jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permission checks for timesheets with activated lockdown (#2271)

Browse Source
This commit is contained in:
Kevin Papst
2021-01-17 17:50:37 +01:00
committed by GitHub
parent 8d72d114c7
commit 67d5cba09f
24 changed files with 595 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
src/Validator/Constraints/TimesheetLockdownValidator.php
View File

@@ -9,8 +9,8 @@
namespace App\Validator\Constraints;
use App\Configuration\SystemConfiguration;
use App\Entity\Timesheet as TimesheetEntity;
use App\Timesheet\LockdownService;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Validator\Constraint;
use Symfony\Component\Validator\ConstraintValidator;
@@ -18,19 +18,13 @@ use Symfony\Component\Validator\Exception\UnexpectedTypeException;
final class TimesheetLockdownValidator extends ConstraintValidator
{
/**
* @var AuthorizationCheckerInterface
*/
private $auth;
/**
* @var SystemConfiguration
*/
private $configuration;
private $lockdownService;
public function __construct(AuthorizationCheckerInterface $auth, SystemConfiguration $configuration)
public function __construct(AuthorizationCheckerInterface $auth, LockdownService $lockdownService)
{
$this->auth = $auth;
$this->configuration = $configuration;
$this->lockdownService = $lockdownService;
}
/**
@@ -47,40 +41,11 @@ final class TimesheetLockdownValidator extends ConstraintValidator
throw new UnexpectedTypeException($timesheet, TimesheetEntity::class);
}
$timesheetStart = $timesheet->getBegin();
if (null === $timesheetStart) {
if (!$this->lockdownService->isLockdownActive()) {
return;
}
if (!$this->configuration->isTimesheetLockdownActive()) {
return;
}
$lockedStart = $this->configuration->getTimesheetLockdownPeriodStart();
$lockedEnd = $this->configuration->getTimesheetLockdownPeriodEnd();
$gracePeriod = $this->configuration->getTimesheetLockdownGracePeriod();
if (!empty($gracePeriod)) {
$gracePeriod = $gracePeriod . ' ';
}
try {
$lockdownStart = new \DateTime($lockedStart, $timesheetStart->getTimezone());
$lockdownEnd = new \DateTime($lockedEnd, $timesheetStart->getTimezone());
$lockdownGrace = new \DateTime($gracePeriod . $lockdownEnd->format('Y-m-d'), $timesheetStart->getTimezone());
} catch (\Exception $ex) {
// should not happen, but ... if parsing of datetimes fails: skip validation
return;
}
// misconfiguration detected, skip validation
if ($lockdownEnd < $lockdownStart) {
return;
}
// validate only entries added before the end of lockdown period
if ($timesheetStart > $lockdownEnd) {
if (null === ($timesheetStart = $timesheet->getBegin())) {
return;
}
@@ -89,6 +54,8 @@ final class TimesheetLockdownValidator extends ConstraintValidator
return;
}
$now = new \DateTime('now', $timesheetStart->getTimezone());
if (!empty($constraint->now)) {
if ($constraint->now instanceof \DateTime) {
$now = $constraint->now;
@@ -100,21 +67,10 @@ final class TimesheetLockdownValidator extends ConstraintValidator
}
}
if (empty($now)) {
$now = new \DateTime('now', $timesheetStart->getTimezone());
}
$allowEditInGracePeriod = $this->auth->isGranted('lockdown_grace_timesheet');
// further validate entries inside of the most recent lockdown
if ($timesheetStart > $lockdownStart && $timesheetStart < $lockdownEnd) {
// if grace period is still in effect, validation succeeds
if ($now < $lockdownGrace) {
return;
}
// if user has special role, validation succeeds
if ($this->auth->isGranted('lockdown_grace_timesheet')) {
return;
}
if ($this->lockdownService->isEditable($timesheet, $now, $allowEditInGracePeriod)) {
return;
}
// raise a violation for all entries before the start of lockdown period