--- docman.php	2002/07/28 13:57:13	1.16
+++ docman.php	2002/07/28 16:24:54	1.18
@@ -20,7 +20,7 @@
 //////////////////////////////////////////////////////////////////
 // CONFIGURATION OPTIONS
 
-// 	error_reporting(4) ;		// how verbose ?
+ 	error_reporting(E_ALL) ;		// how verbose ?
 
 	// from where to include auth_*.php modules?
 	$gblIncDir = "/data/docman2";
@@ -84,7 +84,7 @@
 	LoadLanguage($HTTP_SERVER_VARS["HTTP_ACCEPT_LANGUAGE"]);
 
 	// for security and configuration
-	$realm=$HTTP_SERVER_VARS[HTTP_HOST];
+	$realm=$HTTP_SERVER_VARS["HTTP_HOST"];
 
 	$fsDocumentRoot = dirname($HTTP_SERVER_VARS[SCRIPT_FILENAME]);
 	if ($fsDocumentRoot == "") Error("Configuration error","Can't get SCRIPT_FILENAME from your web server. Please set <tt>\$fsDocumentRoot</tt> in <tt>\$</tt>",1);
@@ -138,7 +138,9 @@
 	} else {
 		$url .= md5($gblLogin.$gblPasswd);
 	}
-	if (isset($gblLogin) && $gblLogin != "" && ($gblPasswd == "" || !isset($gblPasswd))) {
+	if ( (  (isset($gblLogin) && $gblLogin != "") ||
+		(!isset($gblLogin) || $gblLogin == "")
+	     ) && ($gblPasswd == "" || !isset($gblPasswd))) {
 		$url_title="login";
 		$url .= "&force_login=1";
 	} else {
@@ -582,9 +584,17 @@
 	
 	$self     = $HTTP_SERVER_VARS["PHP_SELF"] ;
 
-	$fsDir = $fsRoot.$relDir."/";	// current directory
+	$relDir = chopsl($relDir)."/";
+	$fsDir = $fsRoot.$relDir;	// current directory
 
-	if (!is_dir($fsDir)) Error("Dir not found",$relDir,1) ; 
+	if (!is_dir($fsDir)) Error("Dir not found","Directory <tt>$relDir<tt> not found on filesystem at <tt>$fsDir</tt>",1) ; 
+
+	global $debug;
+	$debug .= "[$gblLogin|$relDir] before >";
+
+	if (! check_perm($relDir,(trperm_b | trperm_r)))
+		Error("Access denied","User <tt>$gblLogin</tt> tried to access <tt>$relDir</tt> without valid trustee.",1);
+	$debug .= "< afeter";
 
 	$hide_items=",$gblHide,";
 
@@ -1377,7 +1387,8 @@
 
 // helper function
 function unroll_perm($u,$t,$user,$perm) {
-	// check user
+
+	// check user FIX
 	if ($t & trmask_not && ($u==$user)) continue;
 	if (!($t & trmask_not) && ($u!=$user)) continue;
 
@@ -1399,12 +1410,21 @@
 	global $trustees;
 	$perm[allow] = 0;
 	$perm[deny] = 0;
+
+global $debug;
+$debug .= "<br>check_trustee $path ... ";
+
 	$path_arr=explode("/",$path);
-	$path = "/";
+	$tmppath = "/";
 	while (count($path_arr)) {
-		if (substr($path,strlen($path)-1,1) != "/") $path.="/";
-		$path.=array_shift($path_arr);
-		$tr = $trustees[$path];
+		$tmppath.=array_shift($path_arr);
+$debug.= ">> $tmppath ";
+		if (substr($tmppath,strlen($tmppath)-1,1) != "/") $tmppath.="/";
+		$tr = $trustees[$tmppath];
+
+		# clear one level flag
+		$perm[allow] &= ~trperm_one_level;
+		$perm[deny] &= ~trperm_one_level;
 
 		if (isset($tr)) {
 			// first apply trustee for all
@@ -1413,26 +1433,25 @@
 				unset($tr['*']);
 			}
 			// then apply group policies
-			foreach ($tr as $u=>$t) {
-				if ($t & trmask_group && in_group($user,$u)) {
+			foreach ($tr as $g=>$t) {
+				if ($t & trmask_group && in_group($user,$g)) {
 					// resolv user
 					$t = $t & ~trmask_group;
-					$u = $user;
-					$perm = unroll_perm($u,$t,$user, $perm);
-					unset($tr[$u]);
+					$perm = unroll_perm($user,$t,$user, $perm);
+					unset($tr[$g]);
 				}
 			}
-			// then apply use policy
+			// then apply user policy
 			if (isset($tr[$user])) {
 				$perm = unroll_perm($user,$tr[$user],$user, $perm);
 				unset($tr[$user]);
 			}
-
 		}
+$debug.="d:".display_trustee($perm[deny])." a:".display_trustee($perm[allow])." ";
 
 	}
-#print "<br>user: $user path: $path perm: ";
-#print "d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).")<Br>\n";
+$debug.="<br>check_trustee: user: $user path: $path==$tmppath perm: ";
+$debug.="d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).")<Br>\n";
 	return $perm;
 }
 
@@ -1447,9 +1466,9 @@
 	$return = ! $HAVE_TRUSTEE;
 	if ($HAVE_TRUSTEE) {
 		$perm = check_trustee($gblLogin,$path);
-$debug.=" d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm: $trperm";
+$debug.=" d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm to have: $trperm (".display_trustee($trperm).")";
 		if ($perm[deny] & $trperm) $return=0;
-		elseif ($perm[allow] & $trperm) $return=1;
+		elseif (($perm[allow] & $trperm) == $trperm) $return=1;
 	}
 $debug.=" return: $return<br>\n";
 	return($return);
@@ -1545,6 +1564,10 @@
 		Error("Configuration error","Can't find user handling module at <tt>$gblIncDir/htusers/$gblUsers.php</tt> ! Please fix <tt>$realm_config</tt>");
 	}
 
+	// take additional login vars
+	$relogin = $HTTP_GET_VARS[relogin];
+	$force_login = $HTTP_GET_VARS[force_login];
+
 	// if no password, or empty password logout
 	if (
 		isset($gblLogin) && (
@@ -1569,15 +1592,12 @@
 	// get ACL informations
 	$HAVE_TRUSTEE = init_trustee();
 
-	// take additional login vars
-	$relogin = $HTTP_GET_VARS[relogin];
-	$force_login = $HTTP_GET_VARS[force_login];
-
-	if (strtolower($gblLogin) == "anonymous" || !isset($gblPasswd)) {
+	if (strtolower($gblLogin) == "anonymous" || !isset($gblLogin)) {
 		$perm = check_trustee("anonymous",$path);
 		// browsing must be explicitly allowed for root directory
 		// of repository for anonymous user to work!
 		if ($perm[allow] & trperm_b) {
+			$gblLogin = $gblPasswd = "anonymous";
 			$secHash = md5($gblLogin.$gblPasswd);
 			$gblUserName = "Anonymous user";
 		}
@@ -1630,6 +1650,8 @@
 	$fsDir = $gblFsRoot . $relDir ; // current directory
 	if ( !is_dir($fsDir) ) Error("Dir not found","Can't find <tt>$relDir</tt> which points to <tt>$fsDir</tt>",1) ;
 
+	if ($relDir == "") $relDir="/";
+
 	if (isset($HTTP_SERVER_VARS["HTTPS"]) && $HTTP_SERVER_VARS["HTTPS"] == "on") {
 		$webRoot  = "https://";
 	} else {