ezsystems /
ezpublish-kernel
| @@ 159-176 (lines=18) @@ | ||
| 156 | * If limitations was empty array this means same as '*' |
|
| 157 | */ |
|
| 158 | $limitationsPass = true; |
|
| 159 | foreach ($limitations as $limitation) { |
|
| 160 | $type = $this->limitationService->getLimitationType($limitation->getIdentifier()); |
|
| 161 | $accessVote = $type->evaluate($limitation, $userReference, $object, $targets); |
|
| 162 | /* |
|
| 163 | * For policy limitation atm only support ACCESS_GRANTED |
|
| 164 | * |
|
| 165 | * Reasoning: Right now, use of a policy limitation not valid for a policy is per definition a |
|
| 166 | * BadState. To reach this you would have to configure the "policyMap" wrongly, like using |
|
| 167 | * Node (Location) limitation on state/assign. So in this case Role Limitations will return |
|
| 168 | * ACCESS_ABSTAIN (== no access here), and other limitations will throw InvalidArgument above, |
|
| 169 | * both cases forcing dev to investigate to find miss configuration. This might be relaxed in |
|
| 170 | * the future if valid use cases for ACCESS_ABSTAIN on policy limitations becomes known. |
|
| 171 | */ |
|
| 172 | if ($accessVote !== LimitationType::ACCESS_GRANTED) { |
|
| 173 | $limitationsPass = false; |
|
| 174 | break;// Break to next policy, all limitations must pass |
|
| 175 | } |
|
| 176 | } |
|
| 177 | if ($limitationsPass) { |
|
| 178 | return true; |
|
| 179 | } |
|
| @@ 218-235 (lines=18) @@ | ||
| 215 | * If limitations was empty array this means same as '*' |
|
| 216 | */ |
|
| 217 | $limitationsPass = true; |
|
| 218 | foreach ($limitations as $limitation) { |
|
| 219 | $type = $this->limitationService->getLimitationType($limitation->getIdentifier()); |
|
| 220 | $accessVote = $type->evaluate($limitation, $currentUserRef, $object, $targets); |
|
| 221 | /* |
|
| 222 | * For policy limitation atm only support ACCESS_GRANTED |
|
| 223 | * |
|
| 224 | * Reasoning: Right now, use of a policy limitation not valid for a policy is per definition a |
|
| 225 | * BadState. To reach this you would have to configure the "policyMap" wrongly, like using |
|
| 226 | * Node (Location) limitation on state/assign. So in this case Role Limitations will return |
|
| 227 | * ACCESS_ABSTAIN (== no access here), and other limitations will throw InvalidArgument above, |
|
| 228 | * both cases forcing dev to investigate to find miss configuration. This might be relaxed in |
|
| 229 | * the future if valid use cases for ACCESS_ABSTAIN on policy limitations becomes known. |
|
| 230 | */ |
|
| 231 | if ($accessVote !== LimitationType::ACCESS_GRANTED) { |
|
| 232 | $limitationsPass = false; |
|
| 233 | break;// Break to next policy, all limitations must pass |
|
| 234 | } |
|
| 235 | } |
|
| 236 | if ($limitationsPass) { |
|
| 237 | return true; |
|
| 238 | } |
|
