function execute( $xml )
    {
        include_once( 'kernel/classes/ezrole.php' );
        $assignmentList = $xml->getElementsByTagName( 'RoleAssignment' );
        foreach ( $assignmentList as $roleAssignment )
        {
            $roleID            = $this->getReferenceID( $roleAssignment->getAttribute( 'roleID' ) );
            $assignTo          = $this->getReferenceID( $roleAssignment->getAttribute( 'assignTo' ) );
            $sectionLimitation = $this->getReferenceID( $roleAssignment->getAttribute( 'sectionLimitation' ) );
            $subtreeLimitation = $this->getReferenceID( $roleAssignment->getAttribute( 'subtreeLimitation' ) );

            $role = eZRole::fetch( $roleID );
            if ( !$role )
            {
                $this->writeMessage( "\tRole $roleID does not exist.", 'warning' );
                continue;
            }

            $referenceID = $this->getReferenceID( $assignTo );
            if ( !$referenceID )
            {
                $this->writeMessage( "\tInvalid object $referenceID does not exist.", 'warning' );
                continue;
            }

            if ( $sectionLimitation )
            {
                $section = $this->getReferenceID( $sectionLimitation );
                if ( $section )
                {
                    $role->assignToUser( $referenceID, 'section', $section );
                    $this->writeMessage( "\tAssigned role $roleID: $referenceID to $section", 'notice' );
                }
                else
                {
                    $this->writeMessage( "\tInvalid section $sectionLimitation does not exist.", 'warning' );
                    continue;
                }
            }
            elseif ( $subtreeLimitation )
            {
                $subtree = $this->getReferenceID( $subtreeLimitation );
                if ( $subtree )
                {
                    $role->assignToUser( $referenceID, 'subtree', $subtree );
                    $this->writeMessage( "\tAssigned role $roleID: $referenceID to $subtree", 'notice' );
                }
                else
                {
                    $this->writeMessage( "\tInvalid section $subtreeLimitation does not exist.", 'warning' );
                    continue;
                }
            }
            else
            {
                $role->assignToUser( $referenceID );
                    $this->writeMessage( "\tAssigned role $roleID: $referenceID", 'notice' );
            }
        }
      }

 /**
  * We do our best to sort in a way that makes matching easy when ids are different
  * @return array
  *
  * @todo finish obj to array conversion ($users) to make it easier to have non-html output
  * @todo sorting of same-policies-w.-different-limitations in a role is far from perfect despite our efforts
  */
 public static function getRoles()
 {
     $roles = eZRole::fetchByOffset(0, false, true, true);
     // scrap original array, create a new one where policies are sorted. Can you follow the logic?
     foreach ($roles as $role) {
         $policies = array();
         $users = array();
         foreach ($role->attribute('policies') as $policy) {
             $limitations = array();
             foreach ($policy->attribute('limitations') as $limitation) {
                 $values = $limitation->attribute('values_as_array_with_names');
                 // We only use the "name" in each limitation.
                 // This might cause fake-positives when comparing, f.e. different node-limitations on different folders all having the same name
                 // But comparing what is inside the limitation is hard (eg node-ids, which we do not want to compare)
                 $valNames = array();
                 foreach ($values as $item) {
                     $valNames[] = $item["Name"];
                 }
                 $limName = $limitation->attribute('identifier') . '_' . md5(serialize($valNames));
                 $limitations[$limName] = array('identifier' => $limitation->attribute('identifier'), 'values_as_array_with_names' => $values);
             }
             ksort($limitations);
             $policy = array('module_name' => $policy->attribute('module_name'), 'function_name' => $policy->attribute('function_name'), 'limitations' => array_values($limitations));
             $policies[$policy['module_name'] . '_' . $policy['function_name'] . '_' . md5(serialize(array_keys($limitations)))] = $policy;
         }
         ksort($policies);
         foreach ($role->fetchUserByRole() as $user) {
             $users[$user['user_object']->attribute('name')] = $user;
         }
         ksort($users);
         $roles[$role->attribute('name')] = array('name' => $role->attribute('name'), 'policies' => $policies, 'user_array' => $users);
     }
     ksort($roles);
     return array_values($roles);
 }

 function execute($xml)
 {
     $roleList = $xml->getElementsByTagName('Role');
     $refArray = array();
     foreach ($roleList as $roleNode) {
         $roleName = $roleNode->getAttribute('name');
         $createRoleIfNotExists = $roleNode->getAttribute('createRole');
         $replacePolicies = $roleNode->getAttribute('replacePolicies');
         $referenceID = $roleNode->getAttribute('referenceID');
         $this->writeMessage("\tRole '{$roleName}' will be created.", 'notice');
         $rolePolicyList = $roleNode->getElementsByTagName('Policy');
         $policyList = array();
         foreach ($rolePolicyList as $policyNode) {
             $policyModule = $policyNode->getAttribute('module');
             $policyFunction = $policyNode->getAttribute('function');
             $policyLimitationList = array();
             $policyLimitationNodeList = $policyNode->getElementsByTagName('Limitations')->item(0);
             if ($policyLimitationNodeList) {
                 $limitations = $policyLimitationNodeList->childNodes;
                 foreach ($limitations as $limitation) {
                     if ($limitation->nodeType == XML_ELEMENT_NODE) {
                         if (!array_key_exists($limitation->nodeName, $policyLimitationList)) {
                             $policyLimitationList[$limitation->nodeName] = array();
                         }
                         $policyLimitationList[$limitation->nodeName][] = $this->getLimitationValue($limitation->nodeName, $limitation->textContent);
                     }
                 }
             }
             $policyList[] = array('module' => $policyModule, 'function' => $policyFunction, 'limitation' => $policyLimitationList);
         }
         $role = eZRole::fetchByName($roleName);
         if (is_object($role) || $createRoleIfNotExists == "true") {
             if (!is_object($role)) {
                 $role = eZRole::create($roleName);
                 $role->store();
             }
             $roleID = $role->attribute('id');
             if (count($policyList) > 0) {
                 if ($replacePolicies == "true") {
                     $role->removePolicies();
                     $role->store();
                 }
                 foreach ($policyList as $policyDefinition) {
                     if (isset($policyDefinition['limitation'])) {
                         $role->appendPolicy($policyDefinition['module'], $policyDefinition['function'], $policyDefinition['limitation']);
                     } else {
                         $role->appendPolicy($policyDefinition['module'], $policyDefinition['function']);
                     }
                 }
             }
             if ($referenceID) {
                 $refArray[$referenceID] = $role->attribute('id');
             }
         } else {
             $this->writeMessage("\tRole '{$roleName}' doesn't exist.", 'notice');
         }
     }
     $this->addReference($refArray);
 }

 /**
  * Unit test for eZRole::fetchIDListByUser()
  **/
 public function testFetchIDListByUser()
 {
     // fetch roles ID for anonymous group
     $roles = eZRole::fetchIDListByUser(array(self::$anonymousGroupID));
     $this->assertType('array', $roles, "The method should have returned an array");
     $this->assertEquals(1, count($roles), "The array should contain one item");
     $this->assertEquals(1, $roles[0], "The returned role ID should be 1 (anonymous role)");
 }

 /**
  * Test for eZRole::policyList()
  * Checks that policyList doesn't return temporary policies
  */
 public function testPolicyList()
 {
     $role = array_shift(eZRole::fetchByUser(array(self::$anonymousUserID), true));
     $policy = array_shift($role->policyList());
     // create a temporary copy of one of the role's policies
     $policy->createTemporaryCopy();
     // check that the role's policies all are final (not temporary)
     foreach ($role->policyList() as $policy) {
         $this->assertType('eZPolicy', $policy);
         $this->assertEquals(0, $policy->attribute('original_id'));
     }
 }

 public function __construct()
 {
     $this->eZDataType(self::DATA_TYPE_STRING, ezpI18n::tr('extension/nxc_captcha', 'NXC Captcha'), array('serialize_supported' => true, 'object_serialize_map' => array('data_text' => 'captcha_code', 'data_int' => 'checked')));
     if (count(self::$definition['type']['possible_values']) === 0) {
         self::$definition['type']['possible_values'] = array(self::TYPE_ALPHABETIC => ezpI18n::tr('extension/nxc_captcha', 'Alphabetic'), self::TYPE_NUMERIC => ezpI18n::tr('extension/nxc_captcha', 'Numeric'), self::TYPE_ALPHANUMERIC => ezpI18n::tr('extension/nxc_captcha', 'Alphanumeric'));
     }
     if (count(self::$definition['skip_role_ids']['possible_values']) === 0) {
         $roles = eZRole::fetchList();
         foreach ($roles as $role) {
             self::$definition['skip_role_ids']['possible_values'][$role->attribute('id')] = $role->attribute('name');
         }
     }
 }

}
// Redirect to content node browse in the user tree
// Assign the role for a user or group
if ($Module->isCurrentAction('AssignRole')) {
    $selectedObjectIDArray = eZContentBrowse::result('AssignRole');
    foreach ($selectedObjectIDArray as $objectID) {
        $role->assignToUser($objectID);
    }
    // Clear role caches.
    eZRole::expireCache();
    // Clear all content cache.
    eZContentCacheManager::clearAllContentCache();
}
if ($http->hasPostVariable('NewButton')) {
    $role = eZRole::createNew();
    return $Module->redirectToView('edit', array($role->attribute('id')));
}
$viewParameters = array('offset' => $offset);
$tpl = eZTemplate::factory();
$roles = eZRole::fetchByOffset($offset, $limit, $asObject = true, $ignoreTemp = true);
$roleCount = eZRole::roleCount();
$tempRoles = eZRole::fetchList($temporaryVersions = true);
$tpl->setVariable('roles', $roles);
$tpl->setVariable('role_count', $roleCount);
$tpl->setVariable('temp_roles', $tempRoles);
$tpl->setVariable('module', $Module);
$tpl->setVariable('view_parameters', $viewParameters);
$tpl->setVariable('limit', $limit);
$Result = array();
$Result['content'] = $tpl->fetch('design:role/list.tpl');
$Result['path'] = array(array('url' => false, 'text' => ezpI18n::tr('kernel/role', 'Role list')));

$Module = $Params['Module'];
$policyID = $Params['PolicyID'];

$policy = eZPolicy::fetchTemporaryCopy( $policyID );
$policyID = $policy->attribute( 'id' );
$originalPolicyID = $policy->attribute( 'original_id' );

if( $policy === null )
{
    return $Module->handleError( eZError::KERNEL_NOT_AVAILABLE, 'kernel' );
}

$currentModule = $policy->attribute( 'module_name' );
$currentFunction = $policy->attribute( 'function_name' );
$roleID = $policy->attribute( 'role_id' );
$role = eZRole::fetch( $roleID );
$roleName = $role->attribute( 'name' );
$limitationValueList = $policy->limitationList();
$nodeList = array();
$subtreeList = array();

if ( $currentModule == '*' )
{
    $functions = array();
}
else
{
    $mod = eZModule::exists( $currentModule );
    $functions = $mod->attribute( 'available_functions' );
}
$currentFunctionLimitations = array();

    $originalRoleID = $originalRole->attribute('id');
    // Who changes which role(s) should be logged.
    if ($http->hasSessionVariable('RoleWasChanged') and $http->sessionVariable('RoleWasChanged') === true) {
        eZAudit::writeAudit('role-change', array('Role ID' => $originalRoleID, 'Role name' => $originalRoleName, 'Comment' => 'Changed the current role: kernel/role/edit.php'));
        $http->removeSessionVariable('RoleWasChanged');
    }
    $originalRole->revertFromTemporaryVersion();
    eZContentCacheManager::clearAllContentCache();
    $Module->redirectTo($Module->functionURI('view') . '/' . $originalRoleID . '/');
    /* Clean up policy cache */
    eZUser::cleanupCache();
}
if ($http->hasPostVariable('Discard')) {
    $http->removeSessionVariable('RoleWasChanged');
    $role = eZRole::fetch($roleID);
    $originalRole = eZRole::fetch($role->attribute('version'));
    $role->removeThis();
    if ($originalRole != null && $originalRole->attribute('is_new') == 1) {
        $originalRole->remove();
    }
    $Module->redirectTo($Module->functionURI('list') . '/');
}
if ($http->hasPostVariable('ChangeRoleName')) {
    $role->setAttribute('name', $http->postVariable('NewName'));
    // Set flag for audit. If true audit will be processed
    $http->setSessionVariable('RoleWasChanged', true);
}
if ($http->hasPostVariable('AddModule')) {
    if ($http->hasPostVariable('Modules')) {
        $currentModule = $http->postVariable('Modules');
    } else {

 function role()
 {
     if ($this->ID) {
         return eZPersistentObject::fetchObject(eZRole::definition(), null, array('id' => $this->RoleID), true);
     }
     return false;
 }

 function move($newParentNodeID, $nodeID = 0)
 {
     if ($nodeID == 0) {
         $node = $this;
         $nodeID = $node->attribute('node_id');
     } else {
         $node = eZContentObjectTreeNode::fetch($nodeID);
     }
     $oldPath = $node->attribute('path_string');
     $oldParentNodeID = $node->attribute('parent_node_id');
     $newParentNodeID = (int) $newParentNodeID;
     if ($oldParentNodeID != $newParentNodeID) {
         $node->updateAndStoreModified();
         // Who moves which content should be logged.
         $object = $node->object();
         eZAudit::writeAudit('content-move', array('Node ID' => $node->attribute('node_id'), 'Old parent node ID' => $oldParentNodeID, 'New parent node ID' => $newParentNodeID, 'Object ID' => $object->attribute('id'), 'Content Name' => $object->attribute('name'), 'Comment' => 'Moved the node to the given node: eZContentObjectTreeNode::move()'));
         $newParentNode = eZContentObjectTreeNode::fetch($newParentNodeID);
         $newParentPath = $newParentNode->attribute('path_string');
         $newParentDepth = $newParentNode->attribute('depth');
         $newPath = $newParentPath . $nodeID;
         $oldDepth = $node->attribute('depth');
         $oldPathLength = strlen($oldPath);
         $moveQuery = "UPDATE\n                                 ezcontentobject_tree\n                          SET\n                                 parent_node_id = {$newParentNodeID}\n                          WHERE\n                                 node_id = {$nodeID}";
         $db = eZDB::instance();
         $subStringString = $db->subString('path_string', $oldPathLength);
         $newPathString = $db->concatString(array("'{$newPath}'", $subStringString));
         $moveQuery1 = "UPDATE\n                                 ezcontentobject_tree\n                           SET\n                                 path_identification_string = " . $db->concatString(array("'" . $db->escapeString($newParentNode->PathIdentificationString) . "'", $db->subString("path_identification_string", mb_strlen($node->PathIdentificationString) + 1))) . ",\n                                 path_string = {$newPathString},\n                                 depth = depth + {$newParentDepth} - {$oldDepth} + 1\n                           WHERE\n                                 path_string LIKE '{$oldPath}%'";
         $db->begin();
         $db->query($moveQuery);
         $db->query($moveQuery1);
         /// role system clean up
         // Clean up policies and limitations
         $expireRoleCache = false;
         $limitationsToFix = eZPolicyLimitation::findByType('SubTree', $node->attribute('path_string'), false);
         if (count($limitationsToFix) > 0) {
             $limitationIDString = $db->generateSQLINStatement($limitationsToFix, 'limitation_id');
             $subStringString = $db->subString('value', $oldPathLength);
             $newValue = $db->concatString(array("'{$newPath}'", $subStringString));
             $query = "UPDATE\n                                ezpolicy_limitation_value\n                          SET\n                                value = {$newValue}\n                          WHERE\n                                value LIKE '{$oldPath}%' AND {$limitationIDString}";
             $db->query($query);
             $expireRoleCache = true;
         }
         // clean up limitations on role assignment level
         $countRows = $db->arrayQuery("SELECT COUNT(*) AS row_count FROM ezuser_role WHERE limit_identifier='Subtree' AND limit_value LIKE '{$oldPath}%'");
         $assignmentsToFixCount = $countRows[0]['row_count'];
         if ($assignmentsToFixCount > 0) {
             $subStringString = $db->subString('limit_value', $oldPathLength);
             $newValue = $db->concatString(array("'{$newPath}'", $subStringString));
             $db->query("UPDATE\n                                ezuser_role\n                             SET\n                                limit_value = {$newValue}\n                             WHERE\n                                limit_identifier='Subtree' AND limit_value LIKE '{$oldPath}%'");
             $expireRoleCache = true;
         }
         if ($expireRoleCache) {
             eZRole::expireCache();
         }
         // Update "is_invisible" node attribute.
         $newNode = eZContentObjectTreeNode::fetch($nodeID);
         eZContentObjectTreeNode::updateNodeVisibility($newNode, $newParentNode);
         $db->commit();
     }
 }

 static function fetchByOffset($offset, $limit, $asObject = true, $ignoreTemp = false, $ignoreNew = true)
 {
     if ($ignoreTemp && $ignoreNew) {
         $igTemp = array('version' => '0', 'is_new' => '0');
     } elseif ($ignoreTemp) {
         $igTemp = array('version' => '0');
     } elseif ($ignoreNew) {
         $igTemp = array('is_new' => '0');
     } else {
         $igTemp = null;
     }
     return eZPersistentObject::fetchObjectList(eZRole::definition(), null, $igTemp, array('name' => 'ASC'), array('offset' => $offset, 'length' => $limit), $asObject);
 }

 function roleIDList()
 {
     // If the user object is not the currently logged in user we cannot use the session cache
     $useCache = $this->ContentObjectID == eZSession::get('eZUserLoggedInID', self::anonymousId());
     if ($useCache) {
         $userCache = $this->getUserCache();
         return $userCache['roles'];
     }
     $groups = $this->attribute('groups');
     $groups[] = $this->attribute('contentobject_id');
     return eZRole::fetchIDListByUser($groups);
 }

 function fetchRole($roleID)
 {
     $role = eZRole::fetch($roleID);
     return array('result' => $role);
 }

 function fetchUserRoles($sectionID)
 {
     $userRoles = eZRole::fetchRolesByLimitation('section', $sectionID);
     return array('result' => $userRoles);
 }

 function canBeRemoved($sectionID = false)
 {
     if ($sectionID === false) {
         $sectionID = $this->attribute('id');
     }
     $objects = eZPersistentObject::fetchObjectList(eZContentObject::definition(), null, array('section_id' => $sectionID));
     $limitations = eZPolicyLimitation::findByType('Section', $sectionID, true, false);
     $userRoles = eZRole::fetchRolesByLimitation('section', $sectionID);
     if (count($objects) > 0 or count($limitations) > 0 or count($userRoles) > 0) {
         return false;
     } else {
         return true;
     }
 }

    if ($dbUser !== false) {
        $params['user'] = $dbUser;
        $params['password'] = '';
    }
    if ($dbPassword !== false) {
        $params['password'] = $dbPassword;
    }
    if ($dbName !== false) {
        $params['database'] = $dbName;
    }
    $db = eZDB::instance($dbImpl, $params, true);
    eZDB::setInstance($db);
}
$db->setIsSQLOutputEnabled($showSQL);
if ($flatten['contentobject']) {
    $cli->output("Removing non-published content object versions");
    eZContentObjectVersion::removeVersions();
}
if ($flatten['contentclass']) {
    $cli->output("Removing temporary content classes");
    eZContentClass::removeTemporary();
}
if ($flatten['workflow']) {
    $cli->output("Removing temporary workflows");
    eZWorkflow::removeTemporary();
}
if ($flatten['role']) {
    $cli->output("Removing temporary roles");
    eZRole::removeTemporary();
}
$script->shutdown();

 /**
  * Fetches the count of created roles
  *
  * @static
  * @param boolean $ignoreNew Wether to ignore draft roles
  *
  * @return int
  */
 static function roleCount($ignoreNew = true)
 {
     $conds = array('version' => 0);
     if ($ignoreNew === true) {
         $conds['is_new'] = 0;
     }
     return eZPersistentObject::count(eZRole::definition(), $conds);
 }

//.........这里部分代码省略.........
     if (!$siteINIStored) {
         $siteINI = eZINI::create('site.ini');
         // Set ReadOnlySettingsCheck to false: towards
         // Ignore site.ini[eZINISettings].ReadonlySettingList[] settings when saving ini variables.
         $siteINI->setReadOnlySettingsCheck(false);
         $siteINI->setVariables($siteINIChanges);
         $siteINI->setVariable('DesignSettings', 'SiteDesign', $userDesignName);
         $siteINI->setVariable('DesignSettings', 'AdditionalSiteDesignList', array('base'));
         $siteINI->save(false, '.append.php', false, true, "settings/siteaccess/{$userSiteaccessName}", true);
     }
     if (!$designINIStored) {
         $designINI = eZINI::create('design.ini');
         // Set ReadOnlySettingsCheck to false: towards
         // Ignore site.ini[eZINISettings].ReadonlySettingList[] settings when saving ini variables.
         $designINI->setReadOnlySettingsCheck(false);
         if ($siteCSS) {
             $designINI->setVariable('StylesheetSettings', 'SiteCSS', $siteCSS);
         }
         if ($classesCSS) {
             $designINI->setVariable('StylesheetSettings', 'ClassesCSS', $classesCSS);
         }
         $designINI->save(false, '.append.php', false, true, "settings/siteaccess/{$userSiteaccessName}");
     }
     eZDir::mkdir("design/" . $userDesignName);
     eZDir::mkdir("design/" . $userDesignName . "/templates");
     eZDir::mkdir("design/" . $userDesignName . "/stylesheets");
     eZDir::mkdir("design/" . $userDesignName . "/images");
     eZDir::mkdir("design/" . $userDesignName . "/override");
     eZDir::mkdir("design/" . $userDesignName . "/override/templates");
     if ($siteType['existing_database'] == eZStepInstaller::DB_DATA_KEEP) {
         return true;
     }
     // Try and remove user/login without limitation from the anonymous user
     $anonRole = eZRole::fetchByName('Anonymous');
     if (is_object($anonRole)) {
         $anonPolicies = $anonRole->policyList();
         foreach ($anonPolicies as $anonPolicy) {
             if ($anonPolicy->attribute('module_name') == 'user' and $anonPolicy->attribute('function_name') == 'login') {
                 $anonPolicy->removeThis();
                 break;
             }
         }
     }
     // Setup all roles according to site chosen and addons
     if (function_exists('eZSiteRoles')) {
         $extraRoles = eZSiteRoles($parameters);
         foreach ($extraRoles as $extraRole) {
             if (!$extraRole) {
                 continue;
             }
             $extraRoleName = $extraRole['name'];
             $role = eZRole::fetchByName($extraRoleName);
             if (!is_object($role)) {
                 $role = eZRole::create($extraRoleName);
                 $role->store();
             }
             $roleID = $role->attribute('id');
             if (isset($extraRole['policies'])) {
                 $extraPolicies = $extraRole['policies'];
                 foreach ($extraPolicies as $extraPolicy) {
                     if (isset($extraPolicy['limitation'])) {
                         $role->appendPolicy($extraPolicy['module'], $extraPolicy['function'], $extraPolicy['limitation']);
                     } else {
                         $role->appendPolicy($extraPolicy['module'], $extraPolicy['function']);
                     }
                 }

 function roleIDList()
 {
     if (eZINI::instance()->variable('RoleSettings', 'EnableCaching') === 'true') {
         $userCache = $this->getUserCache();
         return $userCache['roles'];
     }
     $groups = $this->attribute('groups');
     $groups[] = $this->attribute('contentobject_id');
     return eZRole::fetchIDListByUser($groups);
 }