mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
ec8e8261f2
See http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/
51 lines
1.1 KiB
PHP
51 lines
1.1 KiB
PHP
<?php
|
|
/**
|
|
* A PermissionRoleCode represents a single permission code assigned to a {@link PermissionRole}.
|
|
*
|
|
* @package sapphire
|
|
* @subpackage security
|
|
*/
|
|
class PermissionRoleCode extends DataObject {
|
|
static $db = array(
|
|
"Code" => "Varchar",
|
|
);
|
|
|
|
static $has_one = array(
|
|
"Role" => "PermissionRole",
|
|
);
|
|
|
|
protected function validate() {
|
|
$result = parent::validate();
|
|
|
|
// Check that new code doesn't increase privileges, unless an admin is editing.
|
|
$privilegedCodes = Permission::$privileged_permissions;
|
|
if(
|
|
$this->Code
|
|
&& in_array($this->Code, $privilegedCodes)
|
|
&& !Permission::check('ADMIN')
|
|
) {
|
|
$result->error(sprintf(
|
|
_t(
|
|
'PermissionRoleCode.PermsError',
|
|
'Can\'t assign code "%s" with privileged permissions (requires ADMIN access)'
|
|
),
|
|
$this->Code
|
|
));
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
public function canCreate($member = null) {
|
|
return Permission::check('APPLY_ROLES', 'any', $member);
|
|
}
|
|
|
|
public function canEdit($member = null) {
|
|
return Permission::check('APPLY_ROLES', 'any', $member);
|
|
}
|
|
|
|
public function canDelete($member = null) {
|
|
return Permission::check('APPLY_ROLES', 'any', $member);
|
|
}
|
|
}
|