webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-30 04:23:11 +03:00
Code Activity

Started removal of non-view permission queries

Browse Source 
Updated ajax search and entity selector usage to display and handle
items that the user does not have permission to interact with.
Started logic changes to not allow permission type to be passed around,
with views instead being the fixed sole permission.
This commit is contained in:
Dan Brown
2022-07-13 15:23:03 +01:00
parent 2989852520
commit 4fb85a9a5c
10 changed files with 47 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/Auth/Permissions/PermissionApplicator.php
View File

@ -72,6 +72,7 @@ class PermissionApplicator
$action = $permission;
}
// TODO - Use a non-query based check
$hasAccess = $this->entityRestrictionQuery($baseQuery, $action)->count() > 0;
$this->clean();
@ -163,14 +164,14 @@ class PermissionApplicator
/**
* Add restrictions for a generic entity.
*/
public function enforceEntityRestrictions(Entity $entity, Builder $query, string $action = 'view'): Builder
public function enforceEntityRestrictions(Entity $entity, Builder $query): Builder
{
if ($entity instanceof Page) {
// Prevent drafts being visible to others.
$this->enforceDraftVisibilityOnQuery($query);
}
return $this->entityRestrictionQuery($query, $action);
return $this->entityRestrictionQuery($query, 'view');
}
/**

2
app/Auth/User.php
View File

@ -163,7 +163,7 @@ class User extends Model implements AuthenticatableContract, CanResetPasswordCon
}
/**
* Get all permissions belonging to a the current user.
* Get all permissions belonging to the current user.
*/
protected function permissions(): Collection
{