sminnee /
silverstripe-framework
| @@ 1549-1576 (lines=28) @@ | ||
| 1546 | * @param Member $member |
|
| 1547 | * @return bool |
|
| 1548 | */ |
|
| 1549 | public function canEdit($member = null) |
|
| 1550 | { |
|
| 1551 | //get member |
|
| 1552 | if (!$member) { |
|
| 1553 | $member = Security::getCurrentUser(); |
|
| 1554 | } |
|
| 1555 | //check for extensions, we do this first as they can overrule everything |
|
| 1556 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1557 | if ($extended !== null) { |
|
| 1558 | return $extended; |
|
| 1559 | } |
|
| 1560 | ||
| 1561 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1562 | if (!$member) { |
|
| 1563 | return false; |
|
| 1564 | } |
|
| 1565 | ||
| 1566 | // HACK: we should not allow for an non-Admin to edit an Admin |
|
| 1567 | if (!Permission::checkMember($member, 'ADMIN') && Permission::checkMember($this, 'ADMIN')) { |
|
| 1568 | return false; |
|
| 1569 | } |
|
| 1570 | // members can usually edit their own record |
|
| 1571 | if ($this->ID == $member->ID) { |
|
| 1572 | return true; |
|
| 1573 | } |
|
| 1574 | ||
| 1575 | //standard check |
|
| 1576 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1577 | } |
|
| 1578 | ||
| 1579 | /** |
|
| @@ 1586-1617 (lines=32) @@ | ||
| 1583 | * @param Member $member |
|
| 1584 | * @return bool |
|
| 1585 | */ |
|
| 1586 | public function canDelete($member = null) |
|
| 1587 | { |
|
| 1588 | if (!$member) { |
|
| 1589 | $member = Security::getCurrentUser(); |
|
| 1590 | } |
|
| 1591 | //check for extensions, we do this first as they can overrule everything |
|
| 1592 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1593 | if ($extended !== null) { |
|
| 1594 | return $extended; |
|
| 1595 | } |
|
| 1596 | ||
| 1597 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1598 | if (!$member) { |
|
| 1599 | return false; |
|
| 1600 | } |
|
| 1601 | // Members are not allowed to remove themselves, |
|
| 1602 | // since it would create inconsistencies in the admin UIs. |
|
| 1603 | if ($this->ID && $member->ID == $this->ID) { |
|
| 1604 | return false; |
|
| 1605 | } |
|
| 1606 | ||
| 1607 | // HACK: if you want to delete a member, you have to be a member yourself. |
|
| 1608 | // this is a hack because what this should do is to stop a user |
|
| 1609 | // deleting a member who has more privileges (e.g. a non-Admin deleting an Admin) |
|
| 1610 | if (Permission::checkMember($this, 'ADMIN')) { |
|
| 1611 | if (!Permission::checkMember($member, 'ADMIN')) { |
|
| 1612 | return false; |
|
| 1613 | } |
|
| 1614 | } |
|
| 1615 | ||
| 1616 | //standard check |
|
| 1617 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1618 | } |
|
| 1619 | ||
| 1620 | /** |
|
