sminnee /
silverstripe-framework
| @@ 1521-1547 (lines=27) @@ | ||
| 1518 | * @param Member $member |
|
| 1519 | * @return bool |
|
| 1520 | */ |
|
| 1521 | public function canEdit($member = null) |
|
| 1522 | { |
|
| 1523 | //get member |
|
| 1524 | if (!($member instanceof Member)) { |
|
| 1525 | $member = Member::currentUser(); |
|
| 1526 | } |
|
| 1527 | //check for extensions, we do this first as they can overrule everything |
|
| 1528 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1529 | if ($extended !== null) { |
|
| 1530 | return $extended; |
|
| 1531 | } |
|
| 1532 | ||
| 1533 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1534 | if (!$member) { |
|
| 1535 | return false; |
|
| 1536 | } |
|
| 1537 | ||
| 1538 | // HACK: we should not allow for an non-Admin to edit an Admin |
|
| 1539 | if (!Permission::checkMember($member, 'ADMIN') && Permission::checkMember($this, 'ADMIN')) { |
|
| 1540 | return false; |
|
| 1541 | } |
|
| 1542 | // members can usually edit their own record |
|
| 1543 | if ($this->ID == $member->ID) { |
|
| 1544 | return true; |
|
| 1545 | } |
|
| 1546 | //standard check |
|
| 1547 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1548 | } |
|
| 1549 | /** |
|
| 1550 | * Users can edit their own record. |
|
| @@ 1556-1586 (lines=31) @@ | ||
| 1553 | * @param Member $member |
|
| 1554 | * @return bool |
|
| 1555 | */ |
|
| 1556 | public function canDelete($member = null) |
|
| 1557 | { |
|
| 1558 | if (!($member instanceof Member)) { |
|
| 1559 | $member = Member::currentUser(); |
|
| 1560 | } |
|
| 1561 | //check for extensions, we do this first as they can overrule everything |
|
| 1562 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1563 | if ($extended !== null) { |
|
| 1564 | return $extended; |
|
| 1565 | } |
|
| 1566 | ||
| 1567 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1568 | if (!$member) { |
|
| 1569 | return false; |
|
| 1570 | } |
|
| 1571 | // Members are not allowed to remove themselves, |
|
| 1572 | // since it would create inconsistencies in the admin UIs. |
|
| 1573 | if ($this->ID && $member->ID == $this->ID) { |
|
| 1574 | return false; |
|
| 1575 | } |
|
| 1576 | ||
| 1577 | // HACK: if you want to delete a member, you have to be a member yourself. |
|
| 1578 | // this is a hack because what this should do is to stop a user |
|
| 1579 | // deleting a member who has more privileges (e.g. a non-Admin deleting an Admin) |
|
| 1580 | if (Permission::checkMember($this, 'ADMIN')) { |
|
| 1581 | if (! Permission::checkMember($member, 'ADMIN')) { |
|
| 1582 | return false; |
|
| 1583 | } |
|
| 1584 | } |
|
| 1585 | //standard check |
|
| 1586 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1587 | } |
|
| 1588 | ||
| 1589 | /** |
|
