diff --git a/app/Resources/views/admin/user.html.twig b/app/Resources/views/admin/user.html.twig index 7ef71838..3c6252b7 100644 --- a/app/Resources/views/admin/user.html.twig +++ b/app/Resources/views/admin/user.html.twig @@ -36,10 +36,14 @@ {% endfor %} - {{ widgets.button_group({ - 'edit': path('user_profile', {'username' : entry.username}), - 'trash': path('user_profile_delete', {'username' : entry.username}) - }) }} + {% set actionButtons = {} %} + {% if is_granted('edit', entry) %} + {% set actionButtons = {'edit': path('user_profile', {'username' : entry.username})}|merge(actionButtons) %} + {% endif %} + {% if is_granted('delete', entry) %} + {% set actionButtons = actionButtons|merge({'trash': '#'}) %} + {% endif %} + {{ widgets.button_group(actionButtons) }} {% endfor %} diff --git a/src/AppBundle/Controller/ProfileController.php b/src/AppBundle/Controller/ProfileController.php index 47d80fa0..f36c2099 100644 --- a/src/AppBundle/Controller/ProfileController.php +++ b/src/AppBundle/Controller/ProfileController.php @@ -116,20 +116,6 @@ class ProfileController extends AbstractController return $this->getProfileView($profile, null, null, $rolesForm, 'roles'); } - /** - * FIXME implement profile deletion - * - * @Route("/{username}/delete", name="user_profile_delete") - * @Method({"GET", "POST"}) - * @Security("is_granted('delete', profile)") - */ - public function deleteAction(User $profile, Request $request) - { - $deleteForm = $this->createDeleteForm($profile); - - throw new \Exception('Delete not implemented yet'); - } - /** * @param User $user * @param Form|null $editForm @@ -225,17 +211,4 @@ class ProfileController extends AbstractController ] ); } - - /** - * @param User $user - * @return \Symfony\Component\Form\FormInterface - */ - private function createDeleteForm(User $user) - { - return $this->createFormBuilder() - ->setAction($this->generateUrl('user_profile_delete', ['username' => $user->getUsername()])) - ->setMethod('DELETE') - ->getForm() - ; - } } diff --git a/src/AppBundle/Voter/UserVoter.php b/src/AppBundle/Voter/UserVoter.php index 4b4c3d85..c14e586a 100644 --- a/src/AppBundle/Voter/UserVoter.php +++ b/src/AppBundle/Voter/UserVoter.php @@ -70,11 +70,10 @@ class UserVoter extends AbstractVoter case self::EDIT: case self::PASSWORD: return $this->canEdit($subject, $user, $token); - case self::VIEW_ALL: - case self::CREATE: - // create actually passes in the current user as $subject, not the new one case self::DELETE: - // if we allow to delete user for ADMIN: make sure the user to be deleted is not in a higher level + return $this->canDelete($subject, $user, $token); + case self::VIEW_ALL: + case self::CREATE: // create actually passes in the current user as $subject, not the new one case self::ROLES: return $this->canAdminUsers($token); } @@ -110,6 +109,16 @@ class UserVoter extends AbstractVoter return $profile->getId() == $user->getId(); } + /** + * @param User $profile + * @param User $user + * @return bool + */ + protected function canDelete(User $profile, User $user, TokenInterface $token) + { + return false; + } + /** * @param TokenInterface $token * @return bool diff --git a/src/TimesheetBundle/Controller/Admin/ActivityController.php b/src/TimesheetBundle/Controller/Admin/ActivityController.php index cab8de02..ae708523 100644 --- a/src/TimesheetBundle/Controller/Admin/ActivityController.php +++ b/src/TimesheetBundle/Controller/Admin/ActivityController.php @@ -21,7 +21,6 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Cache; use TimesheetBundle\Entity\Customer; use TimesheetBundle\Entity\Project; -use TimesheetBundle\Form\ActivityDeleteForm; use TimesheetBundle\Form\ActivityEditForm; use TimesheetBundle\Form\Toolbar\ActivityToolbarForm; use TimesheetBundle\Repository\Query\ActivityQuery; @@ -141,10 +140,10 @@ class ActivityController extends AbstractController { $stats = $this->getRepository()->getActivityStatistics($activity); - $deleteForm = $this->createForm(ActivityDeleteForm::class, $activity, [ - 'action' => $this->generateUrl('admin_activity_delete', ['id' => $activity->getId()]), - 'method' => 'POST' - ]); + $deleteForm = $this->createFormBuilder() + ->setAction($this->generateUrl('admin_activity_delete', ['id' => $activity->getId()])) + ->setMethod('POST') + ->getForm(); $deleteForm->handleRequest($request); diff --git a/src/TimesheetBundle/Controller/Admin/CustomerController.php b/src/TimesheetBundle/Controller/Admin/CustomerController.php index 172f3186..d447748d 100644 --- a/src/TimesheetBundle/Controller/Admin/CustomerController.php +++ b/src/TimesheetBundle/Controller/Admin/CustomerController.php @@ -19,7 +19,6 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Cache; -use TimesheetBundle\Form\CustomerDeleteForm; use TimesheetBundle\Form\CustomerEditForm; use TimesheetBundle\Form\Toolbar\CustomerToolbarForm; use TimesheetBundle\Repository\Query\CustomerQuery; @@ -145,10 +144,10 @@ class CustomerController extends AbstractController { $stats = $this->getRepository()->getCustomerStatistics($customer); - $deleteForm = $this->createForm(CustomerDeleteForm::class, $customer, [ - 'action' => $this->generateUrl('admin_customer_delete', ['id' => $customer->getId()]), - 'method' => 'POST' - ]); + $deleteForm = $this->createFormBuilder() + ->setAction($this->generateUrl('admin_customer_delete', ['id' => $customer->getId()])) + ->setMethod('POST') + ->getForm(); $deleteForm->handleRequest($request); diff --git a/src/TimesheetBundle/Controller/Admin/ProjectController.php b/src/TimesheetBundle/Controller/Admin/ProjectController.php index 831cfdc3..3fdcd643 100644 --- a/src/TimesheetBundle/Controller/Admin/ProjectController.php +++ b/src/TimesheetBundle/Controller/Admin/ProjectController.php @@ -20,7 +20,6 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Cache; -use TimesheetBundle\Form\ProjectDeleteForm; use TimesheetBundle\Form\ProjectEditForm; use TimesheetBundle\Form\Toolbar\ProjectToolbarForm; use TimesheetBundle\Repository\Query\ProjectQuery; @@ -129,10 +128,10 @@ class ProjectController extends AbstractController { $stats = $this->getRepository()->getProjectStatistics($project); - $deleteForm = $this->createForm(ProjectDeleteForm::class, $project, [ - 'action' => $this->generateUrl('admin_project_delete', ['id' => $project->getId()]), - 'method' => 'POST' - ]); + $deleteForm = $this->createFormBuilder() + ->setAction($this->generateUrl('admin_project_delete', ['id' => $project->getId()])) + ->setMethod('POST') + ->getForm(); $deleteForm->handleRequest($request); diff --git a/src/TimesheetBundle/Form/ActivityDeleteForm.php b/src/TimesheetBundle/Form/ActivityDeleteForm.php deleted file mode 100644 index 5930a301..00000000 --- a/src/TimesheetBundle/Form/ActivityDeleteForm.php +++ /dev/null @@ -1,38 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace TimesheetBundle\Form; - -use Symfony\Component\Form\AbstractType; -use Symfony\Component\OptionsResolver\OptionsResolver; -use TimesheetBundle\Entity\Activity; - -/** - * The form used to delete Activities. - * - * @author Kevin Papst - */ -class ActivityDeleteForm extends AbstractType -{ - - /** - * {@inheritdoc} - */ - public function configureOptions(OptionsResolver $resolver) - { - $resolver->setDefaults([ - 'data_class' => Activity::class, - 'csrf_protection' => true, - 'csrf_field_name' => '_token', - 'csrf_token_id' => 'admin_activity_delete', - ]); - } -} diff --git a/src/TimesheetBundle/Form/CustomerDeleteForm.php b/src/TimesheetBundle/Form/CustomerDeleteForm.php deleted file mode 100644 index 8bfc5962..00000000 --- a/src/TimesheetBundle/Form/CustomerDeleteForm.php +++ /dev/null @@ -1,38 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace TimesheetBundle\Form; - -use Symfony\Component\Form\AbstractType; -use Symfony\Component\OptionsResolver\OptionsResolver; -use TimesheetBundle\Entity\Customer; - -/** - * The form used to delete Customers. - * - * @author Kevin Papst - */ -class CustomerDeleteForm extends AbstractType -{ - - /** - * {@inheritdoc} - */ - public function configureOptions(OptionsResolver $resolver) - { - $resolver->setDefaults([ - 'data_class' => Customer::class, - 'csrf_protection' => true, - 'csrf_field_name' => '_token', - 'csrf_token_id' => 'admin_customer_delete', - ]); - } -} diff --git a/src/TimesheetBundle/Form/ProjectDeleteForm.php b/src/TimesheetBundle/Form/ProjectDeleteForm.php deleted file mode 100644 index cda54a82..00000000 --- a/src/TimesheetBundle/Form/ProjectDeleteForm.php +++ /dev/null @@ -1,38 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace TimesheetBundle\Form; - -use Symfony\Component\Form\AbstractType; -use Symfony\Component\OptionsResolver\OptionsResolver; -use TimesheetBundle\Entity\Project; - -/** - * The form used to delete Projects. - * - * @author Kevin Papst - */ -class ProjectDeleteForm extends AbstractType -{ - - /** - * {@inheritdoc} - */ - public function configureOptions(OptionsResolver $resolver) - { - $resolver->setDefaults([ - 'data_class' => Project::class, - 'csrf_protection' => true, - 'csrf_field_name' => '_token', - 'csrf_token_id' => 'admin_project_delete', - ]); - } -}