private function hasSufficientPermissions(AclInterface $acl, array $aces, array $masks, array $sids, $administrativeMode)
    {
        $firstRejectedAce = null;

        foreach ($masks as $requiredMask) {
            foreach ($sids as $sid) {
                foreach ($aces as $ace) {
                    if ($sid->equals($ace->getSecurityIdentity()) && $this->isAceApplicable($requiredMask, $ace)) {
                        if ($ace->isGranting()) {
                            if (!$administrativeMode && null !== $this->auditLogger) {
                                $this->auditLogger->logIfNeeded(true, $ace);
                            }

                            return true;
                        }

                        if (null === $firstRejectedAce) {
                            $firstRejectedAce = $ace;
                        }

                        break 2;
                    }
                }
            }
        }

        if (null !== $firstRejectedAce) {
            if (!$administrativeMode && null !== $this->auditLogger) {
                $this->auditLogger->logIfNeeded(false, $firstRejectedAce);
            }

            return false;
        }

        throw new NoAceFoundException();
    }
private function hasSufficientPermissions(AclInterface $acl, array $aces, array $masks, array $sids, $administrativeMode)
    {
        $firstRejectedAce = null;

        foreach ($masks as $requiredMask) {
            foreach ($sids as $sid) {
                foreach ($aces as $ace) {
                    if ($sid->equals($ace->getSecurityIdentity()) && $this->isAceApplicable($requiredMask, $ace)) {
                        if ($ace->isGranting()) {
                            if (!$administrativeMode && null !== $this->auditLogger) {
                                $this->auditLogger->logIfNeeded(true, $ace);
                            }

                            return true;
                        }

                        if (null === $firstRejectedAce) {
                            $firstRejectedAce = $ace;
                        }

                        break 2;
                    }
                }
            }
        }

        if (null !== $firstRejectedAce) {
            if (!$administrativeMode && null !== $this->auditLogger) {
                $this->auditLogger->logIfNeeded(false, $firstRejectedAce);
            }

            return false;
        }

        throw new NoAceFoundException();
    }
private function hasSufficientPermissions ( AclInterface $ acl , array $ aces , array $ masks , array $ sids , $ administrativeMode ) { $ firstRejectedAce = null ; foreach ( $ masks as $ requiredMask ) { foreach ( $ sids as $ sid ) { foreach ( $ aces as $ ace ) { if ( $ sid -> equals ( $ ace -> getSecurityIdentity ( ) ) && $ this -> isAceApplicable ( $ requiredMask , $ ace ) ) { if ( $ ace -> isGranting ( ) ) { if ( ! $ administrativeMode && null !== $ this -> auditLogger ) { $ this -> auditLogger -> logIfNeeded ( true , $ ace ) ; } return true ; } if ( null === $ firstRejectedAce ) { $ firstRejectedAce = $ ace ; } break 2 ; } } } } if ( null !== $ firstRejectedAce ) { if ( ! $ administrativeMode && null !== $ this -> auditLogger ) { $ this -> auditLogger -> logIfNeeded ( false , $ firstRejectedAce ) ; } return false ; } throw new NoAceFoundException ( ) ; }
Makes an authorization decision.

The order of ACEs, and SIDs is significant; the order of permission masks
not so much. It is important to note that the more specific security
identities should be at the beginning of the SIDs array in order for this
strategy to produce intuitive authorization decisions.

First, we will iterate over permissions, then over security identities.
For each combination of permission, and identity we will test the
available ACEs until we find one which is applicable.

The first applicable ACE will make the ultimate decision for the
permission/identity combination. If it is granting, this method will return
true, if it is denying, the method will continue to check the next
permission/identity combination.

This process is repeated until either a granting ACE is found, or no
permission/identity combinations are left. Finally, we will either throw
an NoAceFoundException, or deny access.

@param AclInterface                $acl
@param EntryInterface[]            $aces               An array of ACE to check against
@param array                       $masks              An array of permission masks
@param SecurityIdentityInterface[] $sids               An array of SecurityIdentityInterface implementations
@param bool                        $administrativeMode True turns off audit logging

@return bool true, or false; either granting, or denying access respectively.

@throws NoAceFoundException
Makes an authorization decision .