Skip to content
Snippets Groups Projects
Commit ddb2e84a authored by Liam Morland's avatar Liam Morland
Browse files

ISTWCMS-5085: Refactor UwNodeAccessCheck::access()

parent 23cce581
No related branches found
No related tags found
1 merge request!153ISTWCMS-5085: Prevent non-admin access to menu add, edit, and delete
......@@ -27,37 +27,31 @@ class UwNodeAccessCheck implements AccessInterface {
* The access result.
*/
public function access(RouteMatchInterface $route_match, AccountInterface $account): AccessResult {
$route_name = $route_match->getRouteName();
// Menu link edit pages.
if ($route_name === 'menu_ui.link_edit') {
$menu_link_plugin = $route_match->getParameter('menu_link_plugin');
// Only those with permission may edit home page menu entry.
if ($menu_link_plugin->getPluginId() === 'uw_base_profile.front_page') {
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
}
else {
switch ($route_match->getRouteName()) {
// Menu link edit pages.
case 'menu_ui.link_edit':
$menu_link_plugin = $route_match->getParameter('menu_link_plugin');
// Only those with permission may edit home page menu entry.
if ($menu_link_plugin->getPluginId() === 'uw_base_profile.front_page') {
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
}
// Otherwise, default to access set in menu_admin_per_menu.
$menu_admin_per_menu = new MenuAdminPerMenuAccess();
return $menu_admin_per_menu->menuLinkAccess($account, $menu_link_plugin);
}
}
// Node delete pages.
if ($route_name === 'entity.node.delete_form') {
$node = $route_match->getParameter('node');
// Only those with permission may delete the home page.
if ($node && UWService::nodeIsHomePage((int) $node->id())) {
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
}
else {
// Node delete pages.
case 'entity.node.delete_form':
$node = $route_match->getParameter('node');
// Only those with permission may delete the home page.
if ($node && UWService::nodeIsHomePage((int) $node->id())) {
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
}
return AccessResult::allowed();
}
}
// Dashboard config: admin/config/dashboards/dashboardssettings.
if ($route_name === 'dashboards.dashboards_settings_form') {
return $account->hasPermission('access dashboard config') ? AccessResult::allowed() : AccessResult::forbidden();
// Dashboard config: admin/config/dashboards/dashboardssettings.
case 'dashboards.dashboards_settings_form':
return $account->hasPermission('access dashboard config') ? AccessResult::allowed() : AccessResult::forbidden();
}
// Get the node object, which is in the route match variable.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment