jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permission checks for timesheets with activated lockdown (#2271)

Browse Source
This commit is contained in:
Kevin Papst
2021-01-17 17:50:37 +01:00
committed by GitHub
parent 8d72d114c7
commit 67d5cba09f
24 changed files with 595 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/Voter/CustomerVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Customer;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check authorization on Customers.
*/
class CustomerVoter extends AbstractVoter
class CustomerVoter extends Voter
{
/**
* supported attributes/rules based on the given customer
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'create',
'edit',
@@ -34,6 +36,13 @@ class CustomerVoter extends AbstractVoter
'details',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Customer $subject
@@ -66,7 +75,7 @@ class CustomerVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_customer')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_customer')) {
return true;
}
@@ -75,8 +84,8 @@ class CustomerVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_customer');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_customer');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_customer');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_customer');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;