mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-09-01 08:17:00 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Check permissions for time travel and element undo.

Browse source
This commit is contained in:
Jan Böhmer 2020-03-07 20:49:52 +01:00
parent 254d4e6c69
commit 8a61b465d0
23 changed files with 370 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/Security/Voter/LogEntryVoter.php
View file

@ -51,25 +51,21 @@ class LogEntryVoter extends ExtendedVoter
protected function voteOnUser($attribute, $subject, User $user): bool
{
if ($subject instanceof AbstractLogEntry) {
if ('delete' === $attribute) {
return $this->resolver->inherit($user, 'system', 'delete_logs') ?? false;
}
if ('read' === $attribute) {
//Allow read of the users own log entries
if (
$subject->getUser() === $user
&& $this->resolver->inherit($user, 'self', 'show_logs')
) {
return true;
}
return $this->resolver->inherit($user, 'system', 'show_logs') ?? false;
}
if ('delete' === $attribute) {
return $this->resolver->inherit($user, 'system', 'delete_logs') ?? false;
}
return false;
if ('read' === $attribute) {
//Allow read of the users own log entries
if (
$subject->getUser() === $user
&& $this->resolver->inherit($user, 'self', 'show_logs')
) {
return true;
}
return $this->resolver->inherit($user, 'system', 'show_logs') ?? false;
}
}
protected function supports($attribute, $subject)