Gatekeeper.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Database\AccessCollections;
use Elgg\Database\EntityTable;
use Elgg\Http\Request as HttpRequest;
use Elgg\I18n\Translator;
use ElggEntity;
use ElggGroup;
use ElggSession;
use ElggUser;
use Exception;
use Elgg\Http\Exception\AdminGatekeeperException;
use Elgg\Http\Exception\LoggedInGatekeeperException;
use Elgg\Http\Exception\LoggedOutGatekeeperException;
use Elgg\Http\Exception\AjaxGatekeeperException;

class Gatekeeper {

    protected $session;

    protected $request;

    protected $redirects;

    protected $entities;

    protected $access;

    protected $translator;

    public function __construct(
        ElggSession $session,
        HttpRequest $request,
        RedirectService $redirects,
        EntityTable $entities,
        AccessCollections $access,
        Translator $translator
    ) {
        $this->session = $session;
        $this->request = $request;
        $this->redirects = $redirects;
        $this->entities = $entities;
        $this->access = $access;
        $this->translator = $translator;
    }

    public function assertAuthenticatedUser() {
        if ($this->session->isLoggedIn()) {
            return;
        }

        $this->redirects->setLastForwardFrom();

        throw new LoggedInGatekeeperException();
    }

    public function assertUnauthenticatedUser() {
        if (!$this->session->isLoggedIn()) {
            return;
        }

        $exception = new LoggedOutGatekeeperException();
        $exception->setRedirectUrl(elgg_get_site_url());
        
        throw $exception;
    }

    public function assertAuthenticatedAdmin() {
        $this->assertAuthenticatedUser();

        $user = $this->session->getLoggedInUser();
        if ($user->isAdmin()) {
            return;
        }

        $this->redirects->setLastForwardFrom();

        throw new AdminGatekeeperException();
    }

    public function assertExists($guid, $type = null, $subtype = null) {
        $entity = elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function () use ($guid, $type, $subtype) {
            return $this->entities->get($guid, $type, $subtype);
        });

        if (!$entity) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'guid' => $guid,
                'type' => $type,
                'subtype' => $subtype,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }

        return $entity;
    }

    public function assertAccessibleEntity(ElggEntity $entity, ElggUser $user = null) {

        $result = true;

        try {
            if (!$this->session->getIgnoreAccess() && !$this->access->hasAccessToEntity($entity, $user)) {
                // user is logged in but still does not have access to it
                $msg = $this->translator->translate('limited_access');
                $exception = new EntityPermissionsException($msg);
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }

            if (!$entity->isEnabled() && !$this->session->getDisabledEntityVisibility()) {
                // entity exists, but is disabled
                $exception = new EntityNotFoundException();
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }

            if ($entity instanceof ElggGroup) {
                $this->assertAccessibleGroup($entity, $user);
            }

            foreach (['owner_guid', 'container_guid'] as $prop) {
                if (!$entity->$prop) {
                    continue;
                }

                $parent = $this->assertExists($entity->$prop);
                $this->assertAccessibleEntity($parent, $user);
            }
        } catch (HttpException $ex) {
            $result = $ex;
        }

        $hook_params = [
            'entity' => $entity,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ];

        $result = _elgg_services()->hooks->trigger('gatekeeper', "{$entity->type}:{$entity->subtype}", $hook_params, $result);

        if ($result instanceof HttpException) {
            throw $result;
        } else if ($result === false) {
            throw new HttpException();
        }
    }

    public function assertAccessibleUser(ElggUser $user, ElggUser $viewer = null) {
        if (!$user->isBanned()) {
            return;
        }
        
        if (!isset($viewer)) {
            $viewer = $this->session->getLoggedInUser();
        }

        if (!$viewer || !$viewer->isAdmin()) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'entity' => $user,
                'user' => $viewer,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }
    }

    public function assertAccessibleGroup(ElggGroup $group, ElggUser $user = null) {
        if ($group->canAccessContent($user)) {
            return;
        }
        
        $this->assertAuthenticatedUser();

        $this->redirects->setLastForwardFrom();

        $exception = new GroupGatekeeperException();
        $exception->setParams([
            'entity' => $group,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ]);
        $exception->setRedirectUrl($group->getURL());
        throw $exception;
    }

    public function assertXmlHttpRequest() {
        if ($this->request->isXmlHttpRequest()) {
            return;
        }

        throw new AjaxGatekeeperException();
    }

}