The number of users who will still have the permission if the user {@code excludedUserId}
is deleted. The anyone virtual group is not taken into account.
763880
public int countUsersWithGlobalPermissionExcludingUser(DbSession dbSession, String organizationUuid,
    String permission, int excludedUserId) {
    return mapper(dbSession).countUsersWithGlobalPermissionExcludingUser(organizationUuid, permission, excludedUserId);
  }
910758
private void ensureLastAdminIsNotRemoved(DbSession dbSession, GroupDto group, UserDto user) {
    int remainingAdmins = dbClient.authorizationDao().countUsersWithGlobalPermissionExcludingGroupMember(dbSession,
      group.getOrganizationUuid(), OrganizationPermission.ADMINISTER.getKey(), group.getId(), user.getId());
    checkRequest(remainingAdmins > 0, "The last administrator user cannot be removed");
  }
556477
public void selectAllPermissionsByGroupId(DbSession dbSession, String organizationUuid, Integer groupId, ResultHandler resultHandler) {
    mapper(dbSession).selectAllPermissionsByGroupId(organizationUuid, groupId, resultHandler);
  }
923679
public boolean associateUserWithGroup(String user, String group)
	{
		if (!isUserExist(user))
		{
			throw new SystemException(String.format("User '%s' does not exist.", user));
		}

		if (!isGroupExist(group))
		{
			throw new SystemException(String.format("Group '%s' does not exist.", group));
		}

		List<String> userGroups = allAssociations.get(user);

		if (userGroups == null)
		{
			userGroups = new ArrayList<String>();
		}
		else if (userGroups.contains(group))
		{
			return false;
		}

		userGroups.add(group);

		allAssociations.put(user, userGroups);

		return true;
	}
826085
public boolean isSecuredByPermission(final String permission,
            UserIdentityContext userIdentityContext) {
        try {
            checkPermission(permission,userIdentityContext);
            return true;
        } catch (AuthorizationException e) {
            return false;
        }
    }
1234735
@Override
	public synchronized boolean checkPermission(Principal principal, Permission permission)
	{

		if (principal == null)
			return false;

		if (permission == null)
			return false;

		Set<AccessControl> set = this.entries.get(principal);

		if (set != null && !set.isEmpty())
		{
			for (AccessControl accessControl: set)
			{
				if (accessControl.checkPermission(permission))
					return true;
			}
		}

		// did not find for user, not check for groups
		if (SecurityUser.class.isAssignableFrom(principal.getClass()))
		{
			return checkPermission(((SecurityUser) principal).getGroups(), permission);
		}
		return false;
	}
458125
protected boolean onlyVisibleForOU(CmsUUID userId) {

        try {
            if (m_app.isOUManagable(m_cms.readUser(userId).getOuFqn())) {
                return true;
            }
        } catch (CmsException e) {
            //
        }
        return false;
    }
1081291
private void checkSuperUser() throws AccessControlException {
    // collects user and groups
    String user = AuthenticatedClientUser.getClientUser(ServerConfiguration.global());
    List<String> groups = getGroups(user);
    if (!isPrivilegedUser(user, groups)) {
      throw new AccessControlException(ExceptionMessage.PERMISSION_DENIED
          .getMessage(user + " is not a super user or in super group"));
    }
  }
1268273
public boolean checkPermission(Principal user, int operation) 
  {  
    if (tc.isEntryEnabled()) 
      SibTr.entry(tc, "checkPermission", new Object[]{user, new Integer(operation)});
    boolean allowed = false;
    
    if(operation == 1) // a publish operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToPublish.size() > 0
         && accumGroupAllowedToPublish.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next
        if(accumUsersAllowedToPublish.size() > 0 &&
            accumUsersAllowedToPublish.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToPublish.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToPublish.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {              
              Iterator itr = accumGroupAllowedToPublish.iterator();
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              } // eof while
            }
          }
        } 
      }
    }
    else // a subscribe operation
    {
      // check whether permission has been granted to special group Everyone. 
      // We can do this before we check whether the user is authenticated
      if(accumGroupAllowedToSubscribe.size() > 0
         && accumGroupAllowedToSubscribe.contains(everyone))
      {
        allowed = true;
      }
      // Now check whether the user is authenticated, ie we have a username
      else if (user.getName() != null 
               && user.getName().length() > 0)
      {
        // User is authenticated
                  
        // Check user list next        
        if(accumUsersAllowedToSubscribe.size() > 0 &&
           accumUsersAllowedToSubscribe.contains(user))
        {
          allowed = true;
        }
        else // Now check the groups
        {
          if(accumGroupAllowedToSubscribe.size() > 0)
          {
            // user hasn't been granted access directly, check the groups
            // check for AllAuthenticated first     
            if (accumGroupAllowedToSubscribe.contains(allAuthenticated))
            {
              allowed = true;
            }
            else
            {                       
              Iterator itr = accumGroupAllowedToSubscribe.iterator();
           
              while (itr.hasNext())
              {
                Group group = (Group)itr.next();
                if(group.isMember(user))
                {
                  allowed = true;
                  break;
                }
              }
            }
          } 
        } 
      }       
    }
    if (tc.isEntryEnabled()) SibTr.exit(tc, "checkPermission", new Boolean(allowed));
    return allowed;
  }
956495
private void checkOwner(LockedInodePath inodePath)
      throws AccessControlException, InvalidPathException {
    // collects inodes info on the path
    List<InodeView> inodeList = inodePath.getInodeViewList();

    // collects user and groups
    String user = AuthenticatedClientUser.getClientUser(ServerConfiguration.global());
    List<String> groups = getGroups(user);

    if (isPrivilegedUser(user, groups)) {
      return;
    }

    checkInodeList(user, groups, null, inodePath.getUri().getPath(), inodeList, true);
  }
574671
public boolean isAnyPermissionPermanentlyDenied() {
    boolean hasPermanentlyDeniedAnyPermission = false;

    for (PermissionDeniedResponse deniedResponse : deniedPermissionResponses) {
      if (deniedResponse.isPermanentlyDenied()) {
        hasPermanentlyDeniedAnyPermission = true;
        break;
      }
    }

    return hasPermanentlyDeniedAnyPermission;
  }
701016
public static Specification<JpaDistributionSet> isDeleted(final Boolean isDeleted) {
        return (targetRoot, query, cb) -> cb.equal(targetRoot.<Boolean> get(JpaDistributionSet_.deleted), isDeleted);

    }
487100
@Override
	public UpdateUser exclude(String... varnames) {
	    excludedVars.addAll(Arrays.asList(varnames));
	    return this;
	}
946200
public boolean hasUsersInOtherOus() {

        if (m_lazy) {
            // if we use database-side paging, we have to assume that there may be users from other OUs
            return true;
        }
        if (m_hasUsersInOtherOus == null) {
            // lazzy initialization
            m_hasUsersInOtherOus = Boolean.FALSE;
            try {
                Iterator<CmsUser> itUsers = getUsers(true).iterator();
                while (itUsers.hasNext()) {
                    CmsUser user = itUsers.next();
                    if (!user.getOuFqn().equals(getParamOufqn())) {
                        m_hasUsersInOtherOus = Boolean.TRUE;
                        break;
                    }
                }
            } catch (Exception e) {
                // ignore
            }
        }
        return m_hasUsersInOtherOus.booleanValue();
    }
492252
protected function canDeleteUser()
    {
        return isset($this->data_user['user_id'])
            && $this->access('user_delete')
            && $this->user->canDelete($this->data_user['user_id']);
    }
335863
public int deleteByIdCascade(String id, boolean userTable)
			throws SQLException {
		int count = 0;
		if (id != null) {
			Contents contents = queryForId(id);
			if (contents != null) {
				count = deleteCascade(contents, userTable);
			} else if (userTable) {
				dropTable(id);
			}
		}
		return count;
	}
227991
public function inAllowedGroup()
    {
        if ($this->isCurrentUser() || (! $this->isStaff())) {
            // Always allow editing of non-staff user
            // for the time being
            return true;
        }

        $group  = $this->getGroupId();
        $groups = $this->util->getDbLookup()->getActiveStaffGroups();
        if (! isset($groups[$group])) {
            // Allow editing when the group does not exist or is no longer active.
            return true;
        }

        $allowedGroups = $this->userLoader->getCurrentUser()->getAllowedStaffGroups();
        if ($allowedGroups) {
            return (boolean) isset($allowedGroups[$group]);
        } else {
            return false;
        }
    }