TheCoreDev/sterivein
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add a first verification in controller creation process for verifying if an admin is already logged in. Fix #246

Browse Source
This commit is contained in:
Manuel Raynaud
2014-03-07 12:35:50 +01:00
parent 6193274620
commit 8c45c392ac
5 changed files with 77 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
core/lib/Thelia/Action/HttpException.php
View File

@@ -30,6 +30,7 @@ use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use Symfony\Component\HttpKernel\KernelEvents;
use Thelia\Core\Template\ParserInterface;
use Thelia\Exception\AdminAccessDenied;
use Thelia\Model\ConfigQuery;
use Thelia\Core\Template\TemplateHelper;
@@ -53,13 +54,36 @@ class HttpException extends BaseAction implements EventSubscriberInterface
public function checkHttpException(GetResponseForExceptionEvent $event)
{
if ($event->getException() instanceof NotFoundHttpException) {
$exception = $event->getException();
if ($exception instanceof NotFoundHttpException) {
$this->display404($event);
}
if ($event->getException() instanceof AccessDeniedHttpException) {
if ($exception instanceof AccessDeniedHttpException) {
$this->display403($event);
}
if ($exception instanceof AdminAccessDenied) {
$this->displayAdminGeneralError($event);
}
}
protected function displayAdminGeneralError(GetResponseForExceptionEvent $event)
{
// Define the template thant shoud be used
$this->parser->setTemplateDefinition(TemplateHelper::getInstance()->getActiveAdminTemplate());
$message = $event->getException()->getMessage();
$response = Response::create(
$this->parser->render('general_error.html',
array(
"error_message" => $message
)),
403
) ;
$event->setResponse($response);
}
protected function display404(GetResponseForExceptionEvent $event)

3
core/lib/Thelia/Config/Resources/routing/admin.xml
View File

@@ -7,6 +7,7 @@
<!-- Route to administration base -->
<route id="admin" path="/admin">
<default key="_controller">Thelia\Controller\Admin\AdminController::indexAction</default>
<default key="not-logged">1</default>
</route>
<!-- home -->
@@ -24,6 +25,7 @@
<!-- Route to the administration login page -->
<route id="admin.login" path="/admin/login">
<default key="_controller">Thelia\Controller\Admin\SessionController::showLoginAction</default>
<default key="not-logged">1</default>
</route>
<!-- Route to the administration logout page -->
@@ -34,6 +36,7 @@
<!-- Route to the login check controller -->
<route id="admin.checklogin" path="/admin/checklogin">
<default key="_controller">Thelia\Controller\Admin\SessionController::checkLoginAction</default>
<default key="not-logged">1</default>
</route>
<!-- Route to the catalog controller -->

12
core/lib/Thelia/Core/Controller/ControllerResolver.php
View File

@@ -27,6 +27,9 @@ use Symfony\Component\HttpKernel\Controller\ControllerResolver as BaseController
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\DependencyInjection\ContainerAwareInterface;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Thelia\Controller\Admin\BaseAdminController;
use Thelia\Exception\AdminAccessDenied;
/**
* ControllerResolver that supports "a:b:c", "service:method" and class::method" notations in routes definition
@@ -90,6 +93,15 @@ class ControllerResolver extends BaseControllerResolver
$controller->setContainer($this->container);
}
//check if an admin is logged in
if ($controller instanceof BaseAdminController) {
$securityContext = $this->container->get('thelia.securityContext');
$request = $this->container->get('request');
if(false === $securityContext->hasAdminUser() && $request->attributes->get('not-logged') != 1) {
throw new AdminAccessDenied();
}
}
return array($controller, $method);
}
}

35
core/lib/Thelia/Exception/AdminAccessDenied.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
/*************************************************************************************/
/* */
/* Thelia */
/* */
/* Copyright (c) OpenStudio */
/* email : info@thelia.net */
/* web : http://www.thelia.net */
/* */
/* This program is free software; you can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 3 of the License */
/* */
/* This program is distributed in the hope that it will be useful, */
/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
/* GNU General Public License for more details. */
/* */
/* You should have received a copy of the GNU General Public License */
/* along with this program. If not, see <http://www.gnu.org/licenses/>. */
/* */
/*************************************************************************************/
namespace Thelia\Exception;
/**
* Class AdminAccessDenied
* @package Thelia\Exception
* @author Manuel Raynaud <mraynaud@openstudio.fr>
*/
class AdminAccessDenied extends \RuntimeException
{
}

2
templates/backOffice/default/general_error.html
View File

@@ -15,7 +15,7 @@
{block name="error-message"}<p>{$error_message}</p>{/block}
<a href="{url path='/admin/home'}" class="btn btn-default btn-info btn-lg"><span class="glyphicon glyphicon-home"></span> {intl l="Go to administration home"}</a>
<a href="{url path='/admin'}" class="btn btn-default btn-info btn-lg"><span class="glyphicon glyphicon-home"></span> {intl l="Go to administration home"}</a>
</div>
</div>
</div>