MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [ACL] Event report permission

pull/8753/head
Jakub Onderka 2022-11-14 15:48:11 +01:00
parent f33b6e8231
commit dd1d49cc76
3 changed files with 25 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
app/Controller/Component/ACLComponent.php
View File

@ -974,27 +974,6 @@ class ACLComponent extends Component
return $user['org_id'] == $tagCollection['TagCollection']['org_id'];
}
/**
* Only site admin and event creator can modify an eventReport
*
* @param array $user
* @param array $report
* @return boolean
*/
public function canEditReport(array $user, array $report): bool
{
if ($user['Role']['perm_site_admin']) {
return true;
}
if (empty($report['Event'])) {
return __('Could not find associated event');
}
if ($report['Event']['orgc_id'] != $user['org_id']) {
return __('Only the creator organisation of the event can modify the report');
}
return true;
}
/**
* Only users that can modify organisation can delete sightings as sighting is not linked to user.
*
@ -1024,7 +1003,7 @@ class ACLComponent extends Component
*/
public function canEditEventReport(array $user, array $eventReport)
{
if (!isset($report['Event'])) {
if (!isset($eventReport['Event'])) {
throw new InvalidArgumentException('Passed object does not contain an Event.');
}
if ($user['Role']['perm_site_admin']) {

4
app/Controller/EventReportsController.php
View File

@ -492,9 +492,9 @@ class EventReportsController extends AppController
$this->set('sharingGroups', $sgs);
}
private function __injectPermissionsToViewContext($user, $report)
private function __injectPermissionsToViewContext(array $user, array $report)
{
$canEdit = $this->ACL->canEditReport($user, $report) === true;
$canEdit = $this->ACL->canEditEventReport($user, $report);
$this->set('canEdit', $canEdit);
}

42
app/View/Helper/AclHelper.php
View File

@ -6,10 +6,22 @@ class AclHelper extends Helper
/** @var ACLComponent */
private $ACL;
/** @var array */
private $me;
public function __construct(View $View, $settings = [])
{
parent::__construct($View, $settings);
$this->ACL = $View->viewVars['aclComponent'];
if (!$this->ACL instanceof ACLComponent) {
throw new InvalidArgumentException('ACL not provided.');
}
$this->me = $View->viewVars['me'];
if (empty($this->me)) {
throw new InvalidArgumentException('Me variable not provided.');
}
}
/**
@ -19,8 +31,7 @@ class AclHelper extends Helper
*/
public function canAccess($controller, $action)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canUserAccess($me, $controller, $action);
return $this->ACL->canUserAccess($this->me, $controller, $action);
}
/**
@ -29,8 +40,7 @@ class AclHelper extends Helper
*/
public function canModifyEvent(array $event)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canModifyEvent($me, $event);
return $this->ACL->canModifyEvent($this->me, $event);
}
/**
@ -39,8 +49,7 @@ class AclHelper extends Helper
*/
public function canPublishEvent(array $event)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canPublishEvent($me, $event);
return $this->ACL->canPublishEvent($this->me, $event);
}
/**
@ -50,8 +59,7 @@ class AclHelper extends Helper
*/
public function canModifyTag(array $event, $isTagLocal = false)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canModifyTag($me, $event, $isTagLocal);
return $this->ACL->canModifyTag($this->me, $event, $isTagLocal);
}
/**
@ -60,8 +68,7 @@ class AclHelper extends Helper
*/
public function canDisableCorrelation(array $event)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canDisableCorrelation($me, $event);
return $this->ACL->canDisableCorrelation($this->me, $event);
}
/**
@ -70,8 +77,7 @@ class AclHelper extends Helper
*/
public function canModifyTagCollection(array $tagCollection)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canModifyTagCollection($me, $tagCollection);
return $this->ACL->canModifyTagCollection($this->me, $tagCollection);
}
/**
@ -80,8 +86,7 @@ class AclHelper extends Helper
*/
public function canDeleteSighting(array $sighting)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canDeleteSighting($me, $sighting);
return $this->ACL->canDeleteSighting($this->me, $sighting);
}
/**
@ -90,8 +95,7 @@ class AclHelper extends Helper
*/
public function canEditEventReport(array $eventReport)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canEditReport($me, $eventReport);
return $this->ACL->canEditEventReport($this->me, $eventReport);
}
/**
@ -100,8 +104,7 @@ class AclHelper extends Helper
*/
public function canModifyGalaxyCluster(array $cluster)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canModifyGalaxyCluster($me, $cluster);
return $this->ACL->canModifyGalaxyCluster($this->me, $cluster);
}
/**
@ -110,7 +113,6 @@ class AclHelper extends Helper
*/
public function canPublishGalaxyCluster(array $cluster)
{
$me = $this->_View->viewVars['me'];
return $this->ACL->canModifyGalaxyCluster($me, $cluster);
return $this->ACL->canModifyGalaxyCluster($this->me, $cluster);
}
}