ardent/Snips
1
0
Fork 0
Code Issues 5 Pull Requests Packages Projects Releases Wiki Activity

Add Security for history

Browse Source
This commit is contained in:
Tim 2023-04-05 23:05:33 +02:00
parent 1f464220ee
commit ce456adf10
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Controller/HistoryController.php
View File

@ -3,6 +3,7 @@
namespace App\Controller; namespace App\Controller;
use App\Entity\Snip; use App\Entity\Snip;
use App\Security\Voter\SnipVoter;
use App\Service\SnipServiceFactory; use App\Service\SnipServiceFactory;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
@ -20,6 +21,8 @@ class HistoryController extends AbstractController
#[Route('/', name: '_index')] #[Route('/', name: '_index')]
public function index(Snip $snip): Response public function index(Snip $snip): Response
{ {
$this->denyAccessUnlessGranted(SnipVoter::EDIT, $snip);
return $this->render('history/index.html.twig', [ return $this->render('history/index.html.twig', [
'snip' => $snip, 'snip' => $snip,
'commits' => $this->snipServiceFactory->create($snip)->getRepo()->getAllCommits(), 'commits' => $this->snipServiceFactory->create($snip)->getRepo()->getAllCommits(),
@ -29,6 +32,8 @@ class HistoryController extends AbstractController
#[Route('/set/{commit}', name: '_set')] #[Route('/set/{commit}', name: '_set')]
public function set(Snip $snip, string $commit): Response public function set(Snip $snip, string $commit): Response
{ {
$this->denyAccessUnlessGranted(SnipVoter::EDIT, $snip);
$this->snipServiceFactory->create($snip)->getRepo()->checkout($commit); $this->snipServiceFactory->create($snip)->getRepo()->checkout($commit);
$this->addFlash('success', 'Snip version set to ' . $commit); $this->addFlash('success', 'Snip version set to ' . $commit);
return $this->redirectToRoute('snip_single', ['snip' => $snip->getId()]); return $this->redirectToRoute('snip_single', ['snip' => $snip->getId()]);

5
templates/history/index.html.twig
View File

@ -6,9 +6,10 @@
<a href="{{ path('snip_single', {snip: snip.id}) }}" class="btn btn-primary"> <a href="{{ path('snip_single', {snip: snip.id}) }}" class="btn btn-primary">
<i class="fa fa-arrow-left"></i> Back <i class="fa fa-arrow-left"></i> Back
</a> </a>
<a href="{{ path('history_set', {commit: 'master', snip: snip.id}) }}" class="btn btn-primary"> <a href="{{ path('history_set', {commit: 'master', snip: snip.id}) }}" class="btn btn-warning">
<i class="fa fa-reset"></i> Reset to latest <i class="fa fa-refresh"></i> Master
</a> </a>
<br><br>
<div class="list-group"> <div class="list-group">
{% for commit in commits %} {% for commit in commits %}
<a class="list-group-item" href="{{ path('history_set', {commit: commit.hash, snip: snip.id}) }}"> <a class="list-group-item" href="{{ path('history_set', {commit: commit.hash, snip: snip.id}) }}">