Skip to content
Snippets Groups Projects
Commit ddb2e84a authored by Liam Morland's avatar Liam Morland
Browse files

ISTWCMS-5085: Refactor UwNodeAccessCheck::access()

parent 23cce581
No related branches found
No related tags found
1 merge request!153ISTWCMS-5085: Prevent non-admin access to menu add, edit, and delete
...@@ -27,37 +27,31 @@ class UwNodeAccessCheck implements AccessInterface { ...@@ -27,37 +27,31 @@ class UwNodeAccessCheck implements AccessInterface {
* The access result. * The access result.
*/ */
public function access(RouteMatchInterface $route_match, AccountInterface $account): AccessResult { public function access(RouteMatchInterface $route_match, AccountInterface $account): AccessResult {
$route_name = $route_match->getRouteName(); switch ($route_match->getRouteName()) {
// Menu link edit pages.
// Menu link edit pages. case 'menu_ui.link_edit':
if ($route_name === 'menu_ui.link_edit') { $menu_link_plugin = $route_match->getParameter('menu_link_plugin');
$menu_link_plugin = $route_match->getParameter('menu_link_plugin'); // Only those with permission may edit home page menu entry.
// Only those with permission may edit home page menu entry. if ($menu_link_plugin->getPluginId() === 'uw_base_profile.front_page') {
if ($menu_link_plugin->getPluginId() === 'uw_base_profile.front_page') { return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden(); }
}
else {
// Otherwise, default to access set in menu_admin_per_menu. // Otherwise, default to access set in menu_admin_per_menu.
$menu_admin_per_menu = new MenuAdminPerMenuAccess(); $menu_admin_per_menu = new MenuAdminPerMenuAccess();
return $menu_admin_per_menu->menuLinkAccess($account, $menu_link_plugin); return $menu_admin_per_menu->menuLinkAccess($account, $menu_link_plugin);
}
}
// Node delete pages. // Node delete pages.
if ($route_name === 'entity.node.delete_form') { case 'entity.node.delete_form':
$node = $route_match->getParameter('node'); $node = $route_match->getParameter('node');
// Only those with permission may delete the home page. // Only those with permission may delete the home page.
if ($node && UWService::nodeIsHomePage((int) $node->id())) { if ($node && UWService::nodeIsHomePage((int) $node->id())) {
return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden(); return $account->hasPermission('bypass home page protection') ? AccessResult::allowed() : AccessResult::forbidden();
} }
else {
return AccessResult::allowed(); return AccessResult::allowed();
}
}
// Dashboard config: admin/config/dashboards/dashboardssettings. // Dashboard config: admin/config/dashboards/dashboardssettings.
if ($route_name === 'dashboards.dashboards_settings_form') { case 'dashboards.dashboards_settings_form':
return $account->hasPermission('access dashboard config') ? AccessResult::allowed() : AccessResult::forbidden(); return $account->hasPermission('access dashboard config') ? AccessResult::allowed() : AccessResult::forbidden();
} }
// Get the node object, which is in the route match variable. // Get the node object, which is in the route match variable.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment