chore: Bumped

.github/workflows/run-test.yml

@@ -19,7 +19,7 @@ jobs:
         runs-on: ubuntu-latest
         strategy:
             matrix:
-                php-version: ['8.1', '8.2', '8.3']
+                php-version: ['8.0', '8.1']
         steps:
             - uses: shivammathur/setup-php@v2
               with:

.travis.yml

@@ -0,0 +1,16 @@
+language: php
+sudo: required
+php:
+    - 7.4
+    - 8.0
+    - 8.1
+    - nightly
+install:
+    - curl -s http://getcomposer.org/installer | php
+    - php composer.phar install --dev --no-interaction
+script:
+    - vendor/bin/phpcs --report=full --report-file=./report.txt -p ./src
+    - vendor/bin/phpstan analyse -c phpstan.neon
+jobs:
+    allow_failures:
+        -   php: nightly

README.md

@@ -81,7 +81,7 @@ security:
             custom_authenticator:
                 - RZ\Roadiz\RozierBundle\Security\RozierAuthenticator
     access_control:
-        - { path: ^/rz-admin/login, roles: PUBLIC_ACCESS }
+        - { path: ^/rz-admin/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
         - { path: ^/rz-admin, roles: ROLE_BACKEND_USER }
 ```
 - Add custom routes:

composer.json

@@ -4,7 +4,6 @@
     "keywords": [
         "cms",
         "backoffice",
-        "roadiz",
         "rezo zero"
     ],
     "authors": [
@@ -16,14 +15,13 @@
         }
     ],
     "type": "symfony-bundle",
-    "prefer-stable": true,
     "require": {
-        "php": ">=8.1",
+        "php": ">=8.0",
         "symfony/framework-bundle": "5.4.*",
-        "roadiz/core-bundle": "2.2.*",
-        "roadiz/rozier": "2.2.*",
-        "roadiz/compat-bundle": "2.2.*",
-        "roadiz/openid": "2.2.*"
+        "roadiz/core-bundle": "^2.1",
+        "roadiz/rozier": "^2.1",
+        "roadiz/compat-bundle": "^2.1",
+        "roadiz/openid": "^2.1"
     },
     "require-dev": {
         "php-coveralls/php-coveralls": "^2.4",
@@ -54,8 +52,8 @@
     },
     "extra": {
         "branch-alias": {
-            "dev-main": "2.2.x-dev",
-            "dev-develop": "2.3.x-dev"
+            "dev-main": "2.1.x-dev",
+            "dev-develop": "2.2.x-dev"
         }
     }
 }

config/packages/roadiz_rozier.yaml

@@ -1,9 +1,4 @@
 ---
-parameters:
-    env(OPEN_ID_DISCOVERY_URL): ''
-    env(OPEN_ID_HOSTED_DOMAIN): ''
-    env(OPEN_ID_CLIENT_ID): ''
-    env(OPEN_ID_CLIENT_SECRET): ''
 roadiz_rozier:
     theme_dir: '%kernel.project_dir%/vendor/roadiz/rozier/src'
     open_id:

config/routing.yaml

@@ -81,7 +81,7 @@ tagsRoutes:
 # USERS
 usersHomePage:
     path:     /rz-admin/users
-    controller: Themes\Rozier\Controllers\Users\UsersController::defaultAction
+    controller: Themes\Rozier\Controllers\Users\UsersController::indexAction
 usersRoutes:
     resource: "routing/users.yml"
     prefix: /rz-admin/users

config/routing/attributes.yml

@@ -22,11 +22,6 @@ attributesDeletePage:
         _controller: Themes\Rozier\Controllers\Attributes\AttributeController::deleteAction
     requirements: { id : "[0-9]+" }
 
-attributesBulkDeletePage:
-    methods: [GET, POST]
-    path:     /bulk-delete
-    defaults:
-        _controller: Themes\Rozier\Controllers\Attributes\AttributeController::bulkDeleteAction
 
 attributeGroupsHomePage:
     path:     /groups

config/routing/custom-forms.yml

@@ -27,8 +27,3 @@ customFormsDuplicatePage:
     requirements: { id : "[0-9]+" }
     defaults:
         _controller: Themes\Rozier\Controllers\CustomForms\CustomFormsUtilsController::duplicateAction
-customFormsBulkDeletePage:
-    methods: [GET, POST]
-    path:     /bulk-delete
-    defaults:
-        _controller: Themes\Rozier\Controllers\CustomForms\CustomFormsController::bulkDeleteAction

config/routing/documents.yml

@@ -29,11 +29,6 @@ documentsDownloadPage:
     defaults:
         _controller: Themes\Rozier\Controllers\Documents\DocumentsController::downloadAction
     requirements: { documentId : "[0-9]+" }
-documentsDownloadInlinePage:
-    path:     /download-inline/{documentId}
-    defaults:
-        _controller: Themes\Rozier\Controllers\Documents\DocumentsController::downloadInlineAction
-    requirements: { documentId : "[0-9]+" }
 documentsUsagePage:
     path:     /usage/{documentId}
     defaults:

config/routing/nodes.yml

@@ -91,14 +91,6 @@ nodesTreePage:
     requirements:
         nodeId : "[0-9]+"
         translationId : "[0-9]+"
-nodesMainTreePage:
-    path:     /tree/main/{translationId}
-    defaults:
-        _controller: Themes\Rozier\Controllers\Nodes\NodesTreesController::treeAction
-        nodeId : null
-        translationId : null
-    requirements:
-        translationId : "[0-9]+"
 nodesBulkDeletePage:
     path:     /bulk-delete
     defaults:

config/routing/redirections.yml

@@ -12,8 +12,3 @@ redirectionsDeletePage:
     defaults:
         _controller: Themes\Rozier\Controllers\RedirectionsController::deleteAction
     requirements: { id : "[0-9]+" }
-redirectionsBulkDeletePage:
-    methods: [GET, POST]
-    path:     /bulk-delete
-    defaults:
-        _controller: Themes\Rozier\Controllers\RedirectionsController::bulkDeleteAction

config/routing/users.yml

@@ -1,28 +1,13 @@
 usersEditPage:
-    path:     /edit/{id}
+    path:     /edit/{userId}
     defaults:
         _controller: Themes\Rozier\Controllers\Users\UsersController::editAction
-    requirements: { id : "[0-9]+" }
-usersBulkDeletePage:
-    methods: [GET, POST]
-    path:     /bulk-delete
-    defaults:
-        _controller: Themes\Rozier\Controllers\Users\UsersController::bulkDeleteAction
-usersBulkEnablePage:
-    methods: [GET, POST]
-    path:     /bulk-enable
-    defaults:
-        _controller: Themes\Rozier\Controllers\Users\UsersController::bulkEnableAction
-usersBulkDisablePage:
-    methods: [GET, POST]
-    path:     /bulk-disable
-    defaults:
-        _controller: Themes\Rozier\Controllers\Users\UsersController::bulkDisableAction
+    requirements: { userId : "[0-9]+" }
 usersEditDetailsPage:
-    path:     /edit/{id}/details
+    path:     /edit/{userId}/details
     defaults:
         _controller: Themes\Rozier\Controllers\Users\UsersController::editDetailsAction
-    requirements: { id : "[0-9]+" }
+    requirements: { userId : "[0-9]+" }
 usersEditRolesPage:
     path:     /edit/{userId}/roles
     defaults:
@@ -46,13 +31,13 @@ usersRemoveGroupsPage:
 usersAddPage:
     path:     /add
     defaults:
-        _type: Themes\Rozier\Forms\AddUserType
         _controller: Themes\Rozier\Controllers\Users\UsersController::addAction
 usersDeletePage:
-    path:     /delete/{id}
+    path:     /delete/{userId}
     defaults:
         _controller: Themes\Rozier\Controllers\Users\UsersController::deleteAction
-    requirements: { id : "[0-9]+" }
+    requirements: { userId : "[0-9]+" }
+
 usersSecurityPage:
     path:     /edit/{userId}/security
     defaults:

config/routing/webhooks.yml

@@ -20,8 +20,3 @@ webhooksDeletePage:
     defaults:
         _controller: Themes\Rozier\Controllers\WebhookController::deleteAction
     requirements: { id : "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" }
-webhooksBulkDeletePage:
-    methods: [GET, POST]
-    path:     /bulk-delete
-    defaults:
-        _controller: Themes\Rozier\Controllers\WebhookController::bulkDeleteAction

config/services.yaml

@@ -72,8 +72,6 @@ services:
         calls:
             -   prependPath: [ '%roadiz_core.documents_lib_dir%/Resources/views' ]
             -   addPath: [ '%roadiz_rozier.theme_dir%/Resources/views', 'RoadizRozier' ]
-                # Add a second path to make RoadizRozier templates extendable with @!RoadizRozier namespace
-            -   addPath: [ '%roadiz_rozier.theme_dir%/Resources/views', '!RoadizRozier' ]
         tags: [ 'twig.loader' ]
 
     #

phpstan.neon

@@ -28,8 +28,6 @@ parameters:
         - '#Doctrine\\ORM\\Mapping\\GeneratedValue constructor expects#'
         - '#type mapping mismatch: property can contain Doctrine\\Common\\Collections\\Collection<int, [^\>]+> but database expects Doctrine\\Common\\Collections\\Collection&iterable<[^\>]+>#'
         - '#should return Doctrine\\Common\\Collections\\Collection<int, [^\>]+Interface> but returns Doctrine\\Common\\Collections\\Collection<int, [^\>]+>#'
-        - '#but returns Doctrine\\Common\\Collections\\ReadableCollection<int, [^\>]+>#'
-        - '#does not accept Doctrine\\Common\\Collections\\ReadableCollection<int, [^\>]+>#'
 
     reportUnmatchedIgnoredErrors: false
     checkGenericClassInNonGenericObjectType: false

src/Aliases.php

@@ -12,6 +12,7 @@ final class Aliases
     public static function getAliases(): array
     {
         return [
+            \RZ\Roadiz\RozierBundle\Controller\BackendController::class => \RZ\Roadiz\CMS\Controllers\BackendController::class,
             \RZ\Roadiz\RozierBundle\Form\DocumentTranslationType::class => \Themes\Rozier\Forms\DocumentTranslationType::class,
             \RZ\Roadiz\RozierBundle\Form\CustomFormType::class => \Themes\Rozier\Forms\CustomFormType::class,
             \RZ\Roadiz\RozierBundle\ListManager\SessionListFilters::class => \Themes\Rozier\Utils\SessionListFilters::class,

src/Controller/BackendController.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace RZ\Roadiz\RozierBundle\Controller;
+
+use Psr\Log\LoggerInterface;
+use RZ\Roadiz\CompatBundle\Controller\AppController;
+use RZ\Roadiz\CoreBundle\Bag\NodeTypes;
+use RZ\Roadiz\CoreBundle\Bag\Roles;
+use RZ\Roadiz\CoreBundle\Bag\Settings;
+use RZ\Roadiz\CoreBundle\Mailer\EmailManager;
+use RZ\Roadiz\Documents\Packages;
+use RZ\Roadiz\OpenId\OAuth2LinkGenerator;
+use Symfony\Component\HttpKernel\KernelInterface;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
+use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
+use Themes\Rozier\Explorer\FoldersProvider;
+use Themes\Rozier\Explorer\SettingsProvider;
+use Themes\Rozier\Explorer\UsersProvider;
+use Themes\Rozier\RozierServiceRegistry;
+
+/**
+ * Special controller app file for backend themes.
+ *
+ * This AppController implementation will use a security scheme
+ */
+abstract class BackendController extends AppController
+{
+    protected static bool $backendTheme = true;
+    public static int $priority = -10;
+
+    public static function getSubscribedServices(): array
+    {
+        return array_merge(parent::getSubscribedServices(), [
+            'securityAuthenticationUtils' => AuthenticationUtils::class,
+            'urlGenerator' => UrlGeneratorInterface::class,
+            EmailManager::class => EmailManager::class,
+            'logger' => LoggerInterface::class,
+            'kernel' => KernelInterface::class,
+            'settingsBag' => Settings::class,
+            'nodeTypesBag' => NodeTypes::class,
+            'rolesBag' => Roles::class,
+            'assetPackages' => Packages::class,
+            'csrfTokenManager' => CsrfTokenManagerInterface::class,
+            OAuth2LinkGenerator::class => OAuth2LinkGenerator::class,
+            RozierServiceRegistry::class => RozierServiceRegistry::class,
+            UsersProvider::class => UsersProvider::class,
+            SettingsProvider::class => SettingsProvider::class,
+            FoldersProvider::class => FoldersProvider::class,
+        ]);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function createEntityListManager($entity, array $criteria = [], array $ordering = [])
+    {
+        return parent::createEntityListManager($entity, $criteria, $ordering)
+            ->setDisplayingNotPublishedNodes(true);
+    }
+}

src/Controller/Document/DocumentPublicListController.php

@@ -84,17 +84,20 @@ public function indexAction(Request $request, ?int $folderId = null): Response
             $this->assignation['folder'] = $folder;
         }
 
-        $type = $request->query->get('type');
-        $embedPlatform = $request->query->get('embedPlatform');
-
-        if (\is_string($type) && $type !== '') {
-            $prefilters['mimeType'] = trim($type);
-            $this->assignation['mimeType'] = trim($type);
+        if (
+            $request->query->has('type') &&
+            $request->query->get('type', '') !== ''
+        ) {
+            $prefilters['mimeType'] = trim($request->query->get('type', ''));
+            $this->assignation['mimeType'] = trim($request->query->get('type', ''));
         }
 
-        if (\is_string($embedPlatform) && $embedPlatform !== '') {
-            $prefilters['embedPlatform'] = trim($embedPlatform);
-            $this->assignation['embedPlatform'] = trim($embedPlatform);
+        if (
+            $request->query->has('embedPlatform') &&
+            $request->query->get('embedPlatform', '') !== ''
+        ) {
+            $prefilters['embedPlatform'] = trim($request->query->get('embedPlatform', ''));
+            $this->assignation['embedPlatform'] = trim($request->query->get('embedPlatform', ''));
         }
 
         /*

src/Controller/Login/LoginRequestController.php

@@ -40,7 +40,7 @@ protected function getUserViewer(): UserViewer
      * @throws \Doctrine\ORM\ORMException
      * @throws \Doctrine\ORM\OptimisticLockException
      */
-    public function indexAction(Request $request): Response
+    public function indexAction(Request $request)
     {
         $form = $this->createForm(LoginRequestForm::class);
         $form->handleRequest($request);
@@ -71,7 +71,7 @@ public function indexAction(Request $request): Response
     /**
      * @return Response
      */
-    public function confirmAction(): Response
+    public function confirmAction()
     {
         return $this->render('@RoadizRozier/login/requestConfirm.html.twig', $this->assignation);
     }

src/Controller/Node/NodesTagsController.php

@@ -10,11 +10,11 @@
 use RZ\Roadiz\CoreBundle\Event\Node\NodeTaggedEvent;
 use RZ\Roadiz\CoreBundle\Node\NodeFactory;
 use RZ\Roadiz\CoreBundle\Repository\NodesSourcesRepository;
-use RZ\Roadiz\CoreBundle\Security\Authorization\Voter\NodeVoter;
 use RZ\Roadiz\RozierBundle\Form\NodesTagsType;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Exception\ResourceNotFoundException;
+use Themes\Rozier\Forms\NodeTagsType;
 use Themes\Rozier\RozierApp;
 use Themes\Rozier\Traits\NodesTrait;
 
@@ -45,6 +45,7 @@ protected function getNodeFactory(): NodeFactory
      */
     public function editTagsAction(Request $request, Node $nodeId): Response
     {
+        $this->validateNodeAccessForRole('ROLE_ACCESS_NODES', $nodeId);
         /** @var NodesSourcesRepository $nodeSourceRepository */
         $nodeSourceRepository = $this->em()->getRepository(NodesSources::class);
         $nodeSourceRepository
@@ -61,8 +62,6 @@ public function editTagsAction(Request $request, Node $nodeId): Response
             throw new ResourceNotFoundException();
         }
 
-        $this->denyAccessUnlessGranted(NodeVoter::EDIT_TAGS, $source);
-
         $node = $source->getNode();
         $form = $this->createForm(NodesTagsType::class, $node);
         $form->handleRequest($request);

src/Controller/Node/RealmNodeController.php

@@ -12,7 +12,6 @@
 use RZ\Roadiz\CoreBundle\Event\Realm\NodeLeftRealmEvent;
 use RZ\Roadiz\CoreBundle\Form\RealmNodeType;
 use RZ\Roadiz\CoreBundle\Model\RealmInterface;
-use RZ\Roadiz\CoreBundle\Security\Authorization\Voter\NodeVoter;
 use Symfony\Component\Form\Extension\Core\Type\FormType;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -39,7 +38,7 @@ public function __construct(
 
     public function defaultAction(Request $request, Node $id): Response
     {
-        $this->denyAccessUnlessGranted(NodeVoter::EDIT_REALMS, $id);
+        $this->denyAccessUnlessGranted('ROLE_ACCESS_REALM_NODES');
 
         $node = $id;
         $realmNode = new RealmNode();