AdminObjectAclManipulator.php 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313
  1. <?php
  2. /*
  3. * This file is part of the Sonata Project package.
  4. *
  5. * (c) Thomas Rabaix <thomas.rabaix@sonata-project.org>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Sonata\AdminBundle\Util;
  11. use Sonata\AdminBundle\Form\Type\AclMatrixType;
  12. use Symfony\Component\Form\Form;
  13. use Symfony\Component\Form\FormBuilderInterface;
  14. use Symfony\Component\Form\FormFactoryInterface;
  15. use Symfony\Component\Security\Acl\Domain\ObjectIdentity;
  16. use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;
  17. use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;
  18. use Symfony\Component\Security\Acl\Exception\NoAceFoundException;
  19. use Symfony\Component\Security\Core\User\UserInterface;
  20. /**
  21. * A manipulator for updating ACL related to an object.
  22. *
  23. * @author Kévin Dunglas <kevin@les-tilleuls.coop>
  24. * @author Baptiste Meyer <baptiste@les-tilleuls.coop>
  25. */
  26. class AdminObjectAclManipulator
  27. {
  28. const ACL_USERS_FORM_NAME = 'acl_users_form';
  29. const ACL_ROLES_FORM_NAME = 'acl_roles_form';
  30. /**
  31. * @var FormFactoryInterface
  32. */
  33. protected $formFactory;
  34. /**
  35. * @var string
  36. */
  37. protected $maskBuilderClass;
  38. /**
  39. * @param FormFactoryInterface $formFactory
  40. * @param string $maskBuilderClass
  41. */
  42. public function __construct(FormFactoryInterface $formFactory, $maskBuilderClass)
  43. {
  44. $this->formFactory = $formFactory;
  45. $this->maskBuilderClass = $maskBuilderClass;
  46. }
  47. /**
  48. * Gets mask builder class name.
  49. *
  50. * @return string
  51. */
  52. public function getMaskBuilderClass()
  53. {
  54. return $this->maskBuilderClass;
  55. }
  56. /**
  57. * Gets the form.
  58. *
  59. * NEXT_MAJOR: remove this method.
  60. *
  61. * @param AdminObjectAclData $data
  62. *
  63. * @return Form
  64. *
  65. * @deprecated Deprecated since version 3.0. Use createAclUsersForm() instead
  66. */
  67. public function createForm(AdminObjectAclData $data)
  68. {
  69. @trigger_error(
  70. 'createForm() is deprecated since version 3.0 and will be removed in 4.0. '
  71. .'Use createAclUsersForm() instead.',
  72. E_USER_DEPRECATED
  73. );
  74. return $this->createAclUsersForm($data);
  75. }
  76. /**
  77. * Gets the ACL users form.
  78. *
  79. * @param AdminObjectAclData $data
  80. *
  81. * @return Form
  82. */
  83. public function createAclUsersForm(AdminObjectAclData $data)
  84. {
  85. $aclValues = $data->getAclUsers();
  86. $formBuilder = $this->formFactory->createNamedBuilder(self::ACL_USERS_FORM_NAME, 'form');
  87. $form = $this->buildForm($data, $formBuilder, $aclValues);
  88. $data->setAclUsersForm($form);
  89. return $form;
  90. }
  91. /**
  92. * Gets the ACL roles form.
  93. *
  94. * @param AdminObjectAclData $data
  95. *
  96. * @return Form
  97. */
  98. public function createAclRolesForm(AdminObjectAclData $data)
  99. {
  100. $aclValues = $data->getAclRoles();
  101. $formBuilder = $this->formFactory->createNamedBuilder(self::ACL_ROLES_FORM_NAME, 'form');
  102. $form = $this->buildForm($data, $formBuilder, $aclValues);
  103. $data->setAclRolesForm($form);
  104. return $form;
  105. }
  106. /**
  107. * Updates ACL users.
  108. *
  109. * @param AdminObjectAclData $data
  110. */
  111. public function updateAclUsers(AdminObjectAclData $data)
  112. {
  113. $aclValues = $data->getAclUsers();
  114. $form = $data->getAclUsersForm();
  115. $this->buildAcl($data, $form, $aclValues);
  116. }
  117. /**
  118. * Updates ACL roles.
  119. *
  120. * @param AdminObjectAclData $data
  121. */
  122. public function updateAclRoles(AdminObjectAclData $data)
  123. {
  124. $aclValues = $data->getAclRoles();
  125. $form = $data->getAclRolesForm();
  126. $this->buildAcl($data, $form, $aclValues);
  127. }
  128. /**
  129. * Updates ACl.
  130. *
  131. * NEXT_MAJOR: remove this method.
  132. *
  133. * @param AdminObjectAclData $data
  134. *
  135. * @deprecated Deprecated since version 3.0. Use updateAclUsers() instead
  136. */
  137. public function updateAcl(AdminObjectAclData $data)
  138. {
  139. @trigger_error(
  140. 'updateAcl() is deprecated since version 3.0 and will be removed in 4.0.'
  141. .'Use updateAclUsers() instead.',
  142. E_USER_DEPRECATED
  143. );
  144. $this->updateAclUsers($data);
  145. }
  146. /**
  147. * Builds ACL.
  148. *
  149. * @param AdminObjectAclData $data
  150. * @param Form $form
  151. * @param \Traversable $aclValues
  152. */
  153. protected function buildAcl(AdminObjectAclData $data, Form $form, \Traversable $aclValues)
  154. {
  155. $masks = $data->getMasks();
  156. $acl = $data->getAcl();
  157. $matrices = $form->getData();
  158. foreach ($aclValues as $aclValue) {
  159. foreach ($matrices as $key => $matrix) {
  160. if ($aclValue instanceof UserInterface) {
  161. if (array_key_exists('user', $matrix) && $aclValue->getUsername() === $matrix['user']) {
  162. $matrices[$key]['acl_value'] = $aclValue;
  163. }
  164. } elseif (array_key_exists('role', $matrix) && $aclValue === $matrix['role']) {
  165. $matrices[$key]['acl_value'] = $aclValue;
  166. }
  167. }
  168. }
  169. foreach ($matrices as $matrix) {
  170. if (!isset($matrix['acl_value'])) {
  171. continue;
  172. }
  173. $securityIdentity = $this->getSecurityIdentity($matrix['acl_value']);
  174. $maskBuilder = new $this->maskBuilderClass();
  175. foreach ($data->getUserPermissions() as $permission) {
  176. if (isset($matrix[$permission]) && $matrix[$permission] === true) {
  177. $maskBuilder->add($permission);
  178. }
  179. }
  180. // Restore OWNER and MASTER permissions
  181. if (!$data->isOwner()) {
  182. foreach ($data->getOwnerPermissions() as $permission) {
  183. if ($acl->isGranted(array($masks[$permission]), array($securityIdentity))) {
  184. $maskBuilder->add($permission);
  185. }
  186. }
  187. }
  188. $mask = $maskBuilder->get();
  189. $index = null;
  190. $ace = null;
  191. foreach ($acl->getObjectAces() as $currentIndex => $currentAce) {
  192. if ($currentAce->getSecurityIdentity()->equals($securityIdentity)) {
  193. $index = $currentIndex;
  194. $ace = $currentAce;
  195. break;
  196. }
  197. }
  198. if ($ace) {
  199. $acl->updateObjectAce($index, $mask);
  200. } else {
  201. $acl->insertObjectAce($securityIdentity, $mask);
  202. }
  203. }
  204. $data->getSecurityHandler()->updateAcl($acl);
  205. }
  206. /**
  207. * Builds the form.
  208. *
  209. * @param AdminObjectAclData $data
  210. * @param FormBuilderInterface $formBuilder
  211. * @param \Traversable $aclValues
  212. *
  213. * @return Form
  214. */
  215. protected function buildForm(AdminObjectAclData $data, FormBuilderInterface $formBuilder, \Traversable $aclValues)
  216. {
  217. // Retrieve object identity
  218. $objectIdentity = ObjectIdentity::fromDomainObject($data->getObject());
  219. $acl = $data->getSecurityHandler()->getObjectAcl($objectIdentity);
  220. if (!$acl) {
  221. $acl = $data->getSecurityHandler()->createAcl($objectIdentity);
  222. }
  223. $data->setAcl($acl);
  224. $masks = $data->getMasks();
  225. $securityInformation = $data->getSecurityInformation();
  226. foreach ($aclValues as $key => $aclValue) {
  227. $securityIdentity = $this->getSecurityIdentity($aclValue);
  228. $permissions = array();
  229. foreach ($data->getUserPermissions() as $permission) {
  230. try {
  231. $checked = $acl->isGranted(array($masks[$permission]), array($securityIdentity));
  232. } catch (NoAceFoundException $e) {
  233. $checked = false;
  234. }
  235. $attr = array();
  236. if (
  237. self::ACL_ROLES_FORM_NAME === $formBuilder->getName()
  238. && isset($securityInformation[$aclValue])
  239. && array_search($permission, $securityInformation[$aclValue]) !== false
  240. ) {
  241. $attr['disabled'] = 'disabled';
  242. }
  243. $permissions[$permission] = array(
  244. 'required' => false,
  245. 'data' => $checked,
  246. 'disabled' => array_key_exists('disabled', $attr),
  247. 'attr' => $attr,
  248. );
  249. }
  250. // NEXT_MAJOR: remove when dropping Symfony <2.8 support
  251. $type = method_exists('Symfony\Component\Form\AbstractType', 'getBlockPrefix') ?
  252. 'Sonata\AdminBundle\Form\Type\AclMatrixType' :
  253. new AclMatrixType();
  254. $formBuilder->add($key, $type, array('permissions' => $permissions, 'acl_value' => $aclValue));
  255. }
  256. return $formBuilder->getForm();
  257. }
  258. /**
  259. * Gets a user or a role security identity.
  260. *
  261. * @param string|UserInterface $aclValue
  262. *
  263. * @return RoleSecurityIdentity|UserSecurityIdentity
  264. */
  265. protected function getSecurityIdentity($aclValue)
  266. {
  267. return ($aclValue instanceof UserInterface)
  268. ? UserSecurityIdentity::fromAccount($aclValue)
  269. : new RoleSecurityIdentity($aclValue)
  270. ;
  271. }
  272. }