Skip to content

Commit 68bc010

Browse files
sivaschenkosivaschenko
committed
#29715: Enforced ACL for context menu and view details
1 parent 739e6dc commit 68bc010

File tree

8 files changed

+116
-58
lines changed

8 files changed

+116
-58
lines changed

‎app/code/Magento/MediaGalleryUi/Block/Adminhtml/ImageDetails.php

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\MediaGalleryUi\Block\Adminhtml;
9+
10+
use Magento\Backend\Block\Template;
11+
use Magento\Directory\Helper\Data as DirectoryHelper;
12+
use Magento\Framework\AuthorizationInterface;
13+
use Magento\Framework\Json\Helper\Data as JsonHelper;
14+
use Magento\Framework\Serialize\Serializer\Json;
15+
16+
/**
17+
* Image details block
18+
*
19+
* @api
20+
*/
21+
class ImageDetails extends Template
22+
{
23+
/**
24+
* @var AuthorizationInterface
25+
*/
26+
private $authorization;
27+
28+
/**
29+
* @var Json
30+
*/
31+
private $json;
32+
33+
/**
34+
* @param AuthorizationInterface $authorization
35+
* @param Template\Context $context
36+
* @param array $data
37+
* @param JsonHelper|null $jsonHelper
38+
* @param DirectoryHelper|null $directoryHelper
39+
*/
40+
public function __construct(
41+
AuthorizationInterface $authorization,
42+
Json $json,
43+
Template\Context $context,
44+
array $data = [],
45+
?JsonHelper $jsonHelper = null,
46+
?DirectoryHelper $directoryHelper = null
47+
) {
48+
$this->authorization = $authorization;
49+
$this->json = $json;
50+
parent::__construct($context, $data, $jsonHelper, $directoryHelper);
51+
}
52+
53+
/**
54+
* Retrieve actions json
55+
*
56+
* @return string
57+
*/
58+
public function getActionsJson(): string
59+
{
60+
$actions = [
61+
[
62+
'title' => __('Cancel'),
63+
'handler' => 'closeModal',
64+
'name' => 'cancel',
65+
'classes' => 'action-default scalable cancel action-quaternary'
66+
]
67+
];
68+
69+
if ($this->authorization->isAllowed('MediaGalleryUiApi::edit_assets')) {
70+
$actions[] = [
71+
'title' => __('Edit Details'),
72+
'handler' => 'editImageAction',
73+
'name' => 'edit',
74+
'classes' => 'action-default scalable edit action-quaternary'
75+
];
76+
}
77+
78+
if ($this->authorization->isAllowed('MediaGalleryUiApi::delete_assets')) {
79+
$actions[] = [
80+
'title' => __('Delete Image'),
81+
'handler' => 'deleteImageAction',
82+
'name' => 'delete',
83+
'classes' => 'action-default scalable delete action-quaternary'
84+
];
85+
}
86+
87+
if ($this->authorization->isAllowed('MediaGalleryUiApi::insert_assets')) {
88+
$actions[] = [
89+
'title' => __('Add Image'),
90+
'handler' => 'addImage',
91+
'name' => 'add-image',
92+
'classes' => 'scalable action-primary add-image-action'
93+
];
94+
}
95+
96+
return $this->json->serialize($actions);
97+
}
98+
}

‎app/code/Magento/MediaGalleryUi/Ui/Component/Listing/Columns/Url.php

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,10 @@
2323
class Url extends Column
2424
{
2525
private const ACL_IMAGE_ACTIONS = [
26-
'insert_assets' => 'Magento_MediaGalleryUiApi::insert_assets',
27-
'delete_assets' => 'Magento_MediaGalleryUiApi::delete_assets'
26+
'image-details' => 'Magento_Cms::media_gallery',
27+
'insert' => 'Magento_MediaGalleryUiApi::insert_assets',
28+
'delete' => 'Magento_MediaGalleryUiApi::delete_assets',
29+
'edit' => 'Magento_MediaGalleryUiApi::edit_assets'
2830
];
2931

3032
/**

‎app/code/Magento/MediaGalleryUi/view/adminhtml/layout/media_gallery_index_index.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
<block name="page.actions.toolbar" template="Magento_Backend::pageactions.phtml"/>
1717
</container>
1818
<uiComponent name="media_gallery_listing"/>
19-
<block name="image.details" class="Magento\Backend\Block\Template" template="Magento_MediaGalleryUi::image_details.phtml">
19+
<block name="image.details" class="Magento\MediaGalleryUi\Block\Adminhtml\ImageDetails" template="Magento_MediaGalleryUi::image_details.phtml">
2020
<arguments>
2121
<argument name="imageDetailsUrl" xsi:type="url" path="media_gallery/image/details"/>
2222
</arguments>

‎app/code/Magento/MediaGalleryUi/view/adminhtml/layout/media_gallery_media_index.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<body>
1111
<referenceContainer htmlTag="div" htmlClass="media-gallery-container" name="content">
1212
<uiComponent name="standalone_media_gallery_listing"/>
13-
<block name="image.details" class="Magento\Backend\Block\Template" template="Magento_MediaGalleryUi::image_details_standalone.phtml">
13+
<block name="image.details" class="Magento\MediaGalleryUi\Block\Adminhtml\ImageDetails" template="Magento_MediaGalleryUi::image_details_standalone.phtml">
1414
<arguments>
1515
<argument name="imageDetailsUrl" xsi:type="url" path="media_gallery/image/details"/>
1616
</arguments>

‎app/code/Magento/MediaGalleryUi/view/adminhtml/templates/image_details.phtml

Lines changed: 3 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
use Magento\Backend\Block\Template;
7+
use Magento\MediaGalleryUi\Block\Adminhtml\ImageDetails;
88
use Magento\Framework\Escaper;
99

1010
// phpcs:disable Magento2.Files.LineLength, Generic.Files.LineLength
11-
/** @var Template $block */
11+
/** @var ImageDetails $block */
1212
/** @var Escaper $escaper */
1313

1414
?>
@@ -73,32 +73,7 @@ use Magento\Framework\Escaper;
7373
"modalWindowSelector": ".media-gallery-image-details",
7474
"imageModelName" : "media_gallery_listing.media_gallery_listing.media_gallery_columns.thumbnail_url",
7575
"mediaGalleryImageDetailsName": "mediaGalleryImageDetails",
76-
"actionsList": [
77-
{
78-
"title": "<?= $escaper->escapeJs(__('Edit Details')); ?>",
79-
"handler": "editImageAction",
80-
"name": "edit",
81-
"classes": "action-default scalable edit action-quaternary"
82-
},
83-
{
84-
"title": "<?= $escaper->escapeJs(__('Cancel')); ?>",
85-
"handler": "closeModal",
86-
"name": "cancel",
87-
"classes": "action-default scalable cancel action-quaternary"
88-
},
89-
{
90-
"title": "<?= $escaper->escapeJs(__('Delete Image')); ?>",
91-
"handler": "deleteImageAction",
92-
"name": "delete",
93-
"classes": "action-default scalable delete action-quaternary"
94-
},
95-
{
96-
"title": "<?= $escaper->escapeJs(__('Add Image')); ?>",
97-
"handler": "addImage",
98-
"name": "add-image",
99-
"classes": "scalable action-primary add-image-action"
100-
}
101-
]
76+
"actionsList": <?= $block->getActionsJson() ?>
10277
}
10378
}
10479
}

‎app/code/Magento/MediaGalleryUi/view/adminhtml/templates/image_details_standalone.phtml

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,8 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
use Magento\Backend\Block\Template;
8-
97
// phpcs:disable Magento2.Files.LineLength, Generic.Files.LineLength
10-
/** @var Template $block */
8+
/** @var \Magento\MediaGalleryUi\Block\Adminhtml\ImageDetails $block */
119
/** @var \Magento\Framework\Escaper $escaper */
1210
?>
1311

@@ -71,26 +69,7 @@ use Magento\Backend\Block\Template;
7169
"modalWindowSelector": ".media-gallery-image-details",
7270
"mediaGalleryImageDetailsName": "mediaGalleryImageDetails",
7371
"imageModelName" : "standalone_media_gallery_listing.standalone_media_gallery_listing.media_gallery_columns.thumbnail_url",
74-
"actionsList": [
75-
{
76-
"title": "<?= $escaper->escapeJs(__('Edit Details')); ?>",
77-
"handler": "editImageAction",
78-
"name": "edit",
79-
"classes": "action-default scalable edit action-quaternary"
80-
},
81-
{
82-
"title": "<?= $escaper->escapeJs(__('Cancel')); ?>",
83-
"handler": "closeModal",
84-
"name": "cancel",
85-
"classes": "action-default scalable cancel action-quaternary"
86-
},
87-
{
88-
"title": "<?= $escaper->escapeJs(__('Delete Image')); ?>",
89-
"handler": "deleteImageAction",
90-
"name": "delete",
91-
"classes": "action-default scalable delete action-quaternary"
92-
}
93-
]
72+
"actionsList": <?= $block->getActionsJson() ?>
9473
}
9574
}
9675
}

‎app/code/Magento/MediaGalleryUi/view/adminhtml/web/js/grid/columns/image.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,11 +228,11 @@ define([
228228
return;
229229
}
230230

231-
if (this.allowedActions.includes('insert_assets')) {
231+
if (this.allowedActions.includes('insert')) {
232232
$(this.addSelectedBtnSelector).removeClass('no-display');
233233
}
234234

235-
if (this.allowedActions.includes('delete_assets')) {
235+
if (this.allowedActions.includes('delete')) {
236236
$(this.deleteSelectedBtnSelector).removeClass('no-display');
237237
}
238238
},

‎app/code/Magento/MediaGalleryUi/view/adminhtml/web/js/grid/columns/image/actions.js

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,11 @@ define([
5555
this._super();
5656
this.initEvents();
5757

58-
if (!this.allowedActions.includes('delete_assets')) {
58+
this.actionsList = this.actionsList.filter(function(item) {
59+
return this.allowedActions.includes(item.name);
60+
}.bind(this));
61+
62+
if (!this.allowedActions.includes('delete')) {
5963
$.async('.media-gallery-delete-assets', function () {
6064
$('.media-gallery-delete-assets').unbind('click').addClass('action-disabled');
6165
});

0 commit comments

Comments
 (0)