kenmirrors/grocy
1
0
Fork 0
mirror of https://github.com/grocy/grocy.git synced 2025-08-15 10:14:39 +00:00
Code Issues Projects Releases Wiki Activity

Refined permissions by existing feature structure (closes #971, references #960)

Browse Source
This commit is contained in:
Bernd Bestel
2020-08-29 18:31:28 +02:00
parent a8395cb748
commit 86300b7025
21 changed files with 322 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
controllers/UsersApiController.php
View File

@@ -13,7 +13,7 @@ class UsersApiController extends BaseApiController
public function GetUsers(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
{
User::checkPermission($request, User::PERMISSION_READ_USER);
User::checkPermission($request, User::PERMISSION_USERS_READ);
try
{
return $this->ApiResponse($response, $this->getUsersService()->GetUsersAsDto());
@@ -26,7 +26,7 @@ class UsersApiController extends BaseApiController
public function CreateUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
{
User::checkPermission($request, User::PERMISSION_CREATE_USER);
User::checkPermission($request, User::PERMISSION_USERS_CREATE);
$requestBody = $request->getParsedBody();
try
@@ -47,7 +47,7 @@ class UsersApiController extends BaseApiController
public function DeleteUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
{
User::checkPermission($request, User::PERMISSION_EDIT_USER);
User::checkPermission($request, User::PERMISSION_USERS_EDIT);
try
{
$this->getUsersService()->DeleteUser($args['userId']);
@@ -62,9 +62,9 @@ class UsersApiController extends BaseApiController
public function EditUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
{
if ($args['userId'] == GROCY_USER_ID) {
User::checkPermission($request, User::PERMISSION_EDIT_SELF);
User::checkPermission($request, User::PERMISSION_USERS_EDIT_SELF);
} else {
User::checkPermission($request, User::PERMISSION_EDIT_USER);
User::checkPermission($request, User::PERMISSION_USERS_EDIT);
}
$requestBody = $request->getParsedBody();