acl_data = ""
  750. } else {
  751. log.Fatal(err)
  752. }
  753. }
  754. } else {
  755. if auth_info["view"] {
  756. acl_data = ""
  757. } else {
  758. acl_data = "owner"
  759. }
  760. }
  761. }
  762. if auth_info[acl_pass_auth] {
  763. return true
  764. } else if ban_type == "4" {
  765. return false
  766. }
  767. if acl_data == "" {
  768. acl_data = "normal"
  769. }
  770. except_ban_tool_list := []string{"render", "topic_view", "bbs_view"}
  771. if acl_data != "normal" {
  772. if !(acl_data == "ban" || acl_data == "ban_admin") || ban_type == "3" {
  773. if !Arr_in_str(except_ban_tool_list, tool) {
  774. if get_ban == "true" {
  775. return false
  776. }
  777. }
  778. }
  779. if acl_data == "all" || acl_data == "ban" {
  780. return true
  781. } else if acl_data == "user" {
  782. if !ip_or_user {
  783. return true
  784. }
  785. } else if acl_data == "admin" {
  786. if auth_info["treat_as_admin"] {
  787. return true
  788. }
  789. } else if acl_data == "50_edit" {
  790. if !ip_or_user {
  791. stmt, err := db.Prepare(DB_change("select count(*) from history where ip = ?"))
  792. if err != nil {
  793. log.Fatal(err)
  794. }
  795. defer stmt.Close()
  796. var count int
  797. err = stmt.QueryRow(ip).Scan(&count)
  798. if err != nil {
  799. if err == sql.ErrNoRows {
  800. count = 0
  801. } else {
  802. log.Fatal(err)
  803. }
  804. }
  805. if count >= 50 {
  806. return true
  807. }
  808. }
  809. } else if acl_data == "before" {
  810. stmt, err := db.Prepare(DB_change("select ip from history where title = ? and ip = ? and type != 'edit_request'"))
  811. if err != nil {
  812. log.Fatal(err)
  813. }
  814. defer stmt.Close()
  815. var exist string
  816. err = stmt.QueryRow(name, ip).Scan(&exist)
  817. if err != nil {
  818. if err == sql.ErrNoRows {
  819. exist = ""
  820. } else {
  821. log.Fatal(err)
  822. }
  823. }
  824. if exist != "" {
  825. return true
  826. }
  827. } else if acl_data == "30_day" || acl_data == "90_day" {
  828. if !ip_or_user {
  829. stmt, err := db.Prepare(DB_change("select data from user_set where id = ? and name = 'date'"))
  830. if err != nil {
  831. log.Fatal(err)
  832. }
  833. defer stmt.Close()
  834. var signup_date string
  835. err = stmt.QueryRow(ip).Scan(&signup_date)
  836. if err != nil {
  837. if err == sql.ErrNoRows {
  838. signup_date = Get_time()
  839. } else {
  840. log.Fatal(err)
  841. }
  842. }
  843. time_1, _ := time.Parse("2006-01-02 15:04:05", signup_date)
  844. if acl_data == "30_day" {
  845. time_1 = time_1.AddDate(0, 0, 30)
  846. } else {
  847. time_1 = time_1.AddDate(0, 0, 90)
  848. }
  849. time_2, _ := time.Parse("2006-01-02 15:04:05", Get_time())
  850. if time_2.After(time_1) {
  851. return true
  852. }
  853. }
  854. } else if acl_data == "email" {
  855. if !ip_or_user {
  856. stmt, err := db.Prepare(DB_change("select data from user_set where id = ? and name = 'email'"))
  857. if err != nil {
  858. log.Fatal(err)
  859. }
  860. defer stmt.Close()
  861. var exist string
  862. err = stmt.QueryRow(ip).Scan(&exist)
  863. if err != nil {
  864. if err == sql.ErrNoRows {
  865. exist = ""
  866. } else {
  867. log.Fatal(err)
  868. }
  869. }
  870. if exist != "" {
  871. return true
  872. }
  873. }
  874. } else if acl_data == "owner" {
  875. if auth_info["owner"] {
  876. return true
  877. }
  878. } else if acl_data == "ban_admin" {
  879. if auth_info["treat_as_admin"] || get_ban == "true" {
  880. return true
  881. }
  882. } else if acl_data == "not_all" {
  883. return false
  884. } else if acl_data == "up_to_level_3" || acl_data == "up_to_level_10" {
  885. if acl_data == "up_to_level_3" {
  886. if level_int >= 3 {
  887. return true
  888. }
  889. } else if acl_data == "up_to_level_10" {
  890. if level_int >= 10 {
  891. return true
  892. }
  893. }
  894. } else if acl_data == "30_day_50_edit" {
  895. if !ip_or_user {
  896. stmt, err := db.Prepare(DB_change("select data from user_set where id = ? and name = 'date'"))
  897. if err != nil {
  898. log.Fatal(err)
  899. }
  900. defer stmt.Close()
  901. var signup_date string
  902. err = stmt.QueryRow(ip).Scan(&signup_date)
  903. if err != nil {
  904. if err == sql.ErrNoRows {
  905. signup_date = Get_time()
  906. } else {
  907. log.Fatal(err)
  908. }
  909. }
  910. time_1, _ := time.Parse("2006-01-02 15:04:05", signup_date)
  911. time_1 = time_1.AddDate(0, 0, 30)
  912. time_2, _ := time.Parse("2006-01-02 15:04:05", Get_time())
  913. if time_2.After(time_1) {
  914. stmt, err := db.Prepare(DB_change("select count(*) from history where ip = ?"))
  915. if err != nil {
  916. log.Fatal(err)
  917. }
  918. defer stmt.Close()
  919. var count int
  920. err = stmt.QueryRow(ip).Scan(&count)
  921. if err != nil {
  922. if err == sql.ErrNoRows {
  923. count = 0
  924. } else {
  925. log.Fatal(err)
  926. }
  927. }
  928. if count >= 50 {
  929. return true
  930. }
  931. }
  932. }
  933. }
  934. return false
  935. } else if for_a == end_number-1 {
  936. if !Arr_in_str(except_ban_tool_list, tool) {
  937. if get_ban == "true" {
  938. return false
  939. }
  940. }
  941. if tool == "topic" {
  942. stmt, err := db.Prepare(DB_change("select title from rd where code = ? and stop != ''"))
  943. if err != nil {
  944. log.Fatal(err)
  945. }
  946. defer stmt.Close()
  947. var topic_state string
  948. err = stmt.QueryRow(topic_number).Scan(&topic_state)
  949. if err != nil {
  950. if err == sql.ErrNoRows {
  951. topic_state = ""
  952. } else {
  953. log.Fatal(err)
  954. }
  955. }
  956. if topic_state != "" {
  957. if auth_info["topic"] {
  958. return true
  959. } else {
  960. return false
  961. }
  962. } else {
  963. return true
  964. }
  965. } else {
  966. return true
  967. }
  968. }
  969. }
  970. return false
  971. }