File modules/cms/action/ObjectAction.class.php

Last commit: Sat Mar 19 00:09:47 2022 +0100	dankert	Refactoring: Outputs are setting their content-type themself.


     1 <?php
     2 
     3 namespace cms\action;
     4 
     5 use cms\model\Permission;
     6 use cms\model\BaseObject;
     7 use cms\model\File;
     8 use cms\model\Folder;
     9 use cms\model\Group;
    10 use cms\model\Language;
    11 use cms\model\Link;
    12 use cms\model\Page;
    13 use cms\model\Project;
    14 use cms\model\User;
    15 use language\Messages;
    16 use util\ArrayUtils;
    17 use util\exception\SecurityException;
    18 use util\exception\ValidationException;
    19 use util\Http;
    20 use util\Session;
    21 
    22 
    23 /**
    24  * Basis-Action-Klasse zum Bearbeiten des Basis-Objektes.
    25  * @author Jan Dankert
    26  */
    27 
    28 class ObjectAction extends BaseAction
    29 {
    30 	private $objectid;
    31 
    32     /**
    33      * @var BaseObject
    34      */
    35 	protected $baseObject;
    36 
    37 	public function __construct()
    38     {
    39         parent::__construct();
    40 
    41     }
    42 
    43 
    44 	/**
    45 	 * Should be overwritten by subclasses.
    46 	 *
    47 	 * @return int Permission-flag.
    48 	 */
    49     public function getRequiredPermission() {
    50 		return Permission::ACL_READ;
    51 	}
    52 
    53 
    54     public function init()
    55     {
    56 		$baseObject = new BaseObject( $this->request->getId() );
    57 		$baseObject->objectLoad();
    58 
    59 		$this->setBaseObject( $baseObject );
    60 
    61 		$this->addHeader('X-CMS-OID',$baseObject->objectid );
    62 	}
    63 
    64 
    65 	protected function setBaseObject( $baseObject ) {
    66 
    67 		$this->baseObject = $baseObject;
    68 	}
    69 
    70 
    71     /**
    72      * Stellt fest, ob der angemeldete Benutzer Projekt-Admin ist.
    73      * Dies ist der Fall, wenn der Benutzer PROP-Rechte im Root-Folder hat.
    74      * @return bool|int
    75      */
    76     protected function userIsProjectAdmin() {
    77 
    78 	    $project = new Project( $this->baseObject->projectid );
    79 	    $rootFolder = new Folder( $project->getRootObjectId() );
    80 
    81 	    return $rootFolder->hasRight(Permission::ACL_PROP);
    82     }
    83 
    84 
    85     /**
    86 	 * Checks if the current user has sufficient rights.
    87 	 *
    88 	 * If not, an exception is thrown.
    89 	 *
    90      * @return bool
    91      */
    92     public function checkAccess() {
    93 
    94 		$requiredPermission = $this->getRequiredPermission();
    95 
    96 		if   ( ! $this->baseObject->hasRight($requiredPermission) )
    97 	    	throw new SecurityException('User has insufficient permissions ('.$requiredPermission.')' );
    98     }
    99 }



Download modules/cms/action/ObjectAction.class.php


History
Sat, 19 Mar 2022 00:09:47 +0100	dankert	Refactoring: Outputs are setting their content-type themself.
Sun, 14 Mar 2021 22:29:56 +0100	Jan Dankert	Refactoring: Clearer access check.
Sat, 6 Mar 2021 03:42:38 +0100	Jan Dankert	New: Better permission checks.
Sat, 6 Mar 2021 02:50:20 +0100	Jan Dankert	New: Enable actions for guest users.
Sat, 6 Mar 2021 02:09:25 +0100	Jan Dankert	New: Allow permissions for guests only.
Fri, 26 Feb 2021 01:06:01 +0100	Jan Dankert	Refactoring accessing the request parameter values.
Mon, 4 Jan 2021 19:03:18 +0100	Jan Dankert	Refactoring: ACL class is renamed to Permission, because most RBAC/DMAC concepts are calling it a permission.
Wed, 18 Nov 2020 00:18:10 +0100	Jan Dankert	Refactoring Part 2: Removing all unnecessary methods in the action base classes.
Tue, 17 Nov 2020 23:51:00 +0100	Jan Dankert	Refactoring: Every Actionmethod has now its own class.
Sun, 15 Nov 2020 00:00:33 +0100	Jan Dankert	Fix: Editing of names and descriptions for pages and other objects.
Sat, 14 Nov 2020 22:32:01 +0100	Jan Dankert	Fix: Show name/description of default language.
Fri, 2 Oct 2020 23:11:48 +0200	Jan Dankert	Cleanup: No '.inputholder' any more, notices with links to objects.
Tue, 29 Sep 2020 22:17:11 +0200	Jan Dankert	Refactoring: Do not use global constants.
Tue, 29 Sep 2020 20:25:22 +0200	Jan Dankert	Cleanup: using the parent infoView()
Sat, 26 Sep 2020 04:03:53 +0200	Jan Dankert	Refactoring: read language keys with a class.
Sun, 23 Feb 2020 04:01:30 +0100	Jan Dankert	Refactoring with Namespaces for the cms modules, part 1: moving.