jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

added team permissions on user queries (#1815)

Browse Source
This commit is contained in:
Kevin Papst
2020-07-12 01:18:57 +02:00
committed by GitHub
parent 32c1e3258e
commit b97d9f692d
11 changed files with 128 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/Security/RolePermissionManager.php
View File

@@ -14,6 +14,17 @@ use App\Repository\RolePermissionRepository;
final class RolePermissionManager
{
/**
* Permissions that are always true for ROLE_SUPER_ADMIN, no matter what is inside the database.
*
* @var string[]
*/
public const SUPER_ADMIN_PERMISSIONS = [
'view_all_data',
'role_permissions',
'view_user'
];
/**
* @var array
*/
@@ -36,23 +47,22 @@ final class RolePermissionManager
foreach ($all as $item) {
$perm = $item['permission'];
$role = strtoupper($item['role']);
$isAllowed = $item['allowed'];
$isAllowed = (bool) $item['allowed'];
// see permissions.html.twig for this special case
if ($role === User::ROLE_SUPER_ADMIN && \in_array($perm, ['role_permissions', 'view_user'])) {
// these permissions may not be revoked at any time, because super admin would loose the ability to reactivate any permission
if ($role === User::ROLE_SUPER_ADMIN && \in_array($perm, self::SUPER_ADMIN_PERMISSIONS)) {
continue;
}
if (!$isAllowed) {
if (\array_key_exists($role, $this->permissions)) {
if (($key = array_search($perm, $this->permissions[$role])) !== false) {
unset($this->permissions[$role][$key]);
}
if (!\array_key_exists($role, $this->permissions)) {
$this->permissions[$role] = [];
}
if (false === $isAllowed) {
if (($key = array_search($perm, $this->permissions[$role])) !== false) {
unset($this->permissions[$role][$key]);
}
} else {
if (!\array_key_exists($role, $this->permissions)) {
$this->permissions[$role] = [];
}
$this->permissions[$role][] = $perm;
}
}