espocrm-extensions/espocrm-base
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ref

Browse Source
This commit is contained in:
Yuri Kuznetsov
2024-02-10 19:14:03 +02:00
parent e8f07e0765
commit 1d3c0074d4
17 changed files with 136 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/Espo/Classes/Acl/Attachment/AccessChecker.php
+1 -4
View File
@@ -99,10 +99,7 @@ class AccessChecker implements AccessEntityCREDChecker
else if ($this->aclManager->checkEntity($user, $parent)) {
if (
$entity->getTargetField() &&
in_array(
$entity->getTargetField(),
$this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
)
!$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
) {
return false;
}
application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
+1 -4
View File
@@ -105,10 +105,7 @@ class AccessChecker implements AccessEntityCREDChecker
else if ($this->aclManager->checkEntity($user, $parent)) {
if (
$entity->getTargetField() &&
in_array(
$entity->getTargetField(),
$this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
)
!$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
) {
return false;
}
application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php
+2 -5
View File
@@ -34,7 +34,6 @@ use Espo\Entities\AuthToken;
use Espo\Entities\User;
use Espo\ORM\Entity;
use Espo\Core\Acl;
use Espo\Core\Acl\Table;
use Espo\Core\FieldProcessing\Loader;
use Espo\Core\FieldProcessing\Loader\Params;
use Espo\Core\ORM\EntityManager;
@@ -44,6 +43,7 @@ use Exception;
/**
* @implements Loader<User>
* @noinspection PhpUnused
*/
class LastAccessLoader implements Loader
{
@@ -58,10 +58,7 @@ class LastAccessLoader implements Loader
public function process(Entity $entity, Params $params): void
{
$forbiddenFieldList = $this->acl
->getScopeForbiddenFieldList($entity->getEntityType(), Table::ACTION_READ);
if (in_array('lastAccess', $forbiddenFieldList)) {
if (!$this->acl->checkField($entity->getEntityType(), 'lastAccess')) {
return;
}
application/Espo/Core/Record/Service.php
+26 -37
View File
@@ -43,6 +43,7 @@ use Espo\Core\Exceptions\NotFoundSilent;
use Espo\Core\FieldSanitize\SanitizeManager;
use Espo\Core\ORM\Entity as CoreEntity;
use Espo\Core\ORM\Repository\Option\SaveOption;
use Espo\Core\ORM\Type\FieldType;
use Espo\Core\Record\Access\LinkCheck;
use Espo\Core\Record\ActionHistory\Action;
use Espo\Core\Record\ActionHistory\ActionLogger;
@@ -653,57 +654,45 @@ class Service implements Crud,
public function populateDefaults(Entity $entity, stdClass $data): void
{
if (!$this->user->isPortal()) {
$forbiddenFieldList = null;
if ($entity->hasAttribute('assignedUserId')) {
$forbiddenFieldList = $this->acl
->getScopeForbiddenFieldList($this->entityType, AclTable::ACTION_EDIT);
if (in_array('assignedUser', $forbiddenFieldList)) {
$entity->set('assignedUserId', $this->user->getId());
$entity->set('assignedUserName', $this->user->getName());
}
if (
$entity->hasAttribute('assignedUserId') &&
!$this->acl->checkField($this->entityType, 'assignedUser', AclTable::ACTION_EDIT)
) {
$entity->set('assignedUserId', $this->user->getId());
$entity->set('assignedUserName', $this->user->getName());
}
if (
$entity instanceof CoreEntity &&
$entity->hasLinkMultipleField('teams')
$entity->hasLinkMultipleField('teams') &&
$this->user->getDefaultTeam() &&
!$this->acl->checkField($this->entityType, 'teams', AclTable::ACTION_EDIT)
) {
if (is_null($forbiddenFieldList)) {
$forbiddenFieldList = $this->acl
->getScopeForbiddenFieldList($this->entityType, AclTable::ACTION_EDIT);
$defaultTeamId = $this->user->getDefaultTeam()->getId();
$entity->addLinkMultipleId('teams', $defaultTeamId);
$teamsNames = $entity->get('teamsNames');
if (!$teamsNames || !is_object($teamsNames)) {
$teamsNames = (object) [];
}
if (
in_array('teams', $forbiddenFieldList) &&
$this->user->get('defaultTeamId')
) {
$teamsNames->$defaultTeamId = $this->user->get('defaultTeamName');
$defaultTeamId = $this->user->get('defaultTeamId');
$entity->addLinkMultipleId('teams', $defaultTeamId);
$teamsNames = $entity->get('teamsNames');
if (!$teamsNames || !is_object($teamsNames)) {
$teamsNames = (object) [];
}
$teamsNames->$defaultTeamId = $this->user->get('defaultTeamName');
$entity->set('teamsNames', $teamsNames);
}
$entity->set('teamsNames', $teamsNames);
}
}
foreach ($this->fieldUtil->getEntityTypeFieldList($this->entityType) as $field) {
$type = $this->fieldUtil->getEntityTypeFieldParam($this->entityType, $field, 'type');
if ($type === 'currency') {
if ($entity->get($field) && !$entity->get($field . 'Currency')) {
$entity->set($field . 'Currency', $this->config->get('defaultCurrency'));
}
if (
$type === FieldType::CURRENCY &&
$entity->get($field) &&
!$entity->get($field . 'Currency')
) {
$entity->set($field . 'Currency', $this->config->get('defaultCurrency'));
}
}
}
application/Espo/Core/Select/Where/Checker.php
+1 -1
View File
@@ -168,7 +168,7 @@ class Checker
$entityType = $this->entityType;
if (str_contains($attribute, '.')) {
list($link, $attribute) = explode('.', $attribute);
[$link, $attribute] = explode('.', $attribute);
if (!$this->getSeed()->hasRelation($link)) {
// TODO allow alias
application/Espo/Core/Webhook/Queue.php
+2
View File
@@ -172,6 +172,7 @@ class Queue
->limit(0, $batchSize)
->find();
/** @var ?Webhook $webhook */
$webhook = $this->entityManager->getEntityById(Webhook::ENTITY_TYPE, $webhookId);
if (!$webhook || !$webhook->get('isActive')) {
@@ -187,6 +188,7 @@ class Queue
$user = null;
if ($webhook->get('userId')) {
/** @var ?User $user */
$user = $this->entityManager->getEntity(User::ENTITY_TYPE, $webhook->get('userId'));
if (!$user) {
application/Espo/Modules/Crm/Tools/Case/Service.php
+2 -4
View File
@@ -210,10 +210,8 @@ class Service
return [];
}
$contactForbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Contact::ENTITY_TYPE);
if (in_array('emailAddress', $contactForbiddenFieldList)) {
return [];
if (!$this->acl->checkField(Contact::ENTITY_TYPE, 'emailAddress')) {
return[];
}
$dataList = [];
application/Espo/Modules/Crm/Tools/Opportunity/Report/ByLeadSource.php
+21 -28
View File
@@ -30,6 +30,7 @@
namespace Espo\Modules\Crm\Tools\Opportunity\Report;
use Espo\Core\Acl;
use Espo\Core\Exceptions\BadRequest;
use Espo\Core\Exceptions\Forbidden;
use Espo\Core\Select\SelectBuilderFactory;
use Espo\Core\Utils\Config;
@@ -38,32 +39,19 @@ use Espo\Modules\Crm\Entities\Opportunity;
use Espo\ORM\EntityManager;
use Espo\ORM\Query\Part\Expression;
use Espo\ORM\Query\Part\Order;
use RuntimeException;
use stdClass;
class ByLeadSource
{
private Acl $acl;
private Config $config;
private Metadata $metadata;
private EntityManager $entityManager;
private SelectBuilderFactory $selectBuilderFactory;
private Util $util;
public function __construct(
Acl $acl,
Config $config,
Metadata $metadata,
EntityManager $entityManager,
SelectBuilderFactory $selectBuilderFactory,
Util $util
) {
$this->acl = $acl;
$this->config = $config;
$this->metadata = $metadata;
$this->entityManager = $entityManager;
$this->selectBuilderFactory = $selectBuilderFactory;
$this->util = $util;
}
private Acl $acl,
private Config $config,
private Metadata $metadata,
private EntityManager $entityManager,
private SelectBuilderFactory $selectBuilderFactory,
private Util $util
) {}
/**
* @throws Forbidden
@@ -78,19 +66,24 @@ class ByLeadSource
throw new Forbidden();
}
if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
throw new Forbidden();
if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
throw new Forbidden("No access to 'amount' field.");
}
[$from, $to] = $range->getRange();
$options = $this->metadata->get('entityDefs.Lead.fields.source.options', []);
$queryBuilder = $this->selectBuilderFactory
->create()
->from(Opportunity::ENTITY_TYPE)
->withStrictAccessControl()
->buildQueryBuilder();
try {
$queryBuilder = $this->selectBuilderFactory
->create()
->from(Opportunity::ENTITY_TYPE)
->withStrictAccessControl()
->buildQueryBuilder();
}
catch (BadRequest|Forbidden $e) {
throw new RuntimeException($e->getMessage());
}
$whereClause = [
['stage!=' => $this->util->getLostStageList()],
application/Espo/Modules/Crm/Tools/Opportunity/Report/ByStage.php
+2 -2
View File
@@ -78,8 +78,8 @@ class ByStage
throw new Forbidden();
}
if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
throw new Forbidden();
if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
throw new Forbidden("No access to 'amount' field.");
}
[$from, $to] = $range->getRange();
application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesByMonth.php
+8 -20
View File
@@ -43,25 +43,13 @@ use stdClass;
class SalesByMonth
{
private Acl $acl;
private Config $config;
private EntityManager $entityManager;
private SelectBuilderFactory $selectBuilderFactory;
private Util $util;
public function __construct(
Acl $acl,
Config $config,
EntityManager $entityManager,
SelectBuilderFactory $selectBuilderFactory,
Util $util
) {
$this->acl = $acl;
$this->config = $config;
$this->entityManager = $entityManager;
$this->selectBuilderFactory = $selectBuilderFactory;
$this->util = $util;
}
private Acl $acl,
private Config $config,
private EntityManager $entityManager,
private SelectBuilderFactory $selectBuilderFactory,
private Util $util
) {}
/**
* @throws Forbidden
@@ -76,8 +64,8 @@ class SalesByMonth
throw new Forbidden();
}
if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
throw new Forbidden();
if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
throw new Forbidden("No access to 'amount' field.");
}
[$from, $to] = $range->getRange();
application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesPipeline.php
+9 -23
View File
@@ -42,28 +42,14 @@ use stdClass;
class SalesPipeline
{
private Acl $acl;
private Config $config;
private Metadata $metadata;
private EntityManager $entityManager;
private SelectBuilderFactory $selectBuilderFactory;
private Util $util;
public function __construct(
Acl $acl,
Config $config,
Metadata $metadata,
EntityManager $entityManager,
SelectBuilderFactory $selectBuilderFactory,
Util $util
) {
$this->acl = $acl;
$this->config = $config;
$this->metadata = $metadata;
$this->entityManager = $entityManager;
$this->selectBuilderFactory = $selectBuilderFactory;
$this->util = $util;
}
private Acl $acl,
private Config $config,
private Metadata $metadata,
private EntityManager $entityManager,
private SelectBuilderFactory $selectBuilderFactory,
private Util $util
) {}
/**
* @throws Forbidden
@@ -78,8 +64,8 @@ class SalesPipeline
throw new Forbidden();
}
if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
throw new Forbidden();
if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
throw new Forbidden("No access to 'amount' field.");
}
[$from, $to] = $range->getRange();
application/Espo/Modules/Crm/Tools/Opportunity/Service.php
+31 -37
View File
@@ -30,7 +30,8 @@
namespace Espo\Modules\Crm\Tools\Opportunity;
use Espo\Core\Acl;
use Espo\Core\Exceptions\ForbiddenSilent;
use Espo\Core\Exceptions\BadRequest;
use Espo\Core\Exceptions\Forbidden;
use Espo\Core\Field\EmailAddress;
use Espo\Core\Record\ServiceContainer;
use Espo\Core\Select\SelectBuilderFactory;
@@ -40,29 +41,21 @@ use Espo\Modules\Crm\Entities\Opportunity;
use Espo\ORM\Collection;
use Espo\ORM\EntityManager;
use Espo\Tools\Email\EmailAddressEntityPair;
use RuntimeException;
class Service
{
private ServiceContainer $serviceContainer;
private Acl $acl;
private EntityManager $entityManager;
private SelectBuilderFactory $selectBuilderFactory;
public function __construct(
ServiceContainer $serviceContainer,
Acl $acl,
EntityManager $entityManager,
SelectBuilderFactory $selectBuilderFactory
) {
$this->serviceContainer = $serviceContainer;
$this->acl = $acl;
$this->entityManager = $entityManager;
$this->selectBuilderFactory = $selectBuilderFactory;
}
private ServiceContainer $serviceContainer,
private Acl $acl,
private EntityManager $entityManager,
private SelectBuilderFactory $selectBuilderFactory
) {}
/**
* @throws ForbiddenSilent
* @return EmailAddressEntityPair[]
* @throws Forbidden
*/
public function getEmailAddressList(string $id): array
{
@@ -71,12 +64,10 @@ class Service
->get(Opportunity::ENTITY_TYPE)
->getEntity($id);
$forbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Opportunity::ENTITY_TYPE);
$list = [];
if (
!in_array('contacts', $forbiddenFieldList) &&
$this->acl->checkField(Opportunity::ENTITY_TYPE, 'contacts') &&
$this->acl->checkScope(Contact::ENTITY_TYPE)
) {
foreach ($this->getContactEmailAddressList($entity) as $item) {
@@ -86,7 +77,7 @@ class Service
if (
$list === [] &&
!in_array('account', $forbiddenFieldList) &&
$this->acl->checkField(Opportunity::ENTITY_TYPE, 'account') &&
$this->acl->checkScope(Account::ENTITY_TYPE)
) {
$item = $this->getAccountEmailAddress($entity, $list);
@@ -149,9 +140,7 @@ class Service
return [];
}
$contactForbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Contact::ENTITY_TYPE);
if (in_array('emailAddress', $contactForbiddenFieldList)) {
if (!$this->acl->checkField(Contact::ENTITY_TYPE, 'emailAddress')) {
return [];
}
@@ -159,20 +148,25 @@ class Service
$emailAddressList = [];
$query = $this->selectBuilderFactory
->create()
->from(Contact::ENTITY_TYPE)
->withStrictAccessControl()
->buildQueryBuilder()
->select([
'id',
'emailAddress',
'name',
])
->where([
'id' => $contactIdList,
])
->build();
try {
$query = $this->selectBuilderFactory
->create()
->from(Contact::ENTITY_TYPE)
->withStrictAccessControl()
->buildQueryBuilder()
->select([
'id',
'emailAddress',
'name',
])
->where([
'id' => $contactIdList,
])
->build();
}
catch (BadRequest|Forbidden $e) {
throw new RuntimeException($e->getMessage());
}
/** @var Collection<Contact> $contactCollection */
$contactCollection = $this->entityManager
application/Espo/Services/Webhook.php
+17 -5
View File
@@ -33,7 +33,6 @@ use Espo\Entities\Webhook as WebhookEntity;
use Espo\ORM\Entity;
use Espo\Core\Exceptions\Forbidden;
use Espo\Core\Di;
use Espo\Entities\User;
use stdClass;
@@ -96,6 +95,9 @@ class Webhook extends Record implements
parent::filterUpdateInput($data);
}
/**
* @throws Forbidden
*/
protected function beforeCreateEntity(Entity $entity, $data)
{
$this->checkEntityUserIsApi($entity);
@@ -106,6 +108,9 @@ class Webhook extends Record implements
}
}
/**
* @throws Forbidden
*/
protected function checkMaxCount(): void
{
$maxCount = $this->config->get('webhookMaxCountPerUser', self::WEBHOOK_MAX_COUNT_PER_USER);
@@ -122,12 +127,18 @@ class Webhook extends Record implements
}
}
/**
* @throws Forbidden
*/
protected function beforeUpdateEntity(Entity $entity, $data)
{
$this->checkEntityUserIsApi($entity);
$this->processEntityEventData($entity);
}
/**
* @throws Forbidden
*/
protected function checkEntityUserIsApi(Entity $entity): void
{
$userId = $entity->get('userId');
@@ -144,6 +155,9 @@ class Webhook extends Record implements
}
}
/**
* @throws Forbidden
*/
protected function processEntityEventData(Entity $entity): void
{
$event = $entity->get('event');
@@ -164,7 +178,6 @@ class Webhook extends Record implements
throw new Forbidden("Not supported event.");
}
$arr = explode('.', $event);
$entityType = $arr[0];
$type = $arr[1];
@@ -204,9 +217,7 @@ class Webhook extends Record implements
throw new Forbidden("Field is empty.");
}
$forbiddenFieldList = $this->getAcl()->getScopeForbiddenFieldList($entityType);
if (in_array($field, $forbiddenFieldList)) {
if (!$this->acl->checkField($entityType, $field)) {
throw new Forbidden("Field is forbidden.");
}
@@ -214,6 +225,7 @@ class Webhook extends Record implements
throw new Forbidden("Field does not exist.");
}
} else {
/** @noinspection PhpRedundantOptionalArgumentInspection */
$entity->set('field', null);
}
}
application/Espo/Tools/App/AppService.php
+1 -1
View File
@@ -193,7 +193,7 @@ class AppService
unset($data->authTokenId);
unset($data->password);
$forbiddenAttributeList = $this->acl->getScopeForbiddenAttributeList('User');
$forbiddenAttributeList = $this->acl->getScopeForbiddenAttributeList(User::ENTITY_TYPE);
$isPortal = $user->isPortal();
application/Espo/Tools/Attachment/AccessChecker.php
+8 -16
View File
@@ -60,19 +60,11 @@ class AccessChecker
Attachment::ROLE_INLINE_ATTACHMENT,
];
private User $user;
private Acl $acl;
private Metadata $metadata;
public function __construct(
User $user,
Acl $acl,
Metadata $metadata
) {
$this->user = $user;
$this->acl = $acl;
$this->metadata = $metadata;
}
private User $user,
private Acl $acl,
private Metadata $metadata
) {}
/**
* Check access to a field and role allowance.
@@ -103,7 +95,7 @@ class AccessChecker
$fieldType = $this->metadata->get(['entityDefs', $relatedEntityType, 'fields', $field, 'type']);
if (!$fieldType) {
throw new Forbidden("Field '{$field}' does not exist.");
throw new Forbidden("Field '$field' does not exist.");
}
$fieldTypeList = $role === Attachment::ROLE_INLINE_ATTACHMENT ?
@@ -111,7 +103,7 @@ class AccessChecker
$this->attachmentFieldTypeList;
if (!in_array($fieldType, $fieldTypeList)) {
throw new Forbidden("Field type '{$fieldType}' is not allowed for {$role}.");
throw new Forbidden("Field type '$fieldType' is not allowed for $role.");
}
if ($this->user->isAdmin() && $relatedEntityType === Settings::ENTITY_TYPE) {
@@ -125,8 +117,8 @@ class AccessChecker
throw new Forbidden("No access to " . $relatedEntityType . ".");
}
if (in_array($field, $this->acl->getScopeForbiddenFieldList($relatedEntityType, Table::ACTION_EDIT))) {
throw new Forbidden("No access to field '" . $field . "'.");
if (!$this->acl->checkField($relatedEntityType, $field, Table::ACTION_EDIT)) {
throw new Forbidden("No access to field '$field'.");
}
}
}
application/Espo/Tools/DataPrivacy/Erasor.php
+1 -1
View File
@@ -89,7 +89,7 @@ class Erasor implements
foreach ($fieldList as $field) {
if (in_array($field, $forbiddenFieldList)) {
throw new Forbidden("Field '{$field}' is forbidden to edit.");
throw new Forbidden("Field '$field' is forbidden to edit.");
}
}
application/Espo/Tools/Email/InboxService.php
+3 -13
View File
@@ -109,17 +109,12 @@ class InboxService
throw new Forbidden("No access to current group folder.");
}
if (
in_array(
'groupFolder',
$this->aclManager->getScopeForbiddenFieldList($user, Email::ENTITY_TYPE, Table::ACTION_EDIT)
)
) {
if (!$this->aclManager->checkField($user, Email::ENTITY_TYPE, 'groupFolder', Table::ACTION_EDIT)) {
throw new Forbidden("No access to `groupFolder` field.");
}
}
if ($folderId && strpos($folderId, 'group:') === 0) {
if ($folderId && str_starts_with($folderId, 'group:')) {
try {
$this->moveToGroupFolder($email, substr($folderId, 6), $user);
}
@@ -180,12 +175,7 @@ class InboxService
throw new Forbidden("No read access to email to unset group folder.");
}
if (
in_array(
'groupFolder',
$this->aclManager->getScopeForbiddenFieldList($user, Email::ENTITY_TYPE, Table::ACTION_EDIT)
)
) {
if (!$this->aclManager->checkField($user, Email::ENTITY_TYPE, 'groupFolder', Table::ACTION_EDIT)) {
throw new Forbidden("No access to `groupFolder` field.");
}