Skip to content

Commit 111ef3b

Browse files
seto1ryuring
seto1
and
ryuring
authored
Merge commit from fork
* API実行権限調整 * 管理画面テーマの選択の不具合を改善 fix #3884 --------- Co-authored-by: ryuring <egashira@catchup.co.jp>
1 parent 3e33c2c commit 111ef3b

File tree

5 files changed

+15
-15
lines changed

5 files changed

+15
-15
lines changed

‎plugins/baser-core/config/permission.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
'plugin' => 'BaserCore',
2424
'type' => 'Admin',
2525
'items' => [
26-
'Edit' => ['title' => __d('baser_core', '編集'), 'url' => '/baser/admin/baser-core/content_folders/edit/*', 'method' => 'POST', 'auth' => false]
26+
'Edit' => ['title' => __d('baser_core', '編集'), 'url' => '/baser/admin/baser-core/content_folders/edit/*', 'method' => 'POST', 'auth' => true]
2727
]
2828
],
2929

@@ -33,9 +33,11 @@
3333
'type' => 'Admin',
3434
'items' => [
3535
'Index' => ['title' => __d('baser_core', '一覧'), 'url' => '/baser/admin/baser-core/contents/index', 'method' => '*', 'auth' => true],
36+
'Add' => ['title' => __d('baser_core', '登録'), 'url' => '/baser/admin/baser-core/contents/add', 'method' => '*', 'auth' => true],
37+
'Delete' => ['title' => __d('baser_core', '削除'), 'url' => '/baser/admin/baser-core/contents/delete', 'method' => '*', 'auth' => true],
3638
'Edit' => ['title' => __d('baser_core', 'ゴミ箱'), 'url' => '/baser/admin/baser-core/contents/trash_index', 'method' => 'GET', 'auth' => true],
3739
'EditAlias' => ['title' => __d('baser_core', 'エイリアス編集'), 'url' => '/baser/admin/baser-core/contents/edit_alias/*', 'method' => 'POST', 'auth' => true],
38-
'Delete' => ['title' => __d('baser_core', 'ゴミ箱から戻す'), 'method' => 'POST', 'url' => '/baser/admin/baser-core/contents/trash_return/*', 'auth' => true],
40+
'TrashReturn' => ['title' => __d('baser_core', 'ゴミ箱から戻す'), 'method' => 'POST', 'url' => '/baser/admin/baser-core/contents/trash_return/*', 'auth' => true],
3941
]
4042
],
4143

@@ -186,7 +188,7 @@
186188
'items' => [
187189
'Index' => ['title' => __d('baser_core', '一覧取得'), 'url' => '/baser/api/admin/baser-core/content_folders/index.json', 'method' => '*', 'auth' => true],
188190
'View' => ['title' => __d('baser_core', '単一取得'), 'url' => '/baser/api/admin/baser-core/content_folders/view/*.json', 'method' => '*', 'auth' => true],
189-
'Add' => ['title' => __d('baser_core', '新規登録'), 'url' => '/baser/api/admin/baser-core/content_folders/add.json', 'method' => 'POST', 'auth' => false],
191+
'Add' => ['title' => __d('baser_core', '新規登録'), 'url' => '/baser/api/admin/baser-core/content_folders/add.json', 'method' => 'POST', 'auth' => true],
190192
'Edit' => ['title' => __d('baser_core', '編集'), 'url' => '/baser/api/admin/baser-core/content_folders/edit/*.json', 'method' => 'POST', 'auth' => false],
191193
'Delete' => ['title' => __d('baser_core', '削除'), 'url' => '/baser/api/admin/baser-core/content_folders/delete/*.json', 'method' => 'POST', 'auth' => false]
192194
]

‎plugins/baser-core/config/setting.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -598,7 +598,9 @@
598598
'/baser-core/users/logout',
599599
'/baser-core/password_requests/*',
600600
'/baser/api/admin/baser-core/users/login.json',
601-
'/baser/api/admin/baser-core/users/refresh_token.json'
601+
'/baser/api/admin/baser-core/users/refresh_token.json',
602+
'/baser/api/admin/baser-core/utilities/save_search_opened/*/*.json',
603+
'/baser/api/admin/baser-core/plugins/get_available_core_version_info.json',
602604
]
603605
],
604606

‎plugins/baser-core/src/Controller/AppController.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -165,13 +165,16 @@ public function beforeFilter(EventInterface $event)
165165
if ($this->requirePermission($this->getRequest()) && !$this->checkPermission()) {
166166
$prefix = BcUtil::getRequestPrefix($this->getRequest());
167167
if ($prefix === 'Api/Admin') {
168-
throw new ForbiddenException(__d('baser_core', '指定されたAPIエンドポイントへのアクセスは許可されていません。'));
168+
throw new ForbiddenException(__d('baser_core', '指定されたAPIエンドポイントへのアクセスは許可されていません。必要な場合、システム管理者に「{0} {1}」へのアクセス許可を依頼してください。',
169+
[$this->getRequest()->getMethod(), $this->getRequest()->getPath()]));
169170
} else {
170171
if (BcUtil::loginUser()) {
171172
if ($this->getRequest()->getMethod() === 'GET') {
172-
$this->BcMessage->setError(__d('baser_core', '指定されたページへのアクセスは許可されていません。'));
173+
$this->BcMessage->setError(__d('baser_core', '指定されたページへのアクセスは許可されていません。必要な場合、システム管理者に「{0} {1}」へのアクセス許可を依頼してください。',
174+
[$this->getRequest()->getMethod(), $this->getRequest()->getPath()]));
173175
} else {
174-
$this->BcMessage->setError(__d('baser_core', '実行した操作は許可されていません。'));
176+
$this->BcMessage->setError(__d('baser_core', '実行した操作は許可されていません。必要な場合、システム管理者に「{0} {1}」へのアクセス許可を依頼してください。',
177+
[$this->getRequest()->getMethod(), $this->getRequest()->getPath()]));
175178
}
176179
$url = Configure::read("BcPrefixAuth.{$prefix}.loginRedirect");
177180
} else {

‎plugins/baser-core/src/Service/PermissionsService.php‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -480,13 +480,6 @@ private function checkGroup(
480480
if ($type === 1) return true;
481481
}
482482

483-
if($prefix === 'Api/Admin') {
484-
// 管理画面からAPIのURLを参照した場合は無条件に true
485-
if (BcUtil::isAdminSystem()) return true;
486-
// 管理画面から呼び出された API は無条件に true
487-
if (BcUtil::isSameReferrerAsCurrent()) return true;
488-
}
489-
490483
// URLのプレフィックスを標準の文字列に戻す
491484
foreach(Configure::read('BcPrefixAuth') as $key => $value) {
492485
$prefixAreas = Configure::read('BcApp.' . Inflector::variable($key) . 'Prefix');

‎plugins/bc-uploader/config/permission.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@
8989
'type' => 'Api/Admin',
9090
'items' => [
9191
'index' => ['title' => __d('baser_core', '一覧取得'), 'url' => '/baser/api/admin/bc-uploader/uploader_files/index.json', 'method' => 'GET', 'auth' => true],
92-
'Add' => ['title' => __d('baser_core', '新規追加'), 'url' => '/baser/api/admin/bc-uploader/uploader_files/add.json', 'method' => 'POST', 'auth' => true],
92+
'Add' => ['title' => __d('baser_core', '新規追加'), 'url' => '/baser/api/admin/bc-uploader/uploader_files/upload.json', 'method' => 'POST', 'auth' => true],
9393
'edit' => ['title' => __d('baser_core', '編集'), 'url' => '/baser/api/admin/bc-uploader/uploader_files/edit/*.json', 'method' => 'POST', 'auth' => true],
9494
'delete' => ['title' => __d('baser_core', '削除'), 'url' => '/baser/api/admin/bc-uploader/uploader_files/delete/*.json', 'method' => 'POST', 'auth' => true],
9595
]

0 commit comments

Comments
 (0)