Add Horde_Auth_Application::requireAuth()

This reverts commit 5df37f9934afeee9f4741d41f92c06cfc4b39ca9.

diff --git a/framework/Auth/lib/Horde/Auth/Application.php b/framework/Auth/lib/Horde/Auth/Application.php
index bac41c5..00e56e2 100644 (file)
--- a/framework/Auth/lib/Horde/Auth/Application.php
+++ b/framework/Auth/lib/Horde/Auth/Application.php
@@ -331,4 +331,14 @@ class Horde_Auth_Application extends Horde_Auth_Base
         }
     }
 
+    /**
+     * Indicate whether the application requires authentication.
+     *
+     * @return boolean  True if application requires authentication.
+     */
+    public function requireAuth()
+    {
+        return $this->hasCapability('authenticate') || $this->hasCapability('transparent');
+    }
+
 }

diff --git a/framework/Core/lib/Horde/Registry.php b/framework/Core/lib/Horde/Registry.php
index 7bcdf63..992a1f8 100644 (file)
--- a/framework/Core/lib/Horde/Registry.php
+++ b/framework/Core/lib/Horde/Registry.php
@@ -977,17 +977,20 @@ class Horde_Registry
         /* Always do isAuthenticated() check first. You can be an admin, but
          * application auth != Horde admin auth. */
         if (!Horde_Auth::isAuthenticated(array('app' => $app))) {
-            /* Allow SHOW access for admins, for apps that do not have any
-             * explicit permissions, or for apps that allow SHOW. */
-            return Horde_Auth::isAdmin() ||
-                !$GLOBALS['perms']->exists($app) ||
-                $GLOBALS['perms']->hasPermission($app, Horde_Auth::getAuth(), $perms);
+            /* There can *never* be non-SHOW access to an application that
+             * requires authentication. */
+            $app_auth = Horde_Auth::singleton('application', array('app' => $app));
+            if ($app_auth->requireAuth() && ($perms != PERMS_SHOW)) {
+                return false;
+            }
         }
 
-        /* Admins always are authorized. */
-        return (!Horde_Auth::isAdmin() && $GLOBALS['perms']->exists($app))
-            ? $GLOBALS['perms']->hasPermission($app, Horde_Auth::getAuth(), $perms)
-            : true;
+        /* Otherwise, allow access for admins, for apps that do not have any
+         * have any explicit permissions, or for apps that allow the given
+         * permission. */
+        return Horde_Auth::isAdmin() ||
+            !$GLOBALS['perms']->exists($app) ||
+            $GLOBALS['perms']->hasPermission($app, Horde_Auth::getAuth(), $perms);
     }
 
     /**