jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permission checks for timesheets with activated lockdown (#2271)

Browse Source
This commit is contained in:
Kevin Papst
2021-01-17 17:50:37 +01:00
committed by GitHub
parent 8d72d114c7
commit 67d5cba09f
24 changed files with 595 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/Voter/ProjectVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Project;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on Projects.
*/
class ProjectVoter extends AbstractVoter
class ProjectVoter extends Voter
{
/**
* support rules based on the given project
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'budget',
@@ -33,6 +35,13 @@ class ProjectVoter extends AbstractVoter
'details',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Project $subject
@@ -65,7 +74,7 @@ class ProjectVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_project')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_project')) {
return true;
}
@@ -74,8 +83,8 @@ class ProjectVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_project');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_project');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_project');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_project');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;