Gatekeeper.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Database\AccessCollections;
use Elgg\Database\EntityTable;
use Elgg\Exceptions\HttpException;
use Elgg\Exceptions\Http\EntityNotFoundException;
use Elgg\Exceptions\Http\EntityPermissionsException;
use Elgg\Exceptions\Http\GatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\AdminGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\AjaxGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\GroupGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\LoggedInGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\LoggedOutGatekeeperException;
use Elgg\Http\Request as HttpRequest;
use Elgg\I18n\Translator;

class Gatekeeper {

    protected $session_manager;

    protected $request;

    protected $redirects;

    protected $entities;

    protected $access;

    protected $translator;

    public function __construct(
        SessionManagerService $session_manager,
        HttpRequest $request,
        RedirectService $redirects,
        EntityTable $entities,
        AccessCollections $access,
        Translator $translator
    ) {
        $this->session_manager = $session_manager;
        $this->request = $request;
        $this->redirects = $redirects;
        $this->entities = $entities;
        $this->access = $access;
        $this->translator = $translator;
    }

    public function assertAuthenticatedUser() {
        if ($this->session_manager->isLoggedIn()) {
            return;
        }

        $this->redirects->setLastForwardFrom();

        throw new LoggedInGatekeeperException();
    }

    public function assertUnauthenticatedUser() {
        if (!$this->session_manager->isLoggedIn()) {
            return;
        }

        $exception = new LoggedOutGatekeeperException();
        $exception->setRedirectUrl(elgg_get_site_url());
        
        throw $exception;
    }

    public function assertAuthenticatedAdmin() {
        $this->assertAuthenticatedUser();

        $user = $this->session_manager->getLoggedInUser();
        if ($user->isAdmin()) {
            return;
        }

        $this->redirects->setLastForwardFrom();

        throw new AdminGatekeeperException();
    }

    public function assertExists(int $guid, string $type = null, string $subtype = null): \ElggEntity {
        $entity = elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function () use ($guid, $type, $subtype) {
            return $this->entities->get($guid, $type, $subtype);
        });

        if (!$entity instanceof \ElggEntity) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'guid' => $guid,
                'type' => $type,
                'subtype' => $subtype,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }

        return $entity;
    }

    public function assertAccessibleEntity(\ElggEntity $entity, \ElggUser $user = null, bool $validate_can_edit = false): void {

        $result = true;

        try {
            $user_guid = $user ? $user->guid : 0;
            if (!$this->session_manager->getIgnoreAccess() && !$entity->hasAccess($user_guid)) {
                // user is logged in but still does not have access to it
                $msg = $this->translator->translate('limited_access');
                $exception = new EntityPermissionsException($msg);
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }
            
            if ($validate_can_edit && !$entity->canEdit($user_guid)) {
                // logged in user does not have edit or write access to it
                $msg = $this->translator->translate('limited_access');
                $exception = new EntityPermissionsException($msg);
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }

            if (!$entity->isEnabled() && !$this->session_manager->getDisabledEntityVisibility()) {
                // entity exists, but is disabled
                $exception = new EntityNotFoundException();
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }

            if ($entity instanceof \ElggGroup) {
                $this->assertAccessibleGroup($entity, $user);
            }

            foreach (['owner_guid', 'container_guid'] as $prop) {
                if (!$entity->$prop) {
                    continue;
                }

                $parent = $this->assertExists($entity->$prop);
                $this->assertAccessibleEntity($parent, $user);
            }
        } catch (HttpException $ex) {
            $result = $ex;
        }

        $params = [
            'entity' => $entity,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ];

        $result = _elgg_services()->events->triggerResults('gatekeeper', "{$entity->type}:{$entity->subtype}", $params, $result);

        if ($result instanceof HttpException) {
            throw $result;
        } else if ($result === false) {
            throw new HttpException();
        }
    }

    public function assertAccessibleUser(\ElggUser $user, \ElggUser $viewer = null): void {
        if (!$user->isBanned()) {
            return;
        }
        
        if (!isset($viewer)) {
            $viewer = $this->session_manager->getLoggedInUser();
        }

        if (!$viewer || !$viewer->isAdmin()) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'entity' => $user,
                'user' => $viewer,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }
    }

    public function assertAccessibleGroup(\ElggGroup $group, \ElggUser $user = null): void {
        if ($group->canAccessContent($user)) {
            return;
        }
        
        $this->assertAuthenticatedUser();

        $this->redirects->setLastForwardFrom();

        $exception = new GroupGatekeeperException();
        $exception->setParams([
            'entity' => $group,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ]);
        $exception->setRedirectUrl($group->getURL());
        throw $exception;
    }

    public function assertXmlHttpRequest() {
        if ($this->request->isXmlHttpRequest()) {
            return;
        }

        throw new AjaxGatekeeperException();
    }
}