cerebrate-project
/
cerebrate
mirror of https://github.com/cerebrate-project/cerebrate
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: [ACL] tightening for delete functions 

- implemented beforeSave() function in the CRUD::delete() functionality
- added correct handling for the organisation level encryption keys in the beforeSave constructor
pull/85/head
iglocska 2022-01-18 15:35:55 +01:00
parent c35d67ebca
commit 8cb24baf5f
No known key found for this signature in database
GPG Key ID: BEA224F1FEF113AC
2 changed files with 54 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Controller/Component/CRUDComponent.php
View File

@ -442,6 +442,12 @@ class CRUDComponent extends Component
if (empty($data)) {
throw new NotFoundException(__('Invalid {0}.', $this->ObjectAlias));
}
if (isset($params['beforeSave'])) {
$data = $params['beforeSave']($data);
if ($data === false) {
throw new NotFoundException(__('Could not save {0} due to the input failing to meet expectations. Your input is bad and you should feel bad.', $this->ObjectAlias));
}
}
$this->Controller->set('id', $data['id']);
$this->Controller->set('data', $data);
$this->Controller->set('bulkEnabled', false);
@ -453,6 +459,7 @@ class CRUDComponent extends Component
$isBulk = count($ids) > 1;
$bulkSuccesses = 0;
foreach ($ids as $id) {
$skipExecution = false;
$data = $this->Table->find()->where([$this->Table->getAlias() . '.id' => $id]);
if (!empty($params['conditions'])) {
$data->where($params['conditions']);
@ -460,6 +467,14 @@ class CRUDComponent extends Component
if (!empty($params['contain'])) {
$data->contain($params['contain']);
}
if (isset($params['beforeSave'])) {
$data = $params['beforeSave']($data);
if ($data === false) {
$skipExecution = true;
$success = false;
}
}
if (!$skipExecution) {
$data = $data->first();
if (!empty($data)) {
$success = $this->Table->delete($data);
@ -471,6 +486,7 @@ class CRUDComponent extends Component
$bulkSuccesses++;
}
}
}
$message = $this->getMessageBasedOnResult(
$bulkSuccesses == count($ids),
$isBulk,

8
src/Controller/EncryptionKeysController.php
View File

@ -57,6 +57,7 @@ class EncryptionKeysController extends AppController
private function buildBeforeSave(array $params, $currentUser, array &$orgConditions, array &$individualConditions, array &$dropdownData): array
{
if (empty($currentUser['role']['perm_admin'])) {
$orgConditions = [
'id' => $currentUser['organisation_id']
];
@ -67,7 +68,9 @@ class EncryptionKeysController extends AppController
}
$params['beforeSave'] = function($entity) use($currentUser) {
if ($entity['owner_model'] === 'organisation') {
$entity['owner_id'] = $currentUser['organisation_id'];
if ($entity['owner_id'] !== $currentUser['organisation_id']) {
throw new MethodNotAllowedException(__('Selected organisation cannot be linked by the current user.'));
}
} else {
if ($currentUser['role']['perm_org_admin']) {
$this->loadModel('Alignments');
@ -87,6 +90,7 @@ class EncryptionKeysController extends AppController
}
return $entity;
};
}
$this->loadModel('Organisations');
$this->loadModel('Individuals');
$dropdownData = [
@ -105,9 +109,7 @@ class EncryptionKeysController extends AppController
$params = [
'redirect' => $this->referer()
];
if (empty($currentUser['role']['perm_admin'])) {
$params = $this->buildBeforeSave($params, $currentUser, $orgConditions, $individualConditions, $dropdownData);
}
$this->CRUD->add($params);
$responsePayload = $this->CRUD->getResponsePayload();
if (!empty($responsePayload)) {