custom/plugins/SwagPlatformSecurity/src/Fixes/NEXT14883/SecurityFix.php line 51

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Swag\Security\Fixes\NEXT14883;
  5. use Shopware\Core\Framework\Api\Context\AdminApiSource;
  6. use Shopware\Core\Framework\Api\Controller\Exception\PermissionDeniedException;
  7. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  8. use Shopware\Core\PlatformRequest;
  9. use Swag\Security\Components\AbstractSecurityFix;
  10. use Symfony\Component\DependencyInjection\ContainerBuilder;
  11. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  12. use Symfony\Component\HttpKernel\KernelEvents;
  14. class SecurityFix extends AbstractSecurityFix
  15. {
  16.     private const API_ROUTES = [
  17.         'api.integration.create',
  18.         'api.integration.update',
  19.     ];
  21.     public static function getTicket(): string
  22.     {
  23.         return 'NEXT-14883';
  24.     }
  26.     public static function getMinVersion(): string
  27.     {
  28.         return '6.3.3.0';
  29.     }
  31.     public static function getMaxVersion(): ?string
  32.     {
  33.         return '6.4.0.0';
  34.     }
  36.     public static function getSubscribedEvents(): array
  37.     {
  38.         return [
  39.             KernelEvents::CONTROLLER => [
  40.                 'onKernelRequest', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_CONTEXT_RESOLVE
  41.             ]
  42.         ];
  43.     }
  45.     public static function buildContainer(ContainerBuilder $container): void
  46.     {
  47.         $container->addCompilerPass(new ReplaceIntegrationDefinitionCompilerPass());
  48.     }
  51.     public function onKernelRequest(ControllerEvent $event): void
  52.     {
  53.         $request = $event->getRequest();
  55.         $route = $request->attributes->get('_route');
  57.         if (!in_array($route, self::API_ROUTES, true)) {
  58.             return;
  59.         }
  61.         $context = $request->attributes->get(PlatformRequest::ATTRIBUTE_CONTEXT_OBJECT);
  63.         /** @var AdminApiSource $source */
  64.         $source = $context->getSource();
  66.         $data = $request->request->all();
  68.         // only an admin is allowed to set the admin field
  69.         if (
  70.             !$source->isAdmin()
  71.             && isset($data['admin'])
  72.         ) {
  73.             if (class_exists(PermissionDeniedException::class)) {
  74.                 throw new PermissionDeniedException();
  75.             }
  77.             // In early versions that exception class does not exists yet
  78.             throw new \Swag\Security\Fixes\NEXT14883\PermissionDeniedException();
  79.         }
  80.     }
  81. }