Skip to content

Commit a175fc6

Browse files
joomdonationjoomdonation
authored
[4.0] Use unset filter to unset created_by data if needed (#34303)
1 parent 1e2ffa7 commit a175fc6

File tree

7 files changed

+45
-118
lines changed

7 files changed

+45
-118
lines changed

‎administrator/components/com_banners/src/Model/BannerModel.php‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,12 @@ public function getForm($data = array(), $loadData = true)
210210
$form->setFieldAttribute('sticky', 'filter', 'unset');
211211
}
212212

213+
// Don't allow to change the created_by user if not allowed to access com_users.
214+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
215+
{
216+
$form->setFieldAttribute('created_by', 'filter', 'unset');
217+
}
218+
213219
return $form;
214220
}
215221

@@ -460,31 +466,4 @@ private function canCreateCategory()
460466
{
461467
return Factory::getUser()->authorise('core.create', 'com_banners');
462468
}
463-
464-
/**
465-
* Method to validate the form data.
466-
*
467-
* @param Form $form The form to validate against.
468-
* @param array $data The data to validate.
469-
* @param string $group The name of the field group to validate.
470-
*
471-
* @return array|boolean Array of filtered data if valid, false otherwise.
472-
*
473-
* @see JFormRule
474-
* @see JFilterInput
475-
* @since 3.9.25
476-
*/
477-
public function validate($form, $data, $group = null)
478-
{
479-
// Don't allow to change the users if not allowed to access com_users.
480-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
481-
{
482-
if (isset($data['created_by']))
483-
{
484-
unset($data['created_by']);
485-
}
486-
}
487-
488-
return parent::validate($form, $data, $group);
489-
}
490469
}

‎administrator/components/com_categories/src/Model/CategoryModel.php‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,12 @@ public function getForm($data = array(), $loadData = true)
289289
$form->setFieldAttribute('published', 'filter', 'unset');
290290
}
291291

292+
// Don't allow to change the created_user_id user if not allowed to access com_users.
293+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
294+
{
295+
$form->setFieldAttribute('created_user_id', 'filter', 'unset');
296+
}
297+
292298
return $form;
293299
}
294300

@@ -368,15 +374,6 @@ protected function loadFormData()
368374
*/
369375
public function validate($form, $data, $group = null)
370376
{
371-
// Don't allow to change the users if not allowed to access com_users.
372-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
373-
{
374-
if (isset($data['created_user_id']))
375-
{
376-
unset($data['created_user_id']);
377-
}
378-
}
379-
380377
if (!Factory::getUser()->authorise('core.admin', $data['extension']))
381378
{
382379
if (isset($data['rules']))

‎administrator/components/com_contact/src/Model/ContactModel.php‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,12 @@ public function getForm($data = array(), $loadData = true)
196196
$form->setFieldAttribute('published', 'filter', 'unset');
197197
}
198198

199+
// Don't allow to change the created_by user if not allowed to access com_users.
200+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
201+
{
202+
$form->setFieldAttribute('created_by', 'filter', 'unset');
203+
}
204+
199205
return $form;
200206
}
201207

@@ -543,31 +549,4 @@ private function canCreateCategory()
543549
{
544550
return Factory::getUser()->authorise('core.create', 'com_contact');
545551
}
546-
547-
/**
548-
* Method to validate the form data.
549-
*
550-
* @param Form $form The form to validate against.
551-
* @param array $data The data to validate.
552-
* @param string $group The name of the field group to validate.
553-
*
554-
* @return array|boolean Array of filtered data if valid, false otherwise.
555-
*
556-
* @see JFormRule
557-
* @see JFilterInput
558-
* @since 3.9.25
559-
*/
560-
public function validate($form, $data, $group = null)
561-
{
562-
// Don't allow to change the users if not allowed to access com_users.
563-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
564-
{
565-
if (isset($data['created_by']))
566-
{
567-
unset($data['created_by']);
568-
}
569-
}
570-
571-
return parent::validate($form, $data, $group);
572-
}
573552
}

‎administrator/components/com_content/src/Model/ArticleModel.php‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -586,6 +586,12 @@ public function getForm($data = array(), $loadData = true)
586586
$form->setFieldAttribute('state', 'filter', 'unset');
587587
}
588588

589+
// Don't allow to change the created_by user if not allowed to access com_users.
590+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
591+
{
592+
$form->setFieldAttribute('created_by', 'filter', 'unset');
593+
}
594+
589595
return $form;
590596
}
591597

@@ -656,15 +662,6 @@ protected function loadFormData()
656662
*/
657663
public function validate($form, $data, $group = null)
658664
{
659-
// Don't allow to change the users if not allowed to access com_users.
660-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
661-
{
662-
if (isset($data['created_by']))
663-
{
664-
unset($data['created_by']);
665-
}
666-
}
667-
668665
if (!Factory::getUser()->authorise('core.admin', 'com_content'))
669666
{
670667
if (isset($data['rules']))

‎administrator/components/com_fields/src/Model/FieldModel.php‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,12 @@ public function getForm($data = array(), $loadData = true)
571571
$form->setFieldAttribute('state', 'filter', 'unset');
572572
}
573573

574+
// Don't allow to change the created_user_id user if not allowed to access com_users.
575+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
576+
{
577+
$form->setFieldAttribute('created_user_id', 'filter', 'unset');
578+
}
579+
574580
// In case we are editing a field, field type cannot be changed, so some extra handling below is needed
575581
if ($fieldId)
576582
{
@@ -965,15 +971,6 @@ protected function loadFormData()
965971
*/
966972
public function validate($form, $data, $group = null)
967973
{
968-
// Don't allow to change the users if not allowed to access com_users.
969-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
970-
{
971-
if (isset($data['created_user_id']))
972-
{
973-
unset($data['created_user_id']);
974-
}
975-
}
976-
977974
if (!Factory::getUser()->authorise('core.admin', 'com_fields'))
978975
{
979976
if (isset($data['rules']))

‎administrator/components/com_fields/src/Model/GroupModel.php‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,9 @@ public function getForm($data = array(), $loadData = true)
125125
$data['context'] = $context;
126126
}
127127

128-
if (!Factory::getUser()->authorise('core.edit.state', $context . '.fieldgroup.' . $jinput->get('id')))
128+
$user = Factory::getUser();
129+
130+
if (!$user->authorise('core.edit.state', $context . '.fieldgroup.' . $jinput->get('id')))
129131
{
130132
// Disable fields for display.
131133
$form->setFieldAttribute('ordering', 'disabled', 'true');
@@ -136,6 +138,12 @@ public function getForm($data = array(), $loadData = true)
136138
$form->setFieldAttribute('state', 'filter', 'unset');
137139
}
138140

141+
// Don't allow to change the created_by user if not allowed to access com_users.
142+
if (!$user->authorise('core.manage', 'com_users'))
143+
{
144+
$form->setFieldAttribute('created_by', 'filter', 'unset');
145+
}
146+
139147
return $form;
140148
}
141149

@@ -280,15 +288,6 @@ protected function preprocessForm(Form $form, $data, $group = 'content')
280288
*/
281289
public function validate($form, $data, $group = null)
282290
{
283-
// Don't allow to change the users if not allowed to access com_users.
284-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
285-
{
286-
if (isset($data['created_by']))
287-
{
288-
unset($data['created_by']);
289-
}
290-
}
291-
292291
if (!Factory::getUser()->authorise('core.admin', 'com_fields'))
293292
{
294293
if (isset($data['rules']))

‎administrator/components/com_newsfeeds/src/Model/NewsfeedModel.php‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,12 @@ public function getForm($data = array(), $loadData = true)
133133
$form->setFieldAttribute('publish_down', 'filter', 'unset');
134134
}
135135

136+
// Don't allow to change the created_by user if not allowed to access com_users.
137+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
138+
{
139+
$form->setFieldAttribute('created_by', 'filter', 'unset');
140+
}
141+
136142
return $form;
137143
}
138144

@@ -448,31 +454,4 @@ private function canCreateCategory()
448454
{
449455
return Factory::getUser()->authorise('core.create', 'com_newsfeeds');
450456
}
451-
452-
/**
453-
* Method to validate the form data.
454-
*
455-
* @param Form $form The form to validate against.
456-
* @param array $data The data to validate.
457-
* @param string $group The name of the field group to validate.
458-
*
459-
* @return array|boolean Array of filtered data if valid, false otherwise.
460-
*
461-
* @see JFormRule
462-
* @see JFilterInput
463-
* @since 3.9.25
464-
*/
465-
public function validate($form, $data, $group = null)
466-
{
467-
// Don't allow to change the users if not allowed to access com_users.
468-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
469-
{
470-
if (isset($data['created_by']))
471-
{
472-
unset($data['created_by']);
473-
}
474-
}
475-
476-
return parent::validate($form, $data, $group);
477-
}
478457
}

0 commit comments

Comments
 (0)