[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * @package     Joomla.Administrator
   5   * @subpackage  com_users
   6   *
   7   * @copyright   (C) 2009 Open Source Matters, Inc. <https://www.joomla.org>
   8   * @license     GNU General Public License version 2 or later; see LICENSE.txt
   9   */
  10  
  11  namespace Joomla\Component\Users\Administrator\Controller;
  12  
  13  use Joomla\CMS\Access\Access;
  14  use Joomla\CMS\MVC\Controller\FormController;
  15  
  16  // phpcs:disable PSR1.Files.SideEffects
  17  \defined('_JEXEC') or die;
  18  // phpcs:enable PSR1.Files.SideEffects
  19  
  20  /**
  21   * User view level controller class.
  22   *
  23   * @since  1.6
  24   */
  25  class GroupController extends FormController
  26  {
  27      /**
  28       * @var     string  The prefix to use with controller messages.
  29       * @since   1.6
  30       */
  31      protected $text_prefix = 'COM_USERS_GROUP';
  32  
  33      /**
  34       * Method to check if you can save a new or existing record.
  35       *
  36       * Overrides Joomla\CMS\MVC\Controller\FormController::allowSave to check the core.admin permission.
  37       *
  38       * @param   array   $data  An array of input data.
  39       * @param   string  $key   The name of the key for the primary key.
  40       *
  41       * @return  boolean
  42       *
  43       * @since   1.6
  44       */
  45      protected function allowSave($data, $key = 'id')
  46      {
  47          return ($this->app->getIdentity()->authorise('core.admin', $this->option) && parent::allowSave($data, $key));
  48      }
  49  
  50      /**
  51       * Overrides Joomla\CMS\MVC\Controller\FormController::allowEdit
  52       *
  53       * Checks that non-Super Admins are not editing Super Admins.
  54       *
  55       * @param   array   $data  An array of input data.
  56       * @param   string  $key   The name of the key for the primary key.
  57       *
  58       * @return  boolean
  59       *
  60       * @since   1.6
  61       */
  62      protected function allowEdit($data = array(), $key = 'id')
  63      {
  64          // Check if this group is a Super Admin
  65          if (Access::checkGroup($data[$key], 'core.admin')) {
  66              // If I'm not a Super Admin, then disallow the edit.
  67              if (!$this->app->getIdentity()->authorise('core.admin')) {
  68                  return false;
  69              }
  70          }
  71  
  72          return parent::allowEdit($data, $key);
  73      }
  74  }