groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-12-30 23:09:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Implemented proper voters for attachments and parameters, so we can decide access for log details

Browse source
This commit is contained in:
Jan Böhmer 2023-05-27 19:17:27 +02:00
parent 427f6e4d55
commit 379f7ef865
2 changed files with 120 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

88
src/Security/Voter/ParameterVoter.php
View file

@ -53,66 +53,72 @@ class ParameterVoter extends ExtendedVoter
{
//return $this->resolver->inherit($user, 'attachments', $attribute) ?? false;
if (!$subject instanceof AbstractParameter) {
if (!is_a($subject, AbstractParameter::class, true)) {
return false;
}
//If the attachment has no element (which should not happen), we deny access, as we can not determine if the user is allowed to access the associated element
$target_element = $subject->getElement();
if ($target_element !== null) {
//Depending on the operation delegate either to the attachments element or to the attachment permission
if (is_object($subject)) {
//If the attachment has no element (which should not happen), we deny access, as we can not determine if the user is allowed to access the associated element
$target_element = $subject->getElement();
if ($target_element !== null) {
//Depending on the operation delegate either to the attachments element or to the attachment permission
switch ($attribute) {
//We can view the attachment if we can view the element
case 'read':
case 'view':
$operation = 'read';
break;
//We can edit/create/delete the attachment if we can edit the element
case 'edit':
case 'create':
case 'delete':
$operation = 'edit';
break;
case 'show_history':
$operation = 'show_history';
break;
case 'revert_element':
$operation = 'revert_element';
break;
default:
throw new RuntimeException('Unknown operation: '.$attribute);
switch ($attribute) {
//We can view the attachment if we can view the element
case 'read':
case 'view':
$operation = 'read';
break;
//We can edit/create/delete the attachment if we can edit the element
case 'edit':
case 'create':
case 'delete':
$operation = 'edit';
break;
case 'show_history':
$operation = 'show_history';
break;
case 'revert_element':
$operation = 'revert_element';
break;
default:
throw new RuntimeException('Unknown operation: '.$attribute);
}
return $this->security->isGranted($operation, $target_element);
}
return $this->security->isGranted($operation, $target_element);
}
//If we do not have a concrete element, we delegate to the different categories
if ($subject instanceof AttachmentTypeParameter) {
//If we do not have a concrete element (or we just got a string as value), we delegate to the different categories
if (is_a($subject, AttachmentTypeParameter::class, true)) {
$param = 'attachment_types';
} elseif ($subject instanceof CategoryParameter) {
} elseif (is_a($subject, CategoryParameter::class, true)) {
$param = 'categories';
} elseif ($subject instanceof CurrencyParameter) {
} elseif (is_a($subject, CurrencyParameter::class, true)) {
$param = 'currencies';
} elseif ($subject instanceof ProjectParameter) {
} elseif (is_a($subject, ProjectParameter::class, true)) {
$param = 'projects';
} elseif ($subject instanceof FootprintParameter) {
} elseif (is_a($subject, FootprintParameter::class, true)) {
$param = 'footprints';
} elseif ($subject instanceof GroupParameter) {
} elseif (is_a($subject, GroupParameter::class, true)) {
$param = 'groups';
} elseif ($subject instanceof ManufacturerParameter) {
} elseif (is_a($subject, ManufacturerParameter::class, true)) {
$param = 'manufacturers';
} elseif ($subject instanceof MeasurementUnitParameter) {
} elseif (is_a($subject, MeasurementUnitParameter::class, true)) {
$param = 'measurement_units';
} elseif ($subject instanceof PartParameter) {
} elseif (is_a($subject, PartParameter::class, true)) {
$param = 'parts';
} elseif ($subject instanceof StorelocationParameter) {
} elseif (is_a($subject, StorelocationParameter::class, true)) {
$param = 'storelocations';
} elseif ($subject instanceof SupplierParameter) {
} elseif (is_a($subject, SupplierParameter::class, true)) {
$param = 'suppliers';
} else {
throw new RuntimeException('Encountered unknown Parameter type: ' . get_class($subject));
} elseif ($subject === AbstractParameter::class) {
//If the subject was deleted, we can not determine the type properly, so we just use the parts permission
$param = 'parts';
}
else {
throw new RuntimeException('Encountered unknown Parameter type: ' . (is_object($subject) ? get_class($subject) : $subject));
}
return $this->resolver->inherit($user, $param, $attribute) ?? false;