jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve permission checks for timesheets with activated lockdown (#2271)

Browse Source
This commit is contained in:
Kevin Papst
2021-01-17 17:50:37 +01:00
committed by GitHub
parent 8d72d114c7
commit 67d5cba09f
24 changed files with 595 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Voter/AbstractVoter.php
View File

@@ -17,6 +17,8 @@ use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* Abstract voter to help with checking user permissions.
* @codeCoverageIgnore
* @deprecated since 1.13
*/
abstract class AbstractVoter extends Voter
{

19
src/Voter/ActivityVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Activity;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on Activities.
*/
class ActivityVoter extends AbstractVoter
class ActivityVoter extends Voter
{
/**
* support rules based on the given activity
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'budget',
@@ -30,6 +32,13 @@ class ActivityVoter extends AbstractVoter
'permissions',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Activity $subject
@@ -62,7 +71,7 @@ class ActivityVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_activity')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_activity')) {
return true;
}
@@ -71,8 +80,8 @@ class ActivityVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_activity');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_activity');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_activity');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_activity');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;

19
src/Voter/CustomerVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Customer;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check authorization on Customers.
*/
class CustomerVoter extends AbstractVoter
class CustomerVoter extends Voter
{
/**
* supported attributes/rules based on the given customer
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'create',
'edit',
@@ -34,6 +36,13 @@ class CustomerVoter extends AbstractVoter
'details',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Customer $subject
@@ -66,7 +75,7 @@ class CustomerVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_customer')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_customer')) {
return true;
}
@@ -75,8 +84,8 @@ class CustomerVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_customer');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_customer');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_customer');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_customer');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;

19
src/Voter/ProjectVoter.php
View File

@@ -12,17 +12,19 @@ namespace App\Voter;
use App\Entity\Project;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on Projects.
*/
class ProjectVoter extends AbstractVoter
class ProjectVoter extends Voter
{
/**
* support rules based on the given project
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'budget',
@@ -33,6 +35,13 @@ class ProjectVoter extends AbstractVoter
'details',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Project $subject
@@ -65,7 +74,7 @@ class ProjectVoter extends AbstractVoter
return false;
}
if ($this->hasRolePermission($user, $attribute . '_project')) {
if ($this->permissionManager->hasRolePermission($user, $attribute . '_project')) {
return true;
}
@@ -74,8 +83,8 @@ class ProjectVoter extends AbstractVoter
return false;
}
$hasTeamleadPermission = $this->hasRolePermission($user, $attribute . '_teamlead_project');
$hasTeamPermission = $this->hasRolePermission($user, $attribute . '_team_project');
$hasTeamleadPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_teamlead_project');
$hasTeamPermission = $this->permissionManager->hasRolePermission($user, $attribute . '_team_project');
if (!$hasTeamleadPermission && !$hasTeamPermission) {
return false;

15
src/Voter/RolePermissionVoter.php
View File

@@ -11,13 +11,22 @@ namespace App\Voter;
use App\Entity\Activity;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check the free-configurable permission from "kimai.permissions".
*/
class RolePermissionVoter extends AbstractVoter
class RolePermissionVoter extends Voter
{
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param mixed $subject
@@ -30,7 +39,7 @@ class RolePermissionVoter extends AbstractVoter
return false;
}
return $this->isRegisteredPermission($attribute);
return $this->permissionManager->isRegisteredPermission($attribute);
}
/**
@@ -47,6 +56,6 @@ class RolePermissionVoter extends AbstractVoter
return false;
}
return $this->hasRolePermission($user, $attribute);
return $this->permissionManager->hasRolePermission($user, $attribute);
}
}

15
src/Voter/TeamVoter.php
View File

@@ -11,19 +11,28 @@ namespace App\Voter;
use App\Entity\Team;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
class TeamVoter extends AbstractVoter
class TeamVoter extends Voter
{
/**
* support rules based on the given $subject (here: Team)
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'delete',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param Team $subject
@@ -56,6 +65,6 @@ class TeamVoter extends AbstractVoter
return false;
}
return $this->hasRolePermission($user, $attribute . '_team');
return $this->permissionManager->hasRolePermission($user, $attribute . '_team');
}
}

85
src/Voter/TimesheetVoter.php
View File

@@ -11,12 +11,15 @@ namespace App\Voter;
use App\Entity\Timesheet;
use App\Entity\User;
use App\Security\RolePermissionManager;
use App\Timesheet\LockdownService;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on Timesheets.
*/
class TimesheetVoter extends AbstractVoter
class TimesheetVoter extends Voter
{
public const VIEW = 'view';
public const START = 'start';
@@ -31,7 +34,7 @@ class TimesheetVoter extends AbstractVoter
/**
* support rules based on the given $subject (here: Timesheet)
*/
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
self::VIEW,
self::START,
self::STOP,
@@ -44,6 +47,20 @@ class TimesheetVoter extends AbstractVoter
'duplicate'
];
private $permissionManager;
private $lockdownService;
private $lockdownGrace;
private $lockdownOverride;
private $editExported;
private $now;
public function __construct(RolePermissionManager $permissionManager, LockdownService $lockdownService)
{
$this->permissionManager = $permissionManager;
$this->lockdownService = $lockdownService;
}
/**
* @param string $attribute
* @param mixed $subject
@@ -101,6 +118,9 @@ class TimesheetVoter extends AbstractVoter
break;
case 'duplicate':
if (!$this->canDuplicate($user, $subject)) {
return false;
}
$permission = self::EDIT;
break;
@@ -128,7 +148,7 @@ class TimesheetVoter extends AbstractVoter
$permission .= '_timesheet';
return $this->hasRolePermission($user, $permission);
return $this->permissionManager->hasRolePermission($user, $permission);
}
protected function canStart(Timesheet $timesheet): bool
@@ -158,7 +178,11 @@ class TimesheetVoter extends AbstractVoter
protected function canEdit(User $user, Timesheet $timesheet): bool
{
if ($timesheet->isExported() && !$this->hasRolePermission($user, 'edit_exported_timesheet')) {
if (!$this->isAllowedExported($user, $timesheet)) {
return false;
}
if (!$this->isAllowedInLockdown($user, $timesheet)) {
return false;
}
@@ -167,10 +191,61 @@ class TimesheetVoter extends AbstractVoter
protected function canDelete(User $user, Timesheet $timesheet): bool
{
if ($timesheet->isExported() && !$this->hasRolePermission($user, 'edit_exported_timesheet')) {
if (!$this->isAllowedExported($user, $timesheet)) {
return false;
}
if (!$this->isAllowedInLockdown($user, $timesheet)) {
return false;
}
return true;
}
protected function canDuplicate(User $user, Timesheet $timesheet): bool
{
if (!$this->isAllowedInLockdown($user, $timesheet)) {
return false;
}
return true;
}
private function isAllowedExported(User $user, Timesheet $timesheet): bool
{
if (!$timesheet->isExported()) {
return true;
}
if ($this->editExported === null) {
$this->editExported = $this->permissionManager->hasRolePermission($user, 'edit_exported_timesheet');
}
return $this->editExported;
}
private function isAllowedInLockdown(User $user, Timesheet $timesheet): bool
{
if (!$this->lockdownService->isLockdownActive()) {
return true;
}
if ($this->lockdownOverride === null) {
$this->lockdownOverride = $this->permissionManager->hasRolePermission($user, 'lockdown_override_timesheet');
}
if ($this->lockdownOverride) {
return true;
}
if ($this->lockdownGrace === null) {
$this->lockdownGrace = $this->permissionManager->hasRolePermission($user, 'lockdown_grace_timesheet');
}
if ($this->now === null) {
$this->now = new \DateTime('now', new \DateTimeZone($user->getTimezone()));
}
return $this->lockdownService->isEditable($timesheet, $this->now, $this->lockdownGrace);
}
}

21
src/Voter/UserVoter.php
View File

@@ -10,14 +10,16 @@
namespace App\Voter;
use App\Entity\User;
use App\Security\RolePermissionManager;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
/**
* A voter to check permissions on user profiles.
*/
class UserVoter extends AbstractVoter
class UserVoter extends Voter
{
public const ALLOWED_ATTRIBUTES = [
private const ALLOWED_ATTRIBUTES = [
'view',
'edit',
'roles',
@@ -29,6 +31,13 @@ class UserVoter extends AbstractVoter
'hourly-rate',
];
private $permissionManager;
public function __construct(RolePermissionManager $permissionManager)
{
$this->permissionManager = $permissionManager;
}
/**
* @param string $attribute
* @param mixed $subject
@@ -66,8 +75,10 @@ class UserVoter extends AbstractVoter
return false;
}
return $this->hasRolePermission($user, 'delete_user');
} elseif ($attribute === 'password') {
return $this->permissionManager->hasRolePermission($user, 'delete_user');
}
if ($attribute === 'password') {
if (!$subject->isInternalUser()) {
return false;
}
@@ -84,6 +95,6 @@ class UserVoter extends AbstractVoter
$permission .= '_profile';
return $this->hasRolePermission($user, $permission);
return $this->permissionManager->hasRolePermission($user, $permission);
}
}