Phraseanet/lib/classes/liste.class.php

<?php

class liste
{

    public static function filter($lst)
    {
        $appbox = appbox::get_instance(\bootstrap::getCore());
        $session = $appbox->get_session();

        if ( ! is_array($lst))
            explode(';', $lst);

        $okbrec = array();

        $user = User_Adapter::getInstance($session->get_usr_id(), $appbox);

        foreach ($lst as $basrec) {
            $basrec = explode("_", $basrec);
            if ( ! $basrec || count($basrec) != 2) {
                continue;
            }
            try {
                $record = new record_adapter($basrec[0], $basrec[1]);
            } catch (Exception $e) {
                continue;
            }

            if ($user->ACL()->has_hd_grant($record)) {
                $okbrec[] = implode('_', $basrec);
                ;
                continue;
            }
            if ($user->ACL()->has_preview_grant($record)) {
                $okbrec[] = implode('_', $basrec);
                ;
                continue;
            }

            if ( ! $user->ACL()->has_access_to_base($record->get_base_id()))
                continue;

            try {
                $connsbas = connection::getPDOConnection($basrec[0]);

                $sql = 'SELECT record_id FROM record WHERE ((status ^ ' . $user->ACL()->get_mask_xor($record->get_base_id()) . ')
                    & ' . $user->ACL()->get_mask_and($record->get_base_id()) . ')=0' .
                    ' AND record_id = :record_id';

                $stmt = $connsbas->prepare($sql);
                $stmt->execute(array(':record_id' => $basrec[1]));

                if ($stmt->rowCount() > 0)
                    $okbrec[] = implode('_', $basrec);

                $stmt->closeCursor();
            } catch (Exception $e) {

            }
        }

        return $okbrec;
    }
}