Your IP : 216.73.217.79

Current Path : /var/www/v3.cesa.co.za/src/UserBundle/Security/Authorization/Voter/
Upload File :
Current File : /var/www/v3.cesa.co.za/src/UserBundle/Security/Authorization/Voter/UserAclVoter.php

<?php

namespace App\UserBundle\Security\Authorization\Voter;

use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Security;

class UserAclVoter implements VoterInterface {
    /*
     * @var ContainerInterface
     */

    private $container;

    /*
     * @var Security
     */
    private $security;

    /*
     * @var array
     */
    private $requireRoles;

    public function __construct(ContainerInterface $container, Security $security) {
        $this->container = $container;
        $this->security = $security;
    }

//    public function supportsAttribute($attribute) {
//        // you won't check against a user attribute, so return true
//        return true;
//    }
//
//    public function supportsClass($class) {
//        // your voter supports all type of token classes, so return true
//        return true;
//    }

    public function vote(TokenInterface $token, $object, array $attributes) {

//        $securityContext = $this->container->get('security.token_storage');
//        $securityToken = $securityContext->getToken();
        $user = $token->getUser();

        if (!is_object($user)) {
            $user = $this->container->get('user_list.manager')->getLoggedInUser();
        }

        if (!is_object($user)) {
//            echo 'User is NULL!';
//            exit;
            return self::ACCESS_ABSTAIN;
        }

        if ($user->getGranted('ROLE_SUPER_ADMINISTRATOR')) {
            return self::ACCESS_GRANTED;
        }

        if (!is_array($this->requireRoles)) {


            $this->requireRoles = array('ROLE_LOGGED_IN', 'ROLE_REPORTS_ONLY', 'ROLE_USER');

            if (is_object($object) && property_exists(get_class($object), 'attributes') && is_object($object->attributes)) {
                $controller = $object->attributes->get('_controller');
                $adminClass = $object->attributes->get('_sonata_admin');
            } else {
                $controller = '';
                $adminClass = '';
            }

//        echo print_r($object, true);
//        echo '<br /><br/>' . $object->attributes->get('_sonata_admin');
//        echo '<br /><br/>' . get_class($object) . ' - ' . $controller . ' - ' . $adminClass . '<br />';
//        echo 'Testing...  ';
//        exit;

            if ((is_object($object)) && (strpos($controller, 'dashboard') <= 0) && strlen($adminClass) > 0) {

//            $class = $object->attributes->get('_controller');
                $classArray = explode('.', $adminClass);
                $entityArr = explode('_', $classArray[3]);
                $entity = '';
                foreach ($entityArr as $entityPart) {
                    $entity .= ucfirst($entityPart);
                }
                $class = strtoupper($classArray[0]) . '\\' . ucfirst($classArray[1]) . 'Bundle\\Entity\\' . $entity;
//            echo $class . '<br />';
//            exit;

                if (strpos($class, 'Entity') <= 0) {
                    $class = str_replace('Controller', 'Entity', $controller);
                    $class = str_replace('AdminEntity', '', $class);
                    $class = substr($class, 0, strpos($class, '::'));
                }
//            echo $class . '<br />';

                $accessObjectManager = $this->container->get('access_object.manager');
                $accessLevelManager = $this->container->get('access_level.manager');

                $accessObject = $accessObjectManager->getByClassName($class);

                $accessObject->setAdminClassName($adminClass);

                if (!is_object($accessObject->getAccessLevel())) {
                    $accessObject->setAccessLevel($this->container->get('access_level.manager')->getSuperAdminAccessLevel());
                }

                $accessObjectManager->getEm()->persist($accessObject);
                $accessObjectManager->getEm()->flush();

                $accessLevel = $accessLevelManager->getAccessLevel($user);

                if (is_object($accessLevel) && $accessLevel->getLevelValue() > $accessObject->getAccessLevel()->getLevelValue()) {
//                echo 'No access to object';
//                exit;
                    return self::ACCESS_DENIED;
                }

//            echo $class . '<br />';
//            exit;
                if ($class == '\ContentBundle\\Entity\\ContentI18n') {
                    //Object is a content object
                    $this->requireRoles[] = 'ROLE_CONTENT_ADMIN';
                }

                if ($class == '\AccessBundle\\Entity\\AccessLevelType') {
                    //Object is an Access Level Type
                    $this->requireRoles[] = 'ROLE_SUPER_ADMIN';
                }
            }
        }

        $userRoles = $user->getRoles();

//        var_dump($userRoles);
//        var_dump($this->requireRoles);
//        exit;

        foreach ($this->requireRoles as $role) {
            if (!in_array($role, $userRoles)) {
//                echo 'role not there! ' . $role . '<br>';
//                exit;
                return self::ACCESS_DENIED;
            }
        }

//        foreach ($attributes as $attribute) {
//            if ($this->supportsAttribute($attribute) && $object instanceof UserInterface) {
//                if ($object->isSuperAdmin() && !$token->getUser()->isSuperAdmin()) {
//                    // deny a non super admin user to edit a super admin user
//                    return self::ACCESS_DENIED;
//                }
//            }
//        }
        // use the parent vote with the custom permission map:
        // return parent::vote($token, $object, $attributes);
        // otherwise leave the permission voting to the AclVoter that is using the default permission map
        return self::ACCESS_GRANTED;
    }

}