Skip to content

Commit fae4cec

Browse files
eluhreluhr
authored
Merge pull request #57 from dmstr/feature/fix-permission-errors
fix permission errors
2 parents 130ef0d + 98155fb commit fae4cec

File tree

8 files changed

+229
-179
lines changed

8 files changed

+229
-179
lines changed

‎Module.php‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
*
1919
* @author Christopher Stebe <c.stebe@herzogkommunikation.de>
2020
*
21-
* @property mixed|object $localizedRootNode
2221
*/
2322
class Module extends \yii\base\Module
2423
{
@@ -107,25 +106,6 @@ public function init()
107106
}
108107
}
109108

110-
/**
111-
* @return mixed|object dmstr\modules\pages\models\Tree
112-
*/
113-
public function getLocalizedRootNode()
114-
{
115-
$localizedRoot = Tree::ROOT_NODE_PREFIX.'_'.\Yii::$app->language;
116-
\Yii::trace('localizedRoot: '.$localizedRoot, __METHOD__);
117-
$rootNode = Tree::findOne(
118-
[
119-
Tree::ATTR_DOMAIN_ID => Tree::ROOT_NODE_PREFIX,
120-
Tree::ATTR_ACTIVE => Tree::ACTIVE,
121-
]
122-
);
123-
if ($rootNode !== null && !$rootNode->isVisible()) {
124-
return null;
125-
}
126-
return $rootNode;
127-
}
128-
129109
/**
130110
* Check for "pheme/yii2-settings" component and module
131111
* @return bool

‎README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -216,11 +216,14 @@ Run tests
216216
make run-tests
217217

218218

219-
Ressources
219+
Changelog
220220
----------
221221

222-
tbd
222+
2.5.10
223223

224-
---
224+
- Removed localized root node message
225+
- Updated kartik-v/yii2-tree-manager requirement to ^1.1.2
226+
- Update Tree model to support new child_allowed attribute (since kartik-v/yii2-tree-manager 1.0.9)
227+
- Improved permission check for page nodes so allowed child nodes in not allowed parents do not show up
225228

226229
### ![dmstr logo](http://t.phundament.com/dmstr-16-cropped.png) Built by [dmstr](http://diemeisterei.de)

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
],
2222
"require": {
2323
"yiisoft/yii2": "*",
24-
"kartik-v/yii2-tree-manager": ">=1.0.3 <=1.0.5",
24+
"kartik-v/yii2-tree-manager": "^1.1.2",
2525
"kartik-v/yii2-widget-select2": "^2.0.1",
2626
"2amigos/yii2-translateable-behavior": "^1.1.0",
2727
"insolita/yii2-adminlte-widgets": "^1.1.4",

‎controllers/DefaultController.php‎

Lines changed: 84 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,13 @@
1717
use dmstr\modules\pages\models\Tree;
1818
use dmstr\modules\pages\Module;
1919
use dmstr\modules\pages\traits\RequestParamActionTrait;
20+
use kartik\tree\TreeView;
2021
use pheme\settings\components\Settings;
2122
use Yii;
2223
use yii\base\Event;
2324
use yii\helpers\ArrayHelper;
2425
use yii\helpers\Html;
26+
use yii\helpers\Inflector;
2527
use yii\helpers\Json;
2628
use yii\helpers\Url;
2729
use yii\web\Controller;
@@ -61,9 +63,9 @@ protected function refPageActionParamPageId()
6163
{
6264

6365
$rootIds = [Tree::ROOT_NODE_PREFIX];
64-
/** @var Settings \Yii::$app->settings */
66+
/** @var Settings Yii::$app->settings */
6567
if (Module::checkSettingsInstalled() && Yii::$app->settings->get('refPageRootIds', 'pages', null)) {
66-
$tmp = explode("\n", \Yii::$app->settings->get('pages.refPageRootIds'));
68+
$tmp = explode("\n", Yii::$app->settings->get('pages.refPageRootIds'));
6769
$tmp = array_filter(array_map('trim', $tmp));
6870
$rootIds = $tmp ?? $rootIds;
6971
}
@@ -106,8 +108,8 @@ protected function refPageActionParamPageId()
106108
*/
107109
public function init()
108110
{
109-
if (\Yii::$app->user->can('pages', ['route' => true])) {
110-
\Yii::$app->trigger('registerMenuItems', new Event(['sender' => $this]));
111+
if (Yii::$app->user->can('pages', ['route' => true])) {
112+
Yii::$app->trigger('registerMenuItems', new Event(['sender' => $this]));
111113
}
112114

113115
parent::init();
@@ -118,58 +120,84 @@ public function init()
118120
*/
119121
public function actionIndex($pageId = null)
120122
{
121-
$localicedRootNode = $this->module->getLocalizedRootNode();
122-
if (!$localicedRootNode) {
123-
$language = mb_strtolower(\Yii::$app->language);
124-
$rootNodePrefix = Tree::ROOT_NODE_PREFIX;
125-
126-
$msg = <<<HTML
127-
<b>Localized root-node missing</b>
128-
<p>
129-
Please create a new root-node for the current language.
130-
</p>
131-
<p>
132-
<a onclick="$('#tree-domain_id').val('{$rootNodePrefix}');$('#tree-name').val('{$rootNodePrefix}_{$language}');$('.kv-detail-container button[type=submit]').click()"
133-
class="btn btn-warning">Create root-node for <b>{$language}</b></a>
134-
</p>
123+
124+
// do rbac permission check if page is readable. The active record permssion check does not show the page if it does not exist
125+
if (!empty($pageId) && empty(Tree::findOne($pageId))) {
126+
throw new NotFoundHttpException(Yii::t('pages', 'The requested page does not exist.'));
127+
}
128+
129+
$query = Tree::getAccessibleItemsQuery();
130+
131+
$headerTemplate = <<< HTML
132+
<div class="row">
133+
<div class="col-sm-6" id="dmstr-pages-detail-heading">
134+
{heading}
135+
</div>
136+
<div class="col-sm-6" id="dmstr-pages-detail-search">
137+
{search}
138+
</div>
139+
</div>
135140
HTML;
136141

137-
$js = <<<'JS'
138-
$(".kv-create-root").click();
139-
JS;
142+
$toolbar = [];
140143

141-
$this->getView()->registerJs($js, View::POS_LOAD);
142-
\Yii::$app->session->addFlash('warning', $msg);
143-
} else {
144-
if (!empty($pageId)) {
145-
Yii::$app->session->set('kvNodeId', $pageId);
144+
// check settings component and module existence
145+
if (Yii::$app->has('settings') && Yii::$app->hasModule('settings')) {
146+
147+
// check module permissions
148+
$settingPermission = false;
149+
if (Yii::$app->getModule('settings')->accessRoles === null) {
150+
$settingPermission = true;
151+
} else {
152+
foreach (Yii::$app->getModule('settings')->accessRoles as $role) {
153+
$settingPermission = Yii::$app->user->can($role);
154+
}
155+
}
156+
157+
if ($settingPermission) {
158+
$settings = [
159+
'icon' => 'cogs',
160+
'url' => ['/settings', 'SettingSearch' => ['section' => 'pages']],
161+
'options' => [
162+
'title' => Yii::t('pages', 'Settings'),
163+
'class' => 'btn btn-info'
164+
]
165+
];
166+
$toolbar[] = TreeView::BTN_SEPARATOR;
167+
$toolbar['settings'] = $settings;
146168
}
147169
}
148170

149-
/**
150-
* Register the pages asset bundle
151-
*/
152-
PagesBackendAsset::register($this->view);
171+
$mainTemplate = <<< HTML
172+
<div class="row">
173+
<div class="col-md-5" id="dmstr-pages-detail-wrapper">
174+
<div class="box box-solid">
175+
{wrapper}
176+
</div>
177+
</div>
178+
<div class="col-md-7" id="dmstr-pages-detail-panel">
179+
{detail}
180+
</div>
181+
</div>
182+
HTML;
153183

154-
/** @var Tree $queryTree */
155-
$queryTree = Tree::find()
156-
->andWhere(
157-
[
158-
Tree::ATTR_ACCESS_DOMAIN => [
159-
\Yii::$app->language,
160-
Tree::GLOBAL_ACCESS_DOMAIN
161-
]
162-
]
163-
)
164-
->orderBy('root, lft');
165184

166-
return $this->render('index', ['queryTree' => $queryTree]);
185+
PagesBackendAsset::register($this->view);
186+
$this->view->title = Yii::t('pages', 'Pages');
187+
188+
return $this->render('index', [
189+
'query' => $query,
190+
'headerTemplate' => $headerTemplate,
191+
'toolbar' => $toolbar,
192+
'mainTemplate' => $mainTemplate,
193+
'pageId' => $pageId
194+
]);
167195
}
168196

169197
/**
170-
* @return \yii\web\Response
198+
* @return Yii\web\Response
171199
* @throws MethodNotAllowedHttpException
172-
* @throws \yii\base\InvalidConfigException
200+
* @throws Yii\base\InvalidConfigException
173201
*/
174202
public function actionResolveRouteToSchema()
175203
{
@@ -214,7 +242,7 @@ public function actionRefPage($pageId)
214242
public function actionPage($pageId)
215243
{
216244
Url::remember();
217-
\Yii::$app->session->set('__crudReturnUrl', null);
245+
Yii::$app->session->set('__crudReturnUrl', null);
218246

219247
// Set layout
220248
$this->layout = $this->module->defaultPageLayout;
@@ -232,15 +260,15 @@ public function actionPage($pageId)
232260
);
233261

234262
if ($this->module->pageCheckAccessDomain) {
235-
$pageQuery->andWhere(['access_domain' => [\Yii::$app->language, Tree::$_all]]);
263+
$pageQuery->andWhere(['access_domain' => [Yii::$app->language, Tree::$_all]]);
236264
}
237265

238266
// get page
239267
/** @var $page Tree */
240268
$page = $pageQuery->one();
241269

242270
// Show disabled pages for admins
243-
if ($page !== null && $page->isDisabled() && !\Yii::$app->user->can('pages')) {
271+
if ($page !== null && $page->isDisabled() && !Yii::$app->user->can('pages')) {
244272
$page = null;
245273
}
246274

@@ -257,13 +285,13 @@ public function actionPage($pageId)
257285
Tree::$activeAccessTrait = true;
258286
// check if page has access_read permissions set, if yes check if user is allowed
259287
if (!empty($page->access_read) && $page->access_read !== '*') {
260-
if (!\Yii::$app->user->can($page->access_read)) {
288+
if (!Yii::$app->user->can($page->access_read)) {
261289
# if userIsGuest, redirect to login page
262-
if (!\Yii::$app->user->isGuest) {
263-
throw new HttpException(403, \Yii::t('pages', 'Forbidden'));
290+
if (!Yii::$app->user->isGuest) {
291+
throw new HttpException(403, Yii::t('pages', 'Forbidden'));
264292
}
265293

266-
return $this->redirect(\Yii::$app->user->loginUrl);
294+
return $this->redirect(Yii::$app->user->loginUrl);
267295
}
268296
}
269297

@@ -282,24 +310,24 @@ public function actionPage($pageId)
282310

283311
// Render view
284312
if (empty($page->view)) {
285-
throw new HttpException(404, \Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
313+
throw new HttpException(404, Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
286314
}
287315
return $this->render($page->view, ['page' => $page]);
288316
} else {
289317
if ($fallbackPage = $this->resolveFallbackPage($pageId)) {
290-
\Yii::trace('Resolved fallback URL for ' . $fallbackPage->id, __METHOD__);
318+
Yii::trace('Resolved fallback URL for ' . $fallbackPage->id, __METHOD__);
291319
return $this->redirect($fallbackPage->createUrl(['language' => $fallbackPage->access_domain]));
292320
} else {
293-
throw new HttpException(404, \Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
321+
throw new HttpException(404, Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
294322
}
295323
}
296324

297325
if ($fallbackPage = $this->resolveFallbackPage($pageId)) {
298-
\Yii::trace('Resolved fallback URL for ' . $fallbackPage->id, __METHOD__);
326+
Yii::trace('Resolved fallback URL for ' . $fallbackPage->id, __METHOD__);
299327
return $this->redirect($fallbackPage->createUrl(['language' => $fallbackPage->access_domain]));
300328
}
301329

302-
throw new HttpException(404, \Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
330+
throw new HttpException(404, Yii::t('pages', 'Page not found.') . ' [ID: ' . $pageId . ']');
303331
}
304332

305333

‎models/BaseTree.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ class BaseTree extends \kartik\tree\models\Tree
3030
{
3131
use ActiveRecordAccessTrait;
3232

33+
// needed since 1.0.9. Currently we want all children to have children so new need for a extra db field (yet)
34+
// If that changes in the future, the default value must be `1` to ensure backwards compatibility
35+
public $child_allowed = 1;
36+
3337
/**
3438
* Icon type css
3539
*/

0 commit comments

Comments
 (0)