From 993a9c21ca939b7ea0f426425af2a76a7080b587 Mon Sep 17 00:00:00 2001 From: Guy Sartorelli Date: Tue, 15 Oct 2024 12:04:46 +1300 Subject: [PATCH] NEW AdminController as superclass for /admin/* routed controllers --- code/AdminController.php | 362 ++++++++++++++++++++ code/AdminRootController.php | 69 ++-- code/LeftAndMain.php | 618 ++++++++--------------------------- code/SudoModeController.php | 8 +- 4 files changed, 536 insertions(+), 521 deletions(-) create mode 100644 code/AdminController.php diff --git a/code/AdminController.php b/code/AdminController.php new file mode 100644 index 000000000..00c975891 --- /dev/null +++ b/code/AdminController.php @@ -0,0 +1,362 @@ +" if no permissions are defined here. + * See {@link canView()} for more details on permission checks. + */ + private static string|array $required_permission_codes = []; + + /** + * The configuration passed to the supporting JS for each CMS section includes a 'name' key + * that by default matches the FQCN of the current class. This setting allows you to change + * the key if necessary (for example, if you are overloading CMSMain or another core class + * and want to keep the core JS - which depends on the core class names - functioning, you + * would need to set this to the FQCN of the class you are overloading). + * + * See getClientConfig() + */ + private static ?string $section_name = null; + + /** + * Get list of required permissions for accessing this controller. + * If false, no permission is required. + */ + public static function getRequiredPermissions(): array|string|false + { + if (static::class === AdminController::class) { + throw new BadMethodCallException('getRequiredPermissions should be called on a subclass'); + } + // If the user is accessing LeftAndMain directly, only generic permissions are required. + if (static::class === LeftAndMain::class) { + return 'CMS_ACCESS'; + } + $codes = static::config()->get('required_permission_codes'); + // allow explicit FALSE to disable subclass check + if ($codes === false) { + return false; + } + if ($codes) { + return $codes; + } + // Fallback if no explicit permission was declared + return 'CMS_ACCESS_' . static::class; + } + + public function canView($member = null) + { + if (!$member && $member !== false) { + $member = Security::getCurrentUser(); + } + + // don't allow unauthenticated users + if (!$member) { + return false; + } + + // alternative extended checks + if ($this->hasMethod('alternateAccessCheck')) { + $alternateAllowed = $this->alternateAccessCheck($member); + if ($alternateAllowed === false) { + return false; + } + } + + // Check for "Access to all CMS sections" permission + if (Permission::checkMember($member, 'CMS_ACCESS_LeftAndMain')) { + return true; + } + + // Check for permission to access this specific controller + $codes = static::getRequiredPermissions(); + // allow explicit FALSE to disable subclass check + if ($codes === false) { + return true; + } + foreach ((array) $codes as $code) { + if (!Permission::checkMember($member, $code)) { + return false; + } + } + + return true; + } + + public function Link($action = null) + { + // LeftAndMain methods have a top-level uri access + if (static::class === LeftAndMain::class) { + $segment = ''; + } else { + // Get url_segment + $segment = static::config()->get('url_segment'); + if (!$segment) { + throw new BadMethodCallException( + sprintf('AdminController subclasses (%s) must have url_segment', static::class) + ); + } + } + + $link = Controller::join_links( + AdminRootController::admin_url(), + $segment, + "$action" + ); + $this->extend('updateLink', $link); + return $link; + } + + /** + * Overloaded redirection logic to trigger a fake redirect on ajax requests. + * While this violates HTTP principles, its the only way to work around the + * fact that browsers handle HTTP redirects opaquely, no intervention via JS is possible. + * In isolation, that's not a problem - but combined with history.pushState() + * it means we would request the same redirection URL twice if we want to update the URL as well. + * See LeftAndMain.js for the required jQuery ajaxComplete handlers. + */ + public function redirect(string $url, int $code = 302): HTTPResponse + { + if ($this->getRequest()->isAjax()) { + $response = $this->getResponse(); + $response->addHeader('X-ControllerURL', $url); + if ($this->getRequest()->getHeader('X-Pjax') && !$response->getHeader('X-Pjax')) { + $response->addHeader('X-Pjax', $this->getRequest()->getHeader('X-Pjax')); + } + $newResponse = new LeftAndMain_HTTPResponse( + $response->getBody(), + $response->getStatusCode(), + $response->getStatusDescription() + ); + foreach ($response->getHeaders() as $k => $v) { + $newResponse->addHeader($k, $v); + } + $newResponse->setIsFinished(true); + $this->setResponse($newResponse); + // Actual response will be re-requested by client + return $newResponse; + } else { + return parent::redirect($url, $code); + } + } + + /** + * Returns configuration required by the client app + */ + public function getClientConfig(): array + { + // Allows the section name to be overridden in config + $name = static::config()->get('section_name') ?: static::class; + // Trim leading/trailing slash to make it easier to concatenate URL + // and use in routing definitions. + $url = trim($this->Link(), '/'); + $clientConfig = [ + 'name' => $name, + 'url' => $url, + 'reactRoutePath' => preg_replace('/^' . preg_quote(AdminRootController::admin_url(), '/') . '/', '', $url), + ]; + $this->extend('updateClientConfig', $clientConfig); + return $clientConfig; + } + + protected function init() + { + parent::init(); + + HTTPCacheControlMiddleware::singleton()->disableCache(); + + SSViewer::setRewriteHashLinksDefault(false); + ContentNegotiator::setEnabled(false); + + // set language + $member = Security::getCurrentUser(); + if (!empty($member->Locale)) { + i18n::set_locale($member->Locale); + } + + // Don't allow access if the request hasn't finished being handled and the user can't access this controller + if (!$this->canView() && !$this->getResponse()->isFinished()) { + // Allow subclasses and extensions to redirect somewhere more appropriate + $this->invokeWithExtensions('onInitPermissionFailure'); + + // If we're redirecting away, just let that happen + if ($this->getResponse()->isRedirect()) { + return; + } + + if (Security::getCurrentUser()) { + $this->getRequest()->getSession()->clear("BackURL"); + } + + // if no alternate menu items have matched, return a permission error + $messageSet = [ + 'default' => _t( + __CLASS__ . '.PERMDEFAULT', + "You must be logged in to access the administration area." + ), + 'alreadyLoggedIn' => _t( + __CLASS__ . '.PERMALREADY', + "I'm sorry, but you can't access that part of the CMS." + ), + 'logInAgain' => _t( + __CLASS__ . '.PERMAGAIN', + "You have been logged out of the CMS." + ), + ]; + + $this->suppressAdminErrorContext = true; + Security::permissionFailure($this, $messageSet); + return; + } + + // Don't continue if there's already been a redirection request. + if ($this->getResponse()->isRedirect()) { + return; + } + + $this->extend('onInit'); + + // Load the editor with original user themes before overwriting + // them with admin themes + $themes = HTMLEditorConfig::getThemes(); + if (empty($themes)) { + HTMLEditorConfig::setThemes(SSViewer::get_themes()); + } + + // Assign default cms theme and replace user-specified themes + // This ensures any templates rendered use appropriate templates and resources + // instead of the front-end ones + SSViewer::set_themes(LeftAndMain::config()->uninherited('admin_themes')); + + // Set the current reading mode + Versioned::set_stage(Versioned::DRAFT); + + // Set default reading mode to suppress ?stage=Stage querystring params in CMS + Versioned::set_default_reading_mode(Versioned::get_reading_mode()); + } + + /** + * Get a data value from JSON in body of the POST request, ensuring it exists + * Will only read from the root node of the JSON body + */ + protected function getPostedJsonValue(HTTPRequest $request, string $key): mixed + { + $data = json_decode($request->getBody(), true); + if (!array_key_exists($key, $data)) { + $this->jsonError(400); + } + return $data[$key]; + } + + /** + * Creates a successful json response + */ + protected function jsonSuccess(int $statusCode, ?array $data = null): HTTPResponse + { + if ($statusCode < 200 || $statusCode >= 300) { + throw new InvalidArgumentException("Status code $statusCode must be between 200 and 299"); + } + if (is_null($data)) { + $body = ''; + } else { + $body = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); + } + return $this->getResponse() + ->addHeader('Content-Type', 'application/json') + ->setStatusCode($statusCode) + ->setBody($body); + } + + /** + * Return an error HTTPResponse encoded as json + * + * @param int $errorCode + * @param string $errorMessage + * @return HTTPResponse + * @throws HTTPResponse_Exception + */ + protected function jsonError($errorCode, $errorMessage = null) + { + // Build error from message + $error = [ + 'type' => 'error', + 'code' => $errorCode, + ]; + if ($errorMessage) { + $error['value'] = $errorMessage; + } else { + $messageDefault = match ($errorCode) { + 400 => 'Sorry, it seems there was something wrong with the request.', + 401 => 'Sorry, it seems you are not authorised to access this section or object.', + 403 => 'Sorry, it seems the action you were trying to perform is forbidden.', + 404 => 'Sorry, it seems you were trying to access a section or object that doesn\'t exist.', + 500 => 'Sorry, it seems there was an internal server error.', + 503 => 'Sorry, it seems the service is temporarily unavailable.', + default => 'Error', + }; + /** @phpstan-ignore translation.key (we need the key to be dynamic here) */ + $error['value'] = _t(__CLASS__ . ".ErrorMessage{$errorCode}", $messageDefault); + } + + // Support explicit error handling with status = error, or generic message handling + // with a message of type = error + $result = [ + 'status' => 'error', + 'errors' => [$error] + ]; + $response = HTTPResponse::create(json_encode($result), $errorCode) + ->addHeader('Content-Type', 'application/json'); + + // Call a handler method such as onBeforeHTTPError404 + $this->extend("onBeforeJSONError{$errorCode}", $request, $response); + + // Call a handler method such as onBeforeHTTPError, passing 404 as the first arg + $this->extend('onBeforeJSONError', $errorCode, $request, $response); + + // Throw a new exception + throw new HTTPResponse_Exception($response); + } +} diff --git a/code/AdminRootController.php b/code/AdminRootController.php index 32fade435..0a5a7c6f0 100644 --- a/code/AdminRootController.php +++ b/code/AdminRootController.php @@ -10,24 +10,41 @@ use SilverStripe\Core\Injector\Injector; use SilverStripe\View\TemplateGlobalProvider; +/** + * Controller in charge of managing AdminController routing. + * + * Adds AdminController classes to the Director routing rules and redirects to an + * appropriate controller if a user navigates directly to /admin + */ class AdminRootController extends Controller implements TemplateGlobalProvider { - /** * Fallback admin URL in case this cannot be infered from Director.rules + */ + private static string $url_base = 'admin'; + + /** + * The LeftAndMain child that will be used as the initial panel to display if none is selected (i.e. if you + * visit /admin) + */ + private static string $default_panel = SecurityAdmin::class; + + /** + * Holds an array of url_pattern => controller k/v pairs, the same as Director::rules. However this is built + * dynamically from introspecting on all the classes that derive from LeftAndMain. + * + * Don't access this directly - always access via the rules() accessor, which will build this array + * the first time it's accessed * - * @var string - * @config + * @internal */ - private static $url_base = 'admin'; + private static ?array $adminRules = null; /** * Convenience function to return the admin route config. * Looks for the {@link Director::$rules} for the current admin Controller. - * - * @return string */ - public static function get_admin_route() + public static function get_admin_route(): string { $rules = Director::config()->get('rules'); $adminRoute = array_search(__CLASS__, $rules ?? []); @@ -36,44 +53,22 @@ public static function get_admin_route() /** * Returns the root admin URL for the site with trailing slash - * - * @return string */ - public static function admin_url(string $action = '') + public static function admin_url(string $action = ''): string { return Controller::join_links(AdminRootController::get_admin_route(), $action); } - /** - * @var string - * @config - * The LeftAndMain child that will be used as the initial panel to display if none is selected (i.e. if you - * visit /admin) - */ - private static $default_panel = SecurityAdmin::class; - - /** - * @var array - * @internal - * - * Holds an array of url_pattern => controller k/v pairs, the same as Director::rules. However this is built - * dynamically from introspecting on all the classes that derive from LeftAndMain. - * - * Don't access this directly - always access via the rules() accessor below, which will build this array - * the first time it's accessed - */ - private static $adminRules = null; - /** * Gets a list of url_pattern => controller k/v pairs for each LeftAndMain derived controller */ - public static function rules() + public static function rules(): array { if (AdminRootController::$adminRules === null) { AdminRootController::$adminRules = []; // Map over the array calling add_rule_for_controller on each - $classes = CMSMenu::get_cms_classes(null, true, CMSMenu::URL_PRIORITY); + $classes = CMSMenu::get_cms_classes(AdminController::class, true, CMSMenu::URL_PRIORITY); array_map([__CLASS__, 'add_rule_for_controller'], $classes ?? []); } return AdminRootController::$adminRules; @@ -81,10 +76,8 @@ public static function rules() /** * Add the appropriate k/v pair to AdminRootController::$rules for the given controller. - * - * @param string $controllerClass Name of class */ - protected static function add_rule_for_controller($controllerClass) + protected static function add_rule_for_controller(string $controllerClass): void { $config = Config::forClass($controllerClass); $urlSegment = $config->get('url_segment'); @@ -118,7 +111,7 @@ public function handleRequest(HTTPRequest $request): HTTPResponse // Otherwise $rules = AdminRootController::rules(); foreach ($rules as $pattern => $controller) { - if (($arguments = $request->match($pattern, true)) !== false) { + if ($request->match($pattern, true) !== false) { /** @var LeftAndMain $controllerObj */ $controllerObj = Injector::inst()->create($controller); return $controllerObj->handleRequest($request); @@ -131,10 +124,10 @@ public function handleRequest(HTTPRequest $request): HTTPResponse } /** - * @return array Returns an array of strings of the method names of methods on the call that should be exposed + * Returns an array of strings of the method names of methods on the call that should be exposed * as global variables in the templates. */ - public static function get_template_global_variables() + public static function get_template_global_variables(): array { return [ 'adminURL' => 'admin_url' diff --git a/code/LeftAndMain.php b/code/LeftAndMain.php index 9eb920f7b..25d305c24 100644 --- a/code/LeftAndMain.php +++ b/code/LeftAndMain.php @@ -2,19 +2,16 @@ namespace SilverStripe\Admin; -use BadMethodCallException; use InvalidArgumentException; use LogicException; use ReflectionClass; use SilverStripe\CMS\Controllers\CMSMain; use SilverStripe\Admin\Navigator\SilverStripeNavigator; -use SilverStripe\Control\ContentNegotiator; use SilverStripe\Control\Controller; use SilverStripe\Control\Director; use SilverStripe\Control\HTTPRequest; use SilverStripe\Control\HTTPResponse; use SilverStripe\Control\HTTPResponse_Exception; -use SilverStripe\Control\Middleware\HTTPCacheControlMiddleware; use SilverStripe\Control\PjaxResponseNegotiator; use SilverStripe\Core\ClassInfo; use SilverStripe\Core\Config\Config; @@ -43,13 +40,11 @@ use SilverStripe\Model\List\SS_List; use SilverStripe\Core\Validation\ValidationException; use SilverStripe\Core\Validation\ValidationResult; -use SilverStripe\Security\Member; use SilverStripe\Security\Permission; use SilverStripe\Security\PermissionProvider; use SilverStripe\Security\Security; use SilverStripe\Security\SecurityToken; use SilverStripe\SiteConfig\SiteConfig; -use SilverStripe\Versioned\Versioned; use SilverStripe\Model\ArrayData; use SilverStripe\View\Requirements; use SilverStripe\View\SSViewer; @@ -61,7 +56,7 @@ * This is essentially an abstract class which should be subclassed. * See {@link CMSMain} for a good example. */ -class LeftAndMain extends Controller implements PermissionProvider +class LeftAndMain extends AdminController implements PermissionProvider { /** @@ -77,20 +72,6 @@ class LeftAndMain extends Controller implements PermissionProvider */ private static $client_debugging = true; - /** - * The current url segment attached to the LeftAndMain instance - * - * @config - * @var string - */ - private static $url_segment = null; - - /** - * @config - * @var string Used by {@link AdminRootController} to augment Director route rules for sub-classes of LeftAndMain - */ - private static $url_rule = '/$Action/$ID/$OtherID'; - /** * @config * @var string @@ -109,12 +90,6 @@ class LeftAndMain extends Controller implements PermissionProvider */ private static $menu_priority = 0; - /** - * @config - * @var int - */ - private static $url_priority = 50; - /** * A subclass of {@link DataObject}. * @@ -187,18 +162,6 @@ class LeftAndMain extends Controller implements PermissionProvider */ private static $admin_themes = []; - /** - * Codes which are required from the current user to view this controller. - * If multiple codes are provided, all of them are required. - * All CMS controllers require "CMS_ACCESS_LeftAndMain" as a baseline check, - * and fall back to "CMS_ACCESS_" if no permissions are defined here. - * See {@link canView()} for more details on permission checks. - * - * @config - * @var array - */ - private static $required_permission_codes; - /** * Namespace for session info, e.g. current record. * Defaults to the current class name, but can be amended to share a namespace in case @@ -281,16 +244,35 @@ class LeftAndMain extends Controller implements PermissionProvider private static $frame_options = 'SAMEORIGIN'; /** - * The configuration passed to the supporting JS for each CMS section includes a 'name' key - * that by default matches the FQCN of the current class. This setting allows you to change - * the key if necessary (for example, if you are overloading CMSMain or another core class - * and want to keep the core JS - which depends on the core class names - functioning, you - * would need to set this to the FQCN of the class you are overloading). + * The urls used for the links in the Help dropdown in the backend + * + * Set this to `false` via yml config if you do not want to show any help links * * @config - * @var string|null + * @var array */ - private static $section_name = null; + private static $help_links = [ + 'CMS User help' => 'https://userhelp.silverstripe.org/en/5', + 'Developer docs' => 'https://docs.silverstripe.org/en/5/', + 'Community' => 'https://www.silverstripe.org/', + 'Feedback' => 'https://www.silverstripe.org/give-feedback/', + ]; + + /** + * The href for the anchor on the Silverstripe logo + * + * @config + * @var string + */ + private static $application_link = '//www.silverstripe.org/'; + + /** + * The application name + * + * @config + * @var string + */ + private static $application_name = 'Silverstripe'; /** * @var PjaxResponseNegotiator @@ -302,6 +284,13 @@ class LeftAndMain extends Controller implements PermissionProvider */ protected $versionProvider; + /** + * Cached search filter instance for current search + * + * @var LeftAndMain_SearchFilter + */ + protected $searchFilterCache = null; + /** * Gets the combined configuration of all LeftAndMain subclasses required by the client app. * @@ -312,7 +301,7 @@ class LeftAndMain extends Controller implements PermissionProvider public function getCombinedClientConfig() { $combinedClientConfig = ['sections' => []]; - $cmsClassNames = CMSMenu::get_cms_classes(LeftAndMain::class, true, CMSMenu::URL_PRIORITY); + $cmsClassNames = CMSMenu::get_cms_classes(AdminController::class, true, CMSMenu::URL_PRIORITY); // append LeftAndMain to the list as well $cmsClassNames[] = LeftAndMain::class; @@ -336,40 +325,20 @@ public function getCombinedClientConfig() return json_encode($combinedClientConfig); } - /** - * Returns configuration required by the client app - * - * @return array - */ - public function getClientConfig() + public function getClientConfig(): array { - // Allows the section name to be overridden in config - $name = $this->config()->get('section_name'); - $url = trim($this->Link() ?? '', '/'); - - if (!$name) { - $name = static::class; - } - - $clientConfig = [ - // Trim leading/trailing slash to make it easier to concatenate URL - // and use in routing definitions. - 'name' => $name, - 'url' => $url, - 'reactRoutePath' => preg_replace('/^' . preg_quote(AdminRootController::admin_url(), '/') . '/', '', $url), - 'form' => [ + // Add WYSIWYG link form schema before extensions are applied + $this->beforeExtending('updateClientConfig', function (array &$clientConfig): void { + $clientConfig['form'] = [ 'EditorExternalLink' => [ 'schemaUrl' => $this->Link('methodSchema/Modals/EditorExternalLink'), ], 'EditorEmailLink' => [ 'schemaUrl' => $this->Link('methodSchema/Modals/EditorEmailLink'), ], - ], - ]; - - $this->extend('updateClientConfig', $clientConfig); - - return $clientConfig; + ]; + }); + return parent::getClientConfig(); } /** @@ -425,87 +394,9 @@ public function schema(HTTPRequest $request): HTTPResponse } /** - * Get a data value from JSON in body of the POST request, ensuring it exists - * Will only read from the root node of the JSON body - */ - protected function getPostedJsonValue(HTTPRequest $request, string $key): mixed - { - $data = json_decode($request->getBody(), true); - if (!array_key_exists($key, $data)) { - $this->jsonError(400); - } - return $data[$key]; - } - - /** - * Creates a successful json response - */ - protected function jsonSuccess(int $statusCode, ?array $data = null): HTTPResponse - { - if ($statusCode < 200 || $statusCode >= 300) { - throw new InvalidArgumentException("Status code $statusCode must be between 200 and 299"); - } - if (is_null($data)) { - $body = ''; - } else { - $body = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); - } - return $this->getResponse() - ->addHeader('Content-Type', 'application/json') - ->setStatusCode($statusCode) - ->setBody($body); - } - - /** - * Return an error HTTPResponse encoded as json - * - * @param int $errorCode - * @param string $errorMessage - * @return HTTPResponse - * @throws HTTPResponse_Exception + * Get the form schema from a given method. + * The method must return a Form. */ - public function jsonError($errorCode, $errorMessage = null) - { - // Build error from message - $error = [ - 'type' => 'error', - 'code' => $errorCode, - ]; - if ($errorMessage) { - $error['value'] = $errorMessage; - } else { - $messageDefault = match ($errorCode) { - 400 => 'Sorry, it seems there was something wrong with the request.', - 401 => 'Sorry, it seems you are not authorised to access this section or object.', - 403 => 'Sorry, it seems the action you were trying to perform is forbidden.', - 404 => 'Sorry, it seems you were trying to access a section or object that doesn\'t exist.', - 500 => 'Sorry, it seems there was an internal server error.', - 503 => 'Sorry, it seems the service is temporarily unavailable.', - default => 'Error', - }; - /** @phpstan-ignore translation.key (we need the key to be dynamic here) */ - $error['value'] = _t(__CLASS__ . ".ErrorMessage{$errorCode}", $messageDefault); - } - - // Support explicit error handling with status = error, or generic message handling - // with a message of type = error - $result = [ - 'status' => 'error', - 'errors' => [$error] - ]; - $response = HTTPResponse::create(json_encode($result), $errorCode) - ->addHeader('Content-Type', 'application/json'); - - // Call a handler method such as onBeforeHTTPError404 - $this->extend("onBeforeJSONError{$errorCode}", $request, $response); - - // Call a handler method such as onBeforeHTTPError, passing 404 as the first arg - $this->extend('onBeforeJSONError', $errorCode, $request, $response); - - // Throw a new exception - throw new HTTPResponse_Exception($response); - } - public function methodSchema(HTTPRequest $request): HTTPResponse { $method = $request->param('Method'); @@ -574,258 +465,135 @@ protected function getSchemaResponse($schemaID, $form = null, ValidationResult $ } /** - * @param Member $member - * @return bool + * Try to redirect to an appropriate admin section if we can't access this one */ - public function canView($member = null) + public function onInitPermissionFailure(): void { - if (!$member && $member !== false) { - $member = Security::getCurrentUser(); - } - - // cms menus only for logged-in members - if (!$member) { - return false; - } - - // alternative extended checks - if ($this->hasMethod('alternateAccessCheck')) { - $alternateAllowed = $this->alternateAccessCheck($member); - if ($alternateAllowed === false) { - return false; - } - } - - // Check for "CMS admin" permission - if (Permission::checkMember($member, "CMS_ACCESS_LeftAndMain")) { - return true; - } - - // Check for LeftAndMain sub-class permissions - $codes = $this->getRequiredPermissions(); - if ($codes === false) { // allow explicit FALSE to disable subclass check - return true; - } - foreach ((array)$codes as $code) { - if (!Permission::checkMember($member, $code)) { - return false; + $menu = $this->MainMenu(); + foreach ($menu as $candidate) { + if ($candidate->Link && + $candidate->Link != $this->Link() + && $candidate->MenuItem->controller + && singleton($candidate->MenuItem->controller)->canView() + ) { + $this->redirect($candidate->Link); + return; } } - - return true; - } - - /** - * Get list of required permissions - * - * @return array|string|bool Code, array of codes, or false if no permission required - */ - public static function getRequiredPermissions() - { - $class = get_called_class(); - // If the user is accessing LeftAndMain directly, only generic permissions are required. - if ($class === LeftAndMain::class) { - return 'CMS_ACCESS'; - } - $code = Config::inst()->get($class, 'required_permission_codes'); - if ($code === false) { - return false; - } - if ($code) { - return $code; - } - return 'CMS_ACCESS_' . $class; } - /** - * @uses CMSMenu - */ protected function init() { - parent::init(); - - HTTPCacheControlMiddleware::singleton()->disableCache(); - - SSViewer::setRewriteHashLinksDefault(false); - ContentNegotiator::setEnabled(false); - - // set language - $member = Security::getCurrentUser(); - if (!empty($member->Locale)) { - i18n::set_locale($member->Locale); - } - - // Allow customisation of the access check by a extension - // Also all the canView() check to execute Controller::redirect() - if (!$this->canView() && !$this->getResponse()->isFinished()) { - // When access /admin/, we should try a redirect to another part of the admin rather than be locked out - $menu = $this->MainMenu(); - foreach ($menu as $candidate) { - if ($candidate->Link && - $candidate->Link != $this->Link() - && $candidate->MenuItem->controller - && singleton($candidate->MenuItem->controller)->canView() - ) { - $this->redirect($candidate->Link); - return; - } + $this->beforeExtending('onInit', function () { + // Audit logging hook + if (empty($_REQUEST['executeForm']) && !$this->getRequest()->isAjax()) { + $this->extend('accessedCMS'); } + // Set the members html editor config if (Security::getCurrentUser()) { - $this->getRequest()->getSession()->clear("BackURL"); + HTMLEditorConfig::set_active_identifier(Security::getCurrentUser()->getHtmlEditorConfigForCMS()); } - // if no alternate menu items have matched, return a permission error - $messageSet = [ - 'default' => _t( - __CLASS__ . '.PERMDEFAULT', - "You must be logged in to access the administration area; please enter your credentials below." - ), - 'alreadyLoggedIn' => _t( - __CLASS__ . '.PERMALREADY', - "I'm sorry, but you can't access that part of the CMS. If you want to log in as someone else, do" - . " so below." - ), - 'logInAgain' => _t( - __CLASS__ . '.PERMAGAIN', - "You have been logged out of the CMS. If you would like to log in again, enter a username and" - . " password below." - ), - ]; - - $this->suppressAdminErrorContext = true; - Security::permissionFailure($this, $messageSet); - return; - } - - // Don't continue if there's already been a redirection request. - if ($this->redirectedTo()) { - return; - } - - // Audit logging hook - if (empty($_REQUEST['executeForm']) && !$this->getRequest()->isAjax()) { - $this->extend('accessedCMS'); - } - - // Set the members html editor config - if (Security::getCurrentUser()) { - HTMLEditorConfig::set_active_identifier(Security::getCurrentUser()->getHtmlEditorConfigForCMS()); - } - - // Set default values in the config if missing. These things can't be defined in the config - // file because insufficient information exists when that is being processed - $htmlEditorConfig = HTMLEditorConfig::get_active(); - $htmlEditorConfig->setOption('language', TinyMCEConfig::get_tinymce_lang()); - $langUrl = TinyMCEConfig::get_tinymce_lang_url(); - if ($langUrl) { - $htmlEditorConfig->setOption('language_url', $langUrl); - } - - Requirements::customScript(" - window.ss = window.ss || {}; - window.ss.config = " . $this->getCombinedClientConfig() . "; - "); + // Set default values in the config if missing. These things can't be defined in the config + // file because insufficient information exists when that is being processed + $htmlEditorConfig = HTMLEditorConfig::get_active(); + $htmlEditorConfig->setOption('language', TinyMCEConfig::get_tinymce_lang()); + $langUrl = TinyMCEConfig::get_tinymce_lang_url(); + if ($langUrl) { + $htmlEditorConfig->setOption('language_url', $langUrl); + } - Requirements::javascript('silverstripe/admin: client/dist/js/vendor.js'); - Requirements::javascript('silverstripe/admin: client/dist/js/bundle.js'); + Requirements::customScript(" + window.ss = window.ss || {}; + window.ss.config = " . $this->getCombinedClientConfig() . "; + "); + + Requirements::javascript('silverstripe/admin: client/dist/js/vendor.js'); + Requirements::javascript('silverstripe/admin: client/dist/js/bundle.js'); + + // Bootstrap components + Requirements::javascript('silverstripe/admin: thirdparty/popper/popper.min.js'); + Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/util.js'); + Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/collapse.js'); + Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/tooltip.js'); + Requirements::customScript( + "window.jQuery('body').tooltip({ selector: '[data-toggle=tooltip]' });", + 'bootstrap.tooltip-boot' + ); - // Bootstrap components - Requirements::javascript('silverstripe/admin: thirdparty/popper/popper.min.js'); - Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/util.js'); - Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/collapse.js'); - Requirements::javascript('silverstripe/admin: thirdparty/bootstrap/js/dist/tooltip.js'); - Requirements::customScript( - "window.jQuery('body').tooltip({ selector: '[data-toggle=tooltip]' });", - 'bootstrap.tooltip-boot' - ); + Requirements::css('silverstripe/admin: client/dist/styles/bundle.css'); + Requirements::add_i18n_javascript('silverstripe/admin:client/lang'); + Requirements::add_i18n_javascript('silverstripe/admin:client/dist/moment-locales', false); - Requirements::css('silverstripe/admin: client/dist/styles/bundle.css'); - Requirements::add_i18n_javascript('silverstripe/admin:client/lang'); - Requirements::add_i18n_javascript('silverstripe/admin:client/dist/moment-locales', false); + if (LeftAndMain::config()->uninherited('session_keepalive_ping')) { + Requirements::javascript('silverstripe/admin: client/dist/js/LeftAndMain.Ping.js'); + } - if (LeftAndMain::config()->uninherited('session_keepalive_ping')) { - Requirements::javascript('silverstripe/admin: client/dist/js/LeftAndMain.Ping.js'); - } + // Custom requirements + $extraJs = $this->config()->get('extra_requirements_javascript'); - // Custom requirements - $extraJs = $this->config()->get('extra_requirements_javascript'); + if ($extraJs) { + foreach ($extraJs as $file => $config) { + if (is_numeric($file)) { + $file = $config; + $config = []; + } - if ($extraJs) { - foreach ($extraJs as $file => $config) { - if (is_numeric($file)) { - $file = $config; - $config = []; + Requirements::javascript($file, $config); } - - Requirements::javascript($file, $config); } - } - $extraI18n = $this->config()->get('extra_requirements_i18n'); - if ($extraI18n) { - foreach ($extraI18n as $dir => $return) { - if (is_numeric($dir)) { - $dir = $return; - $return = false; + $extraI18n = $this->config()->get('extra_requirements_i18n'); + if ($extraI18n) { + foreach ($extraI18n as $dir => $return) { + if (is_numeric($dir)) { + $dir = $return; + $return = false; + } + Requirements::add_i18n_javascript($dir, $return); } - Requirements::add_i18n_javascript($dir, $return); } - } - $extraCss = $this->config()->get('extra_requirements_css'); - - if ($extraCss) { - foreach ($extraCss as $file => $config) { - if (is_numeric($file)) { - $file = $config; - $config = []; - } - $media = null; - if (isset($config['media'])) { - $media = $config['media']; - unset($config['media']); - } - - Requirements::css($file, $media, $config); - } - } + $extraCss = $this->config()->get('extra_requirements_css'); - $extraThemedCss = $this->config()->get('extra_requirements_themedCss'); + if ($extraCss) { + foreach ($extraCss as $file => $config) { + if (is_numeric($file)) { + $file = $config; + $config = []; + } + $media = null; + if (isset($config['media'])) { + $media = $config['media']; + unset($config['media']); + } - if ($extraThemedCss) { - foreach ($extraThemedCss as $file => $config) { - if (is_numeric($file)) { - $file = $config; - $config = []; - } - $media = null; - if (isset($config['media'])) { - $media = $config['media']; - unset($config['media']); + Requirements::css($file, $media, $config); } - - Requirements::themedCSS($file, $media, $config); } - } - - $this->extend('onInit'); - // Load the editor with original user themes before overwriting - // them with admin themes - $themes = HTMLEditorConfig::getThemes(); - if (empty($themes)) { - HTMLEditorConfig::setThemes(SSViewer::get_themes()); - } + $extraThemedCss = $this->config()->get('extra_requirements_themedCss'); - // Assign default cms theme and replace user-specified themes - SSViewer::set_themes(LeftAndMain::config()->uninherited('admin_themes')); + if ($extraThemedCss) { + foreach ($extraThemedCss as $file => $config) { + if (is_numeric($file)) { + $file = $config; + $config = []; + } + $media = null; + if (isset($config['media'])) { + $media = $config['media']; + unset($config['media']); + } - // Set the current reading mode - Versioned::set_stage(Versioned::DRAFT); + Requirements::themedCSS($file, $media, $config); + } + } + }); - // Set default reading mode to suppress ?stage=Stage querystring params in CMS - Versioned::set_default_reading_mode(Versioned::get_reading_mode()); + // Run parent init and process the onInit extension hook + parent::init(); } public function afterHandleRequest() @@ -891,39 +659,6 @@ public function handleRequest(HTTPRequest $request): HTTPResponse return $response; } - /** - * Overloaded redirection logic to trigger a fake redirect on ajax requests. - * While this violates HTTP principles, its the only way to work around the - * fact that browsers handle HTTP redirects opaquely, no intervention via JS is possible. - * In isolation, that's not a problem - but combined with history.pushState() - * it means we would request the same redirection URL twice if we want to update the URL as well. - * See LeftAndMain.js for the required jQuery ajaxComplete handlers. - */ - public function redirect(string $url, int $code = 302): HTTPResponse - { - if ($this->getRequest()->isAjax()) { - $response = $this->getResponse(); - $response->addHeader('X-ControllerURL', $url); - if ($this->getRequest()->getHeader('X-Pjax') && !$response->getHeader('X-Pjax')) { - $response->addHeader('X-Pjax', $this->getRequest()->getHeader('X-Pjax')); - } - $newResponse = new LeftAndMain_HTTPResponse( - $response->getBody(), - $response->getStatusCode(), - $response->getStatusDescription() - ); - foreach ($response->getHeaders() as $k => $v) { - $newResponse->addHeader($k, $v); - } - $newResponse->setIsFinished(true); - $this->setResponse($newResponse); - // Actual response will be re-requested by client - return $newResponse; - } else { - return parent::redirect($url, $code); - } - } - public function index(HTTPRequest $request): HTTPResponse { return $this->getResponseNegotiator()->respond($request); @@ -940,41 +675,6 @@ public function ShowSwitchView() return false; } - - //------------------------------------------------------------------------------------------// - // Main controllers - - /** - * You should implement a Link() function in your subclass of LeftAndMain, - * to point to the URL of that particular controller. - * - * @param string $action - * @return string - */ - public function Link($action = null) - { - // LeftAndMain methods have a top-level uri access - if (static::class === LeftAndMain::class) { - $segment = ''; - } else { - // Get url_segment - $segment = $this->config()->get('url_segment'); - if (!$segment) { - throw new BadMethodCallException( - sprintf('LeftAndMain subclasses (%s) must have url_segment', static::class) - ); - } - } - - $link = Controller::join_links( - AdminRootController::admin_url(), - $segment, - "$action" - ); - $this->extend('updateLink', $link); - return $link; - } - /** * Get menu title for this section (translated) * @@ -1272,13 +972,6 @@ public function Breadcrumbs($unlinked = false) return $items; } - /** - * Cached search filter instance for current search - * - * @var LeftAndMain_SearchFilter - */ - protected $searchFilterCache = null; - /** * Gets the current search filter for this request, if available * @@ -1861,21 +1554,6 @@ public function SiteConfig() return class_exists(SiteConfig::class) ? SiteConfig::current_site_config() : null; } - /** - * The urls used for the links in the Help dropdown in the backend - * - * Set this to `false` via yml config if you do not want to show any help links - * - * @config - * @var array - */ - private static $help_links = [ - 'CMS User help' => 'https://userhelp.silverstripe.org/en/5', - 'Developer docs' => 'https://docs.silverstripe.org/en/5/', - 'Community' => 'https://www.silverstripe.org/', - 'Feedback' => 'https://www.silverstripe.org/give-feedback/', - ]; - /** * Returns help_links in a format readable by a template * @return ArrayList @@ -1901,14 +1579,6 @@ public function getHelpLinks() return ArrayList::create($formattedLinks); } - /** - * The href for the anchor on the Silverstripe logo - * - * @config - * @var string - */ - private static $application_link = '//www.silverstripe.org/'; - /** * @return string */ @@ -1917,14 +1587,6 @@ public function ApplicationLink() return $this->config()->get('application_link'); } - /** - * The application name - * - * @config - * @var string - */ - private static $application_name = 'Silverstripe'; - /** * Get the application name. * diff --git a/code/SudoModeController.php b/code/SudoModeController.php index 0a5376d5e..7140c3144 100644 --- a/code/SudoModeController.php +++ b/code/SudoModeController.php @@ -15,12 +15,10 @@ /** * Responsible for checking and verifying whether sudo mode is enabled */ -class SudoModeController extends LeftAndMain +class SudoModeController extends AdminController { private static string $url_segment = 'sudomode'; - private static bool $ignore_menuitem = true; - private static array $allowed_actions = [ 'check', 'activate', @@ -43,7 +41,7 @@ class SudoModeController extends LeftAndMain */ private static bool $required_permission_codes = false; - public function getClientConfig() + public function getClientConfig(): array { $request = Injector::inst()->get(HTTPRequest::class); @@ -91,7 +89,7 @@ public function activate(HTTPRequest $request): HTTPResponse return $this->jsonResponse([ 'result' => false, 'message' => _t(__CLASS__ . '.INVALID', 'Incorrect password'), - ]); + ], 400); } // Activate sudo mode and return successful result