Mirrors/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-02-20 19:56:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added UserObject::$isAuthorizedCallable to allow $user->isAuthorized() customization

Browse Source
This commit is contained in:
Matias Griese 2021-12-15 18:00:50 +02:00
parent a4beb9b8bd
commit 1c51bf8a66
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -5,6 +5,7 @@
* Made `Grav::redirect()` to accept `Route` class
* Added `translated()` method to `PageTranslateInterface`
* Added second parameter to `UserObject::isMyself()` method
* Added `UserObject::$isAuthorizedCallable` to allow `$user->isAuthorized()` customization
* Use secure session cookies in HTTPS by default (`system.session.secure_https: true`)
2. [](#improved)
* Upgraded vendor libs for PHP 8.1 compatibility

12
system/src/Grav/Common/Flex/Types/Users/UserObject.php
View File

@ -79,6 +79,8 @@ class UserObject extends FlexObject implements UserInterface, Countable
/** @var Closure|null */
static public $authorizeCallable;
/** @var Closure|null */
static public $isAuthorizedCallable;
/** @var array|null */
protected $_uploads_original;
@ -690,6 +692,16 @@ class UserObject extends FlexObject implements UserInterface, Countable
*/
protected function isAuthorizedOverride(UserInterface $user, string $action, string $scope, bool $isMe = false): ?bool
{
// Check custom application access.
$isAuthorizedCallable = static::$isAuthorizedCallable;
if ($isAuthorizedCallable instanceof Closure) {
$callable = $isAuthorizedCallable->bindTo($this, $this);
$authorized = $callable($user, $action, $scope, $isMe);
if (is_bool($authorized)) {
return $authorized;
}
}
if ($user instanceof self && $user->getStorageKey() === $this->getStorageKey()) {
// User cannot delete his own account, otherwise he has full access.
return $action !== 'delete';