acl refactor 2

application/Espo/Acl/Email.php

@@ -0,0 +1,64 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Email extends \Espo\Core\Acl\Base
+{
+
+    public function checkRead(User $user, Entity $entity, $data)
+    {
+        if ($this->checkEntity($user, $entity, $data, 'read')) {
+            return true;
+        }
+
+        if (!$entity->has('usersIds')) {
+            $entity->loadLinkMultipleField('users');
+        }
+        $userIdList = $entity->get('usersIds');
+        if (is_array($userIdList) && in_array($user->id, $userIdList)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        /*if ($entity->has('assignedUserId')) {
+            if ($user->id === $entity->get('assignedUserId')) {
+                return true;
+            }
+        }*/
+
+        if ($user->id === $entity->get('createdById')) {
+            return true;
+        }
+
+        return false;
+    }
+
+}
+

application/Espo/Core/Acl/Base.php

@@ -31,6 +31,8 @@ class Base implements Injectable
 {
     protected $dependencies = array(
         'config',
+        'entityManager',
+        'aclManager'
     );
 
     protected $injections = array();
@@ -69,6 +71,16 @@ class Base implements Injectable
         return $this->getInjection('config');
     }
 
+    protected function getEntityManager()
+    {
+        return $this->getInjection('entityManager');
+    }
+
+    protected function getAclManager()
+    {
+        return $this->getInjection('aclManager');
+    }
+
     public function checkReadOnlyTeam(User $user, $scope, $data)
     {
         if (empty($data) || !is_array($data) || !isset($data['read'])) {
@@ -79,14 +91,18 @@ class Base implements Injectable
 
     public function checkReadOnlyOwn(User $user, $scope, $data)
     {
-
         if (empty($data) || !is_array($data) || !isset($data['read'])) {
             return false;
         }
         return $data['read'] === 'own';
     }
 
-    public function checkScope(User $user, $data, $scope, $action = null, $isOwner = null, $inTeam = null, $entity = null)
+    public function checkEntity(User $user, Entity $entity, $data, $action)
+    {
+        return $this->checkScope($user, $data, $entity->getEntityType(), $action, null, null, $entity);
+    }
+
+    public function checkScope(User $user, $data, $scope, $action = null, $isOwner = null, $inTeam = null, Entity $entity = null)
     {
         if (is_null($data)) {
             return true;
@@ -97,6 +113,7 @@ class Base implements Injectable
         if ($data === true) {
             return true;
         }
+
         if (!is_null($action)) {
             if (array_key_exists($action, $data)) {
                 $value = $data[$action];
@@ -109,8 +126,12 @@ class Base implements Injectable
                     return false;
                 }
 
-                if (is_null($isOwner) && $entity) {
-                    $isOwner = $this->checkIsOwner($user, $entity);
+                if (is_null($isOwner)) {
+                    if ($entity) {
+                        $isOwner = $this->checkIsOwner($user, $entity);
+                    } else {
+                        return true;
+                    }
                 }
 
                 if ($isOwner) {
@@ -135,14 +156,13 @@ class Base implements Injectable
 
     public function checkIsOwner(User $user, Entity $entity)
     {
-        $userId = $user->id;
         if ($entity->has('assignedUserId')) {
-            if ($userId === $entity->get('assignedUserId')) {
+            if ($user->id === $entity->get('assignedUserId')) {
                 return true;
             }
         }
         if ($entity->has('createdById')) {
-            if ($userId === $entity->get('createdById')) {
+            if ($user->id === $entity->get('createdById')) {
                 return true;
             }
         }

application/Espo/Core/AclManager.php

@@ -147,17 +147,34 @@ class AclManager
             $entity = $subject;
             if ($entity instanceof Entity) {
                 $entityType = $entity->getEntityType();
-                return $this->checkScope($user, $entityType, $action, $isOwner, $inTeam, $entity);
+
+                $impl = $this->getImplementation($entityType);
+                $methodName = 'check' . ucfirst($action);
+                if (method_exists($impl, $methodName)) {
+                    $data = $this->getTable($user)->getScopeData($entityType);
+                    return $impl->$methodName($user, $entity, $data);
+                }
+
+                return $this->checkEntity($user, $entity, $action, $isOwner, $inTeam, $entity);
             }
         }
     }
 
+    public function checkEntity(User $user, Entity $entity, $action)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+        $data = $this->getTable($user)->getScopeData($entity->getEntityType());
+        return $this->getImplementation($scope)->checkEntity($user, $entity, $data, $action);
+    }
+
     public function checkScope(User $user, $scope, $action = null, $isOwner = null, $inTeam = null, $entity = null)
     {
         if ($user->isAdmin()) {
             return true;
         }
-        $data = $this->getTable($user)->getScopeData($user, $scope);
+        $data = $this->getTable($user)->getScopeData($scope);
         return $this->getImplementation($scope)->checkScope($user, $data, $scope, $action, $isOwner, $inTeam, $entity);
     }
 }

application/Espo/Services/Email.php

@@ -195,10 +195,7 @@ class Email extends Record
             $this->loadAdditionalFields($entity);
 
             if (!$this->getAcl()->check($entity, 'read')) {
-                $userIdList = $entity->get('usersIds');
-                if (!is_array($userIdList) || !in_array($this->getUser()->id, $userIdList)) {
-                    throw new Forbidden();
-                }
+                throw new Forbidden();
             }
         }
         if (!empty($entity)) {