[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * @package     Joomla.Administrator
   5   * @subpackage  com_users
   6   *
   7   * @copyright   (C) 2009 Open Source Matters, Inc. <https://www.joomla.org>
   8   * @license     GNU General Public License version 2 or later; see LICENSE.txt
   9   */
  10  
  11  namespace Joomla\Component\Users\Administrator\Controller;
  12  
  13  use Joomla\CMS\Access\Access;
  14  use Joomla\CMS\Access\Exception\NotAllowed;
  15  use Joomla\CMS\Language\Text;
  16  use Joomla\CMS\MVC\Controller\FormController;
  17  use Joomla\CMS\Router\Route;
  18  
  19  // phpcs:disable PSR1.Files.SideEffects
  20  \defined('_JEXEC') or die;
  21  // phpcs:enable PSR1.Files.SideEffects
  22  
  23  /**
  24   * User view level controller class.
  25   *
  26   * @since  1.6
  27   */
  28  class LevelController extends FormController
  29  {
  30      /**
  31       * @var     string  The prefix to use with controller messages.
  32       * @since   1.6
  33       */
  34      protected $text_prefix = 'COM_USERS_LEVEL';
  35  
  36      /**
  37       * Method to check if you can save a new or existing record.
  38       *
  39       * Overrides Joomla\CMS\MVC\Controller\FormController::allowSave to check the core.admin permission.
  40       *
  41       * @param   array   $data  An array of input data.
  42       * @param   string  $key   The name of the key for the primary key.
  43       *
  44       * @return  boolean
  45       *
  46       * @since   1.6
  47       */
  48      protected function allowSave($data, $key = 'id')
  49      {
  50          return ($this->app->getIdentity()->authorise('core.admin', $this->option) && parent::allowSave($data, $key));
  51      }
  52  
  53      /**
  54       * Overrides JControllerForm::allowEdit
  55       *
  56       * Checks that non-Super Admins are not editing Super Admins.
  57       *
  58       * @param   array   $data  An array of input data.
  59       * @param   string  $key   The name of the key for the primary key.
  60       *
  61       * @return  boolean
  62       *
  63       * @since   3.8.8
  64       */
  65      protected function allowEdit($data = array(), $key = 'id')
  66      {
  67          // Check for if Super Admin can edit
  68          $viewLevel = $this->getModel('Level', 'Administrator')->getItem((int) $data['id']);
  69  
  70          // If this group is super admin and this user is not super admin, canEdit is false
  71          if (!$this->app->getIdentity()->authorise('core.admin') && $viewLevel->rules && Access::checkGroup($viewLevel->rules[0], 'core.admin')) {
  72              $this->setMessage(Text::_('JLIB_APPLICATION_ERROR_EDIT_NOT_PERMITTED'), 'error');
  73  
  74              $this->setRedirect(
  75                  Route::_(
  76                      'index.php?option=' . $this->option . '&view=' . $this->view_list
  77                      . $this->getRedirectToListAppend(),
  78                      false
  79                  )
  80              );
  81  
  82              return false;
  83          }
  84  
  85          return parent::allowEdit($data, $key);
  86      }
  87  
  88      /**
  89       * Removes an item.
  90       *
  91       * Overrides Joomla\CMS\MVC\Controller\FormController::delete to check the core.admin permission.
  92       *
  93       * @return  void
  94       *
  95       * @since   1.6
  96       */
  97      public function delete()
  98      {
  99          // Check for request forgeries.
 100          $this->checkToken();
 101  
 102          $ids = (array) $this->input->get('cid', array(), 'int');
 103  
 104          // Remove zero values resulting from input filter
 105          $ids = array_filter($ids);
 106  
 107          if (!$this->app->getIdentity()->authorise('core.admin', $this->option)) {
 108              throw new NotAllowed(Text::_('JERROR_ALERTNOAUTHOR'), 403);
 109          } elseif (empty($ids)) {
 110              $this->setMessage(Text::_('COM_USERS_NO_LEVELS_SELECTED'), 'warning');
 111          } else {
 112              // Get the model.
 113              $model = $this->getModel();
 114  
 115              // Remove the items.
 116              if ($model->delete($ids)) {
 117                  $this->setMessage(Text::plural('COM_USERS_N_LEVELS_DELETED', count($ids)));
 118              }
 119          }
 120  
 121          $this->setRedirect('index.php?option=com_users&view=levels');
 122      }
 123  }