silverstripe / silverstripe-framework

src/Security/PermissionCheckboxSetField.php

<?php

namespace SilverStripe\Security;

use InvalidArgumentException;
use SilverStripe\Core\Config\Config;
use SilverStripe\Forms\FormField;
use SilverStripe\ORM\ArrayList;
use SilverStripe\ORM\DataObject;
use SilverStripe\ORM\DataObjectInterface;
use SilverStripe\ORM\SS_List;
use Traversable;

/**
 * Shows a categorized list of available permissions (through {@link Permission::get_codes()}).
 * Permissions which are assigned to a given {@link Group} record
 * (either directly, inherited from parent groups, or through a {@link PermissionRole})
 * will be checked automatically. All checkboxes for "inherited" permissions will be readonly.
 *
 * The field can gets its assignment data either from {@link Group} or {@link PermissionRole} records.
 */
class PermissionCheckboxSetField extends FormField
{

    /**
     * @var array Filter certain permission codes from the output.
     * Useful to simplify the interface
     */
    protected $hiddenPermissions = array();

    /**
     * @var SS_List
     */
    protected $records = null;

    /**
     * @var array Array Nested array in same notation as {@link CheckboxSetField}.
     */
    protected $source = null;

    /**
     * @param String $name
     * @param String $title
     * @param String $managedClass
     * @param String $filterField
     * @param Group|SS_List $records One or more {@link Group} or {@link PermissionRole} records
     *  used to determine permission checkboxes.
     *  Caution: saveInto() can only be used with a single record, all inherited permissions will be marked readonly.
     *  Setting multiple groups only makes sense in a readonly context. (Optional)
     */
    public function __construct($name, $title, $managedClass, $filterField, $records = null)
    {
        $this->filterField = $filterField;

The property filterField does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.

        $this->managedClass = $managedClass;

The property managedClass does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.

        if ($records instanceof SS_List) {
            $this->records = $records;
        } elseif ($records instanceof Group) {
            $this->records = new ArrayList(array($records));
        } elseif ($records) {

$records is of type null, thus it always evaluated to false.

            throw new InvalidArgumentException(
                '$record should be either a Group record, or a SS_List of Group records'
            );
        }

        // Get all available codes in the system as a categorized nested array
        $this->source = Permission::get_codes(true);

        parent::__construct($name, $title);
    }

    /**
     * @param array $codes
     */
    public function setHiddenPermissions($codes)
    {
        $this->hiddenPermissions = $codes;
    }

    /**
     * @return array
     */
    public function getHiddenPermissions()
    {
        return $this->hiddenPermissions;
    }

    /**
     * @param array $properties
     * @return string
     */
    public function Field($properties = array())
    {
        $uninheritedCodes = array();
        $inheritedCodes = array();
        $records = ($this->records) ? $this->records : new ArrayList();

        // Get existing values from the form record (assuming the formfield name is a join field on the record)
        if (is_object($this->form)) {
            $record = $this->form->getRecord();
            if ($record
                && ($record instanceof Group || $record instanceof PermissionRole)
                && !$records->find('ID', $record->ID)
            ) {
                $records->push($record);

The method push() does not exist on SilverStripe\ORM\SS_List. It seems like you code against a sub-type of said class. However, the method does not exist in SilverStripe\ORM\Sortable or SilverStripe\ORM\Filterable or SilverStripe\ORM\Relation or SilverStripe\ORM\Limitable or SilverStripe\ORM\Relation or SilverStripe\ORM\Relation or SilverStripe\ORM\Relation. Are you sure you never get one of those?

            }
        }

        // Get all 'inherited' codes not directly assigned to the group (which is stored in $values)
        foreach ($records as $record) {
            // Get all uninherited permissions
            $relationMethod = $this->name;
            foreach ($record->$relationMethod() as $permission) {
                if (!isset($uninheritedCodes[$permission->Code])) {
                    $uninheritedCodes[$permission->Code] = array();
                }
                $uninheritedCodes[$permission->Code][] = _t(
                    'SilverStripe\\Security\\PermissionCheckboxSetField.AssignedTo',
                    'assigned to "{title}"',
                    array('title' => $record->dbObject('Title')->forTemplate())
                );
            }

            // Special case for Group records (not PermissionRole):
            // Determine inherited assignments
            if ($record instanceof Group) {
                // Get all permissions from roles
                if ($record->Roles()->count()) {
                    foreach ($record->Roles() as $role) {
                        /** @var PermissionRole $role */
                        foreach ($role->Codes() as $code) {

The method Codes() does not exist on SilverStripe\ORM\DataObject. Since you implemented __call, consider adding a @method annotation.

                            if (!isset($inheritedCodes[$code->Code])) {
                                $inheritedCodes[$code->Code] = array();
                            }
                            $inheritedCodes[$code->Code][] = _t(
                                'SilverStripe\\Security\\PermissionCheckboxSetField.FromRole',
                                'inherited from role "{title}"',
                                'A permission inherited from a certain permission role',
                                array('title' => $role->dbObject('Title')->forTemplate())
                            );
                        }
                    }
                }

                // Get from parent groups
                $parentGroups = $record->getAncestors();

The method getAncestors() does not exist on SilverStripe\Security\Group. Since you implemented __call, consider adding a @method annotation.

                if ($parentGroups) {
                    foreach ($parentGroups as $parent) {
                        if (!$parent->Roles()->Count()) {
                            continue;
                        }
                        foreach ($parent->Roles() as $role) {
                            if ($role->Codes()) {
                                foreach ($role->Codes() as $code) {
                                    if (!isset($inheritedCodes[$code->Code])) {
                                        $inheritedCodes[$code->Code] = array();
                                    }
                                    $inheritedCodes[$code->Code][] = _t(
                                        'SilverStripe\\Security\\PermissionCheckboxSetField.FromRoleOnGroup',
                                        'inherited from role "{roletitle}" on group "{grouptitle}"',
                                        'A permission inherited from a role on a certain group',
                                        array(
                                            'roletitle' => $role->dbObject('Title')->forTemplate(),
                                            'grouptitle' => $parent->dbObject('Title')->forTemplate()
                                        )
                                    );
                                }
                            }
                        }
                        if ($parent->Permissions()->Count()) {
                            foreach ($parent->Permissions() as $permission) {
                                if (!isset($inheritedCodes[$permission->Code])) {
                                    $inheritedCodes[$permission->Code] = array();
                                }
                                $inheritedCodes[$permission->Code][] =
                                _t(
                                    'SilverStripe\\Security\\PermissionCheckboxSetField.FromGroup',
                                    'inherited from group "{title}"',
                                    'A permission inherited from a certain group',
                                    array('title' => $parent->dbObject('Title')->forTemplate())
                                );
                            }
                        }
                    }
                }
            }
        }

        $odd = 0;
        $options = '';
        $globalHidden = (array)Config::inst()->get('SilverStripe\\Security\\Permission', 'hidden_permissions');
        if ($this->source) {

The expression $this->source of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

            $privilegedPermissions = Permission::config()->privileged_permissions;

The property privileged_permissions does not exist on SilverStripe\Core\Config\Config_ForClass. Since you implemented __get, consider adding a @property annotation.

            // loop through all available categorized permissions and see if they're assigned for the given groups
            foreach ($this->source as $categoryName => $permissions) {
                $options .= "<li><h5>$categoryName</h5></li>";
                foreach ($permissions as $code => $permission) {
                    if (in_array($code, $this->hiddenPermissions)) {
                        continue;
                    }
                    if (in_array($code, $globalHidden)) {
                        continue;
                    }

                    $value = $permission['name'];

                    $odd = ($odd + 1) % 2;
                    $extraClass = $odd ? 'odd' : 'even';
                    $extraClass .= ' val' . str_replace(' ', '', $code);
                    $itemID = $this->ID() . '_' . preg_replace('/[^a-zA-Z0-9]+/', '', $code);
                    $disabled = $inheritMessage = '';
                    $checked = (isset($uninheritedCodes[$code]) || isset($inheritedCodes[$code]))
                        ? ' checked="checked"'
                        : '';
                    $title = $permission['help']
                        ? 'title="' . htmlentities($permission['help'], ENT_COMPAT, 'UTF-8') . '" '
                        : '';

                    if (isset($inheritedCodes[$code])) {
                        // disable inherited codes, as any saving logic would be too complicate to express in this
                        // interface
                        $disabled = ' disabled="true"';
                        $inheritMessage = ' (' . join(', ', $inheritedCodes[$code]) . ')';
                    } elseif ($this->records && $this->records->Count() > 1 && isset($uninheritedCodes[$code])) {
                        // If code assignments are collected from more than one "source group",
                        // show its origin automatically
                        $inheritMessage = ' (' . join(', ', $uninheritedCodes[$code]) . ')';
                    }

                    // Disallow modification of "privileged" permissions unless currently logged-in user is an admin
                    if (!Permission::check('ADMIN') && in_array($code, $privilegedPermissions)) {
                        $disabled = ' disabled="true"';
                    }

                    // If the field is readonly, always mark as "disabled"
                    if ($this->readonly) {
                        $disabled = ' disabled="true"';
                    }

                    $inheritMessage = '<small>' . $inheritMessage . '</small>';

                    // If the field is readonly, add a span that will replace the disabled checkbox input
                    if ($this->readonly) {
                        $icon = ($checked) ? 'check-mark-circle' : 'cancel-circled';
                        $record = is_object($this->form) ? $this->form->getRecord() : false;
                        // Inherited codes are shown as a gray x
                        if ($record && $record instanceof Member &&
                            Permission::checkMember($record, 'ADMIN') && $code != 'ADMIN') {
                            $icon = 'plus-circled';
                        }

                        $options .= "<li class=\"$extraClass\">"
                            . "<input id=\"$itemID\"$disabled name=\"$this->name[$code]\" type=\"checkbox\""
                            . " value=\"$code\"$checked class=\"checkbox\" />"
                            . "<label {$title}for=\"$itemID\">"
                            . "<span class=\"font-icon-$icon\"></span>"
                            . "{$value}{$inheritMessage}</label>"
                            . "</li>\n";
                    } else {
                        $options .= "<li class=\"$extraClass\">"
                            . "<input id=\"$itemID\"$disabled name=\"$this->name[$code]\" type=\"checkbox\""
                            . " value=\"$code\"$checked class=\"checkbox\" />"
                            . "<label {$title}for=\"$itemID\">{$value}{$inheritMessage}</label>"
                            . "</li>\n";
                    }
                }
            }
        }
        if ($this->readonly) {
            $message = _t(
                'SilverStripe\\Security\\Permission.UserPermissionsIntro',
                'Assigning groups to this user will adjust the permissions they have.'
                . ' See the groups section for details of permissions on individual groups.'
            );

            return
                "<ul id=\"{$this->ID()}\" class=\"optionset checkboxsetfield{$this->extraClass()}\">\n" .
                "<li class=\"help\">" . $message . "</li>" .
                $options .
                "</ul>\n";
        } else {
            return
                "<ul id=\"{$this->ID()}\" class=\"optionset checkboxsetfield{$this->extraClass()}\">\n" .
                $options .
                "</ul>\n";
        }
    }

    /**
     * Update the permission set associated with $record DataObject
     *
     * @param DataObjectInterface $record
     */
    public function saveInto(DataObjectInterface $record)
    {
        $fieldname = $this->name;
        $managedClass = $this->managedClass;

        // Remove all "privileged" permissions if the currently logged-in user is not an admin
        $privilegedPermissions = Permission::config()->privileged_permissions;

The property privileged_permissions does not exist on SilverStripe\Core\Config\Config_ForClass. Since you implemented __get, consider adding a @property annotation.

        if ((is_array($this->value) || $this->value instanceof Traversable)
            && !Permission::check('ADMIN')
        ) {
            foreach ($this->value as $id => $bool) {
                if (in_array($id, $privilegedPermissions)) {
                    unset($this->value[$id]);
                }
            }
        }

        // remove all permissions and re-add them afterwards
        $permissions = $record->$fieldname();
        foreach ($permissions as $permission) {
            $permission->delete();
        }

        $schema = DataObject::getSchema();
        if ($fieldname && $record && (
            $schema->hasManyComponent(get_class($record), $fieldname)
            || $schema->manyManyComponent(get_class($record), $fieldname)
        )) {
            if (!$record->ID) {

The property ID does not exist on SilverStripe\ORM\DataObjectInterface. Since you implemented __get, consider adding a @property annotation.

                $record->write(); // We need a record ID to write permissions
            }

            if (is_array($this->value) || $this->value instanceof Traversable) {
                foreach ($this->value as $id => $bool) {
                    if ($bool) {
                        $perm = new $managedClass();
                        $perm->{$this->filterField} = $record->ID;
                        $perm->Code = $id;
                        $perm->write();
                    }
                }
            }
        }
    }

    /**
     * @return PermissionCheckboxSetField_Readonly
     */
    public function performReadonlyTransformation()
    {
        $readonly = new PermissionCheckboxSetField_Readonly(
            $this->name,
            $this->title,
            $this->managedClass,
            $this->filterField,
            $this->records
        );

        return $readonly;
    }
}