UserCapabilities.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Database\EntityTable;
use Elgg\Exceptions\Database\UserFetchFailureException;
use Elgg\Exceptions\InvalidArgumentException;
use ElggAnnotation;
use ElggEntity;
use ElggFile;
use ElggRiverItem;
use ElggSession;

class UserCapabilities {

    private $hooks;

    private $entities;

    private $session;

    public function __construct(PluginHooksService $hooks, EntityTable $entities, ElggSession $session) {
        $this->hooks = $hooks;
        $this->entities = $entities;
        $this->session = $session;
    }

    public function canBypassPermissionsCheck($user_guid = 0) {
        if ($this->session->getIgnoreAccess()) {
            // Checking ignored access first to avoid infinite loops,
            // when trying to fetch a user by guid
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        return $user && $user->isAdmin();
    }

    public function canEdit(ElggEntity $entity, $user_guid = 0) {
        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        // Test user if possible - should default to false unless a plugin hook says otherwise
        $default = call_user_func(function () use ($entity, $user) {
            if (!$user) {
                return false;
            }

            // favor the persisted attributes if not saved
            $attrs = array_merge(
                    [
                'owner_guid' => $entity->owner_guid,
                'container_guid' => $entity->container_guid,
                    ], $entity->getOriginalAttributes()
            );

            if ($attrs['owner_guid'] == $user->guid) {
                return true;
            }

            if ($attrs['container_guid'] == $user->guid) {
                return true;
            }

            if ($entity->guid == $user->guid) {
                return true;
            }

            $container = $this->entities->get($attrs['container_guid']);

            return ($container && $container->canEdit($user->guid));
        });

        $params = ['entity' => $entity, 'user' => $user];
        return $this->hooks->trigger('permissions_check', $entity->getType(), $params, $default);
    }

    public function canDelete(ElggEntity $entity, $user_guid = 0) {
        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        $return = $entity->canEdit($user_guid);

        $params = [
            'entity' => $entity,
            'user' => $user
        ];
        return $this->hooks->trigger('permissions_check:delete', $entity->getType(), $params, $return);
    }

    public function canDeleteRiverItem(ElggRiverItem $item, $user_guid = 0) {
        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        $params = [
            'item' => $item,
            'user' => $user,
        ];
        return $this->hooks->trigger('permissions_check:delete', 'river', $params, false);
    }

    public function canEditAnnotation(ElggEntity $entity, $user_guid = 0, ElggAnnotation $annotation = null) {
        if (!$annotation) {
            return false;
        }

        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        $result = false;

        if ($user) {
            // If the owner of annotation is the specified user, they can edit.
            if ($annotation->owner_guid == $user->guid) {
                $result = true;
            }

            // If the user can edit the entity this is attached to, they can edit.
            if ($result === false && $entity->canEdit($user->guid)) {
                $result = true;
            }
        }

        // Trigger plugin hook - note that $user may be null
        $params = [
            'entity' => $entity,
            'user' => $user,
            'annotation' => $annotation
        ];

        return $this->hooks->trigger('permissions_check', 'annotation', $params, $result);
    }
    
    public function canWriteToContainer(ElggEntity $entity, string $type, string $subtype, int $user_guid = 0) {
        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        if ($user) {
            $user_guid = $user->guid;
        }

        $params = [
            'container' => $entity,
            'user' => $user,
            'subtype' => $subtype
        ];

        // Unlike permissions, logic check can be used to prevent certain entity
        // types from being contained by other entity types,
        // e.g. discussion reply objects can only be contained by discussion objects.
        // This hook can also be used to apply status logic, e.g. to disallow
        // new replies in closed discussions.
        // We do not take a stand hence the return is null. This can be used by
        // handlers to check if another hook has modified the value.
        $logic_check = $this->hooks->trigger('container_logic_check', $type, $params);

        if ($logic_check === false) {
            return false;
        }

        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        // If the user can edit the container, they can also write to it
        $return = $entity->canEdit($user_guid);

        // Container permissions can prevent users from writing to an entity.
        // For instance, these permissions can prevent non-group members from writing
        // content to the group.
        return $this->hooks->trigger('container_permissions_check', $type, $params, $return);
    }

    public function canComment(ElggEntity $entity, $user_guid = 0, $default = null) {
        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }
        
        $container_result = $this->canWriteToContainer($entity, 'object', 'comment', $user_guid);
        if ($this->canBypassPermissionsCheck($user_guid)) {
            // doing this again here to prevent bypassed users to be influenced by permissions_check:comment hook
            return $container_result;
        }
        
        if (is_null($default) || $default === $container_result) {
            $default = $container_result;
        } else {
            elgg_deprecated_notice('Passing "$default" to $entity->canComment() has been deprecated.', '4.1');
        }
        
        // By default, we don't take a position of whether commenting is allowed
        // because it is handled by the subclasses of \ElggEntity
        $params = [
            'entity' => $entity,
            'user' => $user,
        ];
        return $this->hooks->trigger('permissions_check:comment', $entity->getType(), $params, $default);
    }

    public function canAnnotate(ElggEntity $entity, $user_guid = 0, $annotation_name = '') {
        if ($annotation_name === null || $annotation_name === false) {
            // accepting these for BC
            $annotation_name = '';
        } elseif (!is_string($annotation_name)) {
            throw new InvalidArgumentException(__METHOD__ . ' expects \$annotation_name to be a string');
        }

        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        $return = (bool) $user;

        $params = [
            'entity' => $entity,
            'user' => $user,
            'annotation_name' => $annotation_name,
        ];

        if (!empty($annotation_name)) {
            $return = $this->hooks->trigger("permissions_check:annotate:$annotation_name", $entity->getType(), $params, $return);
        }

        return $this->hooks->trigger('permissions_check:annotate', $entity->getType(), $params, $return);
    }

    public function canDownload(ElggFile $entity, $user_guid = 0, $default = true) {
        if ($this->canBypassPermissionsCheck($user_guid)) {
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        $params = [
            'entity' => $entity,
            'user' => $user
        ];

        return $this->hooks->trigger('permissions_check:download', 'file', $params, $default);
    }

}