LinkGenerator: throws an error when the link points to #[Requires(forward: true)]

Author: dg

src/Application/LinkGenerator.php

@@ -137,7 +137,7 @@ public function createRequest(
 					throw new UI\InvalidLinkException("Unknown signal '$signal', missing handler {$reflection->getName()}::{$component::formatSignalMethod($signal)}()");
 				}
 
-				$this->validateLinkTarget($refPresenter, $method, "signal '$signal'" . ($component === $refPresenter ? '' : ' in ' . $component::class));
+				$this->validateLinkTarget($refPresenter, $method, "signal '$signal'" . ($component === $refPresenter ? '' : ' in ' . $component::class), $mode);
 
 				// convert indexed parameters to named
 				UI\ParameterConverter::toParameters($method, $args, [], $missing);
@@ -166,7 +166,7 @@ public function createRequest(
 			$current = $refPresenter && ($action === '*' || strcasecmp($action, $refPresenter->getAction()) === 0) && $presenterClass === $refPresenter::class;
 
 			$reflection = new UI\ComponentReflection($presenterClass);
-			$this->validateLinkTarget($refPresenter, $reflection, "presenter '$presenter'");
+			$this->validateLinkTarget($refPresenter, $reflection, "presenter '$presenter'", $mode);
 
 			foreach (array_intersect_key($reflection->getParameters(), $args) as $name => $param) {
 				if ($args[$name] === $param['def']) {
@@ -176,7 +176,7 @@ public function createRequest(
 
 			// counterpart of run() & tryCall()
 			if ($method = $reflection->getActionRenderMethod($action)) {
-				$this->validateLinkTarget($refPresenter, $method, "action '$presenter:$action'");
+				$this->validateLinkTarget($refPresenter, $method, "action '$presenter:$action'", $mode);
 
 				UI\ParameterConverter::toParameters($method, $args, $path === 'this' ? $refPresenter->getParameters() : [], $missing);
 
@@ -296,9 +296,12 @@ private function validateLinkTarget(
 		?UI\Presenter $presenter,
 		\ReflectionClass|\ReflectionMethod $element,
 		string $message,
+		string $mode,
 	): void
 	{
-		if ($presenter?->invalidLinkMode
+		if ($mode !== 'forward' && !(new UI\AccessPolicy($element))->isLinkable()) {
+			throw new UI\InvalidLinkException("Link to forbidden $message from '{$presenter->getName()}:{$presenter->getAction()}'.");
+		} elseif ($presenter?->invalidLinkMode
 			&& (UI\ComponentReflection::parseAnnotation($element, 'deprecated') || $element->getAttributes(Attributes\Deprecated::class))
 		) {
 			trigger_error("Link to deprecated $message from '{$presenter->getName()}:{$presenter->getAction()}'.", E_USER_DEPRECATED);

src/Application/UI/AccessPolicy.php

@@ -43,6 +43,13 @@ public function checkAccess(Component $component): void
 	}
 
 
+	public function isLinkable(): bool
+	{
+		$attrs = $this->getAttributes();
+		return !$attrs || !Nette\Utils\Arrays::some($attrs, fn($attr) => $attr->forward === true);
+	}
+
+
 	/**
 	 * @return Attributes\Requires[]
 	 */

tests/UI/Requires.forward.link().phpt

@@ -0,0 +1,99 @@
+<?php
+
+/**
+ * Test: Nette\Application\UI\Presenter::link() and #[Requires(forward: true)]
+ */
+
+declare(strict_types=1);
+
+use Nette\Application;
+use Nette\Application\Attributes\Requires;
+use Nette\Http;
+use Tester\Assert;
+
+require __DIR__ . '/../bootstrap.php';
+
+
+class TestPresenter extends Application\UI\Presenter
+{
+	protected function startup(): void
+	{
+		parent::startup();
+		$this->terminate();
+	}
+
+
+	#[Requires(forward: true)]
+	public function actionFoo()
+	{
+	}
+
+
+	#[Requires(forward: true)]
+	public function handleFoo()
+	{
+	}
+
+
+	#[Requires(forward: true)]
+	public function renderBar()
+	{
+	}
+}
+
+
+#[Requires(forward: true)]
+class ForwardPresenter extends TestPresenter
+{
+}
+
+
+$url = new Http\UrlScript('http://localhost/index.php', '/index.php');
+
+$presenterFactory = Mockery::mock(Nette\Application\IPresenterFactory::class);
+$presenterFactory->shouldReceive('getPresenterClass')
+	->andReturnUsing(fn($presenter) => $presenter . 'Presenter');
+
+$presenter = new TestPresenter;
+$presenter->injectPrimary(
+	new Http\Request($url),
+	new Http\Response,
+	$presenterFactory,
+	new Application\Routers\SimpleRouter,
+);
+
+$presenter->invalidLinkMode = TestPresenter::InvalidLinkWarning;
+
+$request = new Application\Request('Test', Http\Request::Get, []);
+$presenter->run($request);
+
+Assert::error(
+	fn() => $presenter->link('foo'),
+	E_USER_WARNING,
+	"Invalid link: Link to forbidden action 'Test:foo' from 'Test:default'.",
+);
+
+Assert::error(
+	fn() => $presenter->link('bar'),
+	E_USER_WARNING,
+	"Invalid link: Link to forbidden action 'Test:bar' from 'Test:default'.",
+);
+
+Assert::error(
+	fn() => $presenter->link('foo!'),
+	E_USER_WARNING,
+	"Invalid link: Link to forbidden signal 'foo' from 'Test:default'.",
+);
+
+Assert::error(
+	fn() => $presenter->link('Forward:'),
+	E_USER_WARNING,
+	"Invalid link: Link to forbidden presenter 'Forward' from 'Test:default'.",
+);
+
+Assert::noError(fn() => $presenter->link('Test:'));
+
+Assert::error( // no error
+	fn() => $presenter->forward('Forward:'),
+	Application\AbortException::class,
+);