Skip to content

Commit ba9ee1b

Browse files
smg6511smg6511
committed
User Group & ACLs updates
Apply new permissions methods
1 parent e709b70 commit ba9ee1b

File tree

14 files changed

+284
-175
lines changed

14 files changed

+284
-175
lines changed

Diff for: ‎core/src/Revolution/Processors/Security/Access/UserGroup/AccessNamespace/GetList.php

+34-20
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,13 @@ class GetList extends GetListProcessor
4242
/** @var modUserGroup $userGroup */
4343
public $userGroup;
4444

45+
/** @var bool $canCreate Whether user can assign a new Category ACL entry for a given User Group */
46+
public $canCreate = false;
47+
/** @var bool $canEdit Whether user can change a Category ACL entry for a given User Group */
48+
public $canEdit = false;
49+
/** @var bool $canRemove Whether user can remove a Category ACL entry for a given User Group */
50+
public $canRemove = false;
51+
4552
/**
4653
* @return bool
4754
*/
@@ -64,6 +71,15 @@ public function initialize()
6471
if ($this->getProperty('sort') == 'role_display') {
6572
$this->setProperty('sort', 'authority');
6673
}
74+
/*
75+
Currently, all actions essentially relate to editing a User Group.
76+
Nonetheless, we maintain each separately to remain consistent with how permissions
77+
are relayed throughout the MODX app
78+
*/
79+
$canChange = $this->modx->hasPermission('usergroup_edit') && $this->modx->hasPermission('usergroup_save');
80+
$this->canCreate = $canChange;
81+
$this->canEdit = $canChange;
82+
$this->canRemove = $canChange;
6783
return $initialized;
6884
}
6985

@@ -142,33 +158,31 @@ public function useSecondaryGroupCondition(string $sortBy, string $groupBy, stri
142158
*/
143159
public function prepareRow(xPDOObject $object)
144160
{
145-
$objectArray = $object->toArray();
146-
if (empty($objectArray['name'])) {
147-
$objectArray['name'] = '(' . $this->modx->lexicon('none') . ')';
161+
$permissions = [
162+
'create' => $this->canCreate,
163+
'update' => $this->canEdit,
164+
'delete' => $this->canRemove
165+
];
166+
167+
$aclData = $object->toArray();
168+
if (empty($aclData['name'])) {
169+
$aclData['name'] = '(' . $this->modx->lexicon('none') . ')';
148170
}
149-
$objectArray['authority_name'] = !empty($objectArray['role_name'])
150-
? $objectArray['role_name'] . ' - ' . $objectArray['authority']
151-
: $objectArray['authority']
171+
$aclData['authority_name'] = !empty($aclData['role_name'])
172+
? $aclData['role_name'] . ' - ' . $aclData['authority']
173+
: $aclData['authority']
152174
;
153175

154176
/* get permissions list */
155-
$data = $objectArray['policy_data'];
156-
unset($objectArray['policy_data']);
177+
$aclData['policyPermissions'] = [];
178+
$data = $aclData['policy_data'];
179+
unset($aclData['policy_data']);
157180
$data = $this->modx->fromJSON($data);
158181
if (!empty($data)) {
159-
$permissions = [];
160-
foreach ($data as $permission => $enabled) {
161-
if (!$enabled) {
162-
continue;
163-
}
164-
$permissions[] = $permission;
165-
}
166-
$objectArray['permissions'] = implode(', ', $permissions);
182+
$aclData['policyPermissions'] = array_keys($data, 1);
167183
}
184+
$aclData['permissions'] = $permissions;
168185

169-
$cls = 'pedit premove';
170-
$objectArray['cls'] = $cls;
171-
172-
return $objectArray;
186+
return $aclData;
173187
}
174188
}

Diff for: ‎core/src/Revolution/Processors/Security/Access/UserGroup/Category/GetList.php

+38-20
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ class GetList extends GetListProcessor
4343
/** @var modUserGroup $userGroup */
4444
public $userGroup;
4545

46+
/** @var bool $canCreate Whether user can assign a new Category ACL entry for a given User Group */
47+
public $canCreate = false;
48+
/** @var bool $canEdit Whether user can change a Category ACL entry for a given User Group */
49+
public $canEdit = false;
50+
/** @var bool $canRemove Whether user can remove a Category ACL entry for a given User Group */
51+
public $canRemove = false;
52+
4653
/**
4754
* @return bool
4855
*/
@@ -65,6 +72,15 @@ public function initialize()
6572
if ($this->getProperty('sort') == 'role_display') {
6673
$this->setProperty('sort', 'authority');
6774
}
75+
/*
76+
Currently, all actions essentially relate to editing a User Group.
77+
Nonetheless, we maintain each separately to remain consistent with how permissions
78+
are relayed throughout the MODX app
79+
*/
80+
$canChange = $this->modx->hasPermission('usergroup_edit') && $this->modx->hasPermission('usergroup_save');
81+
$this->canCreate = $canChange;
82+
$this->canEdit = $canChange;
83+
$this->canRemove = $canChange;
6884
return $initialized;
6985
}
7086

@@ -143,33 +159,35 @@ public function useSecondaryGroupCondition(string $sortBy, string $groupBy, stri
143159
*/
144160
public function prepareRow(xPDOObject $object)
145161
{
146-
$objectArray = $object->toArray();
147-
if (empty($objectArray['name'])) {
148-
$objectArray['name'] = '(' . $this->modx->lexicon('none') . ')';
162+
$permissions = [
163+
'create' => $this->canCreate,
164+
'update' => $this->canEdit,
165+
'delete' => $this->canRemove
166+
];
167+
168+
$aclData = $object->toArray();
169+
if (empty($aclData['name'])) {
170+
$aclData['name'] = '(' . $this->modx->lexicon('none') . ')';
149171
}
150172

151173
/* get permissions list */
152-
$data = $objectArray['policy_data'];
153-
unset($objectArray['policy_data']);
174+
$aclData['policyPermissions'] = [];
175+
$data = $aclData['policy_data'];
176+
unset($aclData['policy_data']);
154177
$data = $this->modx->fromJSON($data);
155178
if (!empty($data)) {
156-
$permissions = [];
157-
foreach ($data as $permission => $enabled) {
158-
if (!$enabled) {
159-
continue;
160-
}
161-
$permissions[] = $permission;
162-
}
163-
$objectArray['permissions'] = implode(', ', $permissions);
179+
$aclData['policyPermissions'] = array_keys($data, 1);
164180
}
165-
166-
$cls = '';
167-
if (($objectArray['target'] === 'web' || $objectArray['target'] === 'mgr') && $objectArray['policy_name'] === 'Administrator' && ($this->userGroup && $this->userGroup->get('name') === 'Administrator')) {
168-
} else {
169-
$cls .= 'pedit premove';
181+
if (
182+
in_array($aclData['target'], ['web', 'mgr'])
183+
&& $aclData['policy_name'] === 'Administrator'
184+
&& ($this->userGroup && $this->userGroup->get('name') === 'Administrator')
185+
) {
186+
$permissions['edit'] = false;
187+
$permissions['delete'] = false;
170188
}
171-
$objectArray['cls'] = $cls;
189+
$aclData['permissions'] = $permissions;
172190

173-
return $objectArray;
191+
return $aclData;
174192
}
175193
}

Diff for: ‎core/src/Revolution/Processors/Security/Access/UserGroup/Context/GetList.php

+35-21
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,13 @@ class GetList extends GetListProcessor
4141
/** @var modUserGroup $userGroup */
4242
public $userGroup;
4343

44+
/** @var bool $canCreate Whether user can assign a new Context ACL entry for a given User Group */
45+
public $canCreate = false;
46+
/** @var bool $canEdit Whether user can change a Context ACL entry for a given User Group */
47+
public $canEdit = false;
48+
/** @var bool $canRemove Whether user can remove a Context ACL entry for a given User Group */
49+
public $canRemove = false;
50+
4451
/**
4552
* @return mixed
4653
*/
@@ -63,6 +70,15 @@ public function initialize()
6370
if ($this->getProperty('sort') == 'role_display') {
6471
$this->setProperty('sort', 'authority');
6572
}
73+
/*
74+
Currently, all actions essentially relate to editing a User Group.
75+
Nonetheless, we maintain each separately to remain consistent with how permissions
76+
are relayed throughout the MODX app
77+
*/
78+
$canChange = $this->modx->hasPermission('usergroup_edit') && $this->modx->hasPermission('usergroup_save');
79+
$this->canCreate = $canChange;
80+
$this->canEdit = $canChange;
81+
$this->canRemove = $canChange;
6682
return $initialized;
6783
}
6884

@@ -135,37 +151,35 @@ public function useSecondaryGroupCondition(string $sortBy, string $groupBy, stri
135151
*/
136152
public function prepareRow(xPDOObject $object)
137153
{
138-
$objectArray = $object->toArray();
139-
if (empty($objectArray['name'])) {
140-
$objectArray['name'] = '(' . $this->modx->lexicon('none') . ')';
154+
$permissions = [
155+
'create' => $this->canCreate,
156+
'update' => $this->canEdit,
157+
'delete' => $this->canRemove
158+
];
159+
160+
$aclData = $object->toArray();
161+
if (empty($aclData['name'])) {
162+
$aclData['name'] = '(' . $this->modx->lexicon('none') . ')';
141163
}
142164

143165
/* get permissions list */
144-
$data = $objectArray['policy_data'];
145-
unset($objectArray['policy_data']);
166+
$aclData['policyPermissions'] = [];
167+
$data = $aclData['policy_data'];
168+
unset($aclData['policy_data']);
146169
$data = $this->modx->fromJSON($data);
147170
if (!empty($data)) {
148-
$permissions = [];
149-
foreach ($data as $permission => $enabled) {
150-
if (!$enabled) {
151-
continue;
152-
}
153-
$permissions[] = $permission;
154-
}
155-
$objectArray['permissions'] = implode(', ', $permissions);
171+
$aclData['policyPermissions'] = array_keys($data, 1);
156172
}
157-
158-
$cls = '';
159173
if (
160-
($objectArray['target'] === 'web' || $objectArray['target'] === 'mgr')
161-
&& $objectArray['policy_name'] === 'Administrator'
174+
in_array($aclData['target'], ['web', 'mgr'])
175+
&& $aclData['policy_name'] === 'Administrator'
162176
&& ($this->userGroup && $this->userGroup->get('name') === 'Administrator')
163177
) {
164-
} else {
165-
$cls .= 'pedit premove';
178+
$permissions['edit'] = false;
179+
$permissions['delete'] = false;
166180
}
167-
$objectArray['cls'] = $cls;
181+
$aclData['permissions'] = $permissions;
168182

169-
return $objectArray;
183+
return $aclData;
170184
}
171185
}

Diff for: ‎core/src/Revolution/Processors/Security/Access/UserGroup/ResourceGroup/GetList.php

+36-20
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ class GetList extends GetListProcessor
4343
/** @var modUserGroup $userGroup */
4444
public $userGroup;
4545

46+
/** @var bool $canCreate Whether user can assign a new Resource Group ACL entry for a given User Group */
47+
public $canCreate = false;
48+
/** @var bool $canEdit Whether user can change a Resource Group ACL entry for a given User Group */
49+
public $canEdit = false;
50+
/** @var bool $canRemove Whether user can remove a Resource Group ACL entry for a given User Group */
51+
public $canRemove = false;
52+
4653
/**
4754
* @return bool
4855
*/
@@ -65,6 +72,16 @@ public function initialize()
6572
if ($this->getProperty('sort') == 'role_display') {
6673
$this->setProperty('sort', 'authority');
6774
}
75+
/*
76+
Currently, all actions essentially relate to editing a User Group.
77+
Nonetheless, we maintain each separately to remain consistent with how permissions
78+
are relayed throughout the MODX app
79+
*/
80+
$canChange = $this->modx->hasPermission('usergroup_edit') && $this->modx->hasPermission('usergroup_save');
81+
$this->canCreate = $canChange;
82+
$this->canEdit = $canChange;
83+
$this->canRemove = $canChange;
84+
6885
return $initialized;
6986
}
7087

@@ -143,36 +160,35 @@ public function useSecondaryGroupCondition(string $sortBy, string $groupBy, stri
143160
*/
144161
public function prepareRow(xPDOObject $object)
145162
{
146-
$objectArray = $object->toArray();
147-
if (empty($objectArray['name'])) {
148-
$objectArray['name'] = '(' . $this->modx->lexicon('none') . ')';
163+
$permissions = [
164+
'create' => $this->canCreate,
165+
'update' => $this->canEdit,
166+
'delete' => $this->canRemove
167+
];
168+
169+
$aclData = $object->toArray();
170+
if (empty($aclData['name'])) {
171+
$aclData['name'] = '(' . $this->modx->lexicon('none') . ')';
149172
}
150173

151174
/* get permissions list */
152-
$data = $objectArray['policy_data'];
153-
unset($objectArray['policy_data']);
175+
$aclData['policyPermissions'] = [];
176+
$data = $aclData['policy_data'];
177+
unset($aclData['policy_data']);
154178
$data = $this->modx->fromJSON($data);
155179
if (!empty($data)) {
156-
foreach ($data as $permission => $enabled) {
157-
if (!$enabled) {
158-
continue;
159-
}
160-
$permissions[] = $permission;
161-
}
162-
$objectArray['permissions'] = implode(', ', $permissions);
180+
$aclData['policyPermissions'] = array_keys($data, 1);
163181
}
164-
165-
$cls = '';
166182
if (
167-
($objectArray['target'] === 'web' || $objectArray['target'] == 'mgr')
168-
&& $objectArray['policy_name'] === 'Administrator'
183+
in_array($aclData['target'], ['web', 'mgr'])
184+
&& $aclData['policy_name'] === 'Administrator'
169185
&& ($this->userGroup && $this->userGroup->get('name') === 'Administrator')
170186
) {
171-
} else {
172-
$cls .= 'pedit premove';
187+
$permissions['edit'] = false;
188+
$permissions['delete'] = false;
173189
}
174-
$objectArray['cls'] = $cls;
190+
$aclData['permissions'] = $permissions;
175191

176-
return $objectArray;
192+
return $aclData;
177193
}
178194
}

0 commit comments

Comments
 (0)