forked from pkp/pkp-lib
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
pkp#3666 Prevent dual-assigned editors from accessing discussions
- Loading branch information
Showing
10 changed files
with
198 additions
and
68 deletions.
There are no files selected for viewing
62 changes: 62 additions & 0 deletions
62
classes/security/authorization/AssignedStageRoleHandlerOperationPolicy.inc.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| <?php | ||
| /** | ||
| * @file classes/security/authorization/AssignedStageRoleHandlerOperationPolicy.inc.php | ||
| * | ||
| * Copyright (c) 2014-2018 Simon Fraser University | ||
| * Copyright (c) 2000-2018 John Willinsky | ||
| * Distributed under the GNU GPL v2. For full terms see the file docs/COPYING. | ||
| * | ||
| * @class AssignedStageRoleHandlerOperationPolicy | ||
| * @ingroup security_authorization | ||
| * | ||
| * @brief Class to control access to handler operations based on assigned | ||
| * role(s) in a submission's workflow stage. | ||
| */ | ||
|
|
||
| import('lib.pkp.classes.security.authorization.RoleBasedHandlerOperationPolicy'); | ||
|
|
||
| class AssignedStageRoleHandlerOperationPolicy extends RoleBasedHandlerOperationPolicy { | ||
|
|
||
| /** @var int */ | ||
| var $_stageId; | ||
|
|
||
| /** | ||
| * Constructor | ||
| * @param $request PKPRequest | ||
| * @param $roles array|integer either a single role ID or an array of role ids | ||
| * @param $operations array|string either a single operation or a list of operations that | ||
| * this policy is targeting. | ||
| * @param $stageId int The stage ID to check for assigned roles | ||
| * @param $message string a message to be displayed if the authorization fails | ||
| * @param $allRoles boolean whether all roles must match ("all of") or whether it is | ||
| * enough for only one role to match ("any of"). Default: false ("any of") | ||
| */ | ||
| function __construct($request, $roles, $operations, $stageId, | ||
| $message = 'user.authorization.assignedStageRoleBasedAccessDenied', | ||
| $allRoles = false) { | ||
| parent::__construct($request, $roles, $operations, $message, $allRoles); | ||
|
|
||
| $this->_stageId = $stageId; | ||
| } | ||
|
|
||
| // | ||
| // Implement template methods from AuthorizationPolicy | ||
| // | ||
| /** | ||
| * @see AuthorizationPolicy::effect() | ||
| */ | ||
| function effect() { | ||
| // Check whether the user has one of the allowed roles | ||
| // assigned. If that's the case we'll permit access. | ||
| // Get user roles grouped by context. | ||
| $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_ACCESSIBLE_WORKFLOW_STAGES); | ||
| if (empty($userRoles) || empty($userRoles[$this->_stageId])) return AUTHORIZATION_DENY; | ||
|
|
||
| if (!$this->_checkUserRoleAssignment($userRoles[$this->_stageId])) return AUTHORIZATION_DENY; | ||
| if (!$this->_checkOperationWhitelist()) return AUTHORIZATION_DENY; | ||
|
|
||
| return AUTHORIZATION_PERMIT; | ||
| } | ||
| } | ||
|
|
||
| ?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
classes/security/authorization/internal/SubmissionFileNotQueryAccessPolicy.inc.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| <?php | ||
| /** | ||
| * @file classes/security/authorization/internal/SubmissionFileNotQueryAccessPolicy.inc.php | ||
| * | ||
| * Copyright (c) 2014-2018 Simon Fraser University | ||
| * Copyright (c) 2000-2018 John Willinsky | ||
| * Distributed under the GNU GPL v2. For full terms see the file docs/COPYING. | ||
| * | ||
| * @class SubmissionFileNotQueryAccessPolicy | ||
| * @ingroup security_authorization_internal | ||
| * | ||
| * @brief Submission file policy to check if the requested file is not attached | ||
| * to a query. This returns AUTHORIZATION_PERMIT for _any_ file that is not | ||
| * attached to a query note. | ||
| */ | ||
|
|
||
| import('lib.pkp.classes.security.authorization.internal.SubmissionFileBaseAccessPolicy'); | ||
|
|
||
| class SubmissionFileNotQueryAccessPolicy extends SubmissionFileBaseAccessPolicy { | ||
|
|
||
| /** | ||
| * @see AuthorizationPolicy::effect() | ||
| */ | ||
| function effect() { | ||
| $request = $this->getRequest(); | ||
|
|
||
| // Get the submission file | ||
| $submissionFile = $this->getSubmissionFile($request); | ||
| if (!is_a($submissionFile, 'SubmissionFile')) return AUTHORIZATION_DENY; | ||
|
|
||
| // Check if it's associated with a note. | ||
| if ($submissionFile->getAssocType() != ASSOC_TYPE_NOTE) return AUTHORIZATION_PERMIT; | ||
|
|
||
| // Check if that note is associated with a query | ||
| $noteDao = DAORegistry::getDAO('NoteDAO'); | ||
| $note = $noteDao->getById($submissionFile->getAssocId()); | ||
| if ($note->getAssocType() != ASSOC_TYPE_QUERY) return AUTHORIZATION_PERMIT; | ||
|
|
||
| return AUTHORIZATION_DENY; | ||
| } | ||
| } | ||
|
|
||
| ?> |
Oops, something went wrong.