diff --git a/Config/config.php b/Config/config.php index 1476deaf4..826948053 100644 --- a/Config/config.php +++ b/Config/config.php @@ -747,6 +747,7 @@ 'custom_item.permission.provider', 'custom_field.repository', 'translator', + 'mautic.user.model.user', ], ], 'custom_item.contact.subscriber' => [ diff --git a/EventListener/ImportSubscriber.php b/EventListener/ImportSubscriber.php index 98fba5826..852856c46 100644 --- a/EventListener/ImportSubscriber.php +++ b/EventListener/ImportSubscriber.php @@ -10,6 +10,7 @@ use Mautic\LeadBundle\Event\ImportProcessEvent; use Mautic\LeadBundle\Event\ImportValidateEvent; use Mautic\LeadBundle\LeadEvents; +use Mautic\UserBundle\Model\UserModel; use MauticPlugin\CustomObjectsBundle\Entity\CustomField; use MauticPlugin\CustomObjectsBundle\Exception\ForbiddenException; use MauticPlugin\CustomObjectsBundle\Exception\NotFoundException; @@ -56,13 +57,16 @@ class ImportSubscriber implements EventSubscriberInterface */ private $customFieldRepository; + private UserModel $userModel; + public function __construct( CustomObjectModel $customObjectModel, CustomItemImportModel $customItemImportModel, ConfigProvider $configProvider, CustomItemPermissionProvider $permissionProvider, CustomFieldRepository $customFieldRepository, - TranslatorInterface $translator + TranslatorInterface $translator, + UserModel $userModel ) { $this->customObjectModel = $customObjectModel; $this->customItemImportModel = $customItemImportModel; @@ -70,6 +74,7 @@ public function __construct( $this->permissionProvider = $permissionProvider; $this->customFieldRepository = $customFieldRepository; $this->translator = $translator; + $this->userModel = $userModel; } /** @@ -185,8 +190,9 @@ public function onImportProcess(ImportProcessEvent $event): void try { $customObjectId = $this->getCustomObjectId($event->import->getObject()); - $this->permissionProvider->canCreate($customObjectId); - $customObject = $this->customObjectModel->fetchEntity($customObjectId); + $user = $event->import->isBackgroundProcess() ? $this->userModel->getEntity($event->import->getCreatedBy()) : null; + $this->permissionProvider->canCreate($customObjectId, $user); + $customObject = $this->customObjectModel->fetchEntity($customObjectId); $merged = $this->customItemImportModel->import($event->import, $event->rowData, $customObject); $event->setWasMerged($merged); } catch (NotFoundException $e) { diff --git a/Provider/CustomItemPermissionProvider.php b/Provider/CustomItemPermissionProvider.php index c756e1da8..a9d5bc8f0 100644 --- a/Provider/CustomItemPermissionProvider.php +++ b/Provider/CustomItemPermissionProvider.php @@ -5,6 +5,7 @@ namespace MauticPlugin\CustomObjectsBundle\Provider; use Mautic\CoreBundle\Security\Permissions\CorePermissions; +use Mautic\UserBundle\Entity\User; use MauticPlugin\CustomObjectsBundle\Entity\CustomItem; use MauticPlugin\CustomObjectsBundle\Exception\ForbiddenException; use MauticPlugin\CustomObjectsBundle\Security\Permissions\CustomObjectPermissions; @@ -24,9 +25,9 @@ public function __construct(CorePermissions $corePermissions) /** * @throws ForbiddenException */ - public function isGranted(string $permission, int $customObjectId): void + public function isGranted(string $permission, int $customObjectId, ?User $user = null): void { - if (!$this->corePermissions->isGranted($this->getPermissionName($customObjectId, $permission))) { + if (!$this->corePermissions->isGranted($this->getPermissionName($customObjectId, $permission), 'MATCH_ALL', $user)) { throw new ForbiddenException($permission, 'Items for Custom Object', $customObjectId); } } @@ -45,9 +46,9 @@ public function hasEntityAccess(string $permission, CustomItem $entity): void /** * @throws ForbiddenException */ - public function canCreate(int $customObjectId): void + public function canCreate(int $customObjectId, ?User $user = null): void { - $this->isGranted('create', $customObjectId); + $this->isGranted('create', $customObjectId, $user); } /** @@ -94,7 +95,7 @@ public function canDelete(CustomItem $entity): void $this->hasEntityAccess('delete', $entity); } - private function getPermissionName(int $customObjectId, string $permission): string + public function getPermissionName(int $customObjectId, string $permission): string { return sprintf('%s:%d:%s', CustomObjectPermissions::NAME, $customObjectId, $permission); }