';
$tmp .= sprintf(
- '
',
+ '
',
$context->getID(),
+ $disabled ? 'disabled' : '',
$icon,
$title
);
$tmp .= sprintf(
- '
',
+ '
',
$context->getID(),
+ $disabled ? 'disabled' : '',
$this->translator->trans('log.undo.revert')
);
diff --git a/src/DataTables/LogDataTable.php b/src/DataTables/LogDataTable.php
index ea2e9255..ad519cb5 100644
--- a/src/DataTables/LogDataTable.php
+++ b/src/DataTables/LogDataTable.php
@@ -66,6 +66,7 @@ use Omines\DataTablesBundle\DataTableTypeInterface;
use Psr\Log\LogLevel;
use Symfony\Component\OptionsResolver\OptionsResolver;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Security;
use Symfony\Contracts\Translation\TranslatorInterface;
use Symfony\Flex\Options;
@@ -76,15 +77,17 @@ class LogDataTable implements DataTableTypeInterface
protected $urlGenerator;
protected $entityURLGenerator;
protected $logRepo;
+ protected $security;
public function __construct(ElementTypeNameGenerator $elementTypeNameGenerator, TranslatorInterface $translator,
- UrlGeneratorInterface $urlGenerator, EntityURLGenerator $entityURLGenerator, EntityManagerInterface $entityManager)
+ UrlGeneratorInterface $urlGenerator, EntityURLGenerator $entityURLGenerator, EntityManagerInterface $entityManager, Security $security)
{
$this->elementTypeNameGenerator = $elementTypeNameGenerator;
$this->translator = $translator;
$this->urlGenerator = $urlGenerator;
$this->entityURLGenerator = $entityURLGenerator;
$this->logRepo = $entityManager->getRepository(AbstractLogEntry::class);
+ $this->security = $security;
}
public function configureOptions(OptionsResolver $optionsResolver)
@@ -235,7 +238,13 @@ class LogDataTable implements DataTableTypeInterface
}
}
return null;
+ },
+ 'disabled' => function ($value, AbstractLogEntry $context) {
+ return
+ !$this->security->isGranted('@tools.timetravel')
+ || !$this->security->isGranted('show_history', $context->getTargetClass());
}
+
]);
$dataTable->add('actionRevert', RevertLogColumn::class, [
diff --git a/src/Entity/UserSystem/PermissionsEmbed.php b/src/Entity/UserSystem/PermissionsEmbed.php
index 99c93427..c6b01782 100644
--- a/src/Entity/UserSystem/PermissionsEmbed.php
+++ b/src/Entity/UserSystem/PermissionsEmbed.php
@@ -481,7 +481,7 @@ class PermissionsEmbed
*/
final protected static function readBitPair($data, int $n): int
{
- Assert::lessThanEq($n, 31, '$n must be smaller than 32, because only a 32bit int is used! Got %s.');
+ //Assert::lessThanEq($n, 31, '$n must be smaller than 32, because only a 32bit int is used! Got %s.');
if (0 !== $n % 2) {
throw new InvalidArgumentException('$n must be dividable by 2, because we address bit pairs here!');
}
@@ -501,7 +501,7 @@ class PermissionsEmbed
*/
final protected static function writeBitPair(int $data, int $n, int $new): int
{
- Assert::lessThanEq($n, 31, '$n must be smaller than 32, because only a 32bit int is used! Got %s.');
+ //Assert::lessThanEq($n, 31, '$n must be smaller than 32, because only a 32bit int is used! Got %s.');
Assert::lessThanEq($new, 3, '$new must be smaller than 3, because a bit pair is written! Got %s.');
Assert::greaterThanEq($new, 0, '$new must not be negative, because a bit pair is written! Got %s.');
diff --git a/src/Security/Voter/AttachmentVoter.php b/src/Security/Voter/AttachmentVoter.php
index 01727806..07cc9c25 100644
--- a/src/Security/Voter/AttachmentVoter.php
+++ b/src/Security/Voter/AttachmentVoter.php
@@ -58,11 +58,7 @@ class AttachmentVoter extends ExtendedVoter
*/
protected function voteOnUser($attribute, $subject, User $user): bool
{
- if ($subject instanceof Attachment) {
- return $this->resolver->inherit($user, 'parts_attachments', $attribute) ?? false;
- }
-
- return false;
+ return $this->resolver->inherit($user, 'parts_attachments', $attribute) ?? false;
}
/**
@@ -75,10 +71,11 @@ class AttachmentVoter extends ExtendedVoter
*/
protected function supports($attribute, $subject)
{
- if ($subject instanceof Attachment) {
+ if (is_a($subject, Attachment::class, true)) {
return in_array($attribute, $this->resolver->listOperationsForPermission('parts_attachments'), false);
}
+ //Allow class name as subject
return false;
}
}
diff --git a/src/Security/Voter/GroupVoter.php b/src/Security/Voter/GroupVoter.php
index 0b88b8a0..0201cbe5 100644
--- a/src/Security/Voter/GroupVoter.php
+++ b/src/Security/Voter/GroupVoter.php
@@ -57,11 +57,7 @@ class GroupVoter extends ExtendedVoter
*/
protected function voteOnUser($attribute, $subject, User $user): bool
{
- if ($subject instanceof Group) {
- return $this->resolver->inherit($user, 'groups', $attribute) ?? false;
- }
-
- return false;
+ return $this->resolver->inherit($user, 'groups', $attribute) ?? false;
}
/**
@@ -74,7 +70,7 @@ class GroupVoter extends ExtendedVoter
*/
protected function supports($attribute, $subject)
{
- if ($subject instanceof Group) {
+ if (is_a($subject, Group::class, true)) {
return $this->resolver->isValidOperation('groups', $attribute);
}
diff --git a/src/Security/Voter/LogEntryVoter.php b/src/Security/Voter/LogEntryVoter.php
index cb1c54a1..cdc3f1c8 100644
--- a/src/Security/Voter/LogEntryVoter.php
+++ b/src/Security/Voter/LogEntryVoter.php
@@ -51,25 +51,21 @@ class LogEntryVoter extends ExtendedVoter
protected function voteOnUser($attribute, $subject, User $user): bool
{
- if ($subject instanceof AbstractLogEntry) {
- if ('delete' === $attribute) {
- return $this->resolver->inherit($user, 'system', 'delete_logs') ?? false;
- }
-
- if ('read' === $attribute) {
- //Allow read of the users own log entries
- if (
- $subject->getUser() === $user
- && $this->resolver->inherit($user, 'self', 'show_logs')
- ) {
- return true;
- }
-
- return $this->resolver->inherit($user, 'system', 'show_logs') ?? false;
- }
+ if ('delete' === $attribute) {
+ return $this->resolver->inherit($user, 'system', 'delete_logs') ?? false;
}
- return false;
+ if ('read' === $attribute) {
+ //Allow read of the users own log entries
+ if (
+ $subject->getUser() === $user
+ && $this->resolver->inherit($user, 'self', 'show_logs')
+ ) {
+ return true;
+ }
+
+ return $this->resolver->inherit($user, 'system', 'show_logs') ?? false;
+ }
}
protected function supports($attribute, $subject)
diff --git a/src/Security/Voter/OrderdetailVoter.php b/src/Security/Voter/OrderdetailVoter.php
new file mode 100644
index 00000000..d06215f9
--- /dev/null
+++ b/src/Security/Voter/OrderdetailVoter.php
@@ -0,0 +1,57 @@
+.
+ */
+
+namespace App\Security\Voter;
+
+
+use App\Entity\Parts\PartLot;
+use App\Entity\PriceInformations\Orderdetail;
+use App\Entity\UserSystem\User;
+
+class OrderdetailVoter extends ExtendedVoter
+{
+ /** @var string[] When this permsission are encountered, they are checked on part */
+ protected const PART_PERMS = ['show_history', 'revert_element'];
+
+ /**
+ * @inheritDoc
+ */
+ protected function voteOnUser($attribute, $subject, User $user): bool
+ {
+ if (in_array($attribute, self::PART_PERMS, true)) {
+ return $this->resolver->inherit($user, 'parts', $attribute) ?? false;
+ }
+
+ return $this->resolver->inherit($user, 'parts_orderdetails', $attribute) ?? false;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ protected function supports($attribute, $subject)
+ {
+ if (is_a($subject, Orderdetail::class, true)) {
+ return in_array($attribute, array_merge(
+ self::PART_PERMS,
+ $this->resolver->listOperationsForPermission('parts_orderdetails')
+ ), true);
+ }
+ }
+}
\ No newline at end of file
diff --git a/src/Security/Voter/PartLotVoter.php b/src/Security/Voter/PartLotVoter.php
new file mode 100644
index 00000000..6fc372aa
--- /dev/null
+++ b/src/Security/Voter/PartLotVoter.php
@@ -0,0 +1,56 @@
+.
+ */
+
+namespace App\Security\Voter;
+
+
+use App\Entity\Parts\PartLot;
+use App\Entity\UserSystem\User;
+
+class PartLotVoter extends ExtendedVoter
+{
+ /** @var string[] When this permsission are encountered, they are checked on part */
+ protected const PART_PERMS = ['show_history', 'revert_element'];
+
+ /**
+ * @inheritDoc
+ */
+ protected function voteOnUser($attribute, $subject, User $user): bool
+ {
+ if (in_array($attribute, self::PART_PERMS, true)) {
+ return $this->resolver->inherit($user, 'parts', $attribute) ?? false;
+ }
+
+ return $this->resolver->inherit($user, 'parts_lots', $attribute) ?? false;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ protected function supports($attribute, $subject)
+ {
+ if (is_a($subject, PartLot::class, true)) {
+ return in_array($attribute, array_merge(
+ self::PART_PERMS,
+ $this->resolver->listOperationsForPermission('parts_lots')
+ ), true);
+ }
+ }
+}
\ No newline at end of file
diff --git a/src/Security/Voter/PartVoter.php b/src/Security/Voter/PartVoter.php
index d7d375cc..f829f557 100644
--- a/src/Security/Voter/PartVoter.php
+++ b/src/Security/Voter/PartVoter.php
@@ -57,11 +57,7 @@ class PartVoter extends ExtendedVoter
protected function supports($attribute, $subject)
{
- // replace with your own logic
- // https://symfony.com/doc/current/security/voters.html
- //return ($subject instanceof Part || in_array($subject, ['PERM_parts', 'PERM_parts_name']));
-
- if ($subject instanceof Part) {
+ if (is_a($subject, Part::class, true)) {
//Check if a sub permission should be checked -> $attribute has format name.edit
if (false !== strpos($attribute, '.')) {
[$perm, $op] = explode('.', $attribute);
@@ -72,24 +68,21 @@ class PartVoter extends ExtendedVoter
return $this->resolver->isValidOperation('parts', $attribute);
}
+ //Allow class name as subject
return false;
}
protected function voteOnUser($attribute, $subject, User $user): bool
{
- if ($subject instanceof Part) {
- //Check for sub permissions
- if (false !== strpos($attribute, '.')) {
- [$perm, $op] = explode('.', $attribute);
+ //Check for sub permissions
+ if (false !== strpos($attribute, '.')) {
+ [$perm, $op] = explode('.', $attribute);
- return $this->resolver->inherit($user, 'parts_'.$perm, $op) ?? false;
- }
-
- //Null concealing operator means, that no
- return $this->resolver->inherit($user, 'parts', $attribute) ?? false;
+ return $this->resolver->inherit($user, 'parts_'.$perm, $op) ?? false;
}
- //Deny access by default.
- return false;
+ //Null concealing operator means, that no
+ return $this->resolver->inherit($user, 'parts', $attribute) ?? false;
+
}
}
diff --git a/src/Security/Voter/PricedetailVoter.php b/src/Security/Voter/PricedetailVoter.php
new file mode 100644
index 00000000..19972fad
--- /dev/null
+++ b/src/Security/Voter/PricedetailVoter.php
@@ -0,0 +1,57 @@
+.
+ */
+
+namespace App\Security\Voter;
+
+
+use App\Entity\Parts\PartLot;
+use App\Entity\PriceInformations\Pricedetail;
+use App\Entity\UserSystem\User;
+
+class PricedetailVoter extends ExtendedVoter
+{
+ /** @var string[] When this permsission are encountered, they are checked on part */
+ protected const PART_PERMS = ['show_history', 'revert_element'];
+
+ /**
+ * @inheritDoc
+ */
+ protected function voteOnUser($attribute, $subject, User $user): bool
+ {
+ if (in_array($attribute, self::PART_PERMS, true)) {
+ return $this->resolver->inherit($user, 'parts', $attribute) ?? false;
+ }
+
+ return $this->resolver->inherit($user, 'parts_prices', $attribute) ?? false;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ protected function supports($attribute, $subject)
+ {
+ if (is_a($subject, Pricedetail::class, true)) {
+ return in_array($attribute, array_merge(
+ self::PART_PERMS,
+ $this->resolver->listOperationsForPermission('parts_prices')
+ ), true);
+ }
+ }
+}
\ No newline at end of file
diff --git a/src/Security/Voter/StructureVoter.php b/src/Security/Voter/StructureVoter.php
index e2699b48..d5d6eb51 100644
--- a/src/Security/Voter/StructureVoter.php
+++ b/src/Security/Voter/StructureVoter.php
@@ -43,11 +43,13 @@ declare(strict_types=1);
namespace App\Security\Voter;
use App\Entity\Attachments\AttachmentType;
+use App\Entity\Base\AbstractStructuralDBElement;
use App\Entity\Devices\Device;
use App\Entity\Parts\Category;
use App\Entity\Parts\Footprint;
use App\Entity\Parts\Manufacturer;
use App\Entity\Parts\MeasurementUnit;
+use App\Entity\Parts\Part;
use App\Entity\Parts\Storelocation;
use App\Entity\Parts\Supplier;
use App\Entity\PriceInformations\Currency;
@@ -67,24 +69,29 @@ class StructureVoter extends ExtendedVoter
*/
protected function supports($attribute, $subject)
{
- if (is_object($subject)) {
+ if (is_object($subject) || is_string($subject)) {
$permission_name = $this->instanceToPermissionName($subject);
//If permission name is null, then the subject is not supported
return (null !== $permission_name) && $this->resolver->isValidOperation($permission_name, $attribute);
}
+
return false;
}
/**
* Maps a instance type to the permission name.
*
- * @param mixed $subject The subject for which the permission name should be generated
+ * @param object|string $subject The subject for which the permission name should be generated
*
* @return string|null the name of the permission for the subject's type or null, if the subject is not supported
*/
protected function instanceToPermissionName($subject): ?string
{
- $class_name = get_class($subject);
+ if (!is_string($subject)) {
+ $class_name = get_class($subject);
+ } else {
+ $class_name = $subject;
+ }
switch ($class_name) {
case AttachmentType::class:
return 'attachment_types';
diff --git a/src/Security/Voter/UserVoter.php b/src/Security/Voter/UserVoter.php
index d724a2e6..de7d165b 100644
--- a/src/Security/Voter/UserVoter.php
+++ b/src/Security/Voter/UserVoter.php
@@ -57,11 +57,11 @@ class UserVoter extends ExtendedVoter
*/
protected function supports($attribute, $subject)
{
- if ($subject instanceof User) {
+ if (is_a($subject, User::class, true)) {
return in_array($attribute, array_merge(
$this->resolver->listOperationsForPermission('users'),
$this->resolver->listOperationsForPermission('self')),
- false
+ false
);
}
@@ -89,10 +89,11 @@ class UserVoter extends ExtendedVoter
return $tmp;
}
}
- //Else just check users permission:
- if ($this->resolver->isValidOperation('users', $attribute)) {
- return $this->resolver->inherit($user, 'users', $attribute) ?? false;
- }
+ }
+
+ //Else just check users permission:
+ if ($this->resolver->isValidOperation('users', $attribute)) {
+ return $this->resolver->inherit($user, 'users', $attribute) ?? false;
}
return false;
diff --git a/templates/AdminPages/EntityAdminBase.html.twig b/templates/AdminPages/EntityAdminBase.html.twig
index ce2ef29d..f298b841 100644
--- a/templates/AdminPages/EntityAdminBase.html.twig
+++ b/templates/AdminPages/EntityAdminBase.html.twig
@@ -59,8 +59,8 @@