mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-28 04:30:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Make user info page public for all logged in user

Browse source
This commit is contained in:
Jan Böhmer 2023-04-08 01:04:10 +02:00
parent bcda71cb25
commit b0d2a22f62
2 changed files with 33 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/Security/Voter/UserVoter.php
View file

@ -38,10 +38,13 @@ class UserVoter extends ExtendedVoter
protected function supports(string $attribute, $subject): bool
{
if (is_a($subject, User::class, true)) {
return in_array($attribute, array_merge(
$this->resolver->listOperationsForPermission('users'),
$this->resolver->listOperationsForPermission('self')),
false
return in_array($attribute,
array_merge(
$this->resolver->listOperationsForPermission('users'),
$this->resolver->listOperationsForPermission('self'),
['info']
),
false
);
}
@ -56,6 +59,16 @@ class UserVoter extends ExtendedVoter
*/
protected function voteOnUser(string $attribute, $subject, User $user): bool
{
if ($attribute === 'info') {
//Every logged-in user (non-anonymous) can see the info pages of other users
if (!$user->isAnonymousUser()) {
return true;
}
//For the anonymous user, use the user read permission
$attribute = 'read';
}
//Check if the checked user is the user itself
if (($subject instanceof User) && $subject->getID() === $user->getID() &&
$this->resolver->isValidOperation('self', $attribute)) {