+`oq0HEI0U>b#Diq\ɓTF2a 牓pL L F\qu Ey''Ϗ+:D/ :%8f 4r~.D
U
+ߥNu7u׃ @"܄{ ;D4EdVQyDQC4
n[\gϜ{ }¬;Er?~ȚC2:al6xv 5k Z=ߖ?dqQN| H39icIPP[!_q7)deL @
kC^UB;`:B4/NV|$ѐ Cɝ`0ҁ~ t?-tK돧ӟg2J&r8BOz$75ȉ} f-HS.7os5u!>qB2|`i6rxfPk>CƁ>R -@2r W_vC7d p~wo&m\ Ԣ?A|tTF-?KX#~
n" 9,7paMQ_zA8TҚNbSk,KKA =r\ _W__@S"Dpw- Z#![8D`C`0Cyg~~|qsgBᛋ[h=Ii+],Fc#ɝ3'b4J0Fd}hy\__C+$Z1
w% *rY aOSZ>PBedYLSѝ(8i@z;k-\LFէWqk
y7\)x'pX?~?%OYTe 0*0K0C^%tZx);h*z θ֯BbJ8ZcfX@1.Xo}[v'xQ vK2M4Y@ j:훝M;k a rpEACa; k?b}=v-$`鴩/ޜ\h HΐD
jєL$qn.d 1 (1?)Ҙ];D)tԓ{ZH]tM7N 0Fl`ض WmUDz:{o?|:HOXw~=06LÀsު b^1
I1 F?d &F?Ղ&*] W2Z3>;1z!A䐪ެ*W@LfBUh,PkQɌ
Ҕ&, O%3Q
F{"`ZN''vP|$ռd<[Sxm,a]4i:(T9(,C 3-[halL}G)XɰGkq[aHh~ʨuͳStk5Hfw{{ )y;p3
uP@[(Wâ!jo/Jc˚mhoN$FK/x?0$+ 8m&G٬*I= ֮Zzfw%mm*%tUemeԚs-| 660
洱1~_#yM6y\a )7ˈt2 Ȕ1 $1 80 kQ?Ԉ? S>=8<;;?O#D]ܿ721QO+X9G9FZlZjq+KZwoA \+һ
G
' <g @:px Y?s!AωP8Wj(s!{p % D3% 왉# " As!,B d5qDPV g &q*DO`D ( Ll~Y.a[iٲ_6 P²ˤDoNqȖk;@!o[)!/?u)ɧ.=0鱩~Dc1&z ;ubA ^AKAu8Y7P[ Wc A78<9z+ T8 5B\roBx)q<$ƌ! 2h ; AZ\^Z87ePy̹Xr w:dzUg+[݃ ^O
. p,q++V ,*~W|U90ּa(ċn{bNx/gJs$";6~\aRN~ ݧ} ͧ"&# k EAفxIm2J/} b|5i5Q(;U65,=w(}szB:UaC$/EzXuf+C!nT0L*Sp N.QK6hOhn/.Cܲ*s%z`Zq`5؋ɞꀱ:U ٝ $ݙvۯ}eQlq0AV/Hqm{(^b~}eQLE. .X_=A
.}MC
9ۇ5!FE5 SL@c#Aeǀ2*TMiLO,=!ߥ'Lxr+俇7&]2D
(a%hM
0S^rKQ B6&,2eʚS$ﯲxgse--M?
ljgutq'\Y;m + qjF~R$-iۺS/]@69F>8/sʽVs
8ޤנGһ}<ɡ[?
D }3ԼݛKS3 IOK]ђp =fUʵ{ O&ԔK{$P$%R&
@ΐ1 S8X
kP9 5:]sAQN/v"QHei zMA]sB` FTă
Ipv# ov= b,}$% 78B:M, ]߯N_vKI LA,e+$16b4fـ7kMWNɆ >⿳G~C;.]rӏfכ^ *kM4^יk >㗡.`fXGd"`2];̧ߣvoQa!z_ 9Ӛ
d YReQjX qD Y.@hؘgʾ. }$ Ng-pr$&~Mo
?jAȥ. vx`ӈEɐ\JW~C{sFw9bH#G}-NMw)/Aϑy:dj̕
zbhjFbIPm?׀41mјRDD+LB.5YwPMgg+@03ϋ1sz'L]AXZv ;Q yz] &Te(UAU+Cvr^~"V\P`n:ʪֱzrU`YIF
h Jf-^bw^~KDyP0g|$ZeLyQ P]wdATʀ uKDwDu :LȑF^!"+LWٙK-f7L1
l`i4i ?bzjĩNqDRŤ;U^,rjǫ<]yZ=;;wf![M#4FXdgfd$'a(n?<"aTlzwT@IJMxc<#QW|JT0Ԩ768;3OO9xt|\߭wj̥
7r$q\ .!0`4y0"\g#(gf geSK"_ s 1F`&I>?*)əϚVħZh .6k=\~ƨ̴gjgA`TiJ'9g
e C>ЄX$Z_ ӊlue&nj4h<7lrM QF1 Ԛg5źG>Gۃf_R,Wt!KpJJ+~m{`\i7jc)?IHVM2 )_R~Lm
F(64o+]'XR^2{tT2J fR'p(o< &zGp@R$S ju 84&L%C0b=S{; 2WQty$|+ % =zԉ#U6&{&6q3Ts* XKCz xvMJJN4QL]pKT8 M8% L#?LJxACSԯ
DϬQ_NrtKiܥ#ZԙRVM,^GK|gO^XV@pO? l6.\"(OJ#dZf`
̔8j@5d
=EK ")f *$vȊ 2*X2`5Lj/)&^1q^hJ]@l`)h
`'&>b Ӵ*h`&3qlą̅
My:6 粚̀Ҵ8ʰXCs= lswSo,kZX gD`vu>익6om9:%Q[Z"0%ݹjkoRP+@$~Q';S0#&kW ?ud8kzƳrQ4WCbcz7< u `3!;߂T2c4h ƿEґ@ FYߣ@9 n??l'/]+3_nak 8K)vqkÉ~[qCJ84-n<"afXJ!hc@SJ4Fk4{}d*s"#T+T5/~Y?Ʋ: w=9+2_8*;
@˙A&%&b!2sKeZ$E}nJX
34/HDuxXTKsOxWsxVx Dp2v)pE V 7|56 \
BrJ1
(7O`,-Y*WN
ař
Bs"1}`.[(ׅ[Zf6VƈkvxV%**0xIix̱4ߠMclGs+K^I
{~e˹>=a3 yi$Ka\ dv+Li!KOVo\έ3LR˂X݆t3m кwH&Z aH-3jenRC XMR*eFgy`@ C!ok/D sk"I{k ٘MQ*W!N5d7uK^W Zy[{+>&Ic
hRH[)$Rqq6ŝݓ'J`_69b.Ms/xl{lGDZs!j鶚 yD q;I
ID h̙ȉ~ 3 ="tMz_ '
bȭcܡgoH6m-:&xɣVCf&zmD?g ǔ L<\_H燴SMӉ d:l''sJMWtYr<ńO aNR
ZFG).j }] ,BƸyғ ¿]߈ fk%gf .?}yΧ3,jqax_;;B"Yp7;M/E"eI
1ڨe/eX#$"|wTp)zPD;amPׁYU^Đ] -PK
{w @j%w3bGf/hՔ.C6cf B qL&-
싽Up7@h@8?#
Y&q"\vF} Q
p
DHiȗ -8"i^sfFCޯكR XŨ]jx=Q d*zyo 1+@_]l%\EH57S^yJ^$H=ZP<:/2m<0hho(c G=H} 6/ٟߪeh ހ
F9G{| xXDEvNzYViа(;f]Uil{/\
+*[as[!JX(uz ( x!7t M]1C;L3K &]-(n;!Kk v@_P ʘ&i:h&>iɷM&GC]A"YY~FCOń;;yʊ eO~oޏ˒ő ^[M&6j׳\zj!ӆ`w"y y'?HεPȺ?1S3VW( 7<#ڬKtF9ʶD1ÀLP! U-EkĒf oL!uq9 MލYƱ}dT<036 rLؚ239 QkYS,`"
e,
S}c ZG_۪m-o,l.lo 7ׂ*\սݦ]h7H\dk \ht@ [aa` c
|<.R X 9cO3c#`PuqfPBE43ɷ~ RJ@wj!@ O<4'813 |>F.Õ텵ז_۶זJ2I59 '<80KہNmAV#;6ϓg;\.ޓ2Ƀ_;cƓQTR \I)!ؽ)''\apf f^;
ZNۿo=]`jƷL_Vt&p{+Œz띥m-I;Ryx{Oy(^1;^IxiS}|$|GᅙsTKaJ-H\>L` /V]$Wno.x`:䀚E
V4tŢbF+Oĕؘ#,_J{rS?gJI6s- gPV* TWηey+>
0\xX3n3iVtڿygmq{e}MRj+7s2L?C~3=G`8q 2iPR>W [[W[E
4}
ķȌK q&4faI)Mem6_4Vj~no32S :"OI\r8L1+ZfeYP`sfDHc**0 BRYHƛ2dt4,4+ٯe;`ΞLK
&# 's X+/MU%K
bOp*6Ev 6<G C$%; E vhk|R˻3'Qy?ڊgq.y㡲wHz'2MjL2. eb'QF3JEZK~^Á8Px7ExPAYx7Z64`TL W"ʦ)qc^r
.b퇡K K2HML HՈ!ơF`N3W|`R)ۢ.i zf`~Ea^4hZ6z*ۛ +ۥ̛AW9pM7UZA;h[{fj|xߧuu1]}~b:=qZ*) ̿Mlv6&
Ն ջ&ֺF %2B.~u,
U Tomd{gfSS\5= O7MRTq
& 97"ߠm`5. $X%/clpf 2` F~u)f3<*Ȇ2:I
Uyl $ e9A ˗3W oR-YVvd r&>a."DO9O+u!k0l?Ly ¿*ί^bV>B^ $lI Z85C'T 9^/ 遬pzɧ3.=ZY~n(̕>};& O VX/=Љ%y=BkFATvWðn/ xaG$rPaI.i>\ww'E'u1 F. c`Ma-]
3|~]i0Ț8UWc(Xc
_mS
82=>0Mu^[Jk6(Tz8b{`SjML0vT
"ݺ
#dVa%7@OpT P @BR,¾ZaNg(+ { :j"頲=#?:dj-*J=Dٞ6a;@0=$ `D'AY њ'ҡX4 `XIZl1*:ۀOCv"0)Èo{Qxw _H9 < q66% A#9m)~$hqk6.5c6"xK {֑/m<]+Jl/쭎0e~ru[
*?G& ) |#N|x* XA>Iv,* ,镞P-7WB # 2Plx 86RٜX",P% OQdpF4S3+V &(ܣ"+QsD
Gtrfw|TB^/czQt+ 8W;]HO)^3RFSXyʪM'U'nZ\0x8*ۣ)!AqMj7O H
]z+_ŗ/_,m՜t1v,fH M`E&3y֟1.bV `
nh`2z.9yàEl| ;DhAu JDJ7nx26
dvڕ@Jl
B*FJY-;vH`zQb<7sJ~D姓ߙ WrG7D{ 4K3O=yζZg!Yp%)
j3Z)$ b8s)&KJ!F@~wp14:,=3MDQo?
?| qC`ך10TppHCHg#g$I</sMey|زt} n`WWq p PG4i EgW-c߫WrBZ'o 66g\QTA+@ J 69N4b|qu.!
#mbw --QnUQb;:m(tohʤčvSM6Ifz?W% h ybS[\̶R;9YsxRyA pB# \2#o\(Oxɟ ofJ<%!>:=ozl u>vvZ#芵\zqcP(t[N{k] P+i ꍴCl]b/_p&^:a^8v?h:eNNuP g^
pۢ}n P'̭8gsޅ>8:
:z:NcT ވ] GOLϩ7I9OĎ<.ÙTUIjG 5*`e/Й0BR e6R=Yц@[х Ll^)V#7 @ G!($hzHЩIn4Rq-%p +ǓSӕUivcu\Y *XZ|aysuwϹ\*AF'6 : , )T.tѯ V c;hzc R"/̮(e`w,&F:E
}?y9`E^S;,8L]k Sk/!S# w¡u'3G9.ٲw5c)vLJÛ\f_1wJ+R< >#lSYä;>$Q[equT)# OK n! #2a.ݓ/ 85 6`e?<(\ G%ZK
K=t$ L QHcWj yC!TkJCicH3ȿ-u@`oeqY6ƬGEw+]j ȹ`TA={Esk~k%
mqblc8@ $CF<@phG|ŨyܱGf»1뽚9 \}P%HN:u>}ll `xv܆ k= NJyVpN ,?`) N!Ln,J_(Tl+! dQ afK ŵ\ j a ȑfk#VY~]:\k*&@Q T@=LOA#Cy5'89=*TNNL ;K\p^bMF@1M ]4w䦆*3\,}cCC'{j* }ty=)A)nr%ji8MH-y ;7NUM+˔ss"'Bl
ڞ%f$A'հC]}bσzm#aۘ ]s;#fRMS <{u8ICn'Tm\I#n
A>87#K%ю;aM J;Wx]uZdS= ?& ʢx3H [^tN@ ⣩ 0X+X_G1rZS;^iBD
(&'Y]x}Ǚ ^w sWfOh3p[$O F^+@Aj g|t}./\0"й
4JzQ#
AQ)%Sb=Vx c( A74(vdiӥR TBm'HmLO3+]);G7)U,d쿻:oC݂T擠%I5 G SȍH}'L(SBrzj'R]\:%m mS0^7##Pat0f@2b=@+ ~'!$Y?hȡGDV(4D ۑ`ϚC. ]k YTH -^f9#~{>w:MnwHs S7_wR #DkOm
9s {yPY"}3Z V - ~`
㦴U>笓`ӯYn YeMG3tOCb,dT G[nG@m
e4 q0Nt0} 'J<1sf+F ő, y~ 5uHx!Y uG_HAҏ L&dcJ0r
`>ylm`|wLP+Rq~ڊO7G"AFAyw6Vx-2$*6urVTONP}#F\9 fNd$, qʛah4BDU5 ?J>P,iz I6poG8O)9/K䵂
p`84
̐3% | {I
1HZmieVC c+|${ װwD?)ր5;KE\q(Xq"E~]i}a_X7o-vS
?]Dȑk^qSH?aXu\F;h*maG%U*
L ʌ2PFM0,DG hPeaR `{#)N
,Ne't.ܿ3Rjcti:+ lt!Rq)܄WoMJ 4G^G'oHūx,_,U ـbJ &uD#bfvW8u* +mt× d~ gD \;dGd%#lS}(DS!Y{7I!E~D!A^FD0E_Šmxw!՟zS}C x3|c M[~&ub2o y@A^{A:SCZ Z<.UwSgvǙ Ǻ8(U9_
F ÈwxT^
d![Vu|ߑ0 qMN x76DQ_~V4A7Fehx1 }*oC?|?am1W<<EnV2&?T<'zGC7u\M#·[#@A8iP̭[> tC{K :ƨP8nG
80rs|)I
Kˋ s}ȪD$ 덓>.[ly@:ghl-o+ wEnMqV籥}wN@l%.%lpS[Sb>cIafٺYZY*2%8bvR+k8.q%5W uQq'w uOr+۷7yup;
i\TM6߶XFK%wjZq5tΞ-
cA8;~ n4}xJop xbD^O98%fm+[[Nqkyuyq'@Uu#
_:^3r^,&(8hW)e"Q W}ΓT1pnox FAF'tp2r~-W[QClCi5"ӹVp~A|#y]GföK~Uɉ N|H4SG
8BiGj >-~O| Ȏb#tsu< $Qld.}uZ@^)ɕ `RUM +%hCZa\aMPa h7!{bEU0. -s
!6zq P{2sww_0r9g2w=N nz$53ARv* [yws{nrI8Sd.}é 7Y mŌ .;t Z$qq DD]@Bh>$B@#h2'y r %Rlz\C.y3UM2l)fi [U&\K&Rcc2gUSf,tT0$1 "8Li>0cV!^̜*t2%+s"{~kɤjAkTo34p9`ds^]KsС D[ n=N~ &5X+a
55bʂ'c|c^ygb?7. ǪVs^,^L~ ~\msǫ?*+U/NL1ettX5Xq^F_;NrnP9!Gw V&PE.M$X\jP乥h_ (Ky8.Y,T1kk[?q2軚ӹ
&5>Re^ö#L0O¨,4ΐs\JI;# Pȧ2>L2rɘIJ#Eҙ"Bh[yj :SC+g< 'W04=ǃ@viB= d
~t
%zor*l= \Q!گQ^|h4tzYa `"qJ5hkRN\#s3i#zdjBK9 {,+O]~:iy驧 xT?N)} TA(8!%
P=b[\նG??
oL)pn/UslT(,w ǁա,!qD'0p8~\pW[b8 "ځ=+m:~vŰ'ő^/=uPr5{E>\ěZ|5~RyP CÎ+nTg.ɵy]!̆t<^;;ŨJ77n[,yG0rvmQխnڨ-ri
++c6X_Ќ56WpHqW.bMb
gg[^~]1B 8TtooO 6V֞m^#8sKWd) Z
o/V]+˛ҜsG~D0zX MpluSYGE[4.,ʺݎ¦"<LJ5w0Ղg|?>=
.q~PUx~]O5xCpjjM ֧ ]1隄dBuF Ⱥ̺ o @!@\za &' @sPG
'"gGc@ %<챏:[>C <Ʒ>C!lG x8w|оBN xy8aXI _)/NJ;09Wϯ i)S?̭% bxK0S9y~cM : Զ8D~YFH_y4qg@G?ɧ {?yf~Ct)cH
Ok+ߔĠ
Aa K0߾?}_n) ȿb73w");~ߕ Qx)^Pϼ [ bz!g秿rsF@ߞ47^46b:<3ҳyF,Bk=a,e (OGQof!z7o۾~5s#`VIg\h) ?N)ri $D^U?icdR@ j]̖ǿ:TH(JcaMo!Fڝc w~[3%+
lkӮfh`B?TO}Q)NVU</ @| ÖIXsoRX #sgGT >=3[~ / ehΠܟO?yecU(l]Oe4^xnOG2o
ژ"w V+;|9bb7ƧШ oyȔ.1ĖRe2f<8VǯA݆aKsB'?F 6 gcxv+G29>"@ &rmyKxLi%fo8D
g_QZ0[?亯bY^V'!r). O"`|'+Ui&g@EU19
V0\/}ZO^??&
Nf㼲gF5B,xu ~ _w>Ez.$l9Ny+«
7NJ;t +<o$ w%+5O0w lH"Cƅ뼢+ˀ7.jVc#oxւ}x4~Y'@o!/8.?(0` QCP@dsMYG=>ʗgGYK3z;4f ywߗ-bxGbh <~kY \x 9{==/ޖ$< FÌ|xc]s~~&s"s,~laSk- jx>o$s95A ːwo
* 2x~?~+Jh e]ߴQppg+J%ia
pW3QjIqanYq 7ѠŖ+|s4`{Tͯ|Y7au 꽓OE9z`Cë
_6dDexg!|>ϟ?$?e1xw8sR0 +}XϷG_aL
!l+>zJe] _>i5| an$x^">W\ֶm.x~K tnq= 詿PP
C<|5xLO^JT*}8_Ǵ2<3o*PL;_HR!װ 7!p2lv&sEzv.<G1~|}} aM\ #3
yZ ?$D*;
CR|8Ղ\;ݸ2v })wh*L%rKb\b-'"aC!V#< <όr aoVZ]i<
xϟ_Wj#_Xx7#~Esx~ի]>?~/Q
O"\ oN;3Nx
:K'IRnY4\Sl7} Їmy sjz{ 6q
ocۏz h1
o6ƀő!nY筿J_qQ2TLf6Q 釭ͭo~O7=,~ )ߵsmmVP? qВ9r3ǼJ )6 6<{3r6 <ߺ7@E kKlny"c9]Wŷn yĩ1ǪxwLE|~}H;NU/'k˿;gZ&x]|X})ɖrƖ M gY ϯz[svV&^WVǁpG Q}'AޙSGͳZrGeV>wi
?oH["&m 1;v1aaHü'[?/kՙ^ݵyÙv"nnugkL+۠pGLVj_ʻgwkVxzc+7ӦO o<膇u_=3 L2ꑚk=N2#1긨/߮7ԝaJ[-@iG PF~竟Ja) 1xg;2^8[3/nCJOh1u0O
gj :2x?Ar }+^xGcäY/~L25#RӼ<gx.R]gb)V~nen ]kKᨶ>gx'^3V[qb2;ҙ9=Q|ȟ|MB?۠tM4o[O/|~ntp^o6.l5Rx:qwsLm= Y:` G Ox: ?<`# mg)S_o60i%x1W~r3w|/~د $o37?WxKg.C#ϷFɍ^}/ũ7ʃ7^~v X~swgؖZ-xzH^ |~A o&L$lөyCΰU{[av~7*!v ۽d HQ{ L̆ A(`1a,J%1 ͱRHV[Ŀ X+ǭs?LRt:[Az7e4[?^Q/l%ſT~)(2%%[|n
7AKBL KShչNJk<;_~y& \fo'ΰk$7x._\3pdxB;3/ =2Y=n 3FKv_mOO-`% L>
<"sabAێgYF{cEqQ}IA'=
PAN4(v(6N]DK*Gևino0Wg/[[n g?),ofr4)pow^Ӧ[1< >Mjno _<;rV8cǠ =/Ґ_ M#v֠)!dam Lf<9ɽ35>
Yv2kGgYܱ@~fғWM%ZxǦx0ۚ9
:ngosk w +pyQCkfT/<|̏њT;UTdӀ=_ /<}fAwutj:bj [ n u(ϟߪ>>r [t o[Z [y7Uڨu@
o_ROO Jf-LP?BLRdS_Use.2mJ Y9XD8 {KW
]1o79e%_89
9rMRV!g>V[Z٬ժT:B/ovrA~(tܷ}%V&w0AqB@8
u,2ǥ|p\̏;V n]m~OO5 N]UvkօS* c .
H3% K BbS wW
H ̚]e+]Jٵ5!_g8gkmˮ2*aq99J `FP*[A z 37!bm:(oE+z§R)OB 8+L ~3;jqju^ў0FFU"\vúܕkX].e~M8P01XSRh4< {j/xŲdۅ) (
/ @EPwZ,96;NiSpCLHd-"z['IS:RE _ iv c.EԆ=DB2.bQl.IbGo#zaTݿٔ%'ƄTq^8{o SD5'KÙB5<ULd:t*yzUy
Nbォ$^_J F:mRW1 f,i/[|7;tU\YtK莹l,d],tJJE0SRʡWk#)9t-rư(Q7,v vR5BRW%~'Q^& 6~i{Xo
]=0PYXtA[pZY_ݸ"ן$hĉzk,^t&!N4)K X+tHhPNL Hj9{
ҞvAT
N;;AP4?N%-w,"Vriw7lUngE!ꃊX\Y]tyA`= S_kbnE17N m5Hq~f:GAJL/#znHMfJ `dAH ʅ (ʺ;i ]ƀU;ib.0t.5.싑1Z9G_]wLhGpˢ0!B.Qq@G^d.é P7uau( .mOCF,nt_H9B'gdC 9$S,c2n,={^=<3HYC}Xcp`-h'9>HR5$(q0PB|ٳ3Үֿ\Z54 4ʟX'sp:w*pj-/h#RV tZ WU^<}P SQ(;'4ٽupﻲ`,J! DA 8u*Pu p"' cH~
Ѭ3!Jb;ɫ4D{4q nI _p] @oуrRPtGʞzd1 YjbFffE ,mౣۼ?fT8*,Ҵ )LJ-/11-7o/ Yw&;
E GlDbʽR`hfBH,gs%gdc ˜5]!Zx]1(IlƦwZ);T 9|n1yG)
tE
nEn%rSLK5^nq|u*>'\+ }_F_wf`a"K5(["='E/Y[Ypp_+S/=v2FK~h9s% bhtF
C>oo6ߺFje@bcs-ˋY,l.Zy!+C; K;7%R˻Β퐧Vt}0%n6&ҫ;%!hcV0G253pQx.7Xήolmqo!0h FIP+[b7: :w p$p 渰zgYlkˀ/FFFwZ>X;䃷Dpf3`ܦ; dΐӆpJ.^&VT-<0f6)ƒ`ՙ bvvq텵%! /;1 Ii54NnVh& r4~Sq
8ld
UYiGʝ !TY#bx|hl^[\?zb zx4\;_[AofzZ 56w9z#5sKԖz5ƕa 2e̅ Jc׳SS=n5UR"& ,bn{[
+
U4,r4DB-XƏzqw)*{?̃@*dty3UȺi[r!aQ@o o\sX l\)Q*@\EL;bTAњX (]=Pڋ k+k_/L"{\#.9!jYjac긅*9]2hBZ`f0 6 _^P=1-Nx0,o4^n[oK@7D
1'a #e97u Ma tQGaƛNPэTD |HשWRb2;J1(8<*䍻AW DFZ.Brr Eq G0@աVHIeȘ?[8Q2uIJ
p-NL p -˿yuE%X
xڱ4*@B2Oũot$ XŒh<.~W 3. .${ 4 4V͢5dʭ2
7XH0=IU<,Sm២ qu*壊p8[0@ (+i
+Y/ģv5ey܃p`eA7}Kݶ8GªsG J{M
cjd,XӪF= xBю Q=B%kA!pNH2* eQ|ёwɧ=4$k5Pq@~ _Y;/AM.W@('ngs1o9`IK6Suus46;'B %9w0
(]jĂ^#ߖw;0)
/ h%wY љU^tcPK mom.Ɲ;w6W&Pt[Y%q
xvu5
t?&М8,}ʨO ]yI ۔${] :#Lu:=|s,دgC͏DC):S<GGRjCcDlh3HYIP,"(8 %hO$3w{*Mj<*H @IҖ N7y
6 ֕T)"
10P'и\Wc̹@Zcч^<)] 4aP-Ӕ;cZ2A3Q# j4)w R H(;C%j7Q4-s &Y |d l:fy96 ʣy upa`K1s`40-Ö(A ǩ!:VC«:șdȑkҐᔡ(zR td
STpGxlz\O*Lab zNЩ1 b\ ٣ƀԌQ >W Yoa+LƭiZcY|k& +vX(,GsUտJٲe7D[\J9dрIà>:,Y*OQ
BR4,V~yJi9M`NMūvYhNWځ l;ر($ʧ DR
gbٯ#(.,1pZÍ'+9 Qu`@(/Ű-] U
]9 T l
_CJáy .hCU|
B Q-N@Ф%Đ8~A3=&2G^7Vss=h2O# dWy{x]69n q ᫆NC @I,ž8@Rn
{$;*ӭr;gF46**M"+o5а*d:!Dո RIIzJYT" ޘop;?9 d$F7uO%Y!,ovU0|z~;@A%ư5.a O[h4b/ęlmP| M01$ Ǩ/AU3|=X=9Gf̻q.ϣ0oyBdfk:Sx<%*>9%)ƔQ=9z8Ob*y Eآ #HK00tf$u$~+x8T@ (8<ƅ{`Ә=q G!])f
-2{VE0 =#+zVjoXDmy p
[q=/!;ub$d.=D R2R kBŧˎXQBjh #H=l TI?pd\*guME/?/aw0̜,!J~bRg dR] SRCM: 76P ?Lcw»%Z@o.^g) $[FbռB@ rǥ,&B̡GokU?>4Hc*։#?^#Оwsq_{ e.xeyΑGgu ^a_IWw xqgST&
fԦ
ƮbwyC˜*;5|R~Q2
3P rZn ] Z # t T
^@]Eg,A% C['n n 6Kg0#r noAjJ"
CJ@&5h E5AzZ\S6&BtBg' FZ *ۋ-blM(`0 @2Hc9p0RL pRA@(= g I0ʠ&jqd鸈Zt0 ÃEd2sp[ A vEA-]Dt1
7ҧ|;.k2* #(R^n&J k:iȿi &ɏ
Y ALᷔˤ*."Q*n9?Z`a`D
?D^p\pb]C~*r %'\t|4Z|Dp;OX WF sw1NJ$\uŔf&2O*J$QH@h,ӳf>c6Up0bX3 ֨i Tg8Pd j$+
+zEZp5W 4Do
P-yd;ujLkIU> a@QԇT |H'ʵ`̠ |Gxh;{`Y&bCř9SVL'a-bO
5xc5
}XxE/İ.Y,TakGh%jD]È
,<S-Mu*2vXg"ݚ9ʅI BfTz%|d7t}Y%X^ uWE 4±YOtٙ&^z#QF\q>;.mnlʥl-F%# ohQ ͦɈpKP`^ۥ6xZk
G_Fmc?Fl,
;i +8xJ! HM,sb۠؋|SH)YML9xiŧ+1OyöIXzJ* s縁*ŐM"U|ư0/ 4(cfN iibqX.!;mTMeeHu!`O3Lm--< p)xI-m 2TBe&*q% :H$㫴{}tvoB
R13:YOYG|qI -.S/`⁼σ<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\auth;
/**
* Permission/Auth class
*/
class auth
{
var $acl = array();
var $cache = array();
var $acl_options = array();
var $acl_forum_ids = false;
/**
* Init permissions
*/
function acl(&$userdata)
{
global $db, $cache;
$this->acl = $this->cache = $this->acl_options = array();
$this->acl_forum_ids = false;
if (($this->acl_options = $cache->get('_acl_options')) === false)
{
$sql = 'SELECT auth_option_id, auth_option, is_global, is_local
FROM ' . ACL_OPTIONS_TABLE . '
ORDER BY auth_option_id';
$result = $db->sql_query($sql);
$global = $local = 0;
$this->acl_options = array();
while ($row = $db->sql_fetchrow($result))
{
if ($row['is_global'])
{
$this->acl_options['global'][$row['auth_option']] = $global++;
}
if ($row['is_local'])
{
$this->acl_options['local'][$row['auth_option']] = $local++;
}
$this->acl_options['id'][$row['auth_option']] = (int) $row['auth_option_id'];
$this->acl_options['option'][(int) $row['auth_option_id']] = $row['auth_option'];
}
$db->sql_freeresult($result);
$cache->put('_acl_options', $this->acl_options);
}
if (!trim($userdata['user_permissions']))
{
$this->acl_cache($userdata);
}
// Fill ACL array
$this->_fill_acl($userdata['user_permissions']);
// Verify bitstring length with options provided...
$renew = dp!I+ :;aa+:Wה1ZsV<pV ûȱJ`H)2 f1E0 PJ8Piњ f q3cMy*ja53(ΣB
=BX(УB
=*U|FChE8|[*vt1؝^U t`<8}Z.r@hҰBz|uf!!Y r ?[]LT`#~3@ʜ
a5ѹbq-(?82Ku*>Y"9/$tl,P|40.|y1Uc;`#89Қ-K=8$RбH jA)BIGI$2N jHT (D[ˋo-JL B`CTD`,˿Y.JT嚤?dS{1J x`zaIXl=q3ѡ02jw\ǧ-ߗ0Zap֧oyV5[;.%:b :8 yMzݠcVJ:A飂X$h }5>;ξfxLNe'
4 9Jq& #$O /ނˠ譄Kl2 Jʐw&7D8FG lSe"6&0
7XHp(6Q| y."b|ݙgUXM_H *aupЃV2ZY2k M~O,/LQ1R!хuJG#JP( U|Rҏ()1 7_ .#tbn-r$h@Cy_a5bAz5VEo$F X͛̒[6)#Rݚ PHܿ+6(y*[u0x!35%><&܋k QW
$local_length = ($local_length % 31) ? ($local_length - ($local_length % 31) + 31) : $local_length;
// You thought we are finished now? Noooo... now compare them.
foreach ($this->acl as $forum_id => $bitstring)
{
if (($forum_id && strlen($bitstring) != $local_length) || (!$forum_id && strlen($bitstring) != $global_length))
{
$renew = true;
break;
}
}
// If a bitstring within the list does not match the options, we have a user with incorrect permissions set and need to renew them
if ($renew)
{
$this->acl_cache($userdata);
$this->_fill_acl($userdata['user_permissions']);
}
return;
}
/**
* Retrieves data wanted by acl function from the database for the
* specified user.
*
* @param int $user_id User ID
* @return array User attributes
*/
public function obtain_user_data($user_id)
{
global $db;
$sql = 'SELECT user_id, username, user_permissions, user_type
FROM ' . USERS_TABLE . '
WHERE user_id = ' . $user_id;
$result = $db->sql_query($sql);
$user_data = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
return $user_data;
}
/**
* Fill ACL array with relevant bitstrings from user_permissions column
* @access private
*/
function _fill_acl($user_permissions)
{
$seq_cache = array();
$this->acl = array();
$user_permissions = explode("\n", $user_permissions);
foreach ($user_permissions as $f => $seq)
{
if ($seq)
{
$i = 0;
if (!isset($this->acl[$f]))
{
$this->acl[$f] = '';
}
while ($subseq = substr($seq, $i, 6))
{
if (isset($seq_cache[$subseq]))
{
$converted = $seq_cache[$subseq];
}
else
{
$converted = $seq_cache[$subseq] = str_pad(base_convert($subseq, 36, 2), 31, 0, STR_PAD_LEFT);
}
// We put the original bitstring into the acl array
$this->acl[$f] .= $converted;
$i += 6;
}
}
}
}
/**
* Look up an option
* if the option is prefixed with !, then the result becomes negated
*
* If a forum id is specified the local option will be combined with a global option if one exist.
* If a forum id is not specified, only the global option will be checked.
*/
function acl_get($opt, $f = 0)
{
$negate = false;
if (strpos($opt, '!') === 0)
{
$negate = true;
$opt = substr($opt, 1);
}
if (!isset($this->cache[$f][$opt]))
{
// We combine the global/local option with an OR because some options are global and local.
// If the user has the global permission the local one is true too and vice versa
$this->cache[$f][$opt] = false;
// Is this option a global permission setting?
if (isset($this->acl_options['global'][$opt]))
{
if (isset($this->acl[0]))
{
$this->cache[$f][$opt] = $this->acl[0][$this->acl_options['global'][$opt]];
}
}
// Is this option a local permission setting?
// But if we check for a global option only, we won't combine the options...
if ($f != 0 && isset($this->acl_options['local'][$opt]))
{
if (isset($this->acl[$f]) && isset($this->acl[$f][$this->acl_options['local'][$opt]]))
{
$this->cache[$f][$opt] |= $this->acl[$f][$this->acl_options['local'][$opt]];
}
}
}
// Founder always has all global options set to true...
return ($negate) ? !$this->cache[$f][$opt] : $this->cache[$f][$opt];
}
/**
* Get forums with the specified permission setting
*
* @param string $opt The permission name to lookup. If prefixed with !, the result is negated.
* @param bool $clean set to true if only values needs to be returned which are set/unset
*
* @return array Contains the forum ids with the specified permission set to true.
This is a nested array: array => forum_id => permission => true
*/
function acl_getf($opt, $clean = false)
{
$acl_f = array();
$negate = false;
if (strpos($opt, '!') === 0)
{
$negate = true;
$opt = substr($opt, 1);
}
// If we retrieve a list of forums not having permissions in, we need to get every forum_id
if ($negate)
{
if ($this->acl_forum_ids === false)
{
global $db;
$sql = 'SELECT forum_id
FROM ' . FORUMS_TABLE;
if (sizeof($this->acl))
{
$sql .= ' WHERE ' . $db->sql_in_set('forum_id', array_keys($this->acl), true);
}
$result = $db->sql_query($sql);
$this->acl_forum_ids = array();
while ($row = $db->sql_fetchrow($result))
{
$this->acl_forum_ids[] = $row['forum_id'];
}
$db->sql_freeresult($result);
}
}
if (isset($this->acl_options['local'][$opt]))
{
foreach ($this->acl as $f => $bitstring)
{
// Skip global settings
if (!$f)
{
continue;
}
$allowed = (!isset($this->cache[$f][$opt])) ? $this->acl_get($opt, $f) : $this->cache[$f][$opt];
if (!$clean)
{
$acl_f[$f][$opt] = ($negate) ? !$allowed : $allowed;
}
else
{
if (($negate && !$allowed) || (!$negate && $allowed))
{
$acl_f[$f][$opt] = 1;
}
}
}
}
// If we get forum_ids not having this permission, we need to fill the remaining parts
if ($negate && sizeof($this->acl_forum_ids))
{
foreach ($this->acl_forum_ids as $f)
{
$acl_f[$f][$opt] = 1;
}
}
return $acl_f;
}
/**
* Get local permission state for any forum.
*
* Returns true if user has the permission in one or more forums, false if in no forum.
* If global option is checked it returns the global state (same as acl_get($opt))
* Local option has precedence...
*/
function acl_getf_global($opt)
{
if (is_array($opt))
{
// evaluates to true as soon as acl_getf_global is true for one option
foreach ($opt as $check_option)
{
if ($this->acl_getf_global($check_option))
{
return true;
}
}
return false;
}
if (isset($this->acl_options['local'][$opt]))
{
foreach ($this->acl as $f => $bitstring)
{
// Skip global settings
if (!$f)
{
continue;
}
// as soon as the user has any permission we're done so return true
if ((!isset($this->cache[$f][$opt])) ? $this->acl_get($opt, $f) : $this->cache[$f][$opt])
{
return true;
}
}
}
else if (isset($this->acl_options['global'][$opt]))
{
return $this->acl_get($opt);
}
return false;
}
/**
* Get permission settings (more than one)
*/
function acl_gets()
{
$args = func_get_args();
$f = array_pop($args);
if (!is_numeric($f))
{
$args[] = $f;
$f = 0;
}
// alternate syntax: acl_gets(array('m_', 'a_'), $forum_id)
if (is_array($args[0]))
{
$args = $args[0];
}
$acl = 0;
foreach ($args as $opt)
{
$acl |= $this->acl_get($opt, $f);
}
return $acl;
}
/**
* Get permission listing based on user_id/options/forum_ids
*
* Be careful when using this function with permissions a_, m_, u_ and f_ !
* It may not work correctly. When a user group grants an a_* permission,
* e.g. a_foo, but the user's a_foo permission is set to "Never", then
* the user does not in fact have the a_ permission.
* But the user will still be listed as having the a_ permission.
*
* For more information see: http://tracker.phpbb.com/browse/PHPBB3-10252
*/
function acl_get_list($user_id = false, $opts = false, $forum_id = false)
{
if ($user_id !== false && !is_array($user_id) && $opts === false && $forum_id === false)
{
$hold_ary = array($user_id => $this->acl_raw_data_single_user($user_id));
}
else
{
$hold_ary = $this->acl_raw_data($user_id, $opts, $forum_id);
}
$auth_ary = array();
foreach ($hold_ary as $user_id => $forum_ary)
{
foreach ($forum_ary as $forum_id => $auth_option_ary)
{
foreach ($auth_option_ary as $auth_option => $auth_setting)
{
if ($auth_setting)
{
$auth_ary[$forum_id][$auth_option][] = $user_id;
}
}
}
}
return $auth_ary;
}
/**
* Cache data to user_permissions row
*/
function acl_cache(&$userdata)
{
global $db;
// Empty user_permissions
$userdata['user_permissions'] = '';
$hold_ary = $this->acl_raw_data_single_user($userdata['user_id']);
// Key 0 in $hold_ary are global options, all others are forum_ids
// If this user is founder we're going to force fill the admin options ...
if ($userdata['user_type'] == USER_FOUNDER)
{
foreach ($this->acl_options['global'] as $opt => $id)
{
if (strpos($opt, 'a_') === 0)
{
$hold_ary[0][$this->acl_options['id'][$opt]] = ACL_YES;
}
}
}
$hold_str = $this->build_bitstring($hold_ary);
if ($hold_str)
{
$userdata['user_permissions'] = $hold_str;
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_permissions = '" . $db->sql_escape($userdata['user_permissions']) . "',
user_perm_from = 0
WHERE user_id = " . $userdata['user_id'];
$db->sql_query($sql);
}
return;
}
/**
* Build bitstring from permission set
*/
function build_bitstring(&$hold_ary)
{
$hold_str = '';
if (sizeof($hold_ary))
{
ksort($hold_ary);
$last_f = 0;
foreach ($hold_ary as $f => $auth_ary)
{
$ary_key = (!$f) ? 'global' : 'local';
$bitstring = array();
foreach ($this->acl_options[$ary_key] as $opt => $id)
{
if (isset($auth_ary[$this->acl_options['id'][$opt]]))
{
$bitstring[$id] = $auth_ary[$this->acl_options['id'][$opt]];
$option_key = substr($opt, 0, strpos($opt, '_') + 1);
// If one option is allowed, the global permission for this option has to be allowed too
// example: if the user has the a_ permission this means he has one or more a_* permissions
if ($auth_ary[$this->acl_options['id'][$opt]] == ACL_YES && (!isset($bitstring[$this->acl_options[$ary_key][$option_key]]) || $bitstring[$this->acl_options[$ary_key][$option_key]] == ACL_NEVER))
{
$bitstring[$this->acl_options[$ary_key][$option_key]] = ACL_YES;
}
}
else
{
$bitstring[$id] = ACL_NEVER;
}
}
// Now this bitstring defines the permission setting for the current forum $f (or global setting)
$bitstring = implode('', $bitstring);
// The line number indicates the id, therefore we have to add empty lines for those ids not present
$hold_str .= str_repeat("\n", $f - $last_f);
// Convert bitstring for storage - we do not use binary/bytes because PHP's string functions are not fully binary safe
for ($i = 0, $bit_length = strlen($bitstring); $i < $bit_length; $i += 31)
{
$hold_str .= str_pad(base_convert(str_pad(substr($bitstring, $i, 31), 31, 0, STR_PAD_RIGHT), 2, 36), 6, 0, STR_PAD_LEFT);
}
$last_f = $f;
}
unset($bitstring);
$hold_str = rtrim($hold_str);
}
return $hold_str;
}
/**
* Clear one or all users cached permission settings
*/
function acl_clear_prefetch($user_id = false)
{
global $db, $cache, $phpbb_dispatcher;
// Rebuild options cache
$cache->destroy('_role_cache');
$sql = 'SELECT *
FROM ' . ACL_ROLES_DATA_TABLE . '
ORDER BY role_id ASC';
$result = $db->sql_query($sql);
$this->role_cache = array();
while ($row = $db->sql_fetchrow($result))
{
$this->role_cache[$row['role_id']][$row['auth_option_id']] = (int) $row['auth_setting'];
}
$db->sql_freeresult($result);
foreach ($this->role_cache as $role_id => $role_options)
{
$this->role_cache[$role_id] = serialize($role_options);
}
$cache->put('_role_cache', $this->role_cache);
// Now empty user permissions
$where_sql = '';
if ($user_id !== false)
{
$user_id = (!is_array($user_id)) ? $user_id = array((int) $user_id) : array_map('intval', $user_id);
$where_sql = ' WHERE ' . $db->sql_in_set('user_id', $user_id);
}
$sql = 'UPDATE ' . USERS_TABLE . "
SET user_permissions = '',
user_perm_from = 0
$where_sql";
$db->sql_query($sql);
/**
* Event is triggered after user(s) permission settings cache has been cleared
*
* @event core.acl_clear_prefetch_after
* @var mixed user_id User ID(s)
* @since 3.1.11-RC1
*/
$vars = array('user_id');
extract($phpbb_dispatcher->trigger_event('core.acl_clear_prefetch_after', compact($vars)));
return;
}
/**
* Get assigned roles
*/
function acl_role_data($user_type, $role_type, $ug_id = false, $forum_id = false)
{
global $db;
$roles = array();
$sql_id = ($user_type == 'user') ? 'user_id' : 'group_id';
$sql_ug = ($ug_id !== false) ? ((!is_array($ug_id)) ? "AND a.$sql_id = $ug_id" : 'AND ' . $db->sql_in_set("a.$sql_id", $ug_id)) : '';
$sql_forum = ($forum_id !== false) ? ((!is_array($forum_id)) ? "AND a.forum_id = $forum_id" : 'AND ' . $db->sql_in_set('a.forum_id', $forum_id)) : '';
// Grab assigned roles...
$sql = 'SELECT a.auth_role_id, a.' . $sql_id . ', a.forum_id
FROM ' . (($user_type == 'user') ? ACL_USERS_TABLE : ACL_GROUPS_TABLE) . ' a, ' . ACL_ROLES_TABLE . " r
WHERE a.auth_role_id = r.role_id
AND r.role_type = '" . $db->sql_escape($role_type) . "'
$sql_ug
$sql_forum
ORDER BY r.role_order ASC";
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$roles[$row[$sql_id]][$row['forum_id']] = $row['auth_role_id'];
}
$db->sql_freeresult($result);
return $roles;
}
/**
* Get raw acl data based on user/option/forum
*/
function acl_raw_data($user_id = false, $opts = false, $forum_id = false)
{
global $db;
$sql_user = ($user_id !== false) ? ((!is_array($user_id)) ? 'user_id = ' . (int) $user_id : $db->sql_in_set('user_id', array_map('intval', $user_id))) : '';
$sql_forum = ($forum_id !== false) ? ((!is_array($forum_id)) ? 'AND a.forum_id = ' . (int) $forum_id : 'AND ' . $db->sql_in_set('a.forum_id', array_map('intval', $forum_id))) : '';
$sql_opts = $sql_opts_select = $sql_opts_from = '';
$hold_ary = array();
if ($opts !== false)
{
$sql_opts_select = ', ao.auth_option';
$sql_opts_from = ', ' . ACL_OPTIONS_TABLE . ' ao';
$this->build_auth_option_statement('ao.auth_option', $opts, $sql_opts);
}
$sql_ary = array();
// Grab non-role settings - user-specific
$sql_ary[] = 'SELECT a.user_id, a.forum_id, a.auth_setting, a.auth_option_id' . $sql_opts_select . '
FROM ' . ACL_USERS_TABLE . ' a' . $sql_opts_from . '
WHERE a.auth_role_id = 0 ' .
(($sql_opts_from) ? 'AND a.auth_option_id = ao.auth_option_id ' : '') .
(($sql_user) ? 'AND a.' . $sql_user : '') . "
$sql_forum
$sql_opts";
// Now the role settings - user-specific
$sql_ary[] = 'SELECT a.user_id, a.forum_id, r.auth_option_id, r.auth_setting, r.auth_option_id' . $sql_opts_select . '
FROM ' . ACL_USERS_TABLE . ' a, ' . ACL_ROLES_DATA_TABLE . ' r' . $sql_opts_from . '
WHERE a.auth_role_id = r.role_id ' .
(($sql_opts_from) ? 'AND r.auth_option_id = ao.auth_option_id ' : '') .
(($sql_user) ? 'AND a.' . $sql_user : '') . "
$sql_forum
$sql_opts";
foreach ($sql_ary as $sql)
{
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$option = ($sql_opts_select) ? $row['auth_option'] : $this->acl_options['option'][$row['auth_option_id']];
$hold_ary[$row['user_id']][$row['forum_id']][$option] = $row['auth_setting'];
}
$db->sql_freeresult($result);
}
$sql_ary = array();
// Now grab group settings - non-role specific...
$sql_ary[] = 'SELECT ug.user_id, a.forum_id, a.auth_setting, a.auth_option_id' . $sql_opts_select . '
FROM ' . ACL_GROUPS_TABLE . ' a, ' . USER_GROUP_TABLE . ' ug, ' . GROUPS_TABLE . ' g' . $sql_opts_from . '
WHERE a.auth_role_id = 0 ' .
(($sql_opts_from) ? 'AND a.auth_option_id = ao.auth_option_id ' : '') . '
AND a.group_id = ug.group_id
AND g.group_id = ug.group_id
AND ug.user_pending = 0
AND NOT (ug.group_leader = 1 AND g.group_skip_auth = 1)
' . (($sql_user) ? 'AND ug.' . $sql_user : '') . "
$sql_forum
$sql_opts";
// Now grab group settings - role specific...
$sql_ary[] = 'SELECT ug.user_id, a.forum_id, r.auth_setting, r.auth_option_id' . $sql_opts_select . '
FROM ' . ACL_GROUPS_TABLE . ' a, ' . USER_GROUP_TABLE . ' ug, ' . GROUPS_TABLE . ' g, ' . ACL_ROLES_DATA_TABLE . ' r' . $sql_opts_from . '
WHERE a.auth_role_id = r.role_id ' .
(($sql_opts_from) ? 'AND r.auth_option_id = ao.auth_option_id ' : '') . '
AND a.group_id = ug.group_id
AND g.group_id = ug.group_id
AND ug.user_pending = 0
AND NOT (ug.group_leader = 1 AND g.group_skip_auth = 1)
' . (($sql_user) ? 'AND ug.' . $sql_user : '') . "
$sql_forum
$sql_opts";
foreach ($sql_ary as $sql)
{
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$option = ($sql_opts_select) ? $row['auth_option'] : $this->acl_options['option'][$row['auth_option_id']];
if (!isset($hold_ary[$row['user_id']][$row['forum_id']][$option]) || (isset($hold_ary[$row['user_id']][$row['forum_id']][$option]) && $hold_ary[$row['user_id']][$row['forum_id']][$option] != ACL_NEVER))
{
$hold_ary[$row['user_id']][$row['forum_id']][$option] = $row['auth_setting'];
// If we detect ACL_NEVER, we will unset the flag option (within building the bitstring it is correctly set again)
if ($row['auth_setting'] == ACL_NEVER)
{
$flag = substr($option, 0, strpos($option, '_') + 1);
if (isset($hold_ary[$row['user_id']][$row['forum_id']][$flag]) && $hold_ary[$row['user_id']][$row['forum_id']][$flag] == ACL_YES)
{
unset($hold_ary[$row['user_id']][$row['forum_id']][$flag]);
/* if (in_array(ACL_YES, $hold_ary[$row['user_id']][$row['forum_id']]))
{
$hold_ary[$row['user_id']][$row['forum_id']][$flag] = ACL_YES;
}
*/
}
}
}
}
$db->sql_freeresult($result);
}
return $hold_ary;
}
/**
* Get raw user based permission settings
*/
function acl_user_raw_data($user_id = false, $opts = false, $forum_id = false)
{
global $db;
$sql_user = ($user_id !== false) ? ((!is_array($user_id)) ? 'user_id = ' . (int) $user_id : $db->sql_in_set('user_id', array_map('intval', $user_id))) : '';
$sql_forum = ($forum_id !== false) ? ((!is_array($forum_id)) ? 'AND a.forum_id = ' . (int) $forum_id : 'AND ' . $db->sql_in_set('a.forum_id', array_map('intval', $forum_id))) : '';
$sql_opts = '';
$hold_ary = $sql_ary = array();
if ($opts !== false)
{
$this->build_auth_option_statement('ao.auth_option', $opts, $sql_opts);
}
// Grab user settings - non-role specific...
$sql_ary[] = 'SELECT a.user_id, a.forum_id, a.auth_setting, a.auth_option_id, ao.auth_option
FROM ' . ACL_USERS_TABLE . ' a, ' . ACL_OPTIONS_TABLE . ' ao
WHERE a.auth_role_id = 0
AND a.auth_option_id = ao.auth_option_id ' .
(($sql_user) ? 'AND a.' . $sql_user : '') . "
$sql_forum
$sql_opts
ORDER BY a.forum_id, ao.auth_option";
// Now the role settings - user-specific
$sql_ary[] = 'SELECT a.user_id, a.forum_id, r.auth_option_id, r.auth_setting, r.auth_option_id, ao.auth_option
FROM ' . ACL_USERS_TABLE . ' a, ' . ACL_ROLES_DATA_TABLE . ' r, ' . ACL_OPTIONS_TABLE . ' ao
WHERE a.auth_role_id = r.role_id
AND r.auth_option_id = ao.auth_option_id ' .
(($sql_user) ? 'AND a.' . $sql_user : '') . "
$sql_forum
$sql_opts
ORDER BY a.forum_id, ao.auth_option";
foreach ($sql_ary as $sql)
{
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$hold_ary[$row['user_id']][$row['forum_id']][$row['auth_option']] = $row['auth_setting'];
}
$db->sql_freeresult($result);
}
return $hold_ary;
}
/**
* Get raw group based permission settings
*/
function acl_group_raw_data($group_id = false, $opts = false, $forum_id = false)
{
global $db;
$sql_group = ($group_id !== false) ? ((!is_array($group_id)) ? 'group_id = ' . (int) $group_id : $db->sql_in_set('group_id', array_map('intval', $group_id))) : '';
$sql_forum = ($forum_id !== false) ? ((!is_array($forum_id)) ? 'AND a.forum_id = ' . (int) $forum_id : 'AND ' . $db->sql_in_set('a.forum_id', array_map('intval', $forum_id))) : '';
$sql_opts = '';
$hold_ary = $sql_ary = array();
if ($opts !== false)
{
$this->build_auth_option_statement('ao.auth_option', $opts, $sql_opts);
}
// Grab group settings - non-role specific...
$sql_ary[] = 'SELECT a.group_id, a.forum_id, a.auth_setting, a.auth_option_id, ao.auth_option
FROM ' . ACL_GROUPS_TABLE . ' a, ' . ACL_OPTIONS_TABLE . ' ao
WHERE a.auth_role_id = 0
AND a.auth_option_id = ao.auth_option_id ' .
(($sql_group) ? 'AND a.' . $sql_group : '') . "
$sql_forum
$sql_opts
ORDER BY a.forum_id, ao.auth_option";
// Now grab group settings - role specific...
$sql_ary[] = 'SELECT a.group_id, a.forum_id, r.auth_setting, r.auth_option_id, ao.auth_option
FROM ' . ACL_GROUPS_TABLE . ' a, ' . ACL_ROLES_DATA_TABLE . ' r, ' . ACL_OPTIONS_TABLE . ' ao
WHERE a.auth_role_id = r.role_id
AND r.auth_option_id = ao.auth_option_id ' .
(($sql_group) ? 'AND a.' . $sql_group : '') . "
$sql_forum
$sql_opts
ORDER BY a.forum_id, ao.auth_option";
foreach ($sql_ary as $sql)
{
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$hold_ary[$row['group_id']][$row['forum_id']][$row['auth_option']] = $row['auth_setting'];
}
$db->sql_freeresult($result);
}
return $hold_ary;
}
/**
* Get raw acl data based on user for caching user_permissions
* This function returns the same data as acl_raw_data(), but without the user id as the first key within the array.
*/
function acl_raw_data_single_user($user_id)
{
global $db, $cache;
// Check if the role-cache is there
if (($this->role_cache = $cache->get('_role_cache')) === false)
{
$this->role_cache = array();
// We pre-fetch roles
$sql = 'SELECT *
FROM ' . ACL_ROLES_DATA_TABLE . '
ORDER BY role_id ASC';
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$this->role_cache[$row['role_id']][$row['auth_option_id']] = (int) $row['auth_setting'];
}
$db->sql_freeresult($result);
foreach ($this->role_cache as $role_id => $role_options)
{
$this->role_cache[$role_id] = serialize($role_options);
}
$cache->put('_role_cache', $this->role_cache);
}
$hold_ary = array();
// Grab user-specific permission settings
$sql = 'SELECT forum_id, auth_option_id, auth_role_id, auth_setting
FROM ' . ACL_USERS_TABLE . '
WHERE user_id = ' . $user_id;
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
// If a role is assigned, assign all options included within this role. Else, only set this one option.
if ($row['auth_role_id'])
{
$hold_ary[$row['forum_id']] = (empty($hold_ary[$row['forum_id']])) ? unserialize($this->role_cache[$row['auth_role_id']]) : $hold_ary[$row['forum_id']] + unserialize($this->role_cache[$row['auth_role_id']]);
}
else
{
$hold_ary[$row['forum_id']][$row['auth_option_id']] = $row['auth_setting'];
}
}
$db->sql_freeresult($result);
// Now grab group-specific permission settings
$sql = 'SELECT a.forum_id, a.auth_option_id, a.auth_role_id, a.auth_setting
FROM ' . ACL_GROUPS_TABLE . ' a, ' . USER_GROUP_TABLE . ' ug, ' . GROUPS_TABLE . ' g
WHERE a.group_id = ug.group_id
AND g.group_id = ug.group_id
AND ug.user_pending = 0
AND NOT (ug.group_leader = 1 AND g.group_skip_auth = 1)
AND ug.user_id = ' . $user_id;
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
if (!$row['auth_role_id'])
{
$this->_set_group_hold_ary($hold_ary[$row['forum_id']], $row['auth_option_id'], $row['auth_setting']);
}
else if (!empty($this->role_cache[$row['auth_role_id']]))
{
foreach (unserialize($this->role_cache[$row['auth_role_id']]) as $option_id => $setting)
{
$this->_set_group_hold_ary($hold_ary[$row['forum_id']], $option_id, $setting);
}
}
}
$db->sql_freeresult($result);
return $hold_ary;
}
/**
* Private function snippet for setting a specific piece of the hold_ary
*/
function _set_group_hold_ary(&$hold_ary, $option_id, $setting)
{
if (!isset($hold_ary[$option_id]) || (isset($hold_ary[$option_id]) && $hold_ary[$option_id] != ACL_NEVER))
{
$hold_ary[$option_id] = $setting;
// If we detect ACL_NEVER, we will unset the flag option (within building the bitstring it is correctly set again)
if ($setting == ACL_NEVER)
{
$flag = substr($this->acl_options['option'][$option_id], 0, strpos($this->acl_options['option'][$option_id], '_') + 1);
$flag = (int) $this->acl_options['id'][$flag];
if (isset($hold_ary[$flag]) && $hold_ary[$flag] == ACL_YES)
{
unset($hold_ary[$flag]);
/* This is uncommented, because i suspect this being slightly wrong due to mixed permission classes being possible
if (in_array(ACL_YES, $hold_ary))
{
$hold_ary[$flag] = ACL_YES;
}*/
}
}
}
}
/**
* Authentication plug-ins is largely down to Sergey Kanareykin, our thanks to him.
*/
function login($username, $password, $autologin = false, $viewonline = 1, $admin = 0)
{
global $db, $user, $phpbb_root_path, $phpEx, $phpbb_container;
global $phpbb_dispatcher;
/* @var $provider_collection \phpbb\auth\provider_collection */
$provider_collection = $phpbb_container->get('auth.provider_collection');
$provider = $provider_collection->get_provider();
if ($provider)
{
$login = $provider->login($username, $password);
// If the auth module wants us to create an empty profile do so and then treat the status as LOGIN_SUCCESS
if ($login['status'] == LOGIN_SUCCESS_CREATE_PROFILE)
{
// we are going to use the user_add function so include functions_user.php if it wasn't defined yet
if (!function_exists('user_add'))
{
include($phpbb_root_path . 'includes/functions_user.' . $phpEx);
}
user_add($login['user_row'], (isset($login['cp_data'])) ? $login['cp_data'] : false);
$sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type
FROM ' . USERS_TABLE . "
WHERE username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if (!$row)
{
return array(
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
'error_msg' => 'AUTH_NO_PROFILE_CREATED',
'user_row' => array('user_id' => ANONYMOUS),
);
}
$login = array(
'status' => LOGIN_SUCCESS,
'error_msg' => false,
'user_row' => $row,
);
}
// If the auth provider wants us to link an empty account do so and redirect
if ($login['status'] == LOGIN_SUCCESS_LINK_PROFILE)
{
// If this status exists a fourth field is in the $login array called 'redirect_data'
// This data is passed along as GET data to the next page allow the account to be linked
$params = array('mode' => 'login_link');
$url = append_sid($phpbb_root_path . 'ucp.' . $phpEx, array_merge($params, $login['redirect_data']));
redirect($url);
}
/**
* Event is triggered after checking for valid username and password, and before the actual session creation.
*
* @event core.auth_login_session_create_before
* @var array login Variable containing login array
* @var bool admin Boolean variable whether user is logging into the ACP
* @var string username Username of user to log in
* @var bool autologin Boolean variable signaling whether login is triggered via auto login
* @since 3.1.7-RC1
*/
$vars = array(
'login',
'admin',
'username',
'autologin',
);
extract($phpbb_dispatcher->trigger_event('core.auth_login_session_create_before', compact($vars)));
// If login succeeded, we will log the user in... else we pass the login array through...
if ($login['status'] == LOGIN_SUCCESS)
{
$old_session_id = $user->session_id;
if ($admin)
{
global $SID, $_SID;
$cookie_expire = time() - 31536000;
$user->set_cookie('u', '', $cookie_expire);
$user->set_cookie('sid', '', $cookie_expire);
unset($cookie_expire);
$SID = '?sid=';
$user->session_id = $_SID = '';
}
$result = $user->session_create($login['user_row']['user_id'], $admin, $autologin, $viewonline);
// Successful session creation
if ($result === true)
{
// If admin re-authentication we remove the old session entry because a new one has been created...
if ($admin)
{
// the login array is used because the user ids do not differ for re-authentication
$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
WHERE session_id = '" . $db->sql_escape($old_session_id) . "'
AND session_user_id = {$login['user_row']['user_id']}";
$db->sql_query($sql);
}
return array(
'status' => LOGIN_SUCCESS,
'error_msg' => false,
'user_row' => $login['user_row'],
);
}
return array(
'status' => LOGIN_BREAK,
'error_msg' => $result,
'user_row' => $login['user_row'],
);
}
return $login;
}
trigger_error('Authentication method not found', E_USER_ERROR);
}
/**
* Fill auth_option statement for later querying based on the supplied options
*/
function build_auth_option_statement($key, $auth_options, &$sql_opts)
{
global $db;
if (!is_array($auth_options))
{
if (strpos($auth_options, '%') !== false)
{
$sql_opts = "AND $key " . $db->sql_like_expression(str_replace('%', $db->get_any_char(), $auth_options));
}
else
{
$sql_opts = "AND $key = '" . $db->sql_escape($auth_options) . "'";
}
}
else
{
$is_like_expression = false;
foreach ($auth_options as $option)
{
if (strpos($option, '%') !== false)
{
$is_like_expression = true;
}
}
if (!$is_like_expression)
{
$sql_opts = 'AND ' . $db->sql_in_set($key, $auth_options);
}
else
{
$sql = array();
foreach ($auth_options as $option)
{
if (strpos($option, '%') !== false)
{
$sql[] = $key . ' ' . $db->sql_like_expression(str_replace('%', $db->get_any_char(), $option));
}
else
{
$sql[] = $key . " = '" . $db->sql_escape($option) . "'";
}
}
$sql_opts = 'AND (' . implode(' OR ', $sql) . ')';
}
}
}
}