rgutierrez/resq
1
0
Fork 0
Code Issues 126 Pull requests 49 Projects Releases 4 Packages Wiki Activity Actions

Add missing acl checks on list methods #30

Browse source
This commit is contained in:
Ramon Gutierrez 2018-02-27 23:42:44 +08:00
parent 0b193947c5
commit 6262f933bc
1 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/Controller/JobOrderController.php
View file

@ -40,10 +40,7 @@ class JobOrderController extends BaseController
{
public function getJobOrders(Request $req)
{
if (!$this->isGranted('jo_in.list')) {
$exception = $this->createAccessDeniedException('No access.');
throw $exception;
}
$this->denyAccessUnlessGranted('jo_in.list', null, 'No access.');
// get search term
$term = $req->query->get('search');
@ -147,7 +144,6 @@ class JobOrderController extends BaseController
public function incomingSubmit(Request $req, ValidatorInterface $validator, InvoiceCreator $ic)
{
error_log(print_r($req->request->all(), true));
$this->denyAccessUnlessGranted('jo_in.list', null, 'No access.');
// initialize error list
@ -342,6 +338,8 @@ class JobOrderController extends BaseController
public function listAssigning()
{
$this->denyAccessUnlessGranted('jo_assign.list', null, 'No access.');
$params = $this->initParameters('jo_assign');
$params['table_refresh_rate'] = $this->container->getParameter('job_order_refresh_interval');
@ -351,6 +349,8 @@ class JobOrderController extends BaseController
public function listFulfillment()
{
$this->denyAccessUnlessGranted('jo_fulfill.list', null, 'No access.');
$params = $this->initParameters('jo_fulfill');
$params['table_refresh_rate'] = $this->container->getParameter('job_order_refresh_interval');
@ -360,6 +360,8 @@ class JobOrderController extends BaseController
public function listOpen()
{
$this->denyAccessUnlessGranted('jo_open.list', null, 'No access.');
$params = $this->initParameters('jo_open');
$params['table_refresh_rate'] = $this->container->getParameter('job_order_refresh_interval');
@ -370,6 +372,8 @@ class JobOrderController extends BaseController
public function listAll()
{
$this->denyAccessUnlessGranted('jo_all.list', null, 'No access.');
$params = $this->initParameters('jo_all');
$params['table_refresh_rate'] = $this->container->getParameter('job_order_refresh_interval');
@ -852,11 +856,11 @@ class JobOrderController extends BaseController
public function fulfillmentForm(MapTools $map_tools, $id)
{
$this->denyAccessUnlessGranted('jo_assign.list', null, 'No access.');
$this->denyAccessUnlessGranted('jo_fulfill.list', null, 'No access.');
$em = $this->getDoctrine()->getManager();
$params = $this->initParameters('jo_assign');
$params = $this->initParameters('jo_fulfill');
$params['mode'] = 'update-fulfillment';
// get row data
@ -901,7 +905,7 @@ class JobOrderController extends BaseController
public function fulfillmentSubmit(Request $req, ValidatorInterface $validator, $id)
{
$this->denyAccessUnlessGranted('jo_assign.list', null, 'No access.');
$this->denyAccessUnlessGranted('jo_fulfill.list', null, 'No access.');
// initialize error list
$error_array = [];