private function getAllowedStoragePaths(&$manifest, $serviceName, $serviceId, $fullTree)
    {
        if (Session::isSysAdmin()) {
            // Get all paths bypassing RBAC
            $manifest['service'][$serviceName] = $this->getAllResources(
                $serviceName, '', ['as_list' => true, 'full_tree' => $fullTree], null, false
            );
        } else {
            $roleId = Session::getRoleId();
            $requestorMask = Session::getRequestor();
            $manifest['service'][$serviceName] = [];

            $accesses = RoleServiceAccess::whereRoleId($roleId)
                ->whereServiceId($serviceId)
                ->whereRequestorMask($requestorMask)
                ->get(['component', 'verb_mask']);

            foreach ($accesses as $access) {
                if ($access->verb_mask & VerbsMask::toNumeric(Verbs::GET)) {
                    $allowedPath = $access->component;
                    if ($allowedPath === '*') {
                        $manifest['service'][$serviceName] = $this->getAllResources(
                            $serviceName, '', ['as_list' => true, 'full_tree' => $fullTree]
                        );
                        // Safe to break out from the loop here.
                        // Access === '*' mean everything is allowed anyway.
                        // No need to check further accesses.
                        break;
                    } else {
                        // Only consider paths ending with * like my/path/*
                        // A path without * at the end (my/path/) only allows
                        // for directory listing which is not useful for exports.
                        if (substr($allowedPath, strlen($allowedPath) - 1) === '*') {
                            if ($fullTree) {
                                $allPaths = $this->getAllResources(
                                    $serviceName,
                                    substr($allowedPath, 0, strlen($allowedPath) - 1),
                                    ['as_list' => true, 'full_tree' => $fullTree]
                                );
                                $manifest['service'][$serviceName] = array_merge(
                                    $manifest['service'][$serviceName],
                                    $allPaths
                                );
                            } else {
                                $manifest['service'][$serviceName][] =
                                    substr($allowedPath, 0, strlen($allowedPath) - 1);
                            }
                        }
                    }
                }
            }
        }
    }
private function getAllowedStoragePaths(&$manifest, $serviceName, $serviceId, $fullTree)
    {
        if (Session::isSysAdmin()) {
            // Get all paths bypassing RBAC
            $manifest['service'][$serviceName] = $this->getAllResources(
                $serviceName, '', ['as_list' => true, 'full_tree' => $fullTree], null, false
            );
        } else {
            $roleId = Session::getRoleId();
            $requestorMask = Session::getRequestor();
            $manifest['service'][$serviceName] = [];

            $accesses = RoleServiceAccess::whereRoleId($roleId)
                ->whereServiceId($serviceId)
                ->whereRequestorMask($requestorMask)
                ->get(['component', 'verb_mask']);

            foreach ($accesses as $access) {
                if ($access->verb_mask & VerbsMask::toNumeric(Verbs::GET)) {
                    $allowedPath = $access->component;
                    if ($allowedPath === '*') {
                        $manifest['service'][$serviceName] = $this->getAllResources(
                            $serviceName, '', ['as_list' => true, 'full_tree' => $fullTree]
                        );
                        // Safe to break out from the loop here.
                        // Access === '*' mean everything is allowed anyway.
                        // No need to check further accesses.
                        break;
                    } else {
                        // Only consider paths ending with * like my/path/*
                        // A path without * at the end (my/path/) only allows
                        // for directory listing which is not useful for exports.
                        if (substr($allowedPath, strlen($allowedPath) - 1) === '*') {
                            if ($fullTree) {
                                $allPaths = $this->getAllResources(
                                    $serviceName,
                                    substr($allowedPath, 0, strlen($allowedPath) - 1),
                                    ['as_list' => true, 'full_tree' => $fullTree]
                                );
                                $manifest['service'][$serviceName] = array_merge(
                                    $manifest['service'][$serviceName],
                                    $allPaths
                                );
                            } else {
                                $manifest['service'][$serviceName][] =
                                    substr($allowedPath, 0, strlen($allowedPath) - 1);
                            }
                        }
                    }
                }
            }
        }
    }
private function getAllowedStoragePaths ( & $ manifest , $ serviceName , $ serviceId , $ fullTree ) { if ( Session :: isSysAdmin ( ) ) { // Get all paths bypassing RBAC $ manifest [ 'service' ] [ $ serviceName ] = $ this -> getAllResources ( $ serviceName , '' , [ 'as_list' => true , 'full_tree' => $ fullTree ] , null , false ) ; } else { $ roleId = Session :: getRoleId ( ) ; $ requestorMask = Session :: getRequestor ( ) ; $ manifest [ 'service' ] [ $ serviceName ] = [ ] ; $ accesses = RoleServiceAccess :: whereRoleId ( $ roleId ) -> whereServiceId ( $ serviceId ) -> whereRequestorMask ( $ requestorMask ) -> get ( [ 'component' , 'verb_mask' ] ) ; foreach ( $ accesses as $ access ) { if ( $ access -> verb_mask & VerbsMask :: toNumeric ( Verbs :: GET ) ) { $ allowedPath = $ access -> component ; if ( $ allowedPath === '*' ) { $ manifest [ 'service' ] [ $ serviceName ] = $ this -> getAllResources ( $ serviceName , '' , [ 'as_list' => true , 'full_tree' => $ fullTree ] ) ; // Safe to break out from the loop here. // Access === '*' mean everything is allowed anyway. // No need to check further accesses. break ; } else { // Only consider paths ending with * like my/path/* // A path without * at the end (my/path/) only allows // for directory listing which is not useful for exports. if ( substr ( $ allowedPath , strlen ( $ allowedPath ) - 1 ) === '*' ) { if ( $ fullTree ) { $ allPaths = $ this -> getAllResources ( $ serviceName , substr ( $ allowedPath , 0 , strlen ( $ allowedPath ) - 1 ) , [ 'as_list' => true , 'full_tree' => $ fullTree ] ) ; $ manifest [ 'service' ] [ $ serviceName ] = array_merge ( $ manifest [ 'service' ] [ $ serviceName ] , $ allPaths ) ; } else { $ manifest [ 'service' ] [ $ serviceName ] [ ] = substr ( $ allowedPath , 0 , strlen ( $ allowedPath ) - 1 ) ; } } } } } } }
Gets all allowed storage paths based on RBAC

@param array   $manifest
@param string  $serviceName
@param integer $serviceId
@param bool    $fullTree
Gets all allowed storage paths based on RBAC