Gatekeeper.php

Go to the documentation of this file.

<?php
 
namespace Elgg;
 
use Elgg\Database\AccessCollections;
use Elgg\Database\EntityTable;
use Elgg\Exceptions\HttpException;
use Elgg\Exceptions\Http\EntityNotFoundException;
use Elgg\Exceptions\Http\EntityPermissionsException;
use Elgg\Exceptions\Http\GatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\AdminGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\AjaxGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\GroupGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\GroupToolGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\LoggedInGatekeeperException;
use Elgg\Exceptions\Http\Gatekeeper\LoggedOutGatekeeperException;
use Elgg\Http\Request as HttpRequest;
use Elgg\I18n\Translator;
use Elgg\Page\PageOwnerService;
 
class Gatekeeper {
 
    public function __construct(
        protected SessionManagerService $session_manager,
        protected HttpRequest $request,
        protected RedirectService $redirects,
        protected EntityTable $entities,
        protected AccessCollections $access,
        protected Translator $translator,
        protected PageOwnerService $page_owner
    ) {
    }
 
    public function assertAuthenticatedUser(): void {
        if ($this->session_manager->isLoggedIn()) {
            return;
        }
 
        $this->redirects->setLastForwardFrom();
 
        throw new LoggedInGatekeeperException();
    }
 
    public function assertUnauthenticatedUser(): void {
        if (!$this->session_manager->isLoggedIn()) {
            return;
        }
 
        $exception = new LoggedOutGatekeeperException();
        $exception->setRedirectUrl(elgg_get_site_url());
        
        throw $exception;
    }
 
    public function assertAuthenticatedAdmin(): void {
        $this->assertAuthenticatedUser();
 
        $user = $this->session_manager->getLoggedInUser();
        if ($user->isAdmin()) {
            return;
        }
 
        $this->redirects->setLastForwardFrom();
 
        throw new AdminGatekeeperException();
    }
 
    public function assertExists(int $guid, ?string $type = null, ?string $subtype = null): \ElggEntity {
        $entity = elgg_call(ELGG_IGNORE_ACCESS | ELGG_SHOW_DISABLED_ENTITIES, function () use ($guid, $type, $subtype) {
            return $this->entities->get($guid, $type, $subtype);
        });
 
        if (!$entity instanceof \ElggEntity) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'guid' => $guid,
                'type' => $type,
                'subtype' => $subtype,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }
 
        return $entity;
    }
 
    public function assertAccessibleEntity(\ElggEntity $entity, ?\ElggUser $user = null, bool $validate_can_edit = false): void {
 
        $result = true;
 
        try {
            $user_guid = $user ? $user->guid : 0;
            if (!$this->session_manager->getIgnoreAccess() && !$entity->hasAccess($user_guid)) {
                // user is logged in but still does not have access to it
                $msg = $this->translator->translate('limited_access');
                $exception = new EntityPermissionsException($msg);
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }
            
            if ($validate_can_edit && !$entity->canEdit($user_guid)) {
                // logged in user does not have edit or write access to it
                $msg = $this->translator->translate('limited_access');
                $exception = new EntityPermissionsException($msg);
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }
 
            if (!$entity->isEnabled() && !$this->session_manager->getDisabledEntityVisibility()) {
                // entity exists, but is disabled
                $exception = new EntityNotFoundException();
                $exception->setParams([
                    'entity' => $entity,
                    'user' => $user,
                    'route' => $this->request->get('_route'),
                ]);
                throw $exception;
            }
 
            if ($entity instanceof \ElggGroup) {
                $this->assertAccessibleGroup($entity, $user);
            }
 
            foreach (['owner_guid', 'container_guid'] as $prop) {
                if (!$entity->$prop) {
                    continue;
                }
 
                $parent = $this->assertExists($entity->$prop);
                $this->assertAccessibleEntity($parent, $user);
            }
        } catch (HttpException $ex) {
            $result = $ex;
        }
 
        $params = [
            'entity' => $entity,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ];
 
        $result = _elgg_services()->events->triggerResults('gatekeeper', "{$entity->type}:{$entity->subtype}", $params, $result);
 
        if ($result instanceof HttpException) {
            throw $result;
        } else if ($result === false) {
            throw new HttpException();
        }
    }
 
    public function assertAccessibleUser(\ElggUser $user, ?\ElggUser $viewer = null): void {
        if (!$user->isBanned()) {
            return;
        }
        
        if (!isset($viewer)) {
            $viewer = $this->session_manager->getLoggedInUser();
        }
 
        if (!$viewer || !$viewer->isAdmin()) {
            $exception = new EntityNotFoundException();
            $exception->setParams([
                'entity' => $user,
                'user' => $viewer,
                'route' => $this->request->get('_route'),
            ]);
            throw $exception;
        }
    }
 
    public function assertAccessibleGroup(\ElggGroup $group, ?\ElggUser $user = null): void {
        if ($group->canAccessContent($user)) {
            return;
        }
        
        $this->assertAuthenticatedUser();
 
        $this->redirects->setLastForwardFrom();
 
        $exception = new GroupGatekeeperException();
        $exception->setParams([
            'entity' => $group,
            'user' => $user,
            'route' => $this->request->get('_route'),
        ]);
        $exception->setRedirectUrl($group->getURL());
        throw $exception;
    }
    
    public function assertGroupToolEnabled(string $group_tool, ?\ElggGroup $group = null): void {
        $group = $group ?? $this->page_owner->getPageOwnerEntity();
        if (!$group instanceof \ElggGroup) {
            return;
        }
        
        if ($group->isToolEnabled($group_tool)) {
            return;
        }
        
        $ex = new GroupToolGatekeeperException();
        $ex->setRedirectUrl($group->getURL());
        $ex->setParams([
            'entity' => $group,
            'tool' => $group_tool,
        ]);
        
        throw $ex;
    }
 
    public function assertXmlHttpRequest(): void {
        if ($this->request->isXmlHttpRequest()) {
            return;
        }
 
        throw new AjaxGatekeeperException();
    }
}