src/Security/Voter/AliasVoter.php line 12

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter;
  5. use App\Util\AccountTools;
  6. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  7. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  8. use Symfony\Component\Security\Core\User\UserInterface;
  9. use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted;
  10. use Symfony\Component\Security\Core\Security;
  12. class AliasVoter extends Voter
  13. {
  14.     private $security;
  15.     
  16.     public function __construct(Security $security)
  17.     {
  18.         $this->security = $security;
  19.     }
  20.     
  21.     protected function supports($attribute, $subject) : bool
  22.     {
  23.         // NEW actions don't yet have objects
  24.         if(in_array($attribute, ['NEW_ALIAS']))
  25.             return true;
  26.             
  27.             return in_array($attribute, ['EDIT', 'DELETE', 'EDITGLOBAL', 'MASS_SEND'])
  28.             && $subject instanceof \App\Model\Alias;
  29.     }
  30.     
  31.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token) : bool
  32.     {
  33.         $user = $token->getUser();
  34.         // if the user is anonymous, do not grant access
  35.         if (!$user instanceof UserInterface) {
  36.             return false;
  37.         }
  38.         
  39.         switch ($attribute) {
  40.             case 'EDIT':
  41.                 if($this->security->isGranted('ROLE_POSTMASTER')) {
  42.                     return true;
  43.                 }
  44.                 
  45.                 if($this->security->isGranted('ROLE_GROUPMASTER')) {
  46.                     foreach($user->getAccounts() as $acc) {
  47.                         if($acc == $subject->getDest()) {
  48.                             return true;
  49.                         }
  50.                     }
  51.                     return false;
  52.                 }
  53.                 break;
  54.                     
  55.             case 'DELETE':
  56.                 if($this->security->isGranted('ROLE_POSTMASTER')) {
  57.                     // check the list of system aliases
  58.                     if(!isset($_SERVER['APP_SYSTEM_ALIASES'])) {
  59.                         return true;
  60.                     }
  61.                     
  62.                     $systemAliases = AccountTools::envToArray($_SERVER['APP_SYSTEM_ALIASES']);
  63.                     $aliasSrcArr = explode('@', $subject->getSrc());
  64.                                         
  65.                     if(count($aliasSrcArr) != 2) {
  66.                         return false;
  67.                     }
  68.                     
  69.                     foreach($systemAliases as $sa) {
  70.                         if($aliasSrcArr[0] == $sa) {
  71.                             return false;
  72.                         }
  73.                     }
  74.                     
  75.                     return true;
  76.                 }
  77.                 break;
  78.                                         
  79.             case 'NEW_ALIAS':
  80.                 if($this->security->isGranted('ROLE_POSTMASTER'))
  81.                     return true;
  82.                 break;
  83.                     
  84.             case 'EDITGLOBAL':
  85.                 if($this->security->isGranted('ROLE_ADMIN')) {
  86.                     return true;
  87.                 }
  88.                 
  89.                 if($this->security->isGranted('ROLE_POSTMASTER_MANY')) {
  90.                     if($subject->getSrc() == "") { // new alias
  91.                         return true;
  92.                     }
  93.                     
  94.                     $userDomainArr = explode('@', $subject->getSrc());
  95.                     
  96.                     if(sizeof($userDomainArr) != 2) {
  97.                         return false;
  98.                     }
  99.                     
  100.                     foreach($user->getDomains() as $d) {
  101.                         if($userDomainArr[1] == $d) {
  102.                             return true;
  103.                         }
  104.                     }
  105.                     return false;
  106.                 }
  107.                 
  108.                 if($this->security->isGranted('ROLE_POSTMASTER')) {
  109.                     if($subject->getSrc() == "") { // new alias
  110.                         return true;
  111.                     }
  112.                     
  113.                     $subjUserDomainArr = explode('@', $subject->getSrc());
  114.                     $userDomainArr = explode('@', $user->getUsername());
  115.                     
  116.                     if(sizeof($subjUserDomainArr) != 2 || sizeof($userDomainArr) != 2) {
  117.                         return false;
  118.                     }
  119.                     
  120.                     if($userDomainArr[1] == $subjUserDomainArr[1]) {
  121.                         return true;
  122.                     }
  123.                     
  124.                     return false;                    
  125.                 }
  126.                 break;
  127.                 
  128.             case 'MASS_SEND':
  129.                 $userDomainArr = explode('@', $subject->getSrc());
  130.                 
  131.                 if(sizeof($userDomainArr) != 2) {
  132.                     return false;
  133.                 }
  134.                 
  135.                 if($this->security->isGranted('ROLE_ADMIN')) {
  136.                     return true;
  137.                 }
  138.                 
  139.                 if($this->security->isGranted('ROLE_POSTMASTER')) {
  140.                     if(in_array($userDomainArr[1], $user->getDomains())) {
  141.                         return true;
  142.                     }
  143.                 }
  145.                 if($this->security->isGranted('ROLE_POSTMASTER_MIN')) {
  146.                     if(in_array($userDomainArr[1], $user->getDomains())) {
  147.                         return true;
  148.                     }
  149.                 }
  150.                 
  151.                 if($this->security->isGranted('ROLE_GROUPMASTER')) {
  152.                     if(in_array($userDomainArr[1], $user->getDomains())) {
  153.                         return true;
  154.                         /*if(in_array($subject->getSrc(), $user->getAccounts()))
  155.                             return true;*/
  156.                     }
  157.                 }
  158.                 
  159.                 if($this->security->isGranted('ROLE_USER')) {
  160.                     // only possible to "mass send" to his own account
  161.                     if($subject->getSrc() == $user->getUsername()) {
  162.                         return true;
  163.                     }
  164.                 }
  165.                 break;
  166.         }
  167.         
  168.         return false;
  169.     }
  170. }