tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

FIX Members can access their own profiles in CMS

Browse Source
This commit is contained in:
Daniel Hensby 2015-08-26 15:46:52 +01:00
parent a40e70f874
commit 2d4b743090
7 changed files with 133 additions and 95 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
admin/code/CMSProfileController.php
View File

@ -50,20 +50,20 @@ class CMSProfileController extends LeftAndMain {
}
public function canView($member = null) {
if(!$member && $member !== FALSE) $member = Member::currentUser();
if(!$member && $member !== false) $member = Member::currentUser();
// cms menus only for logged-in members
if(!$member) return false;
// Only check for generic CMS permissions
// Check they can access the CMS and that they are trying to edit themselves
if(
!Permission::checkMember($member, "CMS_ACCESS_LeftAndMain")
&& !Permission::checkMember($member, "CMS_ACCESS_CMSMain")
Permission::checkMember($member, "CMS_ACCESS")
&& $member->ID === Member::currentUserID()
) {
return false;
return true;
}
return true;
return false;
}
public function save($data, $form) {

2
dev/SapphireTest.php
View File

@ -412,7 +412,7 @@ class SapphireTest extends PHPUnit_Framework_TestCase {
* Will collate all IDs form all fixtures if multiple fixtures are provided.
*
* @param string $className
* @return A map of fixture-identifier => object-id
* @return array A map of fixture-identifier => object-id
*/
protected function allFixtureIDs($className) {
return $this->getFixtureFactory()->getIds($className);

15
security/Permission.php
View File

@ -167,12 +167,21 @@ class Permission extends DataObject implements TemplateGlobalProvider {
if(!is_array($code)) $code = array($code);
if($arg == 'any') {
$adminImpliesAll = (bool)Config::inst()->get('Permission', 'admin_implies_all');
// Cache the permissions in memory
if(!isset(self::$cache_permissions[$memberID])) {
self::$cache_permissions[$memberID] = self::permissions_for_member($memberID);
}
foreach ($code as $permCode) {
if (substr($permCode, 0, 11) == 'CMS_ACCESS_') {
if ($permCode === 'CMS_ACCESS') {
foreach (self::$cache_permissions[$memberID] as $perm) {
//if they have admin rights OR they have an explicit access to the CMS then give permission
if (($adminImpliesAll && $perm == 'ADMIN') || substr($perm, 0, 11) === 'CMS_ACCESS_') {
return true;
}
}
}
elseif (substr($permCode, 0, 11) === 'CMS_ACCESS_') {
//cms_access_leftandmain means access to all CMS areas
$code[] = 'CMS_ACCESS_LeftAndMain';
break;
@ -180,7 +189,9 @@ class Permission extends DataObject implements TemplateGlobalProvider {
}
// if ADMIN has all privileges, then we need to push that code in
if(Config::inst()->get('Permission', 'admin_implies_all')) $code[] = "ADMIN";
if($adminImpliesAll) {
$code[] = "ADMIN";
}
// Multiple $code values - return true if at least one matches, ie, intersection exists
return (bool)array_intersect($code, self::$cache_permissions[$memberID]);

6
tests/control/CMSProfileControllerTest.php
View File

@ -32,7 +32,7 @@ class CMSProfileControllerTest extends FunctionalTest {
}
public function testMemberEditsOwnProfile() {
$member = $this->objFromFixture('Member', 'user1');
$member = $this->objFromFixture('Member', 'user3');
$this->session()->inst_set('loggedInAs', $member->ID);
$response = $this->post('admin/myprofile/EditForm', array(
@ -46,9 +46,9 @@ class CMSProfileControllerTest extends FunctionalTest {
'Password[_ConfirmPassword]' => 'password',
));
$member = $this->objFromFixture('Member', 'user1');
$member = $this->objFromFixture('Member', 'user3');
$this->assertEquals($member->FirstName, 'JoeEdited', 'FirstName field was changed');
$this->assertEquals('JoeEdited', $member->FirstName, 'FirstName field was changed');
}
public function testExtendedPermissionsStopEditingOwnProfile() {

11
tests/control/CMSProfileControllerTest.yml
View File

@ -5,6 +5,9 @@ Permission:
Code: CMS_ACCESS_LeftAndMain
leftandmain:
Code: CMS_ACCESS_CMSMain
test:
Code: CMS_ACCESS_TestController
Group:
admins:
Title: Administrators
@ -12,6 +15,10 @@ Group:
cmsusers:
Title: CMS Users
Permissions: =>Permission.cmsmain, =>Permission.leftandmain
test:
Title: Test group
Permissions: =>Permission.test
Member:
admin:
FirstName: Admin
@ -25,3 +32,7 @@ Member:
FirstName: Steve
Email: user2@user.com
Groups: =>Group.cmsusers
user3:
FirstName: Files
Email: user3@example.com
Groups: =>Group.test

31
tests/security/PermissionTest.php
View File

@ -14,7 +14,7 @@ class PermissionTest extends SapphireTest {
}
public function testGetCodesUngrouped() {
$codes = Permission::get_codes(null, false);
$codes = Permission::get_codes(false);
$this->assertArrayHasKey('SITETREE_VIEW_ALL', $codes);
}
@ -23,20 +23,25 @@ class PermissionTest extends SapphireTest {
$this->assertTrue(Permission::checkMember($member, "SITETREE_VIEW_ALL"));
}
public function testLeftAndMainAccessAll() {
//add user and group
$member = Member::create()->update(array(
'FirstName' => 'Left',
'Surname' => 'Main',
'Email' => 'leftandmain@example.com',
public function testCMSAccess() {
$members = Member::get()->byIDs($this->allFixtureIDs('Member'));
foreach ($members as $member) {
$this->assertTrue(Permission::checkMember($member, 'CMS_ACCESS'));
}
$member = new Member();
$member->update(array(
'FirstName' => 'No CMS',
'Surname' => 'Access',
'Email' => 'no-access@example.com',
));
$member->write();
$group = Group::create()->update(array(
'Title' => 'LeftAndMain',
));
$group->write();
Permission::grant($group->ID, 'CMS_ACCESS_LeftAndMain');
$group->DirectMembers()->add($member);
$this->assertFalse(Permission::checkMember($member, 'CMS_ACCESS'));
}
public function testLeftAndMainAccessAll() {
//add user and group
$member = $this->objFromFixture('Member', 'leftandmain');
$this->assertTrue(Permission::checkMember($member, "CMS_ACCESS_MyAdmin"));
$this->assertTrue(Permission::checkMember($member, "CMS_ACCESS_AssetAdmin"));

11
tests/security/PermissionTest.yml
View File

@ -18,6 +18,7 @@ PermissionRoleCode:
Role: =>PermissionRole.access
Code: EDIT_PERMISSIONS
Member:
author:
FirstName: Test
@ -28,6 +29,10 @@ Member:
globalauthor:
FirstName: Test
Surname: Global Author
leftandmain:
FirstName: Left
Surname: AndMain
Email: leftandmain@example.com
Group:
author:
@ -42,6 +47,9 @@ Group:
Parent: =>Group.author
Title: Global Authors
Members: =>Member.globalauthor
leftandmain:
Title: LeftAndMain
Members: =>Member.leftandmain
Permission:
extra1:
@ -50,3 +58,6 @@ Permission:
globalauthor:
Code: SITETREE_EDIT_ALL
Group: =>Group.globalauthor
leftandmain:
Code: CMS_ACCESS_LeftAndMain
Group: =>Group.leftandmain