Restrict users on collection with provided rights

@param ACL   $ACL
@param array $rights

@return $this
352524
public function on_bases_where_i_am(ACL $ACL, Array $rights)
    {
        $this->bases_restrictions = true;
        $collections = array_keys($ACL->get_granted_base($rights));

        if (count($this->base_ids) > 0) {
            $this->base_ids = array_intersect($this->base_ids, $collections);
        } else {
            $this->base_ids = $collections;
        }

        $this->total = $this->page = $this->total_page = null;

        return $this;
    }
1143747
protected function getAclSddlFlags(Acl $acl)
    {
        $flags = '';

        foreach ($this->aclFlagMap as $flag => $name) {
            $name = $acl->getSddlIdentifier().$name;
            if ($this->controlFlags->has(ControlFlags::FLAG[$name])) {
                $flags .= $flag;
            }
        }

        return $flags;
    }
1164588
public static function setupAcl()
    {
        $acl = new \Mmi\Security\Acl;
        $aclData = (new CmsAclQuery)
            ->join('cms_role')->on('cms_role_id')
            ->find();
        foreach ($aclData as $aclRule) { /* @var $aclData \Cms\Orm\CmsAclRecord */
            $resource = '';
            if ($aclRule->module) {
                $resource .= $aclRule->module . ':';
            }
            if ($aclRule->controller) {
                $resource .= $aclRule->controller . ':';
            }
            if ($aclRule->action) {
                $resource .= $aclRule->action . ':';
            }
            $access = $aclRule->access;
            if ($access == 'allow' || $access == 'deny') {
                $acl->$access($aclRule->getJoined('cms_role')->name, trim($resource, ':'));
            }
        }
        return $acl;
    }
1028013
function acl_compare($acl1, $acl2)
    {
        if (!is_array($acl1)) $acl1 = str_split($acl1);
        if (!is_array($acl2)) $acl2 = str_split($acl2);

        $rights = $this->rights_supported();

        $acl1 = array_intersect($acl1, $rights);
        $acl2 = array_intersect($acl2, $rights);
        $res  = array_intersect($acl1, $acl2);

        $cnt1 = count($res);
        $cnt2 = count($acl2);

        if ($cnt1 == $cnt2)
            return 2;
        else if ($cnt1)
            return 1;
        else
            return 0;
    }
656990
protected function HLSetRights($hlId, array $rights)
    {
        $res = HighloadBlockRightsTable::getList([
            'filter' => ['HL_ID' => $hlId],
        ]);
        while ($right = $res->fetch()) {
            HighloadBlockRightsTable::delete($right['ID']);
        }

        $groups = [];
        $res = GroupTable::getList();
        while ($group = $res->fetch()) {
            $groups[$group['STRING_ID']] = $group;
        }

        $tasks = [];
        $res = TaskTable::getList(['filter' => ['=MODULE_ID' => 'highloadblock']]);
        while ($task = $res->fetch()) {
            $tasks[$task['LETTER']] = $task;
        }

        foreach ($rights as $groupCode => $taskLetter) {
            if (!isset($groups[$groupCode])) {
                throw new Exception("Can't find group {$groupCode}");
            }
            if (!isset($tasks[$taskLetter])) {
                throw new Exception("Can't find task {$taskLetter}");
            }
            $res = HighloadBlockRightsTable::add([
                'HL_ID' => $hlId,
                'ACCESS_CODE' => "G{$groups[$groupCode]['ID']}",
                'TASK_ID' => $tasks[$taskLetter]['ID'],
            ]);
            if (!$res->isSuccess()) {
                throw new Exception("Can't creare {$groupCode} {$taskLetter} right for highload block: " . implode(', ', $res->getErrorMessages()));
            }
        }
    }
886245
def insert_default_acl
      self.class.default_acl.each do |acl|
        unless rights[acl[:acl]]
          Puppet.info _("Inserting default '%{acl}' (auth %{auth}) ACL") % { acl: acl[:acl], auth: acl[:authenticated] }
          mk_acl(acl)
        end
      end
      # queue an empty (ie deny all) right for every other path
      # actually this is not strictly necessary as the rights system
      # denies not explicitly allowed paths
      unless rights["/"]
        rights.newright("/").restrict_authenticated(:any)
      end
    end
784584
def set_collections_acl(self):
        
        acl = [(Allow, 'g:admin', ALL_PERMISSIONS)]
        collections = self.get_collections()
        resources = self.get_resources(collections)
        aces = self._get_least_permissions_aces(resources)
        if aces is not None:
            for ace in aces:
                acl.append(ace)
        acl.append(DENY_ALL)
        self.__acl__ = tuple(acl)
318705
public function setPermissionsAttribute(array $permissions = [])
    {
        foreach ($permissions as $key => $value) {
            $permissions[$key] = (bool) $value;
        }
        $this->attributes['permissions'] = json_encode($permissions ?? []);
    }
1102884
public function giveOwnRights($user) {
        $aclProvider = $this->container->get('security.acl.provider');
        $maskBuilder = new MaskBuilder();

        $usid = UserSecurityIdentity::fromAccount($user);
        $uoid = ObjectIdentity::fromDomainObject($user);
        foreach($this->container->getParameter("fom_user.user_own_permissions") as $permission) {
            $maskBuilder->add($permission);
        }
        $umask = $maskBuilder->get();

        try {
            $acl = $aclProvider->findAcl($uoid);
        } catch(\Exception $e) {
            $acl = $aclProvider->createAcl($uoid);
        }
        $acl->insertObjectAce($usid, $umask);
        $aclProvider->updateAcl($acl);
    }
190492
private function generateRolesAndPermissions()
    {
        if( empty($this->aclData) ) {
            $this->error('empty roles and permissions in "generateRolesAndPermissions" method');

            return;
        }

        foreach ( $this->aclData as $acl ) {
            $this->createPermissions($acl['acl']);
            $this->createRoles($acl['acl']);
        }

        $this->createRolesPermissions($this->aclData);
    }
284036
public function set_acl($folder, $user, $acl)
    {
        if (!$this->get_capability('ACL')) {
            return false;
        }

        if (!$this->check_connection()) {
            return false;
        }

        $this->clear_cache('mailboxes.folder-info.' . $folder);

        return $this->conn->setACL($folder, $user, $acl);
    }
666208
public function setPermissionsAttribute($permissions)
    {
        $module = lcfirst($this->attributes['name']);

        $roles = array();

        //prefix the permission with the module name ex: user.create
        foreach ($permissions as $key => $value)
        {
            $roles[] = $module . '.' . $value;
        }

        $this->attributes['permissions'] = ( ! empty($roles)) ? json_encode($roles) : '';
    }
489694
public function setSacl(Sacl $sacl = null)
    {
        $this->sacl = $sacl;

        return $this->toggleAclPresent((bool) $sacl, Sacl::SDDL_CHAR);
    }
1303056
private function list_rights($attrib=array())
    {
        // Get ACL for the folder
        $acl = $this->rc->storage->get_acl($this->mbox);

        if (!is_array($acl)) {
            $acl = array();
        }

        // Keep special entries (anyone/anonymous) on top of the list
        if (!empty($this->specials) && !empty($acl)) {
            foreach ($this->specials as $key) {
                if (isset($acl[$key])) {
                    $acl_special[$key] = $acl[$key];
                    unset($acl[$key]);
                }
            }
        }

        // Sort the list by username
        uksort($acl, 'strnatcasecmp');

        if (!empty($acl_special)) {
            $acl = array_merge($acl_special, $acl);
        }

        // Get supported rights and build column names
        $supported = $this->rights_supported();

        // give plugins the opportunity to adjust this list
        $data = $this->rc->plugins->exec_hook('acl_rights_supported',
            array('rights' => $supported, 'folder' => $this->mbox, 'labels' => array()));
        $supported = $data['rights'];

        // depending on server capability either use 'te' or 'd' for deleting msgs
        $deleteright = implode(array_intersect(str_split('ted'), $supported));

        // Use advanced or simple (grouped) rights
        $advanced = $this->rc->config->get('acl_advanced_mode');

        if ($advanced) {
            $items = array();
            foreach ($supported as $sup) {
                $items[$sup] = $sup;
            }
        }
        else {
            $items = array(
                'read' => 'lrs',
                'write' => 'wi',
                'delete' => $deleteright,
                'other' => preg_replace('/[lrswi'.$deleteright.']/', '', implode($supported)),
            );

            // give plugins the opportunity to adjust this list
            $data = $this->rc->plugins->exec_hook('acl_rights_simple',
                array('rights' => $items, 'folder' => $this->mbox, 'labels' => array()));
            $items = $data['rights'];
        }

        // Create the table
        $attrib['noheader'] = true;
        $table = new html_table($attrib);

        // Create table header
        $table->add_header('user', $this->gettext('identifier'));
        foreach (array_keys($items) as $key) {
            $label = $data['labels'][$key] ?: $this->gettext('shortacl'.$key);
            $table->add_header(array('class' => 'acl'.$key, 'title' => $label), $label);
        }

        $js_table = array();
        foreach ($acl as $user => $rights) {
            if ($this->rc->storage->conn->user == $user) {
                continue;
            }

            // filter out virtual rights (c or d) the server may return
            $userrights = array_intersect($rights, $supported);
            $userid = rcube_utils::html_identifier($user);

            if (!empty($this->specials) && in_array($user, $this->specials)) {
                $user = $this->gettext($user);
            }

            $table->add_row(array('id' => 'rcmrow'.$userid));
            $table->add('user', html::a(array('id' => 'rcmlinkrow'.$userid), rcube::Q($user)));

            foreach ($items as $key => $right) {
                $in = $this->acl_compare($userrights, $right);
                switch ($in) {
                    case 2: $class = 'enabled'; break;
                    case 1: $class = 'partial'; break;
                    default: $class = 'disabled'; break;
                }
                $table->add('acl' . $key . ' ' . $class, '');
            }

            $js_table[$userid] = implode($userrights);
        }

        $this->rc->output->set_env('acl', $js_table);
        $this->rc->output->set_env('acl_advanced', $advanced);

        $out = $table->show();

        return $out;
    }
215045
public function syncPermissions($permissions)
    {
        $mappedPermissions = [];

        foreach ($permissions as $permission) {
            $mappedPermissions[] = Helper::getIdFor($permission, 'permission');
        }

        $changes = $this->permissions()->sync($mappedPermissions);
        $this->flushCache();
        $this->fireLaratrustEvent("permission.synced", [$this, $changes]);

        return $this;
    }
157788
function acl2text($rights)
    {
        if (empty($rights)) {
            return '';
        }

        $supported = $this->rights_supported();
        $list      = array();
        $attrib    = array(
            'name' => 'rcmyrights',
            'style' => 'margin:0; padding:0 15px;',
        );

        foreach ($supported as $right) {
            if (in_array($right, $rights)) {
                $list[] = html::tag('li', null, rcube::Q($this->gettext('acl' . $right)));
            }
        }

        if (count($list) == count($supported))
            return rcube::Q($this->gettext('aclfull'));

        return html::tag('ul', $attrib, implode("\n", $list));
    }
453228
public function setRights($rights)
    {
        $this->_rights = $rights;
        Session::get()->updateListItem(App::get()->shortName . $this->sessionKey, 'rights', $this->_rights, array('vars' => array(), 'rights' => array()));
        return $this;
    }