diff --git a/src/Controller/LogController.php b/src/Controller/LogController.php index 1bd3620e..b1f7e343 100644 --- a/src/Controller/LogController.php +++ b/src/Controller/LogController.php @@ -42,8 +42,10 @@ class LogController extends AbstractController * * @return JsonResponse|Response */ - public function showCategory(Request $request, DataTableFactory $dataTable) + public function showLogs(Request $request, DataTableFactory $dataTable) { + $this->denyAccessUnlessGranted('@system.show_logs'); + $table = $dataTable->createFromType(LogDataTable::class) ->handleRequest($request); diff --git a/src/Security/Voter/LogEntryVoter.php b/src/Security/Voter/LogEntryVoter.php new file mode 100644 index 00000000..1e2a8476 --- /dev/null +++ b/src/Security/Voter/LogEntryVoter.php @@ -0,0 +1,70 @@ +resolver->inherit($user, 'system', 'delete_logs') ?? false; + } + + if ($attribute === 'read') { + //Allow read of the users own log entries + if ( + $subject->getUser() === $user + && $this->resolver->inherit($user, 'self', 'show_logs') + ) { + return true; + } + + return $this->resolver->inherit($user, 'system','show_logs') ?? false; + } + } + + return false; + } + + /** + * @inheritDoc + */ + protected function supports($attribute, $subject) + { + if ($subject instanceof AbstractLogEntry) { + return in_array($subject, static::ALLOWED_OPS); + } + + return false; + } +} \ No newline at end of file diff --git a/src/Security/Voter/PermissionVoter.php b/src/Security/Voter/PermissionVoter.php index bd708e39..868a20a9 100644 --- a/src/Security/Voter/PermissionVoter.php +++ b/src/Security/Voter/PermissionVoter.php @@ -28,6 +28,7 @@ use App\Entity\UserSystem\User; /** * This voter allows you to directly check permissions from the permission structure, without passing an object. + * This use the syntax like "@permission.op" * However you should use the "normal" object based voters if possible, because they are needed for a future ACL system. */ class PermissionVoter extends ExtendedVoter @@ -44,7 +45,7 @@ class PermissionVoter extends ExtendedVoter $attribute = ltrim($attribute, '@'); [$perm, $op] = explode('.', $attribute); - return $this->resolver->inherit($user, $perm, $op); + return $this->resolver->inherit($user, $perm, $op) ?? false; } /** diff --git a/src/Services/Trees/ToolsTreeBuilder.php b/src/Services/Trees/ToolsTreeBuilder.php index 414ec679..b482c8b2 100644 --- a/src/Services/Trees/ToolsTreeBuilder.php +++ b/src/Services/Trees/ToolsTreeBuilder.php @@ -212,6 +212,13 @@ class ToolsTreeBuilder ); } + if ($this->security->isGranted('@system.show_logs')) { + $nodes[] = new TreeViewNode( + $this->translator->trans('tree.tools.system.event_log'), + $this->urlGenerator->generate('log_view') + ); + } + return $nodes; } }