jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permission checks for timesheets with activated lockdown (#2271)

Browse Source
This commit is contained in:
Kevin Papst
2021-01-17 17:50:37 +01:00
committed by GitHub
parent 8d72d114c7
commit 67d5cba09f
24 changed files with 595 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/Voter/ActivityVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Activity;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on Activities.
*/
class ActivityVoter extends AbstractVoter
class ActivityVoter extends Voter
{
/**
* support rules based on the given activity
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'budget',
@@ -30,6 +32,13 @@ class ActivityVoter extends AbstractVoter
'permissions',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Activity $subject
@@ -62,7 +71,7 @@ class ActivityVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_activity')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_activity')) {
return true;
}
@@ -71,8 +80,8 @@ class ActivityVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_activity');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_activity');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_activity');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_activity');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;