UserAclVoter.php 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. <?php
  2. /*
  3. * This file is part of the Sonata Project package.
  4. *
  5. * (c) Thomas Rabaix <thomas.rabaix@sonata-project.org>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Sonata\UserBundle\Security\Authorization\Voter;
  11. use FOS\UserBundle\Model\UserInterface;
  12. use Symfony\Component\Security\Acl\Voter\AclVoter;
  13. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  14. class UserAclVoter extends AclVoter
  15. {
  16. /**
  17. * {@inheritdoc}
  18. */
  19. public function supportsClass($class)
  20. {
  21. // support the Object-Scope ACL
  22. return is_subclass_of($class, 'FOS\UserBundle\Model\UserInterface');
  23. }
  24. /**
  25. * {@inheritdoc}
  26. */
  27. public function supportsAttribute($attribute)
  28. {
  29. return $attribute === 'EDIT' || $attribute === 'DELETE';
  30. }
  31. /**
  32. * {@inheritdoc}
  33. */
  34. public function vote(TokenInterface $token, $object, array $attributes)
  35. {
  36. if (!$this->supportsClass(get_class($object))) {
  37. return self::ACCESS_ABSTAIN;
  38. }
  39. foreach ($attributes as $attribute) {
  40. if ($this->supportsAttribute($attribute) && $object instanceof UserInterface && $token->getUser() instanceof UserInterface) {
  41. if ($object->isSuperAdmin() && !$token->getUser()->isSuperAdmin()) {
  42. // deny a non super admin user to edit or delete a super admin user
  43. return self::ACCESS_DENIED;
  44. }
  45. }
  46. }
  47. // leave the permission voting to the AclVoter that is using the default permission map
  48. return self::ACCESS_ABSTAIN;
  49. }
  50. }