File modules/cms/action/ProjectAction.class.php

Last commit: Sun Mar 14 22:29:56 2021 +0100	Jan Dankert	Refactoring: Clearer access check.


     1 <?php
     2 
     3 namespace cms\action;
     4 
     5 use cms\base\Configuration;
     6 use cms\model\Permission;
     7 use cms\model\Folder;
     8 use cms\model\Project;
     9 use language\Messages;
    10 use util\exception\SecurityException;
    11 
    12 // OpenRat Content Management System
    13 // Copyright (C) 2002-2012 Jan Dankert, cms@jandankert.de
    14 //
    15 // This program is free software; you can redistribute it and/or
    16 // modify it under the terms of the GNU General Public License
    17 // as published by the Free Software Foundation; either version 2
    18 // of the License, or (at your option) any later version.
    19 //
    20 // This program is distributed in the hope that it will be useful,
    21 // but WITHOUT ANY WARRANTY; without even the implied warranty of
    22 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    23 // GNU General Public License for more details.
    24 //
    25 // You should have received a copy of the GNU General Public License
    26 // along with this program; if not, write to the Free Software
    27 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
    28 
    29 
    30 /**
    31  * Action-Klasse zum Bearbeiten eines Projektes
    32  * @author $Author$
    33  * @version $Revision$
    34  * @package openrat.actions
    35  */
    36 class ProjectAction extends BaseAction
    37 {
    38     /**
    39      * @var Project
    40      */
    41 	protected $project;
    42 
    43 
    44 	function __construct()
    45 	{
    46         parent::__construct();
    47     }
    48 
    49 
    50     public function init()
    51     {
    52 		$this->project = new Project( $this->request->getId() );
    53 		$this->project->load();
    54 
    55 		if   ( ! $this->userMayReadProject() ) {
    56 			throw new SecurityException();
    57 		}
    58 	}
    59 
    60 
    61 	/**
    62 	 * Stellt fest, ob der angemeldete Benutzer Projekt-Admin ist.
    63 	 * Dies ist der Fall, wenn der Benutzer PROP-Rechte im Root-Folder hat.
    64 	 * @return bool|int
    65 	 */
    66 	protected function userIsProjectAdmin() {
    67 
    68 		$rootFolder = new Folder( $this->project->getRootObjectId() );
    69 
    70 		return $rootFolder->hasRight(Permission::ACL_PROP);
    71 	}
    72 
    73 
    74 	/**
    75 	 * Stellt fest, ob der angemeldete Benutzer Projekt-Admin ist.
    76 	 * Dies ist der Fall, wenn der Benutzer PROP-Rechte im Root-Folder hat.
    77 	 * @return bool|int
    78 	 */
    79 	protected function userMayReadProject() {
    80 
    81 		$rootFolder = new Folder( $this->project->getRootObjectId() );
    82 
    83 		return $rootFolder->hasRight(Permission::ACL_READ);
    84 	}
    85 
    86 
    87 
    88 	/**
    89 	 * Make a linkable hostname
    90 	 *
    91 	 * @param $hostname
    92 	 * @return string
    93 	 */
    94 	protected function makeAbsoluteHostnameLink( $hostname ) {
    95 		if    ( strpos($hostname,'//') === false )
    96 			return 'http://'.$hostname;
    97 		return $hostname;
    98 	}
    99 
   100 
   101 
   102 	/**
   103 	 * User must be an administrator.
   104 	 */
   105 	public function checkAccess() {
   106 		if   ( ! $this->userIsAdmin() )
   107 			throw new SecurityException();
   108 	}
   109 
   110 }



Download modules/cms/action/ProjectAction.class.php


History
Sun, 14 Mar 2021 22:29:56 +0100	Jan Dankert	Refactoring: Clearer access check.
Sat, 6 Mar 2021 03:42:38 +0100	Jan Dankert	New: Better permission checks.
Fri, 26 Feb 2021 01:06:01 +0100	Jan Dankert	Refactoring accessing the request parameter values.
Mon, 4 Jan 2021 19:03:18 +0100	Jan Dankert	Refactoring: ACL class is renamed to Permission, because most RBAC/DMAC concepts are calling it a permission.
Wed, 18 Nov 2020 00:18:10 +0100	Jan Dankert	Refactoring Part 2: Removing all unnecessary methods in the action base classes.
Tue, 17 Nov 2020 23:51:00 +0100	Jan Dankert	Refactoring: Every Actionmethod has now its own class.
Sat, 14 Nov 2020 22:02:21 +0100	Jan Dankert	Fixed: Notices may display a message.
Sun, 1 Nov 2020 03:08:55 +0100	Jan Dankert	Replaced the calls to "Configuration::rawConfig()" with the OO style calls; Cleanup LoginAction.
Mon, 26 Oct 2020 21:36:14 +0100	Jan Dankert	Rename css class 'clickable' to 'act-clickable'; enhanced view 'info' for projects.
Wed, 21 Oct 2020 00:26:06 +0200	Jan Dankert	Using fieldsets in all templates (replacing the old '')
Fri, 2 Oct 2020 23:11:48 +0200	Jan Dankert	Cleanup: No '.inputholder' any more, notices with links to objects.
Tue, 29 Sep 2020 22:17:11 +0200	Jan Dankert	Refactoring: Do not use global constants.
Sat, 26 Sep 2020 12:20:43 +0200	Jan Dankert	Refactoring: No global variables like $SESS  any more. All constants are capsulated by classes.
Sat, 26 Sep 2020 10:32:02 +0200	Jan Dankert	Refactoring: No global $conf array any more.
Sat, 26 Sep 2020 04:03:53 +0200	Jan Dankert	Refactoring: read language keys with a class.
Sat, 26 Sep 2020 03:03:47 +0200	Jan Dankert	Refactoring: less global functions.
Sat, 26 Sep 2020 02:26:39 +0200	Jan Dankert	Refactoring: No global functions any more, the database object is read from the Db class.
Mon, 21 Sep 2020 22:48:59 +0200	Jan Dankert	Complexe refactoring: Moving all generation logic from the model (Value,Page,File) to generators classes.
Thu, 10 Sep 2020 18:30:16 +0200	Jan Dankert	Some code cleanup, killing the old "checkMenu()"-methods.
Sun, 23 Feb 2020 04:01:30 +0100	Jan Dankert	Refactoring with Namespaces for the cms modules, part 1: moving.