Chill-project/chill-bundles
6
0
Fork 0
mirror of https://gitlab.com/Chill-Projet/chill-bundles.git synced 2025-07-01 06:26:15 +00:00
Code Issues Actions Projects Releases Wiki Activity

Restrict SHARE action in SavedExportVoter to require COMPOSE_EXPORT permission.

Browse Source
This commit is contained in:
Julien Fastré 2025-06-26 12:35:53 +02:00
parent 925fbaed6d
commit 7533cb3a71
Signed by: julienfastre
GPG Key ID: BDE2190974723FCB
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Bundle/ChillMainBundle/Security/Authorization/SavedExportVoter.php
View File

@ -55,7 +55,8 @@ final class SavedExportVoter extends Voter
}
return match ($attribute) {
self::DELETE, self::EDIT, self::SHARE => $subject->getUser() === $token->getUser(),
self::DELETE, self::EDIT => $subject->getUser() === $token->getUser(),
self::SHARE => $subject->getUser() === $token->getUser() && $this->accessDecisionManager->decide($token, [ChillExportVoter::COMPOSE_EXPORT]),
self::DUPLICATE => $this->accessDecisionManager->decide($token, [ChillExportVoter::COMPOSE_EXPORT]) && $this->accessDecisionManager->decide($token, [self::EDIT], $subject) ,
self::GENERATE => $this->canUserGenerate($user, $subject),
default => throw new \UnexpectedValueException('attribute not supported: '.$attribute),