diff --git a/src/Controller/LogController.php b/src/Controller/LogController.php index 2bfd93bc..24be85c9 100644 --- a/src/Controller/LogController.php +++ b/src/Controller/LogController.php @@ -106,7 +106,7 @@ class LogController extends AbstractController public function logDetails(Request $request, AbstractLogEntry $logEntry, LogEntryExtraFormatter $logEntryExtraFormatter, LogLevelHelper $logLevelHelper, LogTargetHelper $logTargetHelper, EntityManagerInterface $entityManager): Response { - $this->denyAccessUnlessGranted('read', $logEntry); + $this->denyAccessUnlessGranted('show_details', $logEntry); $extra_html = $logEntryExtraFormatter->format($logEntry); $target_html = $logTargetHelper->formatTarget($logEntry); diff --git a/src/Security/Voter/LogEntryVoter.php b/src/Security/Voter/LogEntryVoter.php index 058dac0b..f05de596 100644 --- a/src/Security/Voter/LogEntryVoter.php +++ b/src/Security/Voter/LogEntryVoter.php @@ -24,13 +24,28 @@ namespace App\Security\Voter; use App\Entity\LogSystem\AbstractLogEntry; use App\Entity\UserSystem\User; +use App\Services\UserSystem\PermissionManager; +use Doctrine\ORM\EntityManagerInterface; +use Symfony\Component\Security\Core\Security; class LogEntryVoter extends ExtendedVoter { - public const ALLOWED_OPS = ['read', 'delete']; + public const ALLOWED_OPS = ['read', 'show_details', 'delete']; + + private Security $security; + + public function __construct(PermissionManager $resolver, EntityManagerInterface $entityManager, Security $security) + { + parent::__construct($resolver, $entityManager); + $this->security = $security; + } protected function voteOnUser(string $attribute, $subject, User $user): bool { + if (!$subject instanceof AbstractLogEntry) { + throw new \InvalidArgumentException('The subject must be an instance of '.AbstractLogEntry::class); + } + if ('delete' === $attribute) { return $this->resolver->inherit($user, 'system', 'delete_logs') ?? false; } @@ -47,6 +62,17 @@ class LogEntryVoter extends ExtendedVoter return $this->resolver->inherit($user, 'system', 'show_logs') ?? false; } + if ('show_details' === $attribute) { + //To view details of a element related log entry, the user needs to be able to view the history of this entity type + $targetClass = $subject->getTargetClass(); + if (null !== $targetClass) { + return $this->security->isGranted('show_history', $targetClass) ?? false; + } + + //In other cases, this behaves like the read permission + return $this->voteOnUser('read', $subject, $user); + } + return false; }