sminnee /
silverstripe-framework
| @@ 1558-1585 (lines=28) @@ | ||
| 1555 | * @param Member $member |
|
| 1556 | * @return bool |
|
| 1557 | */ |
|
| 1558 | public function canEdit($member = null) |
|
| 1559 | { |
|
| 1560 | //get member |
|
| 1561 | if (!$member) { |
|
| 1562 | $member = Security::getCurrentUser(); |
|
| 1563 | } |
|
| 1564 | //check for extensions, we do this first as they can overrule everything |
|
| 1565 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1566 | if ($extended !== null) { |
|
| 1567 | return $extended; |
|
| 1568 | } |
|
| 1569 | ||
| 1570 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1571 | if (!$member) { |
|
| 1572 | return false; |
|
| 1573 | } |
|
| 1574 | ||
| 1575 | // HACK: we should not allow for an non-Admin to edit an Admin |
|
| 1576 | if (!Permission::checkMember($member, 'ADMIN') && Permission::checkMember($this, 'ADMIN')) { |
|
| 1577 | return false; |
|
| 1578 | } |
|
| 1579 | // members can usually edit their own record |
|
| 1580 | if ($this->ID == $member->ID) { |
|
| 1581 | return true; |
|
| 1582 | } |
|
| 1583 | ||
| 1584 | //standard check |
|
| 1585 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1586 | } |
|
| 1587 | ||
| 1588 | /** |
|
| @@ 1595-1626 (lines=32) @@ | ||
| 1592 | * @param Member $member |
|
| 1593 | * @return bool |
|
| 1594 | */ |
|
| 1595 | public function canDelete($member = null) |
|
| 1596 | { |
|
| 1597 | if (!$member) { |
|
| 1598 | $member = Security::getCurrentUser(); |
|
| 1599 | } |
|
| 1600 | //check for extensions, we do this first as they can overrule everything |
|
| 1601 | $extended = $this->extendedCan(__FUNCTION__, $member); |
|
| 1602 | if ($extended !== null) { |
|
| 1603 | return $extended; |
|
| 1604 | } |
|
| 1605 | ||
| 1606 | //need to be logged in and/or most checks below rely on $member being a Member |
|
| 1607 | if (!$member) { |
|
| 1608 | return false; |
|
| 1609 | } |
|
| 1610 | // Members are not allowed to remove themselves, |
|
| 1611 | // since it would create inconsistencies in the admin UIs. |
|
| 1612 | if ($this->ID && $member->ID == $this->ID) { |
|
| 1613 | return false; |
|
| 1614 | } |
|
| 1615 | ||
| 1616 | // HACK: if you want to delete a member, you have to be a member yourself. |
|
| 1617 | // this is a hack because what this should do is to stop a user |
|
| 1618 | // deleting a member who has more privileges (e.g. a non-Admin deleting an Admin) |
|
| 1619 | if (Permission::checkMember($this, 'ADMIN')) { |
|
| 1620 | if (!Permission::checkMember($member, 'ADMIN')) { |
|
| 1621 | return false; |
|
| 1622 | } |
|
| 1623 | } |
|
| 1624 | ||
| 1625 | //standard check |
|
| 1626 | return Permission::checkMember($member, 'CMS_ACCESS_SecurityAdmin'); |
|
| 1627 | } |
|
| 1628 | ||
| 1629 | /** |
|
