custom/plugins/swagplatformsecurity6.4/src/Fixes/GHSAp5892ff83wfw/CloneProtectionSubscriber.php line 34

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Swag\Security\Fixes\GHSAp5892ff83wfw;
  5. use Shopware\Core\Framework\Context;
  6. use Shopware\Core\Framework\DataAbstractionLayer\DefinitionInstanceRegistry;
  7. use Shopware\Core\Framework\DataAbstractionLayer\Field\Flag\WriteProtected;
  8. use Shopware\Core\Framework\Validation\WriteConstraintViolationException;
  9. use Shopware\Core\PlatformRequest;
  10. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  11. use Symfony\Component\HttpKernel\Event\ControllerArgumentsEvent;
  12. use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
  13. use Symfony\Component\HttpKernel\KernelEvents;
  14. use Symfony\Component\Validator\ConstraintViolation;
  15. use Symfony\Component\Validator\ConstraintViolationList;
  17. class CloneProtectionSubscriber implements EventSubscriberInterface
  18. {
  19.     /**
  20.      * @var DefinitionInstanceRegistry
  21.      */
  22.     private $registry;
  24.     public function __construct(DefinitionInstanceRegistry $registry)
  25.     {
  26.         $this->registry = $registry;
  27.     }
  29.     public static function getSubscribedEvents(): array
  30.     {
  31.         return [KernelEvents::CONTROLLER_ARGUMENTS => 'onControllerArguments'];
  32.     }
  34.     public function onControllerArguments(ControllerArgumentsEvent $event): void
  35.     {
  36.         // isMainRequest() existiert erst ab Symfony 5.3, isMasterRequest() ist dort deprecated
  37.         $isMainRequest = method_exists($event, 'isMainRequest') ? $event->isMainRequest() : $event->isMasterRequest();
  38.         if (!$isMainRequest) {
  39.             return;
  40.         }
  42.         $request = $event->getRequest();
  43.         if ($request->attributes->get('_route') !== 'api.clone') {
  44.             return;
  45.         }
  47.         $entity = $request->attributes->get('entity');
  48.         if (\in_array($entity, ['user', 'integration'], true)) {
  49.             throw new AccessDeniedHttpException(sprintf('Clone access for entity "%s" is not allowed.', $entity));
  50.         }
  52.         if (!\is_string($entity)) {
  53.             return;
  54.         }
  56.         $context = $request->attributes->get(PlatformRequest::ATTRIBUTE_CONTEXT_OBJECT);
  57.         if (!$context instanceof Context) {
  58.             return;
  59.         }
  61.         $definition = $this->registry->getByEntityName(str_replace('-', '_', $entity));
  62.         foreach ($request->request->all('overwrites') as $propertyName => $value) {
  63.             $field = $definition->getFields()->get($propertyName);
  64.             if ($field === null) {
  65.                 continue;
  66.             }
  67.             $writeProtection = $field->getFlag(WriteProtected::class);
  68.             if ($writeProtection === null || $writeProtection->isAllowed($context->getScope())) {
  69.                 continue;
  70.             }
  72.             throw new WriteConstraintViolationException(new ConstraintViolationList([
  73.                 new ConstraintViolation('This field is write-protected.', 'This field is write-protected.', [], $value, $propertyName, $value),
  74.             ]), '/' . $propertyName);
  75.         }
  76.     }
  77. }