-
-
Notifications
You must be signed in to change notification settings - Fork 188
/
IfHasRoleViewHelper.php
148 lines (133 loc) · 5.15 KB
/
IfHasRoleViewHelper.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
<?php
namespace Neos\FluidAdaptor\ViewHelpers\Security;
/*
* This file is part of the Neos.FluidAdaptor package.
*
* (c) Contributors of the Neos Project - www.neos.io
*
* This package is Open Source Software. For the full copyright and license
* information, please view the LICENSE file which was distributed with this
* source code.
*/
use Neos\Flow\Security\Account;
use Neos\Flow\Security\Context;
use Neos\Flow\Security\Policy\PolicyService;
use Neos\FluidAdaptor\Core\Rendering\FlowAwareRenderingContextInterface;
use Neos\FluidAdaptor\Core\ViewHelper\AbstractConditionViewHelper;
use TYPO3Fluid\Fluid\Core\Rendering\RenderingContextInterface;
/**
* This view helper implements an ifHasRole/else condition.
*
* = Examples =
*
* <code title="Basic usage">
* <f:security.ifHasRole role="Administrator">
* This is being shown in case you have the Administrator role (aka role) defined in the
* current package according to the controllerContext
* </f:security.ifHasRole>
* </code>
*
* <code title="Usage with packageKey attribute">
* <f:security.ifHasRole role="Administrator" packageKey="Acme.MyPackage">
* This is being shown in case you have the Acme.MyPackage:Administrator role (aka role).
* </f:security.ifHasRole>
* </code>
*
* <code title="Usage with full role identifier in role attribute">
* <f:security.ifHasRole role="Acme.MyPackage:Administrator">
* This is being shown in case you have the Acme.MyPackage:Administrator role (aka role).
* </f:security.ifHasRole>
* </code>
*
* Everything inside the <f:ifHasRole> tag is being displayed if you have the given role.
*
* <code title="IfRole / then / else">
* <f:security.ifHasRole role="Administrator">
* <f:then>
* This is being shown in case you have the role.
* </f:then>
* <f:else>
* This is being displayed in case you do not have the role.
* </f:else>
* </f:security.ifHasRole>
* </code>
*
* Everything inside the "then" tag is displayed if you have the role.
* Otherwise, everything inside the "else"-tag is displayed.
*
* <code title="Usage with role object in role attribute">
* <f:security.ifHasRole role="{someRoleObject}">
* This is being shown in case you have the specified role
* </f:security.ifHasRole>
* </code>
*
* <code title="Usage with specific account instead of currently logged in account">
* <f:security.ifHasRole role="Administrator" account="{otherAccount}">
* This is being shown in case "otherAccount" has the Acme.MyPackage:Administrator role (aka role).
* </f:security.ifHasRole>
* </code>
*
*
* @api
*/
class IfHasRoleViewHelper extends AbstractConditionViewHelper
{
/**
* Initializes the "then" and "else" arguments
*/
public function initializeArguments()
{
parent::initializeArguments();
$this->registerArgument('role', 'mixed', 'The role or role identifier.', true);
$this->registerArgument('packageKey', 'string', 'PackageKey of the package defining the role.', false, null);
$this->registerArgument('account', Account::class, 'If specified, this subject of this check is the given Account instead of the currently authenticated account', false, null);
}
/**
* renders <f:then> child if the role could be found in the security context,
* otherwise renders <f:else> child.
*
* @return string the rendered string
* @api
*/
public function render()
{
if (static::evaluateCondition($this->arguments, $this->renderingContext)) {
return $this->renderThenChild();
}
return $this->renderElseChild();
}
/**
* @param array|null $arguments
* @param FlowAwareRenderingContextInterface&RenderingContextInterface $renderingContext
* @return boolean
*/
protected static function evaluateCondition($arguments, RenderingContextInterface $renderingContext)
{
$objectManager = $renderingContext->getObjectManager();
/** @var PolicyService $policyService */
$policyService = $objectManager->get(PolicyService::class);
/** @var Context $securityContext */
$securityContext = $objectManager->get(Context::class);
if ($securityContext != null && !$securityContext->canBeInitialized()) {
return false;
}
$role = $arguments['role'];
$account = $arguments['account'];
$packageKey = isset($arguments['packageKey']) ? $arguments['packageKey'] : $renderingContext->getControllerContext()->getRequest()->getControllerPackageKey();
if (is_string($role)) {
$roleIdentifier = $role;
if (in_array($roleIdentifier, ['Everybody', 'Anonymous', 'AuthenticatedUser'])) {
$roleIdentifier = 'Neos.Flow:' . $roleIdentifier;
}
if (strpos($roleIdentifier, '.') === false && strpos($roleIdentifier, ':') === false) {
$roleIdentifier = $packageKey . ':' . $roleIdentifier;
}
$role = $policyService->getRole($roleIdentifier);
}
$hasRole = $securityContext->hasRole($role->getIdentifier());
if ($account instanceof Account) {
$hasRole = $account->hasRole($role);
}
return $hasRole;
}
}