diff --git a/app/modules/web/Controllers/AccountController.php b/app/modules/web/Controllers/AccountController.php index 79352c19..fa9f6917 100644 --- a/app/modules/web/Controllers/AccountController.php +++ b/app/modules/web/Controllers/AccountController.php @@ -102,19 +102,16 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function searchAction() { try { - $this->checkSecurityToken($this->session, $this->request); + $this->checkSecurityToken($this->previousSk, $this->request); $accountSearchHelper = $this->dic->get(AccountSearchHelper::class); $accountSearchHelper->getAccountSearch(); $this->eventDispatcher->notifyEvent('show.account.search', new Event($this)); - $data = [ - 'sk' => $this->session->generateSecurityKey(), + return $this->returnJsonResponseData([ 'html' => $this->render() - ]; - - return $this->returnJsonResponseData($data); + ]); } catch (\Exception $e) { processException($e); @@ -133,6 +130,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function viewAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetailsResponse = $this->accountService->getById($id); $this->accountService ->withUsersById($accountDetailsResponse) @@ -178,10 +177,10 @@ final class AccountController extends ControllerBase implements CrudControllerIn */ public function viewLinkAction($hash) { - $layoutHelper = $this->dic->get(LayoutHelper::class); - $layoutHelper->getPublicLayout('account-link', 'account'); - try { + $layoutHelper = $this->dic->get(LayoutHelper::class); + $layoutHelper->getPublicLayout('account-link', 'account'); + $publicLinkService = $this->dic->get(PublicLinkService::class); $publicLinkData = $publicLinkService->getByHash($hash); @@ -247,6 +246,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function createAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountHelper = $this->dic->get(AccountHelper::class); $accountHelper->setViewForBlank(Acl::ACCOUNT_CREATE); @@ -285,6 +286,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function copyAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetailsResponse = $this->accountService->getById($id); $this->accountService ->withUsersById($accountDetailsResponse) @@ -329,6 +332,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function editAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetailsResponse = $this->accountService->getById($id); $this->accountService ->withUsersById($accountDetailsResponse) @@ -375,6 +380,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function deleteAction($id = null) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetailsResponse = $this->accountService->getById($id); $this->accountService ->withUsersById($accountDetailsResponse) @@ -418,6 +425,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function editPassAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetailsResponse = $this->accountService->getById($id); $this->accountService ->withUsersById($accountDetailsResponse) @@ -461,6 +470,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function viewHistoryAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountHistoryService = $this->dic->get(AccountHistoryService::class); $accountHistoryData = $accountHistoryService->getById($id); @@ -504,6 +515,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function requestAccessAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountHelper = $this->dic->get(AccountHelper::class); $accountHelper->setIsView(true); $accountHelper->setViewForRequest($this->accountService->getById($id), Acl::ACCOUNT_REQUEST); @@ -536,6 +549,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function viewPassAction($id, $parentId = 0) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountPassHelper = $this->dic->get(AccountPasswordHelper::class); $account = $this->accountService->getPasswordForId($id); @@ -594,6 +609,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function viewPassHistoryAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountPassHelper = $this->dic->get(AccountPasswordHelper::class); $account = $this->accountService->getPasswordHistoryForId($id); @@ -634,9 +651,12 @@ final class AccountController extends ControllerBase implements CrudControllerIn * @throws \SP\Core\Exceptions\QueryException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException + * @throws \SP\Core\Exceptions\SPException */ public function copyPassAction($id) { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountPassHelper = $this->dic->get(AccountPasswordHelper::class); $account = $this->accountService->getPasswordForId($id); @@ -668,9 +688,12 @@ final class AccountController extends ControllerBase implements CrudControllerIn * @throws \SP\Core\Exceptions\QueryException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException + * @throws \SP\Core\Exceptions\SPException */ public function copyPassHistoryAction($id) { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountPassHelper = $this->dic->get(AccountPasswordHelper::class); $account = $this->accountService->getPasswordHistoryForId($id); @@ -702,6 +725,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveCreateAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $form = new AccountForm($this->dic); $form->validate(Acl::ACCOUNT_CREATE); @@ -748,6 +773,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveEditAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $form = new AccountForm($this->dic, $id); $form->validate(Acl::ACCOUNT_EDIT); @@ -793,6 +820,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveEditPassAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $form = new AccountForm($this->dic, $id); $form->validate(Acl::ACCOUNT_EDIT_PASS); @@ -835,6 +864,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveEditRestoreAction($historyId, $id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->accountService->editRestore($historyId, $id); $accountDetails = $this->accountService->getById($id)->getAccountVData(); @@ -871,6 +902,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveDeleteAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($id === null) { $this->accountService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -914,6 +947,8 @@ final class AccountController extends ControllerBase implements CrudControllerIn public function saveRequestAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $description = $this->request->analyzeString('description'); if (empty($description)) { diff --git a/app/modules/web/Controllers/AccountFileController.php b/app/modules/web/Controllers/AccountFileController.php index e49c8a25..56b9b96b 100644 --- a/app/modules/web/Controllers/AccountFileController.php +++ b/app/modules/web/Controllers/AccountFileController.php @@ -66,6 +66,8 @@ final class AccountFileController extends ControllerBase implements CrudControll public function viewAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if (null === ($fileData = $this->accountFileService->getById($id))) { throw new SPException(__u('El archivo no existe'), SPException::INFO); } @@ -118,6 +120,8 @@ final class AccountFileController extends ControllerBase implements CrudControll public function downloadAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if (null === ($fileData = $this->accountFileService->getById($id))) { throw new SPException(__u('El archivo no existe'), SPException::INFO); } @@ -155,6 +159,8 @@ final class AccountFileController extends ControllerBase implements CrudControll public function uploadAction($accountId) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $file = $this->router->request()->files()->get('inFile'); if ($accountId === 0 || null === $file) { @@ -252,11 +258,17 @@ final class AccountFileController extends ControllerBase implements CrudControll /** * Search action * + * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::ACCOUNT_FILE_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -272,6 +284,8 @@ final class AccountFileController extends ControllerBase implements CrudControll * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -312,6 +326,8 @@ final class AccountFileController extends ControllerBase implements CrudControll public function deleteAction($id = null) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($id === null) { $this->accountFileService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -372,6 +388,8 @@ final class AccountFileController extends ControllerBase implements CrudControll } try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->view->addTemplate('files-list', 'account'); $this->view->assign('deleteEnabled', $this->request->analyzeInt('del', false)); diff --git a/app/modules/web/Controllers/AccountHistoryManagerController.php b/app/modules/web/Controllers/AccountHistoryManagerController.php index 6492e03f..ca7071d8 100644 --- a/app/modules/web/Controllers/AccountHistoryManagerController.php +++ b/app/modules/web/Controllers/AccountHistoryManagerController.php @@ -50,11 +50,16 @@ final class AccountHistoryManagerController extends ControllerBase /** * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::ACCOUNTMGR_HISTORY_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -70,6 +75,8 @@ final class AccountHistoryManagerController extends ControllerBase * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -92,6 +99,8 @@ final class AccountHistoryManagerController extends ControllerBase public function deleteAction($id = null) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($id === null) { $this->accountHistoryService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -130,6 +139,8 @@ final class AccountHistoryManagerController extends ControllerBase public function restoreAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $accountDetails = $this->accountHistoryService->getById($id); $accountService = $this->dic->get(AccountService::class); @@ -158,6 +169,8 @@ final class AccountHistoryManagerController extends ControllerBase /** * Initialize class * + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Services\Auth\AuthException */ protected function initialize() diff --git a/app/modules/web/Controllers/AccountManagerController.php b/app/modules/web/Controllers/AccountManagerController.php index a2a7d05f..7d4eedca 100644 --- a/app/modules/web/Controllers/AccountManagerController.php +++ b/app/modules/web/Controllers/AccountManagerController.php @@ -73,6 +73,8 @@ final class AccountManagerController extends ControllerBase */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::ACCOUNTMGR_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -122,6 +124,8 @@ final class AccountManagerController extends ControllerBase public function deleteAction($id = null) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($id === null) { $this->accountService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -163,6 +167,8 @@ final class AccountManagerController extends ControllerBase public function saveBulkEditAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $form = new AccountForm($this->dic); $form->validate(Acl::ACCOUNTMGR_BULK_EDIT); @@ -200,16 +206,18 @@ final class AccountManagerController extends ControllerBase */ public function bulkEditAction() { - if (!$this->acl->checkUserAccess(Acl::ACCOUNTMGR)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Actualización Masiva')); - $this->view->assign('isView', false); - $this->view->assign('route', 'accountManager/saveBulkEdit'); - $this->view->assign('itemsId', $this->getItemsIdFromRequest($this->request)); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ACCOUNTMGR)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Actualización Masiva')); + $this->view->assign('isView', false); + $this->view->assign('route', 'accountManager/saveBulkEdit'); + $this->view->assign('itemsId', $this->getItemsIdFromRequest($this->request)); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.account.bulkEdit', new Event($this)); @@ -229,7 +237,6 @@ final class AccountManagerController extends ControllerBase { $this->view->addTemplate('account_bulkedit', 'itemshow'); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); $clients = SelectItemAdapter::factory(ClientService::getItemsBasic())->getItemsFromModel(); @@ -250,8 +257,8 @@ final class AccountManagerController extends ControllerBase $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } diff --git a/app/modules/web/Controllers/AuthTokenController.php b/app/modules/web/Controllers/AuthTokenController.php index 722c3248..d00290f8 100644 --- a/app/modules/web/Controllers/AuthTokenController.php +++ b/app/modules/web/Controllers/AuthTokenController.php @@ -61,9 +61,12 @@ final class AuthTokenController extends ControllerBase implements CrudController * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -101,16 +104,17 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nueva Autorización')); - $this->view->assign('isView', false); - $this->view->assign('route', 'authToken/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nueva Autorización')); + $this->view->assign('isView', false); + $this->view->assign('route', 'authToken/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.authToken.create', new Event($this)); @@ -143,15 +147,14 @@ final class AuthTokenController extends ControllerBase implements CrudController $this->view->assign('users', SelectItemAdapter::factory(UserService::getItemsBasic())->getItemsFromModelSelected([$authToken->getUserId()])); $this->view->assign('actions', SelectItemAdapter::factory(AuthTokenService::getTokenActions())->getItemsFromArraySelected([$authToken->getActionId()])); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('customFields', $this->getCustomFieldsForItem(Acl::AUTHTOKEN, $authTokenId)); @@ -166,15 +169,18 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Autorización')); - $this->view->assign('isView', false); - $this->view->assign('route', 'authToken/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Autorización')); + $this->view->assign('isView', false); + $this->view->assign('route', 'authToken/saveEdit/' . $id); + + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.authToken.edit', new Event($this)); @@ -196,11 +202,13 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->authTokenService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -239,11 +247,14 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $form = new AuthTokenForm($this->dic); $form->validate(Acl::AUTHTOKEN_CREATE); @@ -274,11 +285,14 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $form = new AuthTokenForm($this->dic, $id); $form->validate(Acl::AUTHTOKEN_EDIT); @@ -323,14 +337,17 @@ final class AuthTokenController extends ControllerBase implements CrudController */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Autorización')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::AUTHTOKEN_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Autorización')); + $this->view->assign('isView', true); + + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.authToken', diff --git a/app/modules/web/Controllers/CategoryController.php b/app/modules/web/Controllers/CategoryController.php index 78410fd5..574a3d02 100644 --- a/app/modules/web/Controllers/CategoryController.php +++ b/app/modules/web/Controllers/CategoryController.php @@ -59,9 +59,12 @@ final class CategoryController extends ControllerBase implements CrudControllerI * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::CATEGORY_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -96,16 +99,17 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nueva Categoría')); - $this->view->assign('isView', false); - $this->view->assign('route', 'category/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nueva Categoría')); + $this->view->assign('isView', false); + $this->view->assign('route', 'category/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.category.create', new Event($this)); @@ -136,15 +140,14 @@ final class CategoryController extends ControllerBase implements CrudControllerI $this->view->assign('category', $category); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('showViewCustomPass', $this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW_PASS)); @@ -160,15 +163,18 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Categoría')); - $this->view->assign('isView', false); - $this->view->assign('route', 'category/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Categoría')); + $this->view->assign('isView', false); + $this->view->assign('route', 'category/saveEdit/' . $id); + + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.category.edit', new Event($this)); @@ -190,11 +196,13 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->categoryService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -233,11 +241,13 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new CategoryForm($this->dic); $form->validate(Acl::CATEGORY_CREATE); @@ -273,11 +283,13 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new CategoryForm($this->dic, $id); $form->validate(Acl::CATEGORY_EDIT); @@ -313,14 +325,16 @@ final class CategoryController extends ControllerBase implements CrudControllerI */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::CATEGORY_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Categoría')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CATEGORY_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Categoría')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.category', new Event($this)); diff --git a/app/modules/web/Controllers/ClientController.php b/app/modules/web/Controllers/ClientController.php index 12b96368..9302cb1e 100644 --- a/app/modules/web/Controllers/ClientController.php +++ b/app/modules/web/Controllers/ClientController.php @@ -55,11 +55,17 @@ final class ClientController extends ControllerBase implements CrudControllerInt /** * Search action * + * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::CLIENT_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -75,6 +81,8 @@ final class ClientController extends ControllerBase implements CrudControllerInt * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -92,16 +100,17 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::CLIENT_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Cliente')); - $this->view->assign('isView', false); - $this->view->assign('route', 'client/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Cliente')); + $this->view->assign('isView', false); + $this->view->assign('route', 'client/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.client.create', new Event($this)); @@ -132,15 +141,14 @@ final class ClientController extends ControllerBase implements CrudControllerInt $this->view->assign('client', $client); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('showViewCustomPass', $this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW_PASS)); @@ -156,15 +164,17 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::CLIENT_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Cliente')); - $this->view->assign('isView', false); - $this->view->assign('route', 'client/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Cliente')); + $this->view->assign('isView', false); + $this->view->assign('route', 'client/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.client.edit', new Event($this)); @@ -186,11 +196,13 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::CLIENT_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->clientService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -226,11 +238,13 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::CLIENT_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new ClientForm($this->dic); $form->validate(Acl::CLIENT_CREATE); @@ -264,11 +278,13 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::CLIENT_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new ClientForm($this->dic, $id); $form->validate(Acl::CLIENT_EDIT); @@ -300,14 +316,16 @@ final class ClientController extends ControllerBase implements CrudControllerInt */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::CLIENT_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Cliente')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CLIENT_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Cliente')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.client', new Event($this)); diff --git a/app/modules/web/Controllers/ConfigAccountController.php b/app/modules/web/Controllers/ConfigAccountController.php index a42f3c1b..9cb7ddab 100644 --- a/app/modules/web/Controllers/ConfigAccountController.php +++ b/app/modules/web/Controllers/ConfigAccountController.php @@ -43,9 +43,13 @@ final class ConfigAccountController extends SimpleControllerBase /** * saveAction + * + * @throws \SP\Core\Exceptions\SPException */ public function saveAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $configData = $this->config->getConfigData(); $eventMessage = EventMessage::factory(); diff --git a/app/modules/web/Controllers/ConfigBackupController.php b/app/modules/web/Controllers/ConfigBackupController.php index 522a052c..15d66780 100644 --- a/app/modules/web/Controllers/ConfigBackupController.php +++ b/app/modules/web/Controllers/ConfigBackupController.php @@ -46,9 +46,12 @@ final class ConfigBackupController extends SimpleControllerBase /** * @return bool + * @throws \SP\Core\Exceptions\SPException */ public function fileBackupAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($this->config->getConfigData()->isDemoEnabled()) { return $this->returnJsonResponse(JsonResponse::JSON_WARNING, __u('Ey, esto es una DEMO!!')); } diff --git a/app/modules/web/Controllers/ConfigEncryptionController.php b/app/modules/web/Controllers/ConfigEncryptionController.php index ea8f7d02..0f51bde8 100644 --- a/app/modules/web/Controllers/ConfigEncryptionController.php +++ b/app/modules/web/Controllers/ConfigEncryptionController.php @@ -50,11 +50,16 @@ final class ConfigEncryptionController extends SimpleControllerBase /** * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException + * @throws \SP\Core\Exceptions\SPException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException */ public function saveAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $mastePassService = $this->dic->get(MasterPassService::class); $currentMasterPass = $this->request->analyzeEncrypted('current_masterpass'); @@ -147,11 +152,13 @@ final class ConfigEncryptionController extends SimpleControllerBase */ public function refreshAction() { - if ($this->config->getConfigData()->isDemoEnabled()) { - return $this->returnJsonResponse(JsonResponse::JSON_WARNING, __u('Ey, esto es una DEMO!!')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if ($this->config->getConfigData()->isDemoEnabled()) { + return $this->returnJsonResponse(JsonResponse::JSON_WARNING, __u('Ey, esto es una DEMO!!')); + } + $masterPassService = $this->dic->get(MasterPassService::class); $masterPassService->updateConfig(Hash::hashKey(CryptSession::getSessionKey($this->session))); @@ -175,6 +182,8 @@ final class ConfigEncryptionController extends SimpleControllerBase public function saveTempAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $temporaryMasterPassService = $this->dic->get(TemporaryMasterPassService::class); $key = $temporaryMasterPassService->create($this->request->analyzeInt('temporary_masterpass_maxtime', 3600)); diff --git a/app/modules/web/Controllers/ConfigGeneralController.php b/app/modules/web/Controllers/ConfigGeneralController.php index f642fc16..df293f6d 100644 --- a/app/modules/web/Controllers/ConfigGeneralController.php +++ b/app/modules/web/Controllers/ConfigGeneralController.php @@ -43,9 +43,13 @@ final class ConfigGeneralController extends SimpleControllerBase /** * saveAction + * + * @throws \SP\Core\Exceptions\SPException */ public function saveAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $configData = $this->config->getConfigData(); $eventMessage = EventMessage::factory(); diff --git a/app/modules/web/Controllers/ConfigImportController.php b/app/modules/web/Controllers/ConfigImportController.php index 887e4767..1a8be2a7 100644 --- a/app/modules/web/Controllers/ConfigImportController.php +++ b/app/modules/web/Controllers/ConfigImportController.php @@ -49,9 +49,12 @@ final class ConfigImportController extends SimpleControllerBase /** * @throws ContainerExceptionInterface * @throws NotFoundExceptionInterface + * @throws \SP\Core\Exceptions\SPException */ public function importAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($this->config->getConfigData()->isDemoEnabled()) { return $this->returnJsonResponse(JsonResponse::JSON_WARNING, __u('Ey, esto es una DEMO!!')); } @@ -64,7 +67,6 @@ final class ConfigImportController extends SimpleControllerBase $importParams->setCsvDelimiter($this->request->analyzeString('csvDelimiter')); try { - $this->eventDispatcher->notifyEvent('run.import.start', new Event($this)); SessionContext::close(); diff --git a/app/modules/web/Controllers/ConfigLdapController.php b/app/modules/web/Controllers/ConfigLdapController.php index a0ac0389..1ccaf39f 100644 --- a/app/modules/web/Controllers/ConfigLdapController.php +++ b/app/modules/web/Controllers/ConfigLdapController.php @@ -54,6 +54,8 @@ final class ConfigLdapController extends SimpleControllerBase public function saveAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $eventMessage = EventMessage::factory(); $configData = $this->config->getConfigData(); @@ -98,7 +100,7 @@ final class ConfigLdapController extends SimpleControllerBase return $this->saveConfig($configData, $this->config, function () use ($eventMessage) { $this->eventDispatcher->notifyEvent('save.config.ldap', new Event($this, $eventMessage)); }); - } catch (ValidationException $e) { + } catch (\Exception $e) { return $this->returnJsonResponseException($e); } } @@ -132,6 +134,8 @@ final class ConfigLdapController extends SimpleControllerBase public function checkAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $ldapParams = $this->getLdapParamsFromRequest(); // Valores para la configuración de LDAP @@ -168,6 +172,8 @@ final class ConfigLdapController extends SimpleControllerBase public function checkImportAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $ldapParams = $this->getLdapParamsFromRequest(); // Valores para la configuración de LDAP @@ -214,6 +220,8 @@ final class ConfigLdapController extends SimpleControllerBase public function importAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + if ($this->configData->isDemoEnabled()) { return $this->returnJsonResponse(JsonResponse::JSON_WARNING, __u('Ey, esto es una DEMO!!')); } diff --git a/app/modules/web/Controllers/ConfigMailController.php b/app/modules/web/Controllers/ConfigMailController.php index 9a5ff0a1..67bcf254 100644 --- a/app/modules/web/Controllers/ConfigMailController.php +++ b/app/modules/web/Controllers/ConfigMailController.php @@ -45,9 +45,13 @@ final class ConfigMailController extends SimpleControllerBase /** * saveAction + * + * @throws \SP\Core\Exceptions\SPException */ public function saveAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $eventMessage = EventMessage::factory(); $configData = $this->config->getConfigData(); @@ -109,9 +113,13 @@ final class ConfigMailController extends SimpleControllerBase /** * checkAction + * + * @throws \SP\Core\Exceptions\SPException */ public function checkAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $mailParams = new MailParams(); $mailParams->server = $this->request->analyzeString('mail_server'); $mailParams->port = $this->request->analyzeInt('mail_port', 25); diff --git a/app/modules/web/Controllers/ConfigWikiController.php b/app/modules/web/Controllers/ConfigWikiController.php index d1916a57..128b1379 100644 --- a/app/modules/web/Controllers/ConfigWikiController.php +++ b/app/modules/web/Controllers/ConfigWikiController.php @@ -42,9 +42,13 @@ final class ConfigWikiController extends SimpleControllerBase /** * saveAction + * + * @throws \SP\Core\Exceptions\SPException */ public function saveAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + $eventMessage = EventMessage::factory(); $configData = $this->config->getConfigData(); diff --git a/app/modules/web/Controllers/ControllerBase.php b/app/modules/web/Controllers/ControllerBase.php index dad66d74..f5254e2f 100644 --- a/app/modules/web/Controllers/ControllerBase.php +++ b/app/modules/web/Controllers/ControllerBase.php @@ -73,9 +73,13 @@ abstract class ControllerBase */ protected $dic; /** - * @var + * @var bool */ protected $isAjax = false; + /** + * @var string + */ + protected $previousSk; /** * Constructor @@ -98,6 +102,7 @@ abstract class ControllerBase $this->view->setBase(strtolower($this->controllerName)); $this->isAjax = $this->request->isAjax(); + $this->previousSk = $this->session->getSecurityKey(); if ($this->session->isLoggedIn()) { $this->userData = clone $this->session->getUserData(); @@ -116,7 +121,7 @@ abstract class ControllerBase */ private function setViewVars() { - $this->view->assign('timeStart', $this->router->request()->server()->get('REQUEST_TIME_FLOAT')); + $this->view->assign('timeStart', $this->request->getServer('REQUEST_TIME_FLOAT')); $this->view->assign('queryTimeStart', microtime()); $this->view->assign('ctx_userId', $this->userData->getId()); $this->view->assign('ctx_userGroupId', $this->userData->getUserGroupId()); @@ -126,9 +131,10 @@ abstract class ControllerBase $this->view->assign('isDemo', $this->configData->isDemoEnabled()); $this->view->assign('icons', $this->theme->getIcons()); $this->view->assign('configData', $this->configData); + $this->view->assign('sk', $this->session->isLoggedIn() ? $this->session->generateSecurityKey() : ''); // Pass the action name to the template as a variable - $this->view->assign($this->actionName); + $this->view->assign($this->actionName, true); } /** diff --git a/app/modules/web/Controllers/CustomFieldController.php b/app/modules/web/Controllers/CustomFieldController.php index d0deb210..1b3884e9 100644 --- a/app/modules/web/Controllers/CustomFieldController.php +++ b/app/modules/web/Controllers/CustomFieldController.php @@ -56,11 +56,17 @@ final class CustomFieldController extends ControllerBase implements CrudControll /** * Search action * + * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -76,6 +82,8 @@ final class CustomFieldController extends ControllerBase implements CrudControll * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -93,16 +101,17 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Campo')); - $this->view->assign('isView', false); - $this->view->assign('route', 'customField/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Campo')); + $this->view->assign('isView', false); + $this->view->assign('route', 'customField/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.customField.create', new Event($this)); @@ -134,15 +143,14 @@ final class CustomFieldController extends ControllerBase implements CrudControll $this->view->assign('types', SelectItemAdapter::factory(CustomFieldTypeService::getItemsBasic())->getItemsFromModelSelected([$customField->getTypeId()])); $this->view->assign('modules', SelectItemAdapter::factory(CustomFieldDefService::getFieldModules())->getItemsFromArraySelected([$customField->getModuleId()])); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -155,15 +163,17 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Campo')); - $this->view->assign('isView', false); - $this->view->assign('route', 'customField/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Campo')); + $this->view->assign('isView', false); + $this->view->assign('route', 'customField/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.customField.edit', new Event($this)); @@ -185,11 +195,13 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->customFieldService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -217,11 +229,13 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new CustomFieldDefForm($this->dic); $form->validate(Acl::CUSTOMFIELD_CREATE); @@ -254,11 +268,13 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new CustomFieldDefForm($this->dic, $id); $form->validate(Acl::CUSTOMFIELD_EDIT); @@ -291,14 +307,16 @@ final class CustomFieldController extends ControllerBase implements CrudControll */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Campo')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Campo')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.customField', new Event($this)); diff --git a/app/modules/web/Controllers/EventlogController.php b/app/modules/web/Controllers/EventlogController.php index 2d604808..468118cd 100644 --- a/app/modules/web/Controllers/EventlogController.php +++ b/app/modules/web/Controllers/EventlogController.php @@ -54,9 +54,12 @@ final class EventlogController extends ControllerBase * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function indexAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::EVENTLOG)) { return; } @@ -94,9 +97,12 @@ final class EventlogController extends ControllerBase * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::EVENTLOG_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -113,6 +119,8 @@ final class EventlogController extends ControllerBase public function clearAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->eventLogService->clear(); $this->eventDispatcher->notifyEvent('clear.eventlog', diff --git a/app/modules/web/Controllers/Helpers/Account/AccountActionsHelper.php b/app/modules/web/Controllers/Helpers/Account/AccountActionsHelper.php index 7b25a074..99b4dcec 100644 --- a/app/modules/web/Controllers/Helpers/Account/AccountActionsHelper.php +++ b/app/modules/web/Controllers/Helpers/Account/AccountActionsHelper.php @@ -523,7 +523,7 @@ final class AccountActionsHelper extends HelperBase */ protected function initialize() { - $this->sk = $this->context->generateSecurityKey(); + $this->sk = $this->view->get('sk'); $this->icons = $this->view->getTheme()->getIcons(); } } \ No newline at end of file diff --git a/app/modules/web/Controllers/Helpers/Account/AccountHelper.php b/app/modules/web/Controllers/Helpers/Account/AccountHelper.php index 6d066c12..37f37b51 100644 --- a/app/modules/web/Controllers/Helpers/Account/AccountHelper.php +++ b/app/modules/web/Controllers/Helpers/Account/AccountHelper.php @@ -156,9 +156,12 @@ final class AccountHelper extends HelperBase $this->view->assign('users', $selectUsers->getItemsFromModelSelected([$accountData->getUserId()])); $this->view->assign('userGroups', $selectUserGroups->getItemsFromModelSelected([$accountData->getUserGroupId()])); - $this->view->assign('tags', $selectTags->getItemsFromModelSelected(SelectItemAdapter::getIdFromArrayOfObjects($accountDetailsResponse->getTags()))); + $this->view->assign('tags', + $selectTags->getItemsFromModelSelected(SelectItemAdapter::getIdFromArrayOfObjects($accountDetailsResponse->getTags()))); - $this->view->assign('historyData', $this->accountHistoryService->getHistoryForAccount($this->accountId)); + $this->view->assign('historyData', SelectItemAdapter::factory( + $this->accountHistoryService->getHistoryForAccount($this->accountId)) + ->getItemsFromArray()); $this->view->assign('isModified', strtotime($accountData->getDateEdit()) !== false); $this->view->assign('maxFileSize', round($this->configData->getFilesAllowedSize() / 1024, 1)); @@ -185,11 +188,19 @@ final class AccountHelper extends HelperBase $userData = $this->context->getUserData(); $userProfileData = $this->context->getUserProfile(); - $this->view->assign('allowPrivate', ($userProfileData->isAccPrivate() && $accountData->getUserId() === $userData->getId()) || $userData->getIsAdminApp()); - $this->view->assign('allowPrivateGroup', ($userProfileData->isAccPrivateGroup() && $accountData->getUserGroupId() === $userData->getUserGroupId()) || $userData->getIsAdminApp()); + $this->view->assign('allowPrivate', + ($userProfileData->isAccPrivate() + && $accountData->getUserId() === $userData->getId()) + || $userData->getIsAdminApp()); + + $this->view->assign('allowPrivateGroup', + ($userProfileData->isAccPrivateGroup() + && $accountData->getUserGroupId() === $userData->getUserGroupId()) + || $userData->getIsAdminApp()); $this->view->assign('accountPassDate', date('Y-m-d H:i:s', $accountData->getPassDate())); - $this->view->assign('accountPassDateChange', $accountData->getPassDateChange() > 0 ? gmdate('Y-m-d', $accountData->getPassDateChange()) : 0); + $this->view->assign('accountPassDateChange', + $accountData->getPassDateChange() > 0 ? gmdate('Y-m-d', $accountData->getPassDateChange()) : 0); $this->view->assign('linkedAccounts', $this->accountService->getLinked($this->accountId)); $this->view->assign('accountId', $accountData->getId()); @@ -239,7 +250,8 @@ final class AccountHelper extends HelperBase */ protected function checkAccess(AccountDetailsResponse $accountDetailsResponse) { - $accountAcl = $this->dic->get(AccountAclService::class)->getAcl($this->actionId, AccountAclDto::makeFromAccount($accountDetailsResponse)); + $accountAcl = $this->dic->get(AccountAclService::class) + ->getAcl($this->actionId, AccountAclDto::makeFromAccount($accountDetailsResponse)); if ($accountAcl === null || $accountAcl->checkAccountAccess($this->actionId) === false) { throw new AccountPermissionException(AccountPermissionException::INFO); @@ -259,27 +271,36 @@ final class AccountHelper extends HelperBase */ protected function setViewCommon() { - $this->view->assign('actionId', $this->actionId); $this->view->assign('isView', $this->isView); $this->view->assign('accountIsHistory', false); $this->view->assign('customFields', $this->getCustomFieldsForItem(ActionsInterface::ACCOUNT, $this->accountId)); - $this->view->assign('categories', SelectItemAdapter::factory($this->dic->get(CategoryService::class)->getAllBasic())->getItemsFromModel()); - $this->view->assign('clients', SelectItemAdapter::factory($this->dic->get(ClientService::class)->getAllForUser())->getItemsFromModel()); + + $this->view->assign('categories', + SelectItemAdapter::factory($this->dic->get(CategoryService::class) + ->getAllBasic())->getItemsFromModel()); + + $this->view->assign('clients', + SelectItemAdapter::factory($this->dic->get(ClientService::class) + ->getAllForUser())->getItemsFromModel()); $this->view->assign('mailRequestEnabled', $this->configData->isMailRequestsEnabled()); $this->view->assign('passToImageEnabled', $this->configData->isAccountPassToImage()); $this->view->assign('otherAccounts', $this->accountService->getForUser($this->accountId)); - $this->view->assign('addClientEnabled', !$this->isView && $this->acl->checkUserAccess(ActionsInterface::CLIENT)); + $this->view->assign('addClientEnabled', + !$this->isView && $this->acl->checkUserAccess(ActionsInterface::CLIENT)); $this->view->assign('addClientRoute', Acl::getActionRoute(ActionsInterface::CLIENT_CREATE)); - $this->view->assign('addCategoryEnabled', !$this->isView && $this->acl->checkUserAccess(ActionsInterface::CATEGORY)); + $this->view->assign('addCategoryEnabled', + !$this->isView && $this->acl->checkUserAccess(ActionsInterface::CATEGORY)); + $this->view->assign('addCategoryRoute', Acl::getActionRoute(ActionsInterface::CATEGORY_CREATE)); - $this->view->assign('addTagEnabled', !$this->isView && $this->acl->checkUserAccess(ActionsInterface::TAG)); + $this->view->assign('addTagEnabled', + !$this->isView && $this->acl->checkUserAccess(ActionsInterface::TAG)); $this->view->assign('addTagRoute', Acl::getActionRoute(ActionsInterface::TAG_CREATE)); $this->view->assign('fileListRoute', Acl::getActionRoute(ActionsInterface::ACCOUNT_FILE_LIST)); @@ -367,7 +388,9 @@ final class AccountHelper extends HelperBase $this->view->assign('accountId', 0); $this->view->assign('gotData', false); - $this->view->assign('accountActions', $this->dic->get(AccountActionsHelper::class)->getActionsForAccount($this->accountAcl, new AccountActionsDto($this->accountId))); + $this->view->assign('accountActions', + $this->dic->get(AccountActionsHelper::class) + ->getActionsForAccount($this->accountAcl, new AccountActionsDto($this->accountId))); $this->setViewCommon(); } @@ -399,7 +422,9 @@ final class AccountHelper extends HelperBase $this->view->assign('accountId', $accountData->getId()); $this->view->assign('accountData', $accountDetailsResponse->getAccountVData()); - $this->view->assign('accountActions', $this->dic->get(AccountActionsHelper::class)->getActionsForAccount($this->accountAcl, new AccountActionsDto($this->accountId, null, $accountData->getParentId()))); + $this->view->assign('accountActions', + $this->dic->get(AccountActionsHelper::class) + ->getActionsForAccount($this->accountAcl, new AccountActionsDto($this->accountId, null, $accountData->getParentId()))); return true; } @@ -424,9 +449,8 @@ final class AccountHelper extends HelperBase $this->publicLinkService = $this->dic->get(PublicLinkService::class); $this->itemPresetService = $this->dic->get(ItemPresetService::class); - $this->view->assign('changesHash'); - $this->view->assign('chkUserEdit'); - $this->view->assign('chkGroupEdit'); - $this->view->assign('sk', $this->context->generateSecurityKey()); + $this->view->assign('changesHash', ''); + $this->view->assign('chkUserEdit', false); + $this->view->assign('chkGroupEdit', false); } } \ No newline at end of file diff --git a/app/modules/web/Controllers/Helpers/Account/AccountHistoryHelper.php b/app/modules/web/Controllers/Helpers/Account/AccountHistoryHelper.php index 2ab5e536..048de2bf 100644 --- a/app/modules/web/Controllers/Helpers/Account/AccountHistoryHelper.php +++ b/app/modules/web/Controllers/Helpers/Account/AccountHistoryHelper.php @@ -79,6 +79,8 @@ final class AccountHistoryHelper extends HelperBase * @throws AccountPermissionException * @throws UnauthorizedPageException * @throws UpdatedMasterPassException + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException * @throws \SP\Repositories\NoSuchItemException @@ -99,23 +101,36 @@ final class AccountHistoryHelper extends HelperBase $this->view->assign('accountAcl', $this->accountAcl); $this->view->assign('actionId', $this->actionId); $this->view->assign('accountId', $this->accountId); - $this->view->assign('accountHistoryId', $this->accountHistoryId); - $this->view->assign('historyData', $this->accountHistoryService->getHistoryForAccount($this->accountId)); + + $this->view->assign('historyData', + SelectItemAdapter::factory($this->accountHistoryService->getHistoryForAccount($this->accountId)) + ->getItemsFromArraySelected([$this->accountHistoryId])); + $this->view->assign('accountPassDate', date('Y-m-d H:i:s', $accountHistoryData->getPassDate())); $this->view->assign('accountPassDateChange', date('Y-m-d', $accountHistoryData->getPassDateChange() ?: 0)); - $this->view->assign('categories', SelectItemAdapter::factory(CategoryService::getItemsBasic())->getItemsFromModelSelected([$accountHistoryData->getCategoryId()])); - $this->view->assign('clients', SelectItemAdapter::factory(ClientService::getItemsBasic())->getItemsFromModelSelected([$accountHistoryData->getClientId()])); + $this->view->assign('categories', + SelectItemAdapter::factory(CategoryService::getItemsBasic()) + ->getItemsFromModelSelected([$accountHistoryData->getCategoryId()])); + $this->view->assign('clients', + SelectItemAdapter::factory(ClientService::getItemsBasic()) + ->getItemsFromModelSelected([$accountHistoryData->getClientId()])); $this->view->assign('isModified', strtotime($accountHistoryData->getDateEdit()) !== false); $accountActionsHelper = $this->dic->get(AccountActionsHelper::class); - $this->view->assign('accountActions', $accountActionsHelper->getActionsForAccount($this->accountAcl, new AccountActionsDto($this->accountId, $this->accountHistoryId, 0))); - $this->view->assign('accountActionsMenu', $accountActionsHelper->getActionsGrouppedForAccount($this->accountAcl, new AccountActionsDto($this->accountId, $this->accountHistoryId, 0))); + $accountActionsDto = new AccountActionsDto($this->accountId, $this->accountHistoryId, 0); + + $this->view->assign('accountActions', + $accountActionsHelper->getActionsForAccount($this->accountAcl, $accountActionsDto)); + $this->view->assign('accountActionsMenu', + $accountActionsHelper->getActionsGrouppedForAccount($this->accountAcl, $accountActionsDto)); } /** * @throws UnauthorizedPageException * @throws UpdatedMasterPassException + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException */ @@ -125,7 +140,9 @@ final class AccountHistoryHelper extends HelperBase throw new UnauthorizedPageException(UnauthorizedPageException::INFO); } - if (!$this->dic->get(MasterPassService::class)->checkUserUpdateMPass($this->context->getUserData()->getLastUpdateMPass())) { + if (!$this->dic->get(MasterPassService::class) + ->checkUserUpdateMPass($this->context->getUserData()->getLastUpdateMPass()) + ) { throw new UpdatedMasterPassException(UpdatedMasterPassException::INFO); } } @@ -136,6 +153,8 @@ final class AccountHistoryHelper extends HelperBase * @param AccountHistoryData $accountHistoryData * * @throws AccountPermissionException + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -147,9 +166,12 @@ final class AccountHistoryHelper extends HelperBase $this->accountHistoryService->getUserGroupsByAccountId($this->accountId) ); - $this->accountAcl = $this->dic->get(AccountAclService::class)->getAcl($this->actionId, $acccountAclDto, true); + $this->accountAcl = $this->dic->get(AccountAclService::class) + ->getAcl($this->actionId, $acccountAclDto, true); - if ($this->accountAcl === null || $this->accountAcl->checkAccountAccess($this->actionId) === false) { + if ($this->accountAcl === null + || $this->accountAcl->checkAccountAccess($this->actionId) === false + ) { throw new AccountPermissionException(SPException::INFO); } } @@ -164,7 +186,5 @@ final class AccountHistoryHelper extends HelperBase { $this->acl = $this->dic->get(Acl::class); $this->accountHistoryService = $this->dic->get(AccountHistoryService::class);; - - $this->view->assign('sk', $this->context->generateSecurityKey()); } } \ No newline at end of file diff --git a/app/modules/web/Controllers/Helpers/Account/AccountPasswordHelper.php b/app/modules/web/Controllers/Helpers/Account/AccountPasswordHelper.php index 5bdd7791..6d986d8e 100644 --- a/app/modules/web/Controllers/Helpers/Account/AccountPasswordHelper.php +++ b/app/modules/web/Controllers/Helpers/Account/AccountPasswordHelper.php @@ -53,10 +53,12 @@ final class AccountPasswordHelper extends HelperBase * * @return array * @throws HelperException + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \Defuse\Crypto\Exception\CryptoException + * @throws \SP\Core\Exceptions\FileNotFoundException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException - * @throws \SP\Core\Exceptions\FileNotFoundException */ public function getPasswordView(AccountPassData $accountData, bool $useImage) { @@ -79,8 +81,6 @@ final class AccountPasswordHelper extends HelperBase $this->view->assign('pass', htmlentities($pass)); } - $this->view->assign('sk', $this->context->generateSecurityKey()); - return [ 'useimage' => $useImage, 'html' => $this->view->render() @@ -104,6 +104,8 @@ final class AccountPasswordHelper extends HelperBase * * @return string * @throws HelperException + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \Defuse\Crypto\Exception\CryptoException * @throws \SP\Repositories\NoSuchItemException * @throws \SP\Services\ServiceException @@ -119,6 +121,10 @@ final class AccountPasswordHelper extends HelperBase return trim(Crypt::decrypt($accountData->getPass(), $accountData->getKey(), CryptSession::getSessionKey($this->context))); } + /** + * @throws \DI\DependencyException + * @throws \DI\NotFoundException + */ protected function initialize() { $this->acl = $this->dic->get(Acl::class); diff --git a/app/modules/web/Controllers/Helpers/Account/AccountSearchHelper.php b/app/modules/web/Controllers/Helpers/Account/AccountSearchHelper.php index 6e8b52ce..efd84a46 100644 --- a/app/modules/web/Controllers/Helpers/Account/AccountSearchHelper.php +++ b/app/modules/web/Controllers/Helpers/Account/AccountSearchHelper.php @@ -148,16 +148,16 @@ final class AccountSearchHelper extends HelperBase $accountSearchService = $this->dic->get(AccountSearchService::class); - $Grid = $this->getGrid(); - $Grid->getData()->setData($accountSearchService->processSearchResults($this->accountSearchFilter)); - $Grid->updatePager(); - $Grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); + $dataGrid = $this->getGrid(); + $dataGrid->getData()->setData($accountSearchService->processSearchResults($this->accountSearchFilter)); + $dataGrid->updatePager(); + $dataGrid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); // Establecer el filtro de búsqueda en la sesión como un objeto $this->context->setSearchFilters($this->accountSearchFilter); - $this->view->assign('data', $Grid); + $this->view->assign('data', $dataGrid); } /** @@ -200,23 +200,23 @@ final class AccountSearchHelper extends HelperBase $actions = $this->dic->get(AccountActionsHelper::class); - $grid = new DataGrid($this->view->getTheme()); - $grid->setId('gridSearch'); - $grid->setDataHeaderTemplate('search-header', $this->view->getBase()); - $grid->setDataRowTemplate('search-rows', $this->view->getBase()); - $grid->setDataPagerTemplate('datagrid-nav-full', 'grid'); - $grid->setHeader($this->getHeaderSort()); - $grid->addDataAction($actions->getViewAction()); - $grid->addDataAction($actions->getViewPassAction()); - $grid->addDataAction($actions->getCopyPassAction()); - $grid->addDataAction($actions->getEditAction(), !$showOptionalActions); - $grid->addDataAction($actions->getCopyAction(), !$showOptionalActions); - $grid->addDataAction($actions->getDeleteAction(), !$showOptionalActions); - $grid->addDataAction($actions->getRequestAction()); - $grid->setPager($gridPager); - $grid->setData(new DataGridData()); + $dataGrid = new DataGrid($this->view->getTheme()); + $dataGrid->setId('gridSearch'); + $dataGrid->setDataHeaderTemplate('search-header', $this->view->getBase()); + $dataGrid->setDataRowTemplate('search-rows', $this->view->getBase()); + $dataGrid->setDataPagerTemplate('datagrid-nav-full', 'grid'); + $dataGrid->setHeader($this->getHeaderSort()); + $dataGrid->addDataAction($actions->getViewAction()); + $dataGrid->addDataAction($actions->getViewPassAction()); + $dataGrid->addDataAction($actions->getCopyPassAction()); + $dataGrid->addDataAction($actions->getEditAction(), !$showOptionalActions); + $dataGrid->addDataAction($actions->getCopyAction(), !$showOptionalActions); + $dataGrid->addDataAction($actions->getDeleteAction(), !$showOptionalActions); + $dataGrid->addDataAction($actions->getRequestAction()); + $dataGrid->setPager($gridPager); + $dataGrid->setData(new DataGridData()); - return $grid; + return $dataGrid; } /** @@ -275,14 +275,11 @@ final class AccountSearchHelper extends HelperBase /** * Initialize - * - * @throws \Psr\Container\ContainerExceptionInterface */ protected function initialize() { $this->queryTimeStart = microtime(true); - $this->sk = $this->context->generateSecurityKey(); - $this->view->assign('sk', $this->sk); + $this->sk = $this->view->get('sk'); $this->setVars(); } diff --git a/app/modules/web/Controllers/Helpers/Grid/AccountGrid.php b/app/modules/web/Controllers/Helpers/Grid/AccountGrid.php index 87dfa7f5..163f5eef 100644 --- a/app/modules/web/Controllers/Helpers/Grid/AccountGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/AccountGrid.php @@ -69,11 +69,16 @@ final class AccountGrid extends GridBase $grid->addDataAction($this->getViewAction()); $grid->addDataAction($this->getDeleteAction()); - $grid->addDataAction($this->getBulkEditAction(), true); + $grid->addDataAction( + $this->getBulkEditAction() + ->setIsSelection(true), + true); + $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/AccountHistoryGrid.php b/app/modules/web/Controllers/Helpers/Grid/AccountHistoryGrid.php index 5f26f880..f392f40b 100644 --- a/app/modules/web/Controllers/Helpers/Grid/AccountHistoryGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/AccountHistoryGrid.php @@ -68,7 +68,8 @@ final class AccountHistoryGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/AuthTokenGrid.php b/app/modules/web/Controllers/Helpers/Grid/AuthTokenGrid.php index 1c503d00..76a83dd3 100644 --- a/app/modules/web/Controllers/Helpers/Grid/AuthTokenGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/AuthTokenGrid.php @@ -71,7 +71,8 @@ final class AuthTokenGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/CategoryGrid.php b/app/modules/web/Controllers/Helpers/Grid/CategoryGrid.php index 65faf865..68e897ac 100644 --- a/app/modules/web/Controllers/Helpers/Grid/CategoryGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/CategoryGrid.php @@ -70,7 +70,8 @@ final class CategoryGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/ClientGrid.php b/app/modules/web/Controllers/Helpers/Grid/ClientGrid.php index a3c72ae9..c9b7cacf 100644 --- a/app/modules/web/Controllers/Helpers/Grid/ClientGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/ClientGrid.php @@ -69,7 +69,8 @@ final class ClientGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/CustomFieldGrid.php b/app/modules/web/Controllers/Helpers/Grid/CustomFieldGrid.php index d000dbd6..90570b69 100644 --- a/app/modules/web/Controllers/Helpers/Grid/CustomFieldGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/CustomFieldGrid.php @@ -70,7 +70,8 @@ final class CustomFieldGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); diff --git a/app/modules/web/Controllers/Helpers/Grid/FileGrid.php b/app/modules/web/Controllers/Helpers/Grid/FileGrid.php index 907fe441..f81166aa 100644 --- a/app/modules/web/Controllers/Helpers/Grid/FileGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/FileGrid.php @@ -69,7 +69,8 @@ final class FileGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); diff --git a/app/modules/web/Controllers/Helpers/Grid/ItemPresetGrid.php b/app/modules/web/Controllers/Helpers/Grid/ItemPresetGrid.php index 1ca33017..120b92b5 100644 --- a/app/modules/web/Controllers/Helpers/Grid/ItemPresetGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/ItemPresetGrid.php @@ -70,9 +70,12 @@ final class ItemPresetGrid extends GridBase $grid->addDataAction($this->getCreateAccountPasswordAction(), true); $grid->addDataAction($this->getEditAction()); $grid->addDataAction($this->getDeleteAction()); - $grid->addDataAction($this->getDeleteAction() - ->setTitle(__('Eliminar Seleccionados')) - ->setName(__('Eliminar Seleccionados')), true); + $grid->addDataAction( + $this->getDeleteAction() + ->setTitle(__('Eliminar Seleccionados')) + ->setName(__('Eliminar Seleccionados')) + ->setIsSelection(true), + true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/NotificationGrid.php b/app/modules/web/Controllers/Helpers/Grid/NotificationGrid.php index 0fd424f5..b951264f 100644 --- a/app/modules/web/Controllers/Helpers/Grid/NotificationGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/NotificationGrid.php @@ -84,7 +84,8 @@ final class NotificationGrid extends GridBase $this->setNonAdminFilter( $this->getDeleteAction() ->setTitle(__('Eliminar Seleccionados')) - ->setName(__('Eliminar Seleccionados'))), + ->setName(__('Eliminar Seleccionados')) + ->setIsSelection(true)), true); diff --git a/app/modules/web/Controllers/Helpers/Grid/PublicLinkGrid.php b/app/modules/web/Controllers/Helpers/Grid/PublicLinkGrid.php index baf11484..71847224 100644 --- a/app/modules/web/Controllers/Helpers/Grid/PublicLinkGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/PublicLinkGrid.php @@ -71,7 +71,8 @@ final class PublicLinkGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); diff --git a/app/modules/web/Controllers/Helpers/Grid/TagGrid.php b/app/modules/web/Controllers/Helpers/Grid/TagGrid.php index 3ef2e8e9..7bd1ae66 100644 --- a/app/modules/web/Controllers/Helpers/Grid/TagGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/TagGrid.php @@ -70,7 +70,8 @@ final class TagGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/UserGrid.php b/app/modules/web/Controllers/Helpers/Grid/UserGrid.php index aa0e03e6..ec0c8b94 100644 --- a/app/modules/web/Controllers/Helpers/Grid/UserGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/UserGrid.php @@ -80,7 +80,8 @@ final class UserGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/UserGroupGrid.php b/app/modules/web/Controllers/Helpers/Grid/UserGroupGrid.php index 615f346f..06001a08 100644 --- a/app/modules/web/Controllers/Helpers/Grid/UserGroupGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/UserGroupGrid.php @@ -71,7 +71,8 @@ final class UserGroupGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/Grid/UserProfileGrid.php b/app/modules/web/Controllers/Helpers/Grid/UserProfileGrid.php index 71be7d31..2ad63903 100644 --- a/app/modules/web/Controllers/Helpers/Grid/UserProfileGrid.php +++ b/app/modules/web/Controllers/Helpers/Grid/UserProfileGrid.php @@ -71,7 +71,8 @@ final class UserProfileGrid extends GridBase $grid->addDataAction( $this->getDeleteAction() ->setName(__('Eliminar Seleccionados')) - ->setTitle(__('Eliminar Seleccionados')), + ->setTitle(__('Eliminar Seleccionados')) + ->setIsSelection(true), true); $grid->setTime(round(getElapsedTime($this->queryTimeStart), 5)); diff --git a/app/modules/web/Controllers/Helpers/LayoutHelper.php b/app/modules/web/Controllers/Helpers/LayoutHelper.php index e377e3ca..46810345 100644 --- a/app/modules/web/Controllers/Helpers/LayoutHelper.php +++ b/app/modules/web/Controllers/Helpers/LayoutHelper.php @@ -66,7 +66,7 @@ final class LayoutHelper extends HelperBase public function getFullLayout($page, Acl $acl = null) { $this->view->addTemplate('main', '_layouts'); - $this->view->assign('useFixedHeader'); + $this->view->assign('useFixedHeader', true); $this->setPage($page); $this->initBody(); @@ -97,17 +97,12 @@ final class LayoutHelper extends HelperBase */ public function initBody() { - $this->view->assign('startTime', microtime()); - $this->view->assign('isInstalled', $this->configData->isInstalled()); - $this->view->assign('sk', $this->loggedIn ? $this->context->generateSecurityKey() : ''); $this->view->assign('app_name', AppInfoInterface::APP_NAME); $this->view->assign('app_desc', AppInfoInterface::APP_DESC); $this->view->assign('app_website_url', AppInfoInterface::APP_WEBSITE_URL); $this->view->assign('app_blog_url', AppInfoInterface::APP_BLOG_URL); $this->view->assign('app_version', Installer::VERSION_TEXT); - $this->view->assign('isDemoMode', $this->configData->isDemoEnabled()); - $this->view->assign('icons', $this->theme->getIcons()); $this->view->assign('logoIcon', Bootstrap::$WEBURI . '/public/images/logo_icon.png'); $this->view->assign('logoNoText', Bootstrap::$WEBURI . '/public/images/logo_icon.svg'); $this->view->assign('logo', Bootstrap::$WEBURI . '/public/images/logo_full_bg.png'); @@ -117,6 +112,7 @@ final class LayoutHelper extends HelperBase $this->loggedIn = $this->context->isLoggedIn(); + $this->view->assign('sk', $this->view->get('sk') ?: $this->context->generateSecurityKey()); $this->view->assign('loggedIn', $this->loggedIn); $this->view->assign('lang', $this->loggedIn ? Language::$userLang : substr(Language::$globalLang, 0, 2)); $this->view->assign('loadApp', $this->context->getAuthCompleted()); @@ -193,7 +189,7 @@ final class LayoutHelper extends HelperBase foreach ($this->dic->get(PluginManager::class)->getLoadedPlugins() as $plugin) { $base = str_replace(APP_ROOT, '', $plugin->getBase()); $base .= DIRECTORY_SEPARATOR . 'public'; - + $jsResources = $plugin->getJsResources(); $cssResources = $plugin->getCssResources(); @@ -373,7 +369,7 @@ final class LayoutHelper extends HelperBase { $this->view->addTemplate('main', '_layouts'); $this->view->addContentTemplate($template); - $this->view->assign('useFixedHeader'); + $this->view->assign('useFixedHeader', true); $this->setPage($page); $this->initBody(); diff --git a/app/modules/web/Controllers/Helpers/TabsGridHelper.php b/app/modules/web/Controllers/Helpers/TabsGridHelper.php index a80b922e..cb5024b7 100644 --- a/app/modules/web/Controllers/Helpers/TabsGridHelper.php +++ b/app/modules/web/Controllers/Helpers/TabsGridHelper.php @@ -56,7 +56,6 @@ final class TabsGridHelper extends HelperBase $this->view->assign('activeTab', $activeTab); $this->view->assign('maxNumActions', self::MAX_NUM_ACTIONS); $this->view->assign('tabsRoute', $route); - $this->view->assign('sk', $this->context->generateSecurityKey()); } /** diff --git a/app/modules/web/Controllers/Helpers/TabsHelper.php b/app/modules/web/Controllers/Helpers/TabsHelper.php index 5ec64fa1..00d38ff9 100644 --- a/app/modules/web/Controllers/Helpers/TabsHelper.php +++ b/app/modules/web/Controllers/Helpers/TabsHelper.php @@ -56,7 +56,6 @@ final class TabsHelper extends HelperBase $this->view->assign('activeTab', $activeTab); $this->view->assign('maxNumActions', self::MAX_NUM_ACTIONS); $this->view->assign('tabsRoute', $route); - $this->view->assign('sk', $this->context->generateSecurityKey()); } /** diff --git a/app/modules/web/Controllers/ItemPresetController.php b/app/modules/web/Controllers/ItemPresetController.php index f105135d..7e660fcb 100644 --- a/app/modules/web/Controllers/ItemPresetController.php +++ b/app/modules/web/Controllers/ItemPresetController.php @@ -63,14 +63,16 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Valor')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Valor')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.itemPreset', new Event($this)); @@ -126,15 +128,14 @@ final class ItemPresetController extends ControllerBase implements CrudControlle } $this->view->assign('preset', $itemPresetData); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -142,11 +143,16 @@ final class ItemPresetController extends ControllerBase implements CrudControlle * Search action * * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -184,23 +190,24 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $args = func_get_args(); - $type = null; - - if (count($args) > 0) { - $type = Filter::getString($args[0]); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Valor')); - $this->view->assign('isView', false); - $this->view->assign('route', 'itemPreset/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $args = func_get_args(); + $type = null; + + if (count($args) > 0) { + $type = Filter::getString($args[0]); + } + + $this->view->assign('header', __('Nuevo Valor')); + $this->view->assign('isView', false); + $this->view->assign('route', 'itemPreset/saveCreate'); + $this->setViewData(null, $type); $this->eventDispatcher->notifyEvent('show.itemPreset.create', new Event($this)); @@ -222,15 +229,17 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Valor')); - $this->view->assign('isView', false); - $this->view->assign('route', 'itemPreset/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Valor')); + $this->view->assign('isView', false); + $this->view->assign('route', 'itemPreset/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.itemPreset.edit', new Event($this)); @@ -252,11 +261,13 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->itemPresetService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -291,11 +302,13 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new ItemsPresetForm($this->dic); $form->validate(Acl::ITEMPRESET_CREATE); @@ -330,11 +343,13 @@ final class ItemPresetController extends ControllerBase implements CrudControlle */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::ITEMPRESET_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new ItemsPresetForm($this->dic, $id); $form->validate(Acl::ITEMPRESET_EDIT); diff --git a/app/modules/web/Controllers/ItemsController.php b/app/modules/web/Controllers/ItemsController.php index 1ed2b1ec..24ec5dbc 100644 --- a/app/modules/web/Controllers/ItemsController.php +++ b/app/modules/web/Controllers/ItemsController.php @@ -133,7 +133,6 @@ final class ItemsController extends SimpleControllerBase 'notifications' => $notifications, 'hash' => sha1(implode('', $notifications)) ]); - $jsonResponse->setCsrf($this->session->getSecurityKey()); Json::factory($this->router->response()) ->returnJson($jsonResponse); diff --git a/app/modules/web/Controllers/LoginController.php b/app/modules/web/Controllers/LoginController.php index 74263dfc..ab021b02 100644 --- a/app/modules/web/Controllers/LoginController.php +++ b/app/modules/web/Controllers/LoginController.php @@ -51,6 +51,8 @@ final class LoginController extends ControllerBase public function loginAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $loginService = $this->dic->get(LoginService::class); $from = $this->getSignedUriFromRequest(); diff --git a/app/modules/web/Controllers/NotificationController.php b/app/modules/web/Controllers/NotificationController.php index 2a79527a..7348399a 100644 --- a/app/modules/web/Controllers/NotificationController.php +++ b/app/modules/web/Controllers/NotificationController.php @@ -55,11 +55,16 @@ final class NotificationController extends ControllerBase implements CrudControl /** * indexAction * + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function indexAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION)) { return; } @@ -98,14 +103,16 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Notificación')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Notificación')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.notification', new Event($this)); @@ -139,15 +146,14 @@ final class NotificationController extends ControllerBase implements CrudControl $this->view->assign('users', SelectItemAdapter::factory(UserService::getItemsBasic())->getItemsFromModelSelected([$notification->userId])); } - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::NOTIFICATION)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -157,9 +163,12 @@ final class NotificationController extends ControllerBase implements CrudControl * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -175,16 +184,17 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nueva Notificación')); - $this->view->assign('isView', false); - $this->view->assign('route', 'notification/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nueva Notificación')); + $this->view->assign('isView', false); + $this->view->assign('route', 'notification/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.notification.create', new Event($this)); @@ -206,16 +216,17 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Editar Notificación')); - $this->view->assign('isView', false); - $this->view->assign('route', 'notification/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Notificación')); + $this->view->assign('isView', false); + $this->view->assign('route', 'notification/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.notification.edit', new Event($this)); @@ -237,11 +248,13 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { if ($this->userData->getIsAdminApp()) { $this->notificationService->deleteAdminBatch($this->getItemsIdFromRequest($this->request)); @@ -288,11 +301,13 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function checkAction($id) { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CHECK)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CHECK)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $this->notificationService->setCheckedById($id); $this->eventDispatcher->notifyEvent('check.notification', @@ -315,11 +330,13 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new NotificationForm($this->dic); $form->validate(Acl::NOTIFICATION_CREATE); @@ -348,11 +365,13 @@ final class NotificationController extends ControllerBase implements CrudControl */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::NOTIFICATION_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new NotificationForm($this->dic, $id); $form->validate(Acl::NOTIFICATION_EDIT); diff --git a/app/modules/web/Controllers/PluginController.php b/app/modules/web/Controllers/PluginController.php index eb421a29..f589e213 100644 --- a/app/modules/web/Controllers/PluginController.php +++ b/app/modules/web/Controllers/PluginController.php @@ -54,11 +54,16 @@ final class PluginController extends ControllerBase /** * indexAction * + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function indexAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::PLUGIN)) { return; } @@ -96,9 +101,12 @@ final class PluginController extends ControllerBase * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::PLUGIN_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -118,14 +126,16 @@ final class PluginController extends ControllerBase */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::PLUGIN_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Plugin')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PLUGIN_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Plugin')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.plugin', new Event($this)); @@ -159,15 +169,14 @@ final class PluginController extends ControllerBase $this->view->assign('plugin', $pluginData); $this->view->assign('pluginInfo', $pluginInfo); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -181,6 +190,8 @@ final class PluginController extends ControllerBase public function enableAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->pluginService->toggleEnabled($id, 1); $this->eventDispatcher->notifyEvent('edit.plugin.enable', @@ -206,6 +217,8 @@ final class PluginController extends ControllerBase public function disableAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->pluginService->toggleEnabled($id, 0); $this->eventDispatcher->notifyEvent('edit.plugin.disable', @@ -231,6 +244,8 @@ final class PluginController extends ControllerBase public function resetAction($id) { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->pluginService->resetById($id); $this->eventDispatcher->notifyEvent('edit.plugin.reset', diff --git a/app/modules/web/Controllers/PublicLinkController.php b/app/modules/web/Controllers/PublicLinkController.php index 6cbbb51a..99449c8a 100644 --- a/app/modules/web/Controllers/PublicLinkController.php +++ b/app/modules/web/Controllers/PublicLinkController.php @@ -64,9 +64,12 @@ final class PublicLinkController extends ControllerBase implements CrudControlle * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -101,16 +104,17 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Enlace Público')); - $this->view->assign('isView', false); - $this->view->assign('route', 'publicLink/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Enlace Público')); + $this->view->assign('isView', false); + $this->view->assign('route', 'publicLink/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.publicLink.create', new Event($this)); @@ -141,7 +145,6 @@ final class PublicLinkController extends ControllerBase implements CrudControlle $this->view->assign('usageInfo', unserialize($publicLink->getUseInfo())); $this->view->assign('accounts', SelectItemAdapter::factory($this->dic->get(AccountService::class)->getForUser())->getItemsFromModelSelected([$publicLink->getItemId()])); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); if ($this->view->isView === true) { @@ -149,8 +152,8 @@ final class PublicLinkController extends ControllerBase implements CrudControlle $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -163,11 +166,13 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function refreshAction($id) { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_REFRESH)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_REFRESH)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $this->publicLinkService->refresh($id); $this->eventDispatcher->notifyEvent('edit.publicLink.refresh', new Event($this)); @@ -189,15 +194,17 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Enlace Público')); - $this->view->assign('isView', false); - $this->view->assign('route', 'publicLink/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Enlace Público')); + $this->view->assign('isView', false); + $this->view->assign('route', 'publicLink/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.publicLink.edit', new Event($this)); @@ -219,11 +226,13 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->publicLinkService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -260,11 +269,13 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new PublicLinkForm($this->dic); $form->validate(Acl::PUBLICLINK_CREATE); @@ -292,11 +303,13 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function saveCreateFromAccountAction($accountId, $notify) { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $publicLinkData = new PublicLinkData(); $publicLinkData->setTypeId(PublicLinkService::TYPE_ACCOUNT); $publicLinkData->setItemId($accountId); @@ -334,14 +347,16 @@ final class PublicLinkController extends ControllerBase implements CrudControlle */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Enlace')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PUBLICLINK_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Enlace')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.publicLink', new Event($this)); diff --git a/app/modules/web/Controllers/SimpleControllerBase.php b/app/modules/web/Controllers/SimpleControllerBase.php index 29dffddb..7d6c57cb 100644 --- a/app/modules/web/Controllers/SimpleControllerBase.php +++ b/app/modules/web/Controllers/SimpleControllerBase.php @@ -42,6 +42,10 @@ abstract class SimpleControllerBase * @var ContainerInterface */ protected $dic; + /** + * @var string + */ + protected $previousSk; /** * SimpleControllerBase constructor. @@ -59,6 +63,8 @@ abstract class SimpleControllerBase $this->setUp($container); + $this->previousSk = $this->session->getSecurityKey(); + if (method_exists($this, 'initialize')) { $this->initialize(); } @@ -90,7 +96,9 @@ abstract class SimpleControllerBase */ protected function checkAccess($action) { - if (!$this->session->getUserData()->getIsAdminApp() && !$this->acl->checkUserAccess($action)) { + if (!$this->session->getUserData()->getIsAdminApp() + && !$this->acl->checkUserAccess($action) + ) { throw new UnauthorizedPageException(UnauthorizedPageException::INFO); } } diff --git a/app/modules/web/Controllers/TagController.php b/app/modules/web/Controllers/TagController.php index a972f507..e036cca7 100644 --- a/app/modules/web/Controllers/TagController.php +++ b/app/modules/web/Controllers/TagController.php @@ -58,9 +58,12 @@ final class TagController extends ControllerBase implements CrudControllerInterf * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::TAG_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -95,16 +98,17 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::TAG_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nueva Etiqueta')); - $this->view->assign('isView', false); - $this->view->assign('route', 'tag/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nueva Etiqueta')); + $this->view->assign('isView', false); + $this->view->assign('route', 'tag/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.tag.create', new Event($this)); @@ -134,15 +138,14 @@ final class TagController extends ControllerBase implements CrudControllerInterf $this->view->assign('tag', $tag); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ITEMS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } } @@ -155,15 +158,17 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::TAG_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Etiqueta')); - $this->view->assign('isView', false); - $this->view->assign('route', 'tag/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Etiqueta')); + $this->view->assign('isView', false); + $this->view->assign('route', 'tag/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.tag.edit', new Event($this)); @@ -185,11 +190,13 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::TAG_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->tagService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -219,11 +226,13 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::TAG_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new TagForm($this->dic); $form->validate(Acl::TAG_CREATE); @@ -250,11 +259,13 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::TAG_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new TagForm($this->dic, $id); $form->validate(Acl::TAG_EDIT); @@ -281,14 +292,16 @@ final class TagController extends ControllerBase implements CrudControllerInterf */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::TAG_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Etiqueta')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TAG_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Etiqueta')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.tag', new Event($this)); diff --git a/app/modules/web/Controllers/TrackController.php b/app/modules/web/Controllers/TrackController.php index 0c6e9bad..fc8ca254 100644 --- a/app/modules/web/Controllers/TrackController.php +++ b/app/modules/web/Controllers/TrackController.php @@ -56,9 +56,12 @@ final class TrackController extends ControllerBase * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException * @throws UnauthorizedActionException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::TRACK_SEARCH)) { throw new UnauthorizedActionException(UnauthorizedActionException::ERROR); } @@ -98,11 +101,13 @@ final class TrackController extends ControllerBase */ public function unlockAction($id) { - if (!$this->acl->checkUserAccess(Acl::TRACK_UNLOCK)) { - throw new UnauthorizedActionException(UnauthorizedActionException::ERROR); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TRACK_UNLOCK)) { + throw new UnauthorizedActionException(UnauthorizedActionException::ERROR); + } + $this->trackService->unlock($id); $this->eventDispatcher->notifyEvent('unlock.track', new Event($this)); @@ -123,11 +128,13 @@ final class TrackController extends ControllerBase */ public function clearAction() { - if (!$this->acl->checkUserAccess(Acl::TRACK_CLEAR)) { - throw new UnauthorizedActionException(UnauthorizedActionException::ERROR); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::TRACK_CLEAR)) { + throw new UnauthorizedActionException(UnauthorizedActionException::ERROR); + } + $this->trackService->clear(); $this->eventDispatcher->notifyEvent('clear.track', new Event($this)); diff --git a/app/modules/web/Controllers/Traits/JsonTrait.php b/app/modules/web/Controllers/Traits/JsonTrait.php index ced1a8d7..aedd0329 100644 --- a/app/modules/web/Controllers/Traits/JsonTrait.php +++ b/app/modules/web/Controllers/Traits/JsonTrait.php @@ -112,6 +112,10 @@ trait JsonTrait $jsonResponse->setMessages([$exception->getHint()]); } + if (property_exists($this, 'session')) { + $jsonResponse->setCsrf($this->session->getSecurityKey()); + } + return Json::fromDic()->returnJson($jsonResponse); } } \ No newline at end of file diff --git a/app/modules/web/Controllers/UserController.php b/app/modules/web/Controllers/UserController.php index 0a1bfd3b..35d355bb 100644 --- a/app/modules/web/Controllers/UserController.php +++ b/app/modules/web/Controllers/UserController.php @@ -60,11 +60,17 @@ final class UserController extends ControllerBase implements CrudControllerInter /** * Search action * + * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::USER_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -80,6 +86,8 @@ final class UserController extends ControllerBase implements CrudControllerInter * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -97,16 +105,17 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::USER_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Usuario')); - $this->view->assign('isView', false); - $this->view->assign('route', 'user/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Usuario')); + $this->view->assign('isView', false); + $this->view->assign('route', 'user/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.user.create', new Event($this)); @@ -137,7 +146,6 @@ final class UserController extends ControllerBase implements CrudControllerInter $this->view->assign('groups', SelectItemAdapter::factory(UserGroupService::getItemsBasic())->getItemsFromModel()); $this->view->assign('profiles', SelectItemAdapter::factory(UserProfileService::getItemsBasic())->getItemsFromModel()); $this->view->assign('isUseSSO', $this->configData->isAuthBasicAutoLoginEnabled()); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('mailEnabled', $this->configData->isMailEnabled()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); @@ -165,8 +173,8 @@ final class UserController extends ControllerBase implements CrudControllerInter return $value; }, $this->userService->getUsageForUser($userId))); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('showViewCustomPass', $this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW_PASS)); @@ -182,16 +190,17 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::USER_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Editar Usuario')); - $this->view->assign('isView', false); - $this->view->assign('route', 'user/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Usuario')); + $this->view->assign('isView', false); + $this->view->assign('route', 'user/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.user.edit', new Event($this)); @@ -213,20 +222,20 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function editPassAction($id) { - // Comprobar si el usuario a modificar es distinto al de la sesión - if (!$this->acl->checkUserAccess(Acl::USER_EDIT_PASS, $id)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->addTemplate('user_pass', 'itemshow'); - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Cambio de Clave')); - $this->view->assign('isView', false); - $this->view->assign('route', 'user/saveEditPass/' . $id); - $this->view->assign('sk', $this->session->generateSecurityKey()); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + // Comprobar si el usuario a modificar es distinto al de la sesión + if (!$this->acl->checkUserAccess(Acl::USER_EDIT_PASS, $id)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->addTemplate('user_pass', 'itemshow'); + + $this->view->assign('header', __('Cambio de Clave')); + $this->view->assign('isView', false); + $this->view->assign('route', 'user/saveEditPass/' . $id); + $user = $id ? $this->userService->getById($id) : new UserData(); $this->view->assign('user', $user); @@ -250,13 +259,13 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::USER_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->userService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -292,11 +301,13 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::USER_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserForm($this->dic); $form->validate(Acl::USER_CREATE); @@ -328,6 +339,8 @@ final class UserController extends ControllerBase implements CrudControllerInter * @param int $userId * @param UserData $userData * + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \Defuse\Crypto\Exception\EnvironmentIsBrokenException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException @@ -353,11 +366,13 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::USER_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserForm($this->dic, $id); $form->validate(Acl::USER_EDIT); @@ -394,11 +409,13 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function saveEditPassAction($id) { - if (!$this->acl->checkUserAccess(Acl::USER_EDIT_PASS, $id)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_EDIT_PASS, $id)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserForm($this->dic, $id); $form->validate(Acl::USER_EDIT_PASS); @@ -431,15 +448,16 @@ final class UserController extends ControllerBase implements CrudControllerInter */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::USER_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Ver Usuario')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::USER_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Usuario')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.user', new Event($this)); diff --git a/app/modules/web/Controllers/UserGroupController.php b/app/modules/web/Controllers/UserGroupController.php index 45d595db..5a1a069c 100644 --- a/app/modules/web/Controllers/UserGroupController.php +++ b/app/modules/web/Controllers/UserGroupController.php @@ -67,9 +67,12 @@ final class UserGroupController extends ControllerBase implements CrudController * @throws \DI\DependencyException * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::GROUP_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -104,16 +107,17 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::GROUP_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Grupo')); - $this->view->assign('isView', false); - $this->view->assign('route', 'userGroup/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Grupo')); + $this->view->assign('isView', false); + $this->view->assign('route', 'userGroup/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.userGroup.create', new Event($this)); @@ -151,15 +155,14 @@ final class UserGroupController extends ControllerBase implements CrudController ->getItemsFromModelSelected($users)); $this->view->assign('usedBy', $this->userGroupService->getUsageByUsers($userGroupId)); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); if ($this->view->isView === true) { $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('showViewCustomPass', $this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW_PASS)); @@ -175,15 +178,17 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::GROUP_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Grupo')); - $this->view->assign('isView', false); - $this->view->assign('route', 'userGroup/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Grupo')); + $this->view->assign('isView', false); + $this->view->assign('route', 'userGroup/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.userGroup.edit', new Event($this)); @@ -205,11 +210,13 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::GROUP_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->userGroupService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -245,11 +252,13 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::GROUP_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserGroupForm($this->dic); $form->validate(Acl::GROUP_CREATE); @@ -284,11 +293,13 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::GROUP_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserGroupForm($this->dic, $id); $form->validate(Acl::GROUP_EDIT); @@ -323,14 +334,16 @@ final class UserGroupController extends ControllerBase implements CrudController */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::GROUP_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Grupo')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::GROUP_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Grupo')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.userGroup', new Event($this)); diff --git a/app/modules/web/Controllers/UserPassResetController.php b/app/modules/web/Controllers/UserPassResetController.php index d14183eb..543cfd7a 100644 --- a/app/modules/web/Controllers/UserPassResetController.php +++ b/app/modules/web/Controllers/UserPassResetController.php @@ -79,6 +79,8 @@ final class UserPassResetController extends ControllerBase public function saveRequestAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->checkTracking(); $login = $this->request->analyzeString('login'); @@ -142,9 +144,12 @@ final class UserPassResetController extends ControllerBase * * @throws \DI\DependencyException * @throws \DI\NotFoundException + * @throws SPException */ public function resetAction($hash = null) { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->dic->get(LayoutHelper::class) ->getCustomLayout('reset', strtolower($this->controllerName)); @@ -163,6 +168,8 @@ final class UserPassResetController extends ControllerBase public function saveResetAction() { try { + $this->checkSecurityToken($this->previousSk, $this->request); + $this->checkTracking(); $pass = $this->request->analyzeEncrypted('password'); @@ -201,6 +208,8 @@ final class UserPassResetController extends ControllerBase } /** + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\InvalidArgumentException */ protected function initialize() diff --git a/app/modules/web/Controllers/UserProfileController.php b/app/modules/web/Controllers/UserProfileController.php index 5a0f2bfb..4676b36b 100644 --- a/app/modules/web/Controllers/UserProfileController.php +++ b/app/modules/web/Controllers/UserProfileController.php @@ -55,11 +55,17 @@ final class UserProfileController extends ControllerBase implements CrudControll /** * Search action * + * @return bool + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException + * @throws \SP\Core\Exceptions\SPException */ public function searchAction() { + $this->checkSecurityToken($this->previousSk, $this->request); + if (!$this->acl->checkUserAccess(Acl::PROFILE_SEARCH)) { return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); } @@ -75,6 +81,8 @@ final class UserProfileController extends ControllerBase implements CrudControll * getSearchGrid * * @return $this + * @throws \DI\DependencyException + * @throws \DI\NotFoundException * @throws \SP\Core\Exceptions\ConstraintException * @throws \SP\Core\Exceptions\QueryException */ @@ -92,16 +100,17 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function createAction() { - if (!$this->acl->checkUserAccess(Acl::PROFILE_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign(__FUNCTION__, 1); - $this->view->assign('header', __('Nuevo Perfil')); - $this->view->assign('isView', false); - $this->view->assign('route', 'userProfile/saveCreate'); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Nuevo Perfil')); + $this->view->assign('isView', false); + $this->view->assign('route', 'userProfile/saveCreate'); + $this->setViewData(); $this->eventDispatcher->notifyEvent('show.userProfile.create', new Event($this)); @@ -133,7 +142,6 @@ final class UserProfileController extends ControllerBase implements CrudControll $this->view->assign('profile', $profile); $this->view->assign('profileData', $profile->getProfile() ?: new ProfileData()); - $this->view->assign('sk', $this->session->generateSecurityKey()); $this->view->assign('nextAction', Acl::getActionRoute(Acl::ACCESS_MANAGE)); if ($this->view->isView === true) { @@ -142,8 +150,8 @@ final class UserProfileController extends ControllerBase implements CrudControll $this->view->assign('disabled', 'disabled'); $this->view->assign('readonly', 'readonly'); } else { - $this->view->assign('disabled'); - $this->view->assign('readonly'); + $this->view->assign('disabled', false); + $this->view->assign('readonly', false); } $this->view->assign('showViewCustomPass', $this->acl->checkUserAccess(Acl::CUSTOMFIELD_VIEW_PASS)); @@ -159,15 +167,17 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function editAction($id) { - if (!$this->acl->checkUserAccess(Acl::PROFILE_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Editar Perfil')); - $this->view->assign('isView', false); - $this->view->assign('route', 'userProfile/saveEdit/' . $id); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Editar Perfil')); + $this->view->assign('isView', false); + $this->view->assign('route', 'userProfile/saveEdit/' . $id); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.userProfile.edit', new Event($this)); @@ -189,11 +199,13 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function deleteAction($id = null) { - if (!$this->acl->checkUserAccess(Acl::PROFILE_DELETE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_DELETE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + if ($id === null) { $this->userProfileService->deleteByIdBatch($this->getItemsIdFromRequest($this->request)); @@ -229,11 +241,13 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function saveCreateAction() { - if (!$this->acl->checkUserAccess(Acl::PROFILE_CREATE)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_CREATE)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserProfileForm($this->dic); $form->validate(Acl::PROFILE_CREATE); @@ -264,11 +278,13 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function saveEditAction($id) { - if (!$this->acl->checkUserAccess(Acl::PROFILE_EDIT)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_EDIT)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + $form = new UserProfileForm($this->dic, $id); $form->validate(Acl::PROFILE_EDIT); @@ -300,14 +316,16 @@ final class UserProfileController extends ControllerBase implements CrudControll */ public function viewAction($id) { - if (!$this->acl->checkUserAccess(Acl::PROFILE_VIEW)) { - return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); - } - - $this->view->assign('header', __('Ver Perfil')); - $this->view->assign('isView', true); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + if (!$this->acl->checkUserAccess(Acl::PROFILE_VIEW)) { + return $this->returnJsonResponse(JsonResponse::JSON_ERROR, __u('No tiene permisos para realizar esta operación')); + } + + $this->view->assign('header', __('Ver Perfil')); + $this->view->assign('isView', true); + $this->setViewData($id); $this->eventDispatcher->notifyEvent('show.userProfile', new Event($this)); diff --git a/app/modules/web/Controllers/UserSettingsGeneralController.php b/app/modules/web/Controllers/UserSettingsGeneralController.php index c3804734..806faba0 100644 --- a/app/modules/web/Controllers/UserSettingsGeneralController.php +++ b/app/modules/web/Controllers/UserSettingsGeneralController.php @@ -47,22 +47,24 @@ final class UserSettingsGeneralController extends SimpleControllerBase */ public function saveAction() { - $userData = $this->session->getUserData(); - - $userPreferencesData = clone $userData->getPreferences(); - - $userPreferencesData->setUserId($userData->getId()); - $userPreferencesData->setLang($this->request->analyzeString('userlang')); - $userPreferencesData->setTheme($this->request->analyzeString('usertheme', 'material-blue')); - $userPreferencesData->setResultsPerPage($this->request->analyzeInt('resultsperpage', 12)); - $userPreferencesData->setAccountLink($this->request->analyzeBool('account_link', false)); - $userPreferencesData->setSortViews($this->request->analyzeBool('sort_views', false)); - $userPreferencesData->setTopNavbar($this->request->analyzeBool('top_navbar', false)); - $userPreferencesData->setOptionalActions($this->request->analyzeBool('optional_actions', false)); - $userPreferencesData->setResultsAsCards($this->request->analyzeBool('resultsascards', false)); - $userPreferencesData->setCheckNotifications($this->request->analyzeBool('check_notifications', false)); - try { + $this->checkSecurityToken($this->previousSk, $this->request); + + $userData = $this->session->getUserData(); + + $userPreferencesData = clone $userData->getPreferences(); + + $userPreferencesData->setUserId($userData->getId()); + $userPreferencesData->setLang($this->request->analyzeString('userlang')); + $userPreferencesData->setTheme($this->request->analyzeString('usertheme', 'material-blue')); + $userPreferencesData->setResultsPerPage($this->request->analyzeInt('resultsperpage', 12)); + $userPreferencesData->setAccountLink($this->request->analyzeBool('account_link', false)); + $userPreferencesData->setSortViews($this->request->analyzeBool('sort_views', false)); + $userPreferencesData->setTopNavbar($this->request->analyzeBool('top_navbar', false)); + $userPreferencesData->setOptionalActions($this->request->analyzeBool('optional_actions', false)); + $userPreferencesData->setResultsAsCards($this->request->analyzeBool('resultsascards', false)); + $userPreferencesData->setCheckNotifications($this->request->analyzeBool('check_notifications', false)); + $this->userService->updatePreferencesById($userData->getId(), $userPreferencesData); // Guardar las preferencias en la sesión diff --git a/app/modules/web/Controllers/UserSettingsManagerController.php b/app/modules/web/Controllers/UserSettingsManagerController.php index fcab6593..58b349c7 100644 --- a/app/modules/web/Controllers/UserSettingsManagerController.php +++ b/app/modules/web/Controllers/UserSettingsManagerController.php @@ -81,13 +81,7 @@ final class UserSettingsManagerController extends ControllerBase implements Exte $template->assign('langs', SelectItemAdapter::factory(Language::getAvailableLanguages())->getItemsFromArraySelected([$userPreferences->getLang() ?: $this->configData->getSiteLang()])); $template->assign('themes', SelectItemAdapter::factory($this->theme->getThemesAvailable())->getItemsFromArraySelected([$userPreferences->getTheme() ?: $this->configData->getSiteTheme()])); - $template->assign('chkAccountLink', $userPreferences->isAccountLink() ? 'checked="checked"' : ''); - $template->assign('resultsPerPage', $userPreferences->getResultsPerPage() ?: $this->configData->getAccountCount()); - $template->assign('chkSortViews', $userPreferences->isSortViews() ? 'checked="checked"' : ''); - $template->assign('chkTopNavbar', $userPreferences->isTopNavbar() ? 'checked="checked"' : ''); - $template->assign('chkOptionalActions', $userPreferences->isOptionalActions() ? 'checked="checked"' : ''); - $template->assign('chkResultsAsCards', $userPreferences->isResultsAsCards() ? 'checked="checked"' : ''); - $template->assign('chkNotifications', $userPreferences->isCheckNotifications() ? 'checked="checked"' : ''); + $template->assign('userPreferences', $userPreferences); $template->assign('route', 'userSettingsGeneral/save'); return new DataTab(__('Preferencias'), $template); diff --git a/app/modules/web/themes/material-blue/views/_layouts/main.inc b/app/modules/web/themes/material-blue/views/_layouts/main.inc index 6f5bec87..ff395cec 100644 --- a/app/modules/web/themes/material-blue/views/_layouts/main.inc +++ b/app/modules/web/themes/material-blue/views/_layouts/main.inc @@ -1,16 +1,21 @@ - + - + - <?php printf('%s :: %s', $app_name, $app_desc); ?> + <?php printf('%s :: %s', $_getvar('app_name'), $_getvar('app_desc')); ?> - - + + - +
-
includePartial('fixed-header'); elseif ($this->hashContentTemplates()): foreach ($this->getContentTemplates() as $template): @@ -37,7 +42,7 @@ includePartial('footer'); ?>
- + @@ -47,7 +52,7 @@ sysPassApp.log.info("ready"); - sysPassApp.sk.set(""); + sysPassApp.sk.set(""); }); diff --git a/app/modules/web/themes/material-blue/views/_partials/error-list.inc b/app/modules/web/themes/material-blue/views/_partials/error-list.inc index 2363ceb4..c54aa6fd 100644 --- a/app/modules/web/themes/material-blue/views/_partials/error-list.inc +++ b/app/modules/web/themes/material-blue/views/_partials/error-list.inc @@ -1,11 +1,12 @@ - 0): ?> + 0): ?> - - \ No newline at end of file + \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/account/account.inc b/app/modules/web/themes/material-blue/views/account/account.inc index 72c61d22..88678d2a 100644 --- a/app/modules/web/themes/material-blue/views/account/account.inc +++ b/app/modules/web/themes/material-blue/views/account/account.inc @@ -1,22 +1,28 @@ 0; +/** @var \SP\DataModel\AccountExtData $accountData */ +$accountData = $_getvar('accountData'); + +/** @var \SP\Services\Account\AccountAcl $accountAcl */ +$accountAcl = $_getvar('accountAcl'); + +$gotData = $_getvar('gotData', false); +$showLinked = $gotData && count($_getvar('linkedAccounts', [])) > 0; $showFiles = $gotData && $configData->isFilesEnabled() && $accountAcl->isShowFiles(); $showDetails = $gotData && $accountAcl->isShowDetails(); -$showPermissions = $accountAcl->isShowPermission() || $allowPrivate || $allowPrivateGroup; -$showCustomFields = count($customFields) > 0; - +$showPermissions = $accountAcl->isShowPermission() + || $_getvar('allowPrivate', false) + || $_getvar('allowPrivateGroup', false); +$showCustomFields = count($_getvar('customFields', 0)) > 0; ?>
- - + +
@@ -46,8 +52,8 @@ $showCustomFields = count($customFields) > 0;
@@ -62,7 +68,7 @@ $showCustomFields = count($customFields) > 0; > + value="getName()) : ''; ?>" >
@@ -74,18 +80,18 @@ $showCustomFields = count($customFields) > 0;
- + 0;
- + 0; > + value="getUrl() : ''; ?>" >
@@ -138,7 +144,7 @@ $showCustomFields = count($customFields) > 0; > + value="getLogin()) : ''; ?>" > @@ -177,8 +183,8 @@ $showCustomFields = count($customFields) > 0;
> + value="" + data-dst-unix="password_date_expire_unix" > @@ -196,7 +202,7 @@ $showCustomFields = count($customFields) > 0;
+ maxlength="5000" >getNotes()) : ''; ?>
@@ -206,19 +212,19 @@ $showCustomFields = count($customFields) > 0;
- + - + 0;
- + isSelected()): ?> getName(); ?> @@ -240,24 +246,27 @@ $showCustomFields = count($customFields) > 0; - + +
- isShowHistory() && count($historyData) > 0): ?> + + isShowHistory() + && count($_getvar('historyData', [])) > 0): ?> @@ -267,29 +276,33 @@ $showCustomFields = count($customFields) > 0; data-action-route="account/viewHistory" data-onchange="account/viewHistory"> - $historyData): ?> + + value="getId(); ?>">getName(); ?> - getUserEditName()): ?> + getUserEditName()): ?> getDateEdit(), $accountData->getUserEditName()); ?> - +
- getIconPublicLink()->getIcon(); ?> @@ -302,7 +315,7 @@ $showCustomFields = count($customFields) > 0;
- getIconPublicLink()->getIcon(); ?> @@ -322,20 +335,28 @@ $showCustomFields = count($customFields) > 0;
- includeTemplate('account-permissions'); endif; ?> + includeTemplate('account-permissions'); + endif; ?>
- includeTemplate('files'); endif; ?> + includeTemplate('files'); + endif; ?>
- includeTemplate('details'); endif; ?> + includeTemplate('details'); + endif; ?>
- includeTemplate('linkedAccounts'); endif; ?> + includeTemplate('linkedAccounts'); + endif; ?>
diff --git a/app/modules/web/themes/material-blue/views/account/actions.inc b/app/modules/web/themes/material-blue/views/account/actions.inc index fa1b47f7..7c373af2 100644 --- a/app/modules/web/themes/material-blue/views/account/actions.inc +++ b/app/modules/web/themes/material-blue/views/account/actions.inc @@ -1,13 +1,17 @@ +
    - +
- 0): ?> + 0): ?>
+ + + + + + @@ -74,7 +93,7 @@
+ min="3" step="3" value="getLimitCount(); ?>" tabindex="7"/>
@@ -88,22 +107,19 @@
- - - + + + - + -
- \ No newline at end of file +
\ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/account/viewpass.inc b/app/modules/web/themes/material-blue/views/account/viewpass.inc index 7bef7e42..cee727cd 100644 --- a/app/modules/web/themes/material-blue/views/account/viewpass.inc +++ b/app/modules/web/themes/material-blue/views/account/viewpass.inc @@ -1,10 +1,15 @@
-

  - +

  + getIconPublicLink()->getIcon(); ?> @@ -12,8 +17,8 @@ - - + + - - + + @@ -48,6 +53,3 @@
- +  
- +  

- diff --git a/app/modules/web/themes/material-blue/views/common/aux-customfields.inc b/app/modules/web/themes/material-blue/views/common/aux-customfields.inc index 1ee07e42..5653d417 100644 --- a/app/modules/web/themes/material-blue/views/common/aux-customfields.inc +++ b/app/modules/web/themes/material-blue/views/common/aux-customfields.inc @@ -2,8 +2,12 @@ /** * @var \SP\Core\UI\ThemeIcons $icons * @var \SP\Services\CustomField\CustomFieldItem[] $customFields + * @var callable $_getvar + * @var \SP\Mvc\View\Template $this */ +$customFields = $_getvar('customFields'); + foreach ($customFields as $index => $field):?> @@ -37,7 +41,7 @@ foreach ($customFields as $index => $field):?> - typeName === 'color' && $isView): ?> + typeName === 'color' && $_getvar('isView')): ?> typeName === 'password'): ?> @@ -45,10 +49,10 @@ foreach ($customFields as $index => $field):?> required ? 'required' : ''; ?> > + value="value) ? '***' : htmlspecialchars($field->value, ENT_QUOTES); ?>" required ? 'required' : ''; ?> >
@@ -56,7 +60,7 @@ foreach ($customFields as $index => $field):?>
+ id="formId; ?>" >value, ENT_QUOTES); ?>
@@ -67,7 +71,7 @@ foreach ($customFields as $index => $field):?> type="typeName; ?>" class="mdl-textfield__input mdl-color-text--indigo-400" maxlength="500" - value="value); ?>" required ? 'required' : ''; ?> > + value="value, ENT_QUOTES); ?>" required ? 'required' : ''; ?> >
diff --git a/app/modules/web/themes/material-blue/views/common/datatabs.inc b/app/modules/web/themes/material-blue/views/common/datatabs.inc index ce0ad643..f7f8b977 100644 --- a/app/modules/web/themes/material-blue/views/common/datatabs.inc +++ b/app/modules/web/themes/material-blue/views/common/datatabs.inc @@ -1,10 +1,14 @@ +
@@ -12,7 +16,7 @@ $tab): ?>
render(); ?> @@ -20,12 +24,8 @@
- - - \ No newline at end of file + \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/common/debug.inc b/app/modules/web/themes/material-blue/views/common/debug.inc index 880ac69b..df43dc55 100644 --- a/app/modules/web/themes/material-blue/views/common/debug.inc +++ b/app/modules/web/themes/material-blue/views/common/debug.inc @@ -1,18 +1,18 @@ +

DEBUG INFO

    -
  • RENDER -> sec
  • -
  • MEM -> Init: KB - End: KB - - Total: KB +
  • RENDER -> sec
  • +
  • MEM -> Init: KB - End: KB - + Total: KB
  • SESSION:
  • -
  • CONFIG FILE: -
    -
- - - - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/common/tabs-end.inc b/app/modules/web/themes/material-blue/views/common/tabs-end.inc deleted file mode 100644 index 9aa8500e..00000000 --- a/app/modules/web/themes/material-blue/views/common/tabs-end.inc +++ /dev/null @@ -1,9 +0,0 @@ -
- - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/common/tabs-start.inc b/app/modules/web/themes/material-blue/views/common/tabs-start.inc deleted file mode 100644 index 2453d7b1..00000000 --- a/app/modules/web/themes/material-blue/views/common/tabs-start.inc +++ /dev/null @@ -1,3 +0,0 @@ - -
-
\ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/config/accounts.inc b/app/modules/web/themes/material-blue/views/config/accounts.inc index 3a0ec545..41c5ab7a 100644 --- a/app/modules/web/themes/material-blue/views/config/accounts.inc +++ b/app/modules/web/themes/material-blue/views/config/accounts.inc @@ -2,9 +2,12 @@ /** * @var \SP\Core\UI\ThemeIcons $icons * @var \SP\Config\ConfigData $configData - */ ?> + * @var callable $_getvar + * @var \SP\Mvc\View\Template $this + */ +?> - +
getIconHelp()->getIcon(); ?> diff --git a/app/modules/web/themes/material-blue/views/config/backup.inc b/app/modules/web/themes/material-blue/views/config/backup.inc index 064c1108..76f7d3a3 100644 --- a/app/modules/web/themes/material-blue/views/config/backup.inc +++ b/app/modules/web/themes/material-blue/views/config/backup.inc @@ -1,6 +1,13 @@ - + - +
getIconHelp()->getIcon(); ?> @@ -25,10 +32,13 @@
- + - + @@ -103,10 +113,12 @@
- + - + @@ -119,7 +131,7 @@ download="" class="download"> diff --git a/app/modules/web/themes/material-blue/views/config/encryption.inc b/app/modules/web/themes/material-blue/views/config/encryption.inc index da8828b1..7c731e65 100644 --- a/app/modules/web/themes/material-blue/views/config/encryption.inc +++ b/app/modules/web/themes/material-blue/views/config/encryption.inc @@ -1,8 +1,11 @@ + * @var \SP\Core\UI\ThemeIcons $icons + * @var \SP\Config\ConfigData $configData + * @var callable $_getvar + * @var \SP\Mvc\View\Template $this + */ +?>
- 0): ?> + 0): ?> @@ -86,7 +89,7 @@
getIconWarning()->getIcon(); ?>
- + @@ -132,8 +135,8 @@
@@ -23,7 +26,7 @@
- +
- - + +
@@ -157,7 +160,7 @@
- +
  • - diff --git a/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc b/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc index dd961794..74da7e4a 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc @@ -1,14 +1,20 @@
    -

    close

    +

    close

    @@ -17,10 +23,10 @@ - + -
    @@ -89,7 +94,4 @@ getIconSave()->getIcon(); ?>
    -
    - \ No newline at end of file + \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/category.inc b/app/modules/web/themes/material-blue/views/itemshow/category.inc index f9cecb09..2e7263ca 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/category.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/category.inc @@ -1,14 +1,20 @@
    -

    close

    +

    close

    @@ -36,23 +42,19 @@ - + includeTemplate('aux-customfields', 'common'); ?> -
    - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/client.inc b/app/modules/web/themes/material-blue/views/itemshow/client.inc index 34791b16..9c2ffbba 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/client.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/client.inc @@ -1,17 +1,21 @@
    -

    close

    +

    close

    @@ -64,13 +68,12 @@ - + includeTemplate('aux-customfields', 'common'); ?> -
    @@ -80,7 +83,4 @@ getIconSave()->getIcon(); ?>
    -
    - \ No newline at end of file + \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc b/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc index 737728da..3c6d2f57 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc @@ -1,17 +1,21 @@
    -

    close

    +

    close

    @@ -33,8 +37,8 @@
    - + @@ -90,7 +94,6 @@ -
    @@ -101,6 +104,3 @@
    - diff --git a/app/modules/web/themes/material-blue/views/itemshow/file.inc b/app/modules/web/themes/material-blue/views/itemshow/file.inc index 32f574f0..42b68aa2 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/file.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/file.inc @@ -1,6 +1,18 @@ - - + + + +
    getName(); ?>
    -
    +
    \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc index 1f70eab6..5efdf833 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc @@ -1,4 +1,14 @@ - + @@ -23,7 +33,7 @@ + value="getExpireTime() ? $password->getExpireTime() / $_getvar('expireTimeMultiplier') : 1; ?>"/> diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc index 848fd82c..b4b9833d 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc @@ -1,6 +1,9 @@ @@ -13,8 +16,8 @@ diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset-session_timeout.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset-session_timeout.inc index d0ecd4cf..7fcc1d92 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset-session_timeout.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset-session_timeout.inc @@ -1,4 +1,14 @@ - + diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc index d4d8e1ef..f030e472 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc @@ -1,22 +1,27 @@
    -

    close

    +

    close

    - +
    @@ -28,10 +33,10 @@
    > + title="" > - + @@ -62,10 +67,10 @@
    -
    - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/public_link.inc b/app/modules/web/themes/material-blue/views/itemshow/public_link.inc index 64e99e37..9306da92 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/public_link.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/public_link.inc @@ -1,14 +1,19 @@
    -

    close

    +

    close

    @@ -17,10 +22,10 @@ - + - + - - - - + + - +
    - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/results.inc b/app/modules/web/themes/material-blue/views/itemshow/results.inc index fd87807a..32c2dbce 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/results.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/results.inc @@ -1,10 +1,18 @@ +
    -

    close

    +

    close

    diff --git a/app/modules/web/themes/material-blue/views/itemshow/tag.inc b/app/modules/web/themes/material-blue/views/itemshow/tag.inc index dff10f76..6edff3ab 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/tag.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/tag.inc @@ -1,14 +1,20 @@
    -

    close

    +

    close

    @@ -27,17 +33,13 @@ -
    - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/user.inc b/app/modules/web/themes/material-blue/views/itemshow/user.inc index e9ee55a7..83ba4e11 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user.inc @@ -1,25 +1,31 @@
    -

    close

    +

    close

    - +
    @@ -33,7 +39,7 @@ > + maxlength="80" >
    @@ -47,7 +53,7 @@ isLdap() ? 'readonly' : $readonly; ?>> + maxlength="80" isLdap() ? 'readonly' : $_getvar('readonly'); ?>>
    @@ -58,7 +64,7 @@ - + @@ -66,7 +72,7 @@ > + maxlength="100" >
    @@ -80,7 +86,8 @@
    > + value="getEmail(); ?>" + maxlength="50" >
    - + @@ -124,10 +131,10 @@
    > + class="select-box" required > - + @@ -157,14 +164,14 @@
    + maxlength="1000" >getNotes(); ?>
    - + includeTemplate('aux-customfields', 'common'); ?> @@ -178,14 +185,14 @@
      - +
    • @@ -203,7 +210,7 @@ for="adminacc_enabled"> isAdminAcc() ? 'checked' : ' '; ?> /> + name="adminacc_enabled" isAdminAcc() ? 'checked' : ' '; ?> /> @@ -216,14 +223,14 @@
    • - +
    • @@ -242,7 +249,7 @@ for="disabled"> isDisabled() ? 'checked' : ' '; ?> /> + name="disabled" isDisabled() ? 'checked' : ' '; ?> /> @@ -258,7 +265,7 @@ - +
      @@ -304,7 +311,7 @@
        - +
      • icon; ?> @@ -322,15 +329,12 @@
      - - - - - + + - +
      - diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_group.inc b/app/modules/web/themes/material-blue/views/itemshow/user_group.inc index d9042437..f4608118 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_group.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_group.inc @@ -1,17 +1,22 @@
      -

      close

      +

      close

      @@ -46,12 +51,12 @@ - + includeTemplate('aux-customfields', 'common'); ?> - + - - +
      - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc b/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc index d2413fb3..f99c0ae3 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc @@ -1,14 +1,21 @@
      -

      close

      +

      close

      @@ -61,7 +68,6 @@ -
      @@ -71,8 +77,4 @@ getIconSave()->getIcon(); ?>
      -
      - - \ No newline at end of file +
      \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc b/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc index 123285a9..1ecf3165 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc @@ -1,18 +1,23 @@
      -

      close

      +

      close

      @@ -37,7 +42,7 @@ for="profile_accadd"> isAccAdd() ? 'CHECKED' : ''; ?> /> + name="profile_accadd" isAccAdd() ? 'CHECKED' : ''; ?> />
    • @@ -53,7 +58,7 @@ @@ -70,7 +75,7 @@ for="profile_accviewpass"> isAccViewPass() ? 'CHECKED' : ''; ?> /> + name="profile_accviewpass" isAccViewPass() ? 'CHECKED' : ''; ?> /> @@ -86,7 +91,7 @@ @@ -102,7 +107,7 @@ @@ -118,7 +123,7 @@ @@ -134,7 +139,7 @@ @@ -150,7 +155,7 @@ @@ -166,7 +171,7 @@ @@ -182,7 +187,7 @@ @@ -198,7 +203,7 @@ @@ -214,7 +219,7 @@ @@ -230,7 +235,7 @@ @@ -250,7 +255,7 @@ @@ -266,7 +271,7 @@ @@ -282,7 +287,7 @@ @@ -298,7 +303,7 @@ @@ -314,7 +319,7 @@ @@ -330,7 +335,7 @@ @@ -346,7 +351,7 @@ @@ -362,7 +367,7 @@ @@ -378,7 +383,7 @@ @@ -394,7 +399,7 @@ @@ -410,7 +415,7 @@ @@ -426,7 +431,7 @@ @@ -446,7 +451,7 @@ @@ -462,7 +467,7 @@ @@ -478,7 +483,7 @@ @@ -494,7 +499,7 @@ @@ -514,7 +519,7 @@ @@ -531,21 +536,21 @@ > + maxlength="50" > - +
        - +
      • person @@ -563,13 +568,10 @@ - - - - + - +
        - \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/login/index.inc b/app/modules/web/themes/material-blue/views/login/index.inc index cad2aa7f..dddb182c 100644 --- a/app/modules/web/themes/material-blue/views/login/index.inc +++ b/app/modules/web/themes/material-blue/views/login/index.inc @@ -1,3 +1,12 @@ + +
        @@ -49,13 +58,14 @@
        - - - + + + +
        - +
        - +
        • diff --git a/app/modules/web/themes/material-blue/views/main/update.inc b/app/modules/web/themes/material-blue/views/main/update.inc index b99dc502..20982a2c 100644 --- a/app/modules/web/themes/material-blue/views/main/update.inc +++ b/app/modules/web/themes/material-blue/views/main/update.inc @@ -1,25 +1,34 @@ - 0): ?> + + + 0): ?>
          feedback + data-badge="">feedback
          + class="mdl-tooltip mdl-tooltip--top"> - - - + + +   
          cloud_download
          - - + +
          check_circle
          - +
          warning
          diff --git a/app/modules/web/themes/material-blue/views/main/upgrade.inc b/app/modules/web/themes/material-blue/views/main/upgrade.inc index b7b52b25..ff9d5e4f 100644 --- a/app/modules/web/themes/material-blue/views/main/upgrade.inc +++ b/app/modules/web/themes/material-blue/views/main/upgrade.inc @@ -1,16 +1,24 @@ +

          + printf(__('Actualización %s'), $_getvar('upgradeVersion')); ?>
          - + - + @@ -29,7 +37,9 @@
          - 0): ?> + 0): + ?>
          • @@ -42,13 +52,16 @@
            - +
          - accounts_user > 0 + accounts_user > 0 || $checkConstraints->accounts_useredit > 0 || $checkConstraints->accountshistory_user > 0 || $checkConstraints->accountshistory_useredit > 0 @@ -63,61 +76,58 @@ accounts_category > 0 - || $checkConstraints->accountshistory_category > 0 - ): ?> -
          - - -
          - - - accounts_customer > 0 - || $checkConstraints->accountshistory_customer > 0 - ): ?> -
          - - -
          - - - users_group > 0 - || $checkConstraints->accounts_group > 0 - || $checkConstraints->accountshistory_group > 0 - ): ?> -
          - - -
          - - - users_profile > 0): ?> -
          - - -
          - + || $checkConstraints->accountshistory_category > 0): ?> +
          + + +
          - + accounts_customer > 0 + || $checkConstraints->accountshistory_customer > 0): ?> +
          + + +
          + + + users_group > 0 + || $checkConstraints->accounts_group > 0 + || $checkConstraints->accountshistory_group > 0): ?> +
          + + +
          + + + users_profile > 0): ?> +
          + + +
          + + + +
          • getIconWarning()->getIcon(); ?>
            - +
            https://doc.syspass.org'); ?>
          • @@ -140,9 +150,9 @@ for="userlogin">
          - = 500): ?> + = 500): ?> - + @@ -152,9 +162,9 @@ - - - + + + diff --git a/app/modules/web/themes/material-blue/views/notification/notification.inc b/app/modules/web/themes/material-blue/views/notification/notification.inc index 8c5abdc4..573f579e 100644 --- a/app/modules/web/themes/material-blue/views/notification/notification.inc +++ b/app/modules/web/themes/material-blue/views/notification/notification.inc @@ -1,14 +1,21 @@
          -

          close

          +

          close

          @@ -18,7 +25,7 @@
          > + value="getType(); ?>" >
          @@ -30,20 +37,20 @@
          > + value="getComponent(); ?>" >
          - + - + @@ -114,7 +121,7 @@ - +
          \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/upgrade/index.inc b/app/modules/web/themes/material-blue/views/upgrade/index.inc index 7d0f39ee..72016f3b 100644 --- a/app/modules/web/themes/material-blue/views/upgrade/index.inc +++ b/app/modules/web/themes/material-blue/views/upgrade/index.inc @@ -1,6 +1,6 @@ diff --git a/app/modules/web/themes/material-blue/views/userpassreset/request.inc b/app/modules/web/themes/material-blue/views/userpassreset/request.inc index db672a21..a6adc249 100644 --- a/app/modules/web/themes/material-blue/views/userpassreset/request.inc +++ b/app/modules/web/themes/material-blue/views/userpassreset/request.inc @@ -30,7 +30,6 @@
        -
        diff --git a/app/modules/web/themes/material-blue/views/userpassreset/reset.inc b/app/modules/web/themes/material-blue/views/userpassreset/reset.inc index b440d2dc..4684fe6b 100644 --- a/app/modules/web/themes/material-blue/views/userpassreset/reset.inc +++ b/app/modules/web/themes/material-blue/views/userpassreset/reset.inc @@ -1,4 +1,11 @@ - +
        @@ -31,9 +38,8 @@ for="password_repeat">
        - + -
        diff --git a/app/modules/web/themes/material-blue/views/usersettings/general.inc b/app/modules/web/themes/material-blue/views/usersettings/general.inc index 030f9e6b..2a5bb6d0 100644 --- a/app/modules/web/themes/material-blue/views/usersettings/general.inc +++ b/app/modules/web/themes/material-blue/views/usersettings/general.inc @@ -1,4 +1,14 @@ - +
        home @@ -7,7 +17,7 @@
        @@ -18,8 +28,8 @@
        - + @@ -57,7 +67,7 @@ + value="getResultsPerPage(); ?>" required/>
        @@ -72,7 +82,7 @@
        @@ -89,7 +99,7 @@
      @@ -106,7 +116,7 @@ @@ -123,7 +133,7 @@ @@ -140,7 +150,7 @@ @@ -157,7 +167,7 @@ @@ -174,7 +184,7 @@ - +
        diff --git a/app/modules/web/themes/material-blue/views/wiki/wikipage.inc b/app/modules/web/themes/material-blue/views/wiki/wikipage.inc index dccfd723..220065ed 100644 --- a/app/modules/web/themes/material-blue/views/wiki/wikipage.inc +++ b/app/modules/web/themes/material-blue/views/wiki/wikipage.inc @@ -1,16 +1,30 @@ + +

        - 0): ?> + 0): ?>


        - +
          -
        • %s', __('Página'), $wikiUrlBase . '/' . $result['id'], $result['id']); ?>
        • +
        • %s', __('Página'), $_getvar('wikiUrlBase') . '/' . $result['id'], $result['id']); ?>
        @@ -18,15 +32,12 @@
        - +
          -
        • %s', __('Página'), $wikiUrlBase . $pageInfo['name'], $pageInfo['name']); ?>
        • +
        • %s', __('Página'), $_getvar('wikiUrlBase') . $pageInfo['name'], $pageInfo['name']); ?>
        - \ No newline at end of file diff --git a/lib/SP/Html/DataGrid/Action/DataGridActionBase.php b/lib/SP/Html/DataGrid/Action/DataGridActionBase.php index 8f7761d9..6e4eac4c 100644 --- a/lib/SP/Html/DataGrid/Action/DataGridActionBase.php +++ b/lib/SP/Html/DataGrid/Action/DataGridActionBase.php @@ -2,8 +2,8 @@ /** * sysPass * - * @author nuxsmin - * @link https://syspass.org + * @author nuxsmin + * @link https://syspass.org * @copyright 2012-2018, Rubén Domínguez nuxsmin@$syspass.org * * This file is part of sysPass. @@ -70,7 +70,7 @@ abstract class DataGridActionBase implements DataGridActionInterface * * @var array */ - protected $onClickArgs = []; + protected $onClickArgs; /** * El icono de la acción * @@ -86,7 +86,7 @@ abstract class DataGridActionBase implements DataGridActionInterface /** * La columna de origen de datos que condiciona esta acción * - * @var string + * @var array */ protected $filterRowSource; /** @@ -106,17 +106,21 @@ abstract class DataGridActionBase implements DataGridActionInterface * * @var array */ - protected $data = []; + protected $data; /** * Atributos adicionales * * @var array */ - protected $attributes = []; + protected $attributes; /** * @var array */ - protected $classes = []; + protected $classes; + /** + * @var bool + */ + protected $isSelection = false; /** * DataGridActionBase constructor. @@ -240,6 +244,10 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function setOnClickArgs($args) { + if ($this->onClickArgs === null) { + $this->onClickArgs = []; + } + $this->onClickArgs[] = $args; return $this; @@ -250,13 +258,17 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function getOnClick() { - $args = []; + if ($this->onClickArgs !== null) { - foreach ($this->onClickArgs as $arg) { - $args[] = (!is_numeric($arg) && $arg !== 'this') ? '\'' . $arg . '\'' : $arg; + $args = array_map(function ($value) { + return (!is_numeric($value) && $value !== 'this') ? '\'' . $value . '\'' : $value; + }, $this->onClickArgs); + + return count($args) > 0 ? $this->onClickFunction . '(' . implode(',', $args) . ')' : $this->onClickFunction; } - return count($args) > 0 ? $this->onClickFunction . '(' . implode(',', $args) . ')' : $this->onClickFunction; + return $this->onClickFunction; + } /** @@ -320,7 +332,7 @@ abstract class DataGridActionBase implements DataGridActionInterface } /** - * @return string + * @return array */ public function getFilterRowSource() { @@ -337,6 +349,10 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function setFilterRowSource($rowSource, $value = 1) { + if ($this->filterRowSource === null) { + $this->filterRowSource = []; + } + $this->filterRowSource[] = ['field' => $rowSource, 'value' => $value]; return $this; @@ -367,7 +383,7 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function getData() { - return $this->data; + return (array)$this->data; } /** @@ -392,6 +408,10 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function addData($name, $data) { + if ($this->data === null) { + $this->data = []; + } + $this->data[$name] = $data; return $this; @@ -402,7 +422,7 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function getAttributes() { - return $this->attributes; + return (array)$this->attributes; } /** @@ -429,6 +449,10 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function addAttribute($name, $value) { + if ($this->attributes === null) { + $this->attributes = []; + } + $this->attributes[$name] = $value; return $this; @@ -437,10 +461,14 @@ abstract class DataGridActionBase implements DataGridActionInterface /** * Returns classes as a string * - * @return array + * @return string */ public function getClassesAsString() { + if ($this->classes === null) { + return ''; + } + return implode(' ', $this->classes); } @@ -451,7 +479,7 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function getClasses() { - return $this->classes; + return (array)$this->classes; } /** @@ -473,8 +501,34 @@ abstract class DataGridActionBase implements DataGridActionInterface */ public function addClass($value) { + if ($this->classes === null) { + $this->classes = []; + } + $this->classes[] = $value; return $this; } + + /** + * Returns if the action is used for selecting multiple items + * + * @return bool + */ + public function isSelection(): bool + { + return $this->isSelection; + } + + /** + * @param bool $isSelection + * + * @return DataGridActionBase + */ + public function setIsSelection(bool $isSelection) + { + $this->isSelection = $isSelection; + + return $this; + } } diff --git a/lib/SP/Html/DataGrid/Action/DataGridActionInterface.php b/lib/SP/Html/DataGrid/Action/DataGridActionInterface.php index 30ebbbfe..073dafe0 100644 --- a/lib/SP/Html/DataGrid/Action/DataGridActionInterface.php +++ b/lib/SP/Html/DataGrid/Action/DataGridActionInterface.php @@ -2,8 +2,8 @@ /** * sysPass * - * @author nuxsmin - * @link https://syspass.org + * @author nuxsmin + * @link https://syspass.org * @copyright 2012-2018, Rubén Domínguez nuxsmin@$syspass.org * * This file is part of sysPass. @@ -111,15 +111,13 @@ interface DataGridActionInterface public function isHelper(); /** - * @param $rowSource string - * @param mixed $value Valor a filtrar - * - * @return + * @param string $rowSource + * @param mixed $value Valor a filtrar */ public function setFilterRowSource($rowSource, $value = 1); /** - * @return string + * @return array */ public function getFilterRowSource(); @@ -197,7 +195,7 @@ interface DataGridActionInterface /** * Returns classes as a string * - * @return array + * @return string */ public function getClassesAsString(); @@ -223,4 +221,11 @@ interface DataGridActionInterface * @return $this */ public function addClass($value); + + /** + * Returns if the action is used for selecting multiple items + * + * @return bool + */ + public function isSelection(): bool; } \ No newline at end of file diff --git a/lib/SP/Mvc/Controller/ControllerTrait.php b/lib/SP/Mvc/Controller/ControllerTrait.php index 27ea2345..1dfa362e 100644 --- a/lib/SP/Mvc/Controller/ControllerTrait.php +++ b/lib/SP/Mvc/Controller/ControllerTrait.php @@ -24,7 +24,6 @@ namespace SP\Mvc\Controller; -use SP\Core\Context\ContextInterface; use SP\Core\Context\SessionContext; use SP\Core\Exceptions\SPException; use SP\Http\Json; @@ -103,19 +102,16 @@ trait ControllerTrait } /** - * @param ContextInterface $context - * @param Request $request + * @param string $previousToken + * @param Request $request * * @throws SPException */ - protected function checkSecurityToken(ContextInterface $context, Request $request) + protected function checkSecurityToken($previousToken, Request $request) { $sk = $request->analyzeString('sk'); - $sessionKey = $context->getSecurityKey(); - if (!$sk - || (null !== $sessionKey && $sessionKey !== $sk) - ) { + if (!$sk || $previousToken !== $sk) { throw new SPException(__u('Acción Inválida')); } } diff --git a/lib/SP/Mvc/View/Template.php b/lib/SP/Mvc/View/Template.php index e001a692..689ad79e 100644 --- a/lib/SP/Mvc/View/Template.php +++ b/lib/SP/Mvc/View/Template.php @@ -27,7 +27,6 @@ namespace SP\Mvc\View; defined('APP_ROOT') || die(); use SP\Core\Exceptions\FileNotFoundException; -use SP\Core\Exceptions\InvalidArgumentException; use SP\Core\UI\Theme; use SP\Core\UI\ThemeInterface; @@ -51,15 +50,15 @@ final class Template */ protected $theme; /** - * @var array Variable con los archivos de plantilla a cargar + * @var array List of templates to load into the view */ private $templates = []; /** - * @var array Variable con las variables a incluir en la plantilla + * @var TemplateVarCollection Template's variables collection */ - private $vars = []; + private $vars; /** - * @var string Directorio base para los archivos de plantillas + * @var string Base path for imcluding templates */ private $base; /** @@ -77,6 +76,7 @@ final class Template public function __construct(Theme $theme) { $this->theme = $theme; + $this->vars = new TemplateVarCollection(); } /** @@ -270,17 +270,10 @@ final class Template * @param string $name Nombre del atributo * * @return null - * @throws \SP\Core\Exceptions\InvalidArgumentException */ public function __get($name) { - if (!array_key_exists($name, $this->vars)) { - logger(sprintf(__('No es posible obtener la variable "%s"'), $name)); - - throw new InvalidArgumentException(sprintf(__('No es posible obtener la variable "%s"'), $name)); - } - - return $this->vars[$name]; + return $this->get($name); } /** @@ -289,13 +282,29 @@ final class Template * * @param string $name Nombre del atributo * @param string $value Valor del atributo - * - * @return null */ public function __set($name, $value) { - $this->vars[$name] = $value; - return null; + $this->vars->set($name, $value); + } + + /** + * Returns a variable value + * + * @param $name + * + * @return mixed + */ + public function get($name) + { + if (!$this->vars->exists($name)) { + logger(sprintf(__('No es posible obtener la variable "%s"'), $name), 'ERROR'); + + return null; +// throw new InvalidArgumentException(sprintf(__('No es posible obtener la variable "%s"'), $name)); + } + + return $this->vars->get($name); } /** @@ -308,7 +317,7 @@ final class Template */ public function __isset($name) { - return array_key_exists($name, $this->vars); + return $this->vars->exists($name); } /** @@ -318,17 +327,18 @@ final class Template * @param string $name Nombre del atributo * * @return $this - * @throws \SP\Core\Exceptions\InvalidArgumentException */ public function __unset($name) { - if (!array_key_exists($name, $this->vars)) { + if (!$this->vars->exists($name)) { logger(sprintf(__('No es posible destruir la variable "%s"'), $name)); - throw new InvalidArgumentException(sprintf(__('No es posible destruir la variable "%s"'), $name)); +// throw new InvalidArgumentException(sprintf(__('No es posible destruir la variable "%s"'), $name)); + return $this; } - unset($this->vars[$name]); + $this->vars->remove($name); + return $this; } @@ -345,7 +355,18 @@ final class Template throw new FileNotFoundException(__('La plantilla no contiene archivos')); } - extract($this->vars, EXTR_SKIP); + $icons = $this->vars->get('icons'); + $configData = $this->vars->get('configData'); + $sk = $this->vars->get('sk'); + + // An anonymous proxy function for handling views variables + $_getvar = function ($key, $default = null) { + if (DEBUG && !$this->vars->exists($key)) { + logger(sprintf(__('No es posible obtener la variable "%s"'), $key), 'WARN'); + } + + return $this->vars->get($key, $default); + }; ob_start(); @@ -371,11 +392,15 @@ final class Template $name = $scope . '_' . $name; } - if (null !== $index) { - $this->vars[$name][$index] = $value; + $var = $this->vars->get($name, []); + + if (null === $index) { + $var[] = $value; } else { - $this->vars[$name][] = $value; + $var[$index] = $value; } + + $this->vars->set($name, $var); } /** @@ -493,7 +518,7 @@ final class Template $name = $scope . '_' . $name; } - $this->vars[$name] = $value; + $this->vars->set($name, $value); } /** @@ -503,16 +528,4 @@ final class Template { return $this->upgraded; } - - /** - * Establecer los atributos de la clase a partir de un array. - * - * @param array $vars Con los atributos de la clase - */ - private function setVars(&$vars) - { - foreach ($vars as $name => $value) { - $this->{$name} = $value; - } - } } \ No newline at end of file diff --git a/lib/SP/Mvc/View/TemplateVarCollection.php b/lib/SP/Mvc/View/TemplateVarCollection.php new file mode 100644 index 00000000..9d4a14f6 --- /dev/null +++ b/lib/SP/Mvc/View/TemplateVarCollection.php @@ -0,0 +1,37 @@ +. + */ + +namespace SP\Mvc\View; + +use SP\Core\DataCollection; + +/** + * Class TemplateVarCollection + * + * @package SP\Mvc\View + */ +final class TemplateVarCollection extends DataCollection +{ + +} \ No newline at end of file diff --git a/lib/SP/Services/Account/AccountSearchItem.php b/lib/SP/Services/Account/AccountSearchItem.php index f888bdbe..977a2673 100644 --- a/lib/SP/Services/Account/AccountSearchItem.php +++ b/lib/SP/Services/Account/AccountSearchItem.php @@ -416,4 +416,14 @@ final class AccountSearchItem { $this->tags = $tags; } + + /** + * @param $wikiFilter + * + * @return bool + */ + public function isWikiMatch($wikiFilter) + { + return preg_match('/^(' . $wikiFilter . ').*/i', $this->accountSearchVData->getName()) !== false; + } } \ No newline at end of file diff --git a/lib/SP/Services/Install/Installer.php b/lib/SP/Services/Install/Installer.php index c802bfc0..c70b88d4 100644 --- a/lib/SP/Services/Install/Installer.php +++ b/lib/SP/Services/Install/Installer.php @@ -57,7 +57,7 @@ final class Installer extends Service */ const VERSION = [3, 0, 0]; const VERSION_TEXT = '3.0-beta'; - const BUILD = 18101601; + const BUILD = 18102201; /** * @var DatabaseSetupInterface diff --git a/public/js/app-actions.js b/public/js/app-actions.js index 61f11ff5..c52a5ef3 100644 --- a/public/js/app-actions.js +++ b/public/js/app-actions.js @@ -37,47 +37,12 @@ sysPass.Actions = function (log) { Object.freeze(ajaxUrl); - // Función para cargar el contenido de la acción del menú seleccionada - const doAction = function (obj, view) { - const itemId = obj.itemId !== undefined ? "/" + obj.itemId : ""; - - const data = { - r: obj.r + itemId, - isAjax: 1 - }; - - const opts = sysPassApp.requests.getRequestOpts(); - opts.url = ajaxUrl.entrypoint; - opts.method = "get"; - opts.type = "html"; - opts.addHistory = true; - opts.data = data; - - sysPassApp.requests.getActionCall(opts, function (response) { - const $content = $("#content"); - - $content.empty().html(response); - - const views = sysPassApp.triggers.views; - views.common($content); - - if (view !== undefined && typeof views[view] === "function") { - views[view](); - } - - const $mdlContent = $(".mdl-layout__content"); - - if ($mdlContent.scrollTop() > 0) { - $mdlContent.animate({scrollTop: 0}, 1000); - } - }); - }; - // Función para cargar el contenido de la acción del menú seleccionada const getContent = function (data, view) { log.info("getContent"); data.isAjax = 1; + data.sk = sysPassApp.sk.get(); const opts = sysPassApp.requests.getRequestOpts(); opts.url = ajaxUrl.entrypoint; @@ -243,6 +208,8 @@ sysPass.Actions = function (log) { sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); + sysPassApp.sk.set(json.csrf); + account.search($obj); }); } @@ -355,12 +322,16 @@ sysPass.Actions = function (log) { const opts = sysPassApp.requests.getRequestOpts(); opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("action-route") + "/" + $obj.data("item-id"); - opts.data = $obj.serialize(); + opts.data = $obj.serialize() + "&sk=" + sysPassApp.sk.get(); sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); - if (json.status === 0 && json.data['nextAction'] !== undefined) { + if (json.status === 0 + && json.data['nextAction'] !== undefined + ) { + sysPassApp.sk.set(json.csrf); + getContent({r: json.data.nextAction['nextAction']}, "account"); } }); @@ -389,20 +360,29 @@ sysPass.Actions = function (log) { const parentId = $obj.data("parent-id"); const itemId = parentId === undefined ? $obj.data("item-id") : parentId; - getContent(sysPassApp.requests.getRouteForQuery($obj.data("action-route"), itemId), "account"); + const route = sysPassApp.requests.getRouteForQuery($obj.data("action-route"), itemId); + + getContent(route, "account"); }, saveEditRestore: function ($obj) { log.info("account:restore"); const opts = sysPassApp.requests.getRequestOpts(); - opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("action-route") + "/" + $obj.data("history-id") + "/" + $obj.data("item-id"); - opts.data = $obj.serialize(); + opts.url = ajaxUrl.entrypoint; + opts.data = { + r: $obj.data("action-route") + "/" + $obj.data("history-id") + "/" + $obj.data("item-id"), + sk: sysPassApp.sk.get() + }; sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); - if (json.data.itemId !== undefined && json.data.nextAction !== undefined) { - getContent(sysPassApp.requests.getRouteForQuery(json.data.nextAction, json.data.itemId), "account"); + if (json.data.itemId !== undefined + && json.data.nextAction !== undefined + ) { + const route = sysPassApp.requests.getRouteForQuery(json.data.nextAction, json.data.itemId); + + getContent(route, "account"); } }); }, @@ -446,8 +426,6 @@ sysPass.Actions = function (log) { sysPassApp.msg.out(json); } - sysPassApp.sk.set(json.data.sk); - $("#res-content").empty().html(json.data.html); }); }, @@ -466,8 +444,12 @@ sysPass.Actions = function (log) { sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); - if (json.data.itemId !== undefined && json.data.nextAction !== undefined) { - getContent(sysPassApp.requests.getRouteForQuery(json.data.nextAction, json.data.itemId), "account"); + if (json.data.itemId !== undefined + && json.data.nextAction !== undefined + ) { + const route = sysPassApp.requests.getRouteForQuery(json.data.nextAction, json.data.itemId); + + getContent(route, "account"); } }); } @@ -1009,7 +991,7 @@ sysPass.Actions = function (log) { opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("action-route") + "/" + accountId + "/" + notify; } else { opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("action-route"); - opts.data = $obj.serialize(); + opts.data = $obj.serialize() + "&sk=" + sysPassApp.sk.get(); } sysPassApp.requests.getActionCall(opts, function (json) { @@ -1413,7 +1395,7 @@ sysPass.Actions = function (log) { const opts = sysPassApp.requests.getRequestOpts(); opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("route"); - opts.data = $obj.serialize(); + opts.data = $obj.serialize() + "&sk=" + sysPassApp.sk.get(); sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); @@ -1453,8 +1435,6 @@ sysPass.Actions = function (log) { getContent({r: $obj.data("action-next")}); } - sysPassApp.sk.set(json.csrf); - notification.getActive(); }); }, @@ -1473,7 +1453,7 @@ sysPass.Actions = function (log) { const opts = sysPassApp.requests.getRequestOpts(); opts.url = ajaxUrl.entrypoint + "?r=" + $obj.data("route"); - opts.data = $obj.serialize(); + opts.data = $obj.serialize() + "&sk=" + sysPassApp.sk.get(); sysPassApp.requests.getActionCall(opts, function (json) { sysPassApp.msg.out(json); @@ -1804,7 +1784,6 @@ sysPass.Actions = function (log) { }; return { - doAction: doAction, getContent: getContent, showFloatingBox: showFloatingBox, closeFloatingBox: closeFloatingBox, diff --git a/public/js/app-actions.min.js b/public/js/app-actions.min.js index 1e6028a2..8a94c68d 100644 --- a/public/js/app-actions.min.js +++ b/public/js/app-actions.min.js @@ -1,22 +1,22 @@ var $jscomp=$jscomp||{};$jscomp.scope={};$jscomp.findInternal=function(d,l,e){d instanceof String&&(d=String(d));for(var f=d.length,h=0;h'+b+"
      "),k=c.find("img");if(0===k.length)return h(b);k.hide();$.magnificPopup.open({items:{src:c,type:"inline"}, -callbacks:{open:function(){var a=this;k.on("click",function(){a.close()});setTimeout(function(){var a=sysPassApp.util.resizeImage(k);c.css({backgroundColor:"#fff",width:a.width,height:"auto"});k.show("slow")},500)}}})},q=function(){$.magnificPopup.close()},n={view:function(a){d.info("account:show");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"),a.data("item-id")),"account")},viewHistory:function(a){d.info("account:showHistory");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"), +sysPass.Actions=function(d){var l=0,e={entrypoint:"/index.php"};Object.freeze(e);var f=function(a,b){d.info("getContent");a.isAjax=1;a.sk=sysPassApp.sk.get();var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.type="html";c.addHistory=!0;c.data=a;return sysPassApp.requests.getActionCall(c,function(a){var c=$("#content");c.empty().html(a);a=sysPassApp.triggers.views;a.common(c);if(void 0!==b&&"function"===typeof a[b])a[b]();c=$(".mdl-layout__content");0'+b+""),k=c.find("img");if(0===k.length)return h(b);k.hide();$.magnificPopup.open({items:{src:c, +type:"inline"},callbacks:{open:function(){var a=this;k.on("click",function(){a.close()});setTimeout(function(){var a=sysPassApp.util.resizeImage(k);c.css({backgroundColor:"#fff",width:a.width,height:"auto"});k.show("slow")},500)}}})},q=function(){$.magnificPopup.close()},n={view:function(a){d.info("account:show");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"),a.data("item-id")),"account")},viewHistory:function(a){d.info("account:showHistory");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"), a.val()),"account")},edit:function(a){d.info("account:edit");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"),a.data("item-id")),"account")},delete:function(a){d.info("account:delete");var b='

      '+sysPassApp.config.LANG[3]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(c){c= -sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.data={r:"account/saveDelete/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(c,function(c){sysPassApp.msg.out(c);n.search(a)})}}})},viewPass:function(a){d.info("account:viewPass");var b=a.data("parent-id")||0,c=0===b?a.data("item-id"):b,k=sysPassApp.requests.getRequestOpts();k.url=e.entrypoint;k.method="get";k.data={r:a.data("action-route")+"/"+c+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(k, -function(a){0!==a.status?sysPassApp.msg.out(a):(a=$(a.data.html),h(a),l=setTimeout(function(){q()},3E4),a.on("mouseleave",function(){clearTimeout(l);l=setTimeout(function(){q()},3E4)}).on("mouseenter",function(){0!==l&&clearTimeout(l)}))})},viewPassHistory:function(a){d.info("account:viewPassHistory");n.viewPass(a)},copyPass:function(a){d.info("account:copyPass");var b=a.data("parent-id");b=0===b?a.data("item-id"):b;var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.async= -!1;c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};return sysPassApp.requests.getActionCall(c)},copyPassHistory:function(a){d.info("account:copyPassHistory");n.copyPassHistory(a)},copy:function(a){d.info("account:copy");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"),a.data("item-id")),"account")},saveFavorite:function(a,b){d.info("account:saveFavorite");var c="on"===a.data("status"),k=c?a.data("action-route-off"):a.data("action-route-on"),r=sysPassApp.requests.getRequestOpts(); -r.url=e.entrypoint;r.data={r:k+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(r,function(k){sysPassApp.msg.out(k);0===k.status&&(a.data("status",c?"off":"on"),"function"===typeof b&&b())})},request:function(a){d.info("account:request");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route")+"/"+a.data("item-id");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&void 0!== -a.data.nextAction&&f({r:a.data.nextAction.nextAction},"account")})},menu:function(a){a.hide();a.parent().children(".actions-optional").show(250)},sort:function(a){d.info("account:sort");var b=$("#frmSearch");b.find('input[name="skey"]').val(a.data("key"));b.find('input[name="sorder"]').val(a.data("dir"));b.find('input[name="start"]').val(a.data("start"));n.search()},editPass:function(a){d.info("account:editpass");var b=a.data("parent-id");b=void 0===b?a.data("item-id"):b;f(sysPassApp.requests.getRouteForQuery(a.data("action-route"), -b),"account")},saveEditRestore:function(a){d.info("account:restore");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route")+"/"+a.data("history-id")+"/"+a.data("item-id");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);void 0!==a.data.itemId&&void 0!==a.data.nextAction&&f(sysPassApp.requests.getRouteForQuery(a.data.nextAction,a.data.itemId),"account")})},listFiles:function(a){d.info("account:getfiles");var b=sysPassApp.requests.getRequestOpts(); -b.method="get";b.type="html";b.url=e.entrypoint;b.data={r:a.data("action-route")+"/"+a.data("item-id"),del:a.data("delete"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(c){a.html(c)})},search:function(a){d.info("account:search");var b=$("#frmSearch");b.find("input[name='sk']").val(sysPassApp.sk.get());b.find("input[name='skey']").val();b.find("input[name='sorder']").val();void 0!==a&&b.find("input[name='start']").val(0);a=sysPassApp.requests.getRequestOpts();a.url=e.entrypoint+ -"?r="+b.data("action-route");a.method="get";a.data=b.serialize();sysPassApp.requests.getActionCall(a,function(a){10===a.status&&sysPassApp.msg.out(a);sysPassApp.sk.set(a.data.sk);$("#res-content").empty().html(a.data.html)})},save:function(a){d.info("account:save");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route")+"/"+a.data("item-id");b.data=a.serialize();$("select.select-box-tags[data-hash][data-updated=true]").each(function(a,k){b.data+="&"+k.getAttribute("id")+ -"_update=1"});sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);void 0!==a.data.itemId&&void 0!==a.data.nextAction&&f(sysPassApp.requests.getRouteForQuery(a.data.nextAction,a.data.itemId),"account")})}},w={logout:function(){sysPassApp.util.redirect("index.php?r=login/logout")},login:function(a){d.info("main:login");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.method="get";b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(b){var c= -$(".extra-hidden");switch(b.status){case 0:sysPassApp.util.redirect(b.data.url);break;case 2:sysPassApp.msg.out(b);a.find("input[type='text'],input[type='password']").val("");a.find("input:visible:first").focus();0

      '+sysPassApp.config.LANG[59]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){var c;(b=a.find("input[name='taskId']").val())&&(c=v(b));var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint+"?r="+a.data("action-route");d.method="get";d.useFullLoading=!!b;d.data=a.serialize(); +sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.data={r:"account/saveDelete/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(c,function(c){sysPassApp.msg.out(c);sysPassApp.sk.set(c.csrf);n.search(a)})}}})},viewPass:function(a){d.info("account:viewPass");var b=a.data("parent-id")||0,c=0===b?a.data("item-id"):b,k=sysPassApp.requests.getRequestOpts();k.url=e.entrypoint;k.method="get";k.data={r:a.data("action-route")+"/"+c+"/"+b,sk:sysPassApp.sk.get(),isAjax:1}; +sysPassApp.requests.getActionCall(k,function(a){0!==a.status?sysPassApp.msg.out(a):(a=$(a.data.html),h(a),l=setTimeout(function(){q()},3E4),a.on("mouseleave",function(){clearTimeout(l);l=setTimeout(function(){q()},3E4)}).on("mouseenter",function(){0!==l&&clearTimeout(l)}))})},viewPassHistory:function(a){d.info("account:viewPassHistory");n.viewPass(a)},copyPass:function(a){d.info("account:copyPass");var b=a.data("parent-id");b=0===b?a.data("item-id"):b;var c=sysPassApp.requests.getRequestOpts();c.url= +e.entrypoint;c.method="get";c.async=!1;c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};return sysPassApp.requests.getActionCall(c)},copyPassHistory:function(a){d.info("account:copyPassHistory");n.copyPassHistory(a)},copy:function(a){d.info("account:copy");f(sysPassApp.requests.getRouteForQuery(a.data("action-route"),a.data("item-id")),"account")},saveFavorite:function(a,b){d.info("account:saveFavorite");var c="on"===a.data("status"),k=c?a.data("action-route-off"):a.data("action-route-on"), +r=sysPassApp.requests.getRequestOpts();r.url=e.entrypoint;r.data={r:k+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(r,function(k){sysPassApp.msg.out(k);0===k.status&&(a.data("status",c?"off":"on"),"function"===typeof b&&b())})},request:function(a){d.info("account:request");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route")+"/"+a.data("item-id");b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b, +function(a){sysPassApp.msg.out(a);0===a.status&&void 0!==a.data.nextAction&&(sysPassApp.sk.set(a.csrf),f({r:a.data.nextAction.nextAction},"account"))})},menu:function(a){a.hide();a.parent().children(".actions-optional").show(250)},sort:function(a){d.info("account:sort");var b=$("#frmSearch");b.find('input[name="skey"]').val(a.data("key"));b.find('input[name="sorder"]').val(a.data("dir"));b.find('input[name="start"]').val(a.data("start"));n.search()},editPass:function(a){d.info("account:editpass"); +var b=a.data("parent-id");b=void 0===b?a.data("item-id"):b;a=sysPassApp.requests.getRouteForQuery(a.data("action-route"),b);f(a,"account")},saveEditRestore:function(a){d.info("account:restore");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.data={r:a.data("action-route")+"/"+a.data("history-id")+"/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);void 0!==a.data.itemId&&void 0!==a.data.nextAction&&(a=sysPassApp.requests.getRouteForQuery(a.data.nextAction, +a.data.itemId),f(a,"account"))})},listFiles:function(a){d.info("account:getfiles");var b=sysPassApp.requests.getRequestOpts();b.method="get";b.type="html";b.url=e.entrypoint;b.data={r:a.data("action-route")+"/"+a.data("item-id"),del:a.data("delete"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(c){a.html(c)})},search:function(a){d.info("account:search");var b=$("#frmSearch");b.find("input[name='sk']").val(sysPassApp.sk.get());b.find("input[name='skey']").val();b.find("input[name='sorder']").val(); +void 0!==a&&b.find("input[name='start']").val(0);a=sysPassApp.requests.getRequestOpts();a.url=e.entrypoint+"?r="+b.data("action-route");a.method="get";a.data=b.serialize();sysPassApp.requests.getActionCall(a,function(a){10===a.status&&sysPassApp.msg.out(a);$("#res-content").empty().html(a.data.html)})},save:function(a){d.info("account:save");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route")+"/"+a.data("item-id");b.data=a.serialize();$("select.select-box-tags[data-hash][data-updated=true]").each(function(a, +k){b.data+="&"+k.getAttribute("id")+"_update=1"});sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);void 0!==a.data.itemId&&void 0!==a.data.nextAction&&(a=sysPassApp.requests.getRouteForQuery(a.data.nextAction,a.data.itemId),f(a,"account"))})}},w={logout:function(){sysPassApp.util.redirect("index.php?r=login/logout")},login:function(a){d.info("main:login");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.method="get";b.data=a.serialize();sysPassApp.requests.getActionCall(b, +function(b){var c=$(".extra-hidden");switch(b.status){case 0:sysPassApp.util.redirect(b.data.url);break;case 2:sysPassApp.msg.out(b);a.find("input[type='text'],input[type='password']").val("");a.find("input:visible:first").focus();0";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){var c;(b=a.find("input[name='taskId']").val())&&(c=v(b));var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint+"?r="+a.data("action-route");d.method="get";d.useFullLoading=!!b;d.data=a.serialize(); sysPassApp.requests.getActionCall(d,function(b){sysPassApp.msg.out(b);0!==b.status?a.find(":input[name=key]").val(""):(void 0!==c&&c.close(),setTimeout(function(){sysPassApp.util.redirect("index.php")},5E3))})}}})},getUpdates:function(){d.info("main:getUpdates");var a=sysPassApp.requests.getRequestOpts();a.url=e.entrypoint+"?r=status/checkRelease";a.method="get";a.timeout=1E4;a.useLoading=!1;a.data={isAjax:1};var b=$("#updates");sysPassApp.requests.getActionCall(a,function(a){0===a.status?0'+a.data.title+'\n
      cloud_download
      \n \n '+a.data.description+""):b.html('
      check_circle
      \n '+ sysPassApp.config.LANG[68]+""):b.html('
      warning
      \n '+sysPassApp.config.LANG[69]+"");sysPassApp.theme.update()},function(){b.html('
      warning
      \n '+ @@ -26,32 +26,31 @@ a.data.length+'">feedback\n \n "_update=1"});sysPassApp.requests.getActionCall(c,function(c){sysPassApp.msg.out(c);0===c.status&&("function"===typeof b&&b(),void 0!==a.data("reload")?(d.info("reload"),setTimeout(function(){sysPassApp.util.redirect("index.php")},2E3)):!0===g.state.tab.refresh&&(d.info("refresh"),f({r:g.state.tab.route,tabIndex:g.state.tab.index})))})},refresh:function(a){this.state.update(a);f({r:this.state.tab.route,tabIndex:this.state.tab.index})}},t={show:function(a){d.info("appMgmt:show");g.state.update(a); var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";var c=m.getSelection(a);!1!==c&&(b.data={r:a.data("action-route")+(0===c.length?"/"+a.data("item-id"):""),items:c,sk:sysPassApp.sk.get(),isAjax:1},sysPassApp.requests.getActionCall(b,function(b){if(0!==b.status)sysPassApp.msg.out(b);else{var d=a.data("item-dst");h(b.data.html,{open:function(){d&&(g.state.tab.refresh=!1)},close:function(){d&&c.update(a)}})}}))},delete:function(a){d.info("appMgmt:delete");g.state.update(a); m.delete(a,function(b){var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+(0===b.length?"/"+a.data("item-id"):""),items:b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a);f({r:g.state.tab.route,tabIndex:g.state.tab.index})})})},save:function(a){d.info("appMgmt:save");g.save(a,function(){q()})},search:function(a){d.info("appMgmt:search");m.search(a)},nav:function(a){d.info("appMgmt:nav"); -m.nav(a)}},u={check:function(a){d.info("notification:check");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(b){0===b.status&&f({r:a.data("action-next")});sysPassApp.sk.set(b.csrf);u.getActive()})},search:function(a){d.info("notification:search");m.search(a)},show:function(a){d.info("notification:show");t.show(a)},save:function(a){d.info("notification:save"); -var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(b){sysPassApp.msg.out(b);0===b.status&&($.magnificPopup.close(),f({r:a.data("action-next")}).then(function(){u.getActive()}))})},delete:function(a){d.info("notification:delete");m.delete(a,function(b){var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+(0===b.length?"/"+a.data("item-id"):""), -items:b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);f({r:a.data("action-next")})})})},getActive:function(){d.info("notification:getActive");var a=sysPassApp.requests.getRequestOpts();a.url=e.entrypoint;a.method="get";a.data={r:"items/notifications",sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(a,function(a){var b=$(".notifications-badge"),d=$(".notifications-tooltip");b.each(function(){var b=$(this);b.attr("data-badge", +m.nav(a)}},u={check:function(a){d.info("notification:check");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(b){0===b.status&&f({r:a.data("action-next")});u.getActive()})},search:function(a){d.info("notification:search");m.search(a)},show:function(a){d.info("notification:show");t.show(a)},save:function(a){d.info("notification:save");var b= +sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(b){sysPassApp.msg.out(b);0===b.status&&($.magnificPopup.close(),f({r:a.data("action-next")}).then(function(){u.getActive()}))})},delete:function(a){d.info("notification:delete");m.delete(a,function(b){var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+(0===b.length?"/"+a.data("item-id"): +""),items:b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);f({r:a.data("action-next")})})})},getActive:function(){d.info("notification:getActive");var a=sysPassApp.requests.getRequestOpts();a.url=e.entrypoint;a.method="get";a.data={r:"items/notifications",sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(a,function(a){var b=$(".notifications-badge"),d=$(".notifications-tooltip");b.each(function(){var b=$(this);b.attr("data-badge", a.data.count);0===a.data.count?(b.removeClass(b.data("color-class")),d.empty().html(a.data.message)):(b.addClass(b.data("color-class")),d.empty().html(a.data.message_has))});0",d=m.getSelection(a);!1!==d&&mdlDialog().show({text:c,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(a){a.preventDefault();"function"===typeof b&&b(d)}}})},getSelection:function(a){a=a.data("selection");var b=[];return a&&($(a).find(".is-selected").each(function(){b.push($(this).data("item-id"))}),0===b.length)?!1: -b}},v=function(a){var b=$("#taskStatus");b.empty().html(sysPassApp.config.LANG[62]);var c=sysPassApp.requests.getRequestOpts();c.method="get";c.url=e.entrypoint+"?r=task/runTask/"+a;return sysPassApp.requests.getActionEvent(c,function(a){a=a.task+" - "+a.message+" - "+a.time+" - "+a.progress+"%";a+="
      "+sysPassApp.config.LANG[62];b.empty().html(a)})};return{doAction:function(a,b){a={r:a.r+(void 0!==a.itemId?"/"+a.itemId:""),isAjax:1};var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint; -c.method="get";c.type="html";c.addHistory=!0;c.data=a;sysPassApp.requests.getActionCall(c,function(a){var c=$("#content");c.empty().html(a);a=sysPassApp.triggers.views;a.common(c);if(void 0!==b&&"function"===typeof a[b])a[b]();c=$(".mdl-layout__content");0";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}}, -positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&n.listFiles($("#list-account-files"))})}}})}},checks:{wiki:function(a){d.info("checks:wiki");a=$(a.data("src"));a.find("[name='sk']").val(sysPassApp.sk.get());var b=sysPassApp.requests.getRequestOpts(); -b.url=e.entrypoint;b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&$("#dokuWikiResCheck").html(a.data)})}},config:{save:function(a){d.info("config:save");g.save(a)},masterpass:function(a){var b='

      '+sysPassApp.config.LANG[59]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(b){b.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44]);a.find(":input[type=password]").val("")}}, -positive:{title:sysPassApp.config.LANG[43],onClick:function(b){var c;(b=a.find("input[name='taskId']").val())&&(c=v(b));var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint;d.useFullLoading=!!b;d.data=a.serialize();sysPassApp.requests.getActionCall(d,function(b){sysPassApp.msg.out(b);a.find(":input[type=password]").val("");void 0!==c&&c.close()})}}})},backup:function(a){d.info("config:backup");g.state.update(a);var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route"); -b.useFullLoading=!0;b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&f({r:g.state.tab.route,tabIndex:g.state.tab.index})})},export:function(a){d.info("config:export");g.save(a)},import:function(a){d.info("config:import");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route");b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a)})}, -refreshMpass:function(a){d.info("config:import");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route");b.data={sk:a.data("sk"),isAjax:1};sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a)})},mailCheck:function(a){d.info("config:mailCheck");var b=$(a.data("src")),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route");c.data=b.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a)})}}, -main:w,user:{showSettings:function(a){d.info("user:showSettings");f({r:a.data("action-route")},"userSettings")},saveSettings:function(a){d.info("user:saveSettings");g.save(a)},password:function(a){d.info("user:password");var b=sysPassApp.requests.getRequestOpts();b.type="html";b.method="get";b.url=e.entrypoint;b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(a){0===a.length?w.logout():h(a)})},passreset:function(a){d.info("user:passreset"); -var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"/?r="+a.data("action-route");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&setTimeout(function(){sysPassApp.util.redirect("index.php")},2E3)})}},link:{save:function(a){d.info("link:save");var b=function(b){var c=a.data("account-id"),d=sysPassApp.requests.getRequestOpts();c?d.url=e.entrypoint+"?r="+a.data("action-route")+"/"+c+"/"+b:(d.url=e.entrypoint+"?r="+a.data("action-route"), -d.data=a.serialize());sysPassApp.requests.getActionCall(d,function(b){sysPassApp.msg.out(b);0===b.status&&f({r:a.data("action-next")+"/"+c})})},c='

      '+sysPassApp.config.LANG[48]+"

      ";mdlDialog().show({text:c,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();b(0)}},positive:{title:sysPassApp.config.LANG[43],onClick:function(a){a.preventDefault();b(1)}}})},delete:function(a){d.info("link:delete");var b='

      '+ -sysPassApp.config.LANG[12]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();b=a.data("item-id");var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route")+"/"+b;sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);0===b.status&&f({r:a.data("action-next")+ -"/"+a.data("account-id")})})}}})},refresh:function(a){d.info("link:refresh");g.state.update(a);var b=a.data("item-id"),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);0===b.status&&((b=a.data("action-next"))?f({r:b+"/"+a.data("account-id")}):f({r:g.state.tab.route,tabIndex:g.state.tab.index}))})}},eventlog:{clear:function(a){var b='

      '+ -sysPassApp.config.LANG[20]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();g.save(a)}}})}},ajaxUrl:e,plugin:{toggle:function(a){d.info("plugin:enable");g.state.update(a);var b=a.data("item-id"),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+ -"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a);0===a.status&&setTimeout(function(){sysPassApp.util.redirect("index.php")},2E3)})},reset:function(a){d.info("plugin:reset");var b='

      '+sysPassApp.config.LANG[58]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43], -onClick:function(b){b.preventDefault();g.save(a)}}})},search:function(a){d.info("plugin:search");m.search(a)},show:function(a){d.info("plugin:show");t.show(a)},save:function(a){d.info("plugin:save");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(b){sysPassApp.msg.out(b);0===b.status&&(f({r:a.data("action-next")}),$.magnificPopup.close())})},nav:function(a){d.info("plugin:nav");m.nav(a)}},notification:u, -wiki:{show:function(a){d.info("wiki:show");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={pageName:a.data("pagename"),actionId:a.data("action-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(a){0!==a.status?sysPassApp.msg.out(a):h(a.data.html)})}},items:{get:function(a){d.info("items:get");var b=a[0].selectize;b.clearOptions();b.load(function(c){var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint;d.method="get";d.data= -{r:a.data("action-route")+"/"+a.data("item-id"),sk:a.data("sk")};sysPassApp.requests.getActionCall(d,function(d){c(d.data);b.setValue(a.data("selected-id"),!0);sysPassApp.triggers.updateFormHash()})})},update:function(a){d.info("items:update");var b=$("#"+a.data("item-dst"))[0].selectize,c=b.getValue();b.clearOptions();b.load(function(d){var f=sysPassApp.requests.getRequestOpts();f.url=e.entrypoint;f.method="get";f.data={r:a.data("item-route"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(f, -function(a){d(a);b.setValue(c,!0)})})}},ldap:{check:function(a){d.info("ldap:check");var b=$(a.data("src")),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route");c.data=b.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a);0===a.status&&void 0!==a.data.template&&void 0!==a.data.items&&h(a.data.template,{open:function(){var b=$("#ldap-results").find(".list-wrap").empty();a.data.items.forEach(function(a){b.append(sysPassApp.theme.html.getList(a.items, -a.icon))})}})})},import:function(a){d.info("ldap:import");var b='

      '+sysPassApp.config.LANG[57]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b=$(a.data("src"));var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route");c.data=b.serialize()+"&sk="+ -sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a)})}}})}},track:{unlock:function(a){d.info("track:unlock");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(b){sysPassApp.msg.out(b);g.refresh(a)})},clear:function(a){d.info("track:clear");var b='

      '+sysPassApp.config.LANG[71]+ -"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();g.save(a)}}})}}}}; +b}},v=function(a){var b=$("#taskStatus");b.empty().html(sysPassApp.config.LANG[62]);var c=sysPassApp.requests.getRequestOpts();c.method="get";c.url=e.entrypoint+"?r=task/runTask/"+a;return sysPassApp.requests.getActionEvent(c,function(a){a=a.task+" - "+a.message+" - "+a.time+" - "+a.progress+"%";a+="
      "+sysPassApp.config.LANG[62];b.empty().html(a)})};return{getContent:f,showFloatingBox:h,closeFloatingBox:q,appMgmt:t,account:n,accountManager:{restore:function(a){d.info("accountManager:restore"); +g.state.update(a);var b=a.data("item-id"),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(c){sysPassApp.msg.out(c);0===c.status&&((c=a.data("action-next"))?f({r:c+"/"+b}):f({r:g.state.tab.route,tabIndex:g.state.tab.index}))})}},file:{view:function(a){d.info("file:view");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+ +"/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(b){if(0!==b.status)return sysPassApp.msg.out(b);p(a,b.data.html)})},download:function(a){d.info("file:download");a={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get()};$.fileDownload(e.entrypoint,{httpMethod:"GET",data:a})},delete:function(a){d.info("file:delete");var b='

      '+sysPassApp.config.LANG[15]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44], +onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&n.listFiles($("#list-account-files"))})}}})}},checks:{wiki:function(a){d.info("checks:wiki");a=$(a.data("src")); +a.find("[name='sk']").val(sysPassApp.sk.get());var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&$("#dokuWikiResCheck").html(a.data)})}},config:{save:function(a){d.info("config:save");g.save(a)},masterpass:function(a){var b='

      '+sysPassApp.config.LANG[59]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(b){b.preventDefault(); +sysPassApp.msg.error(sysPassApp.config.LANG[44]);a.find(":input[type=password]").val("")}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){var c;(b=a.find("input[name='taskId']").val())&&(c=v(b));var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint;d.useFullLoading=!!b;d.data=a.serialize();sysPassApp.requests.getActionCall(d,function(b){sysPassApp.msg.out(b);a.find(":input[type=password]").val("");void 0!==c&&c.close()})}}})},backup:function(a){d.info("config:backup");g.state.update(a); +var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route");b.useFullLoading=!0;b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&f({r:g.state.tab.route,tabIndex:g.state.tab.index})})},export:function(a){d.info("config:export");g.save(a)},import:function(a){d.info("config:import");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route");b.data=a.serialize()+ +"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a)})},refreshMpass:function(a){d.info("config:import");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("action-route");b.data={sk:a.data("sk"),isAjax:1};sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a)})},mailCheck:function(a){d.info("config:mailCheck");var b=$(a.data("src")),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route"); +c.data=b.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a)})}},main:w,user:{showSettings:function(a){d.info("user:showSettings");f({r:a.data("action-route")},"userSettings")},saveSettings:function(a){d.info("user:saveSettings");g.save(a)},password:function(a){d.info("user:password");var b=sysPassApp.requests.getRequestOpts();b.type="html";b.method="get";b.url=e.entrypoint;b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(), +isAjax:1};sysPassApp.requests.getActionCall(b,function(a){0===a.length?w.logout():h(a)})},passreset:function(a){d.info("user:passreset");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"/?r="+a.data("action-route");b.data=a.serialize();sysPassApp.requests.getActionCall(b,function(a){sysPassApp.msg.out(a);0===a.status&&setTimeout(function(){sysPassApp.util.redirect("index.php")},2E3)})}},link:{save:function(a){d.info("link:save");var b=function(b){var c=a.data("account-id"),d=sysPassApp.requests.getRequestOpts(); +c?d.url=e.entrypoint+"?r="+a.data("action-route")+"/"+c+"/"+b:(d.url=e.entrypoint+"?r="+a.data("action-route"),d.data=a.serialize()+"&sk="+sysPassApp.sk.get());sysPassApp.requests.getActionCall(d,function(b){sysPassApp.msg.out(b);0===b.status&&f({r:a.data("action-next")+"/"+c})})},c='

      '+sysPassApp.config.LANG[48]+"

      ";mdlDialog().show({text:c,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();b(0)}},positive:{title:sysPassApp.config.LANG[43], +onClick:function(a){a.preventDefault();b(1)}}})},delete:function(a){d.info("link:delete");var b='

      '+sysPassApp.config.LANG[12]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();b=a.data("item-id");var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+ +a.data("action-route")+"/"+b;sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);0===b.status&&f({r:a.data("action-next")+"/"+a.data("account-id")})})}}})},refresh:function(a){d.info("link:refresh");g.state.update(a);var b=a.data("item-id"),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(b){sysPassApp.msg.out(b);0===b.status&&((b=a.data("action-next"))? +f({r:b+"/"+a.data("account-id")}):f({r:g.state.tab.route,tabIndex:g.state.tab.index}))})}},eventlog:{clear:function(a){var b='

      '+sysPassApp.config.LANG[20]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();g.save(a)}}})}},ajaxUrl:e,plugin:{toggle:function(a){d.info("plugin:enable"); +g.state.update(a);var b=a.data("item-id"),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint;c.method="get";c.data={r:a.data("action-route")+"/"+b,sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a);0===a.status&&setTimeout(function(){sysPassApp.util.redirect("index.php")},2E3)})},reset:function(a){d.info("plugin:reset");var b='

      '+sysPassApp.config.LANG[58]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44], +onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();g.save(a)}}})},search:function(a){d.info("plugin:search");m.search(a)},show:function(a){d.info("plugin:show");t.show(a)},save:function(a){d.info("plugin:save");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint+"?r="+a.data("route");b.data=a.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(b,function(b){sysPassApp.msg.out(b); +0===b.status&&(f({r:a.data("action-next")}),$.magnificPopup.close())})},nav:function(a){d.info("plugin:nav");m.nav(a)}},notification:u,wiki:{show:function(a){d.info("wiki:show");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={pageName:a.data("pagename"),actionId:a.data("action-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b,function(a){0!==a.status?sysPassApp.msg.out(a):h(a.data.html)})}},items:{get:function(a){d.info("items:get");var b= +a[0].selectize;b.clearOptions();b.load(function(c){var d=sysPassApp.requests.getRequestOpts();d.url=e.entrypoint;d.method="get";d.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:a.data("sk")};sysPassApp.requests.getActionCall(d,function(d){c(d.data);b.setValue(a.data("selected-id"),!0);sysPassApp.triggers.updateFormHash()})})},update:function(a){d.info("items:update");var b=$("#"+a.data("item-dst"))[0].selectize,c=b.getValue();b.clearOptions();b.load(function(d){var f=sysPassApp.requests.getRequestOpts(); +f.url=e.entrypoint;f.method="get";f.data={r:a.data("item-route"),sk:sysPassApp.sk.get()};sysPassApp.requests.getActionCall(f,function(a){d(a);b.setValue(c,!0)})})}},ldap:{check:function(a){d.info("ldap:check");var b=$(a.data("src")),c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route");c.data=b.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a);0===a.status&&void 0!==a.data.template&&void 0!==a.data.items&& +h(a.data.template,{open:function(){var b=$("#ldap-results").find(".list-wrap").empty();a.data.items.forEach(function(a){b.append(sysPassApp.theme.html.getList(a.items,a.icon))})}})})},import:function(a){d.info("ldap:import");var b='

      '+sysPassApp.config.LANG[57]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43], +onClick:function(b){b=$(a.data("src"));var c=sysPassApp.requests.getRequestOpts();c.url=e.entrypoint+"?r="+a.data("action-route");c.data=b.serialize()+"&sk="+sysPassApp.sk.get();sysPassApp.requests.getActionCall(c,function(a){sysPassApp.msg.out(a)})}}})}},track:{unlock:function(a){d.info("track:unlock");var b=sysPassApp.requests.getRequestOpts();b.url=e.entrypoint;b.method="get";b.data={r:a.data("action-route")+"/"+a.data("item-id"),sk:sysPassApp.sk.get(),isAjax:1};sysPassApp.requests.getActionCall(b, +function(b){sysPassApp.msg.out(b);g.refresh(a)})},clear:function(a){d.info("track:clear");var b='

      '+sysPassApp.config.LANG[71]+"

      ";mdlDialog().show({text:b,negative:{title:sysPassApp.config.LANG[44],onClick:function(a){a.preventDefault();sysPassApp.msg.error(sysPassApp.config.LANG[44])}},positive:{title:sysPassApp.config.LANG[43],onClick:function(b){b.preventDefault();g.save(a)}}})}}}}; diff --git a/public/js/app-requests.js b/public/js/app-requests.js index 8251b59d..338710e5 100644 --- a/public/js/app-requests.js +++ b/public/js/app-requests.js @@ -152,6 +152,13 @@ sysPass.Requests = function (sysPassApp) { history.add(opts); } + if (opts.type === "json" + && response['csrf'] !== undefined + && response.csrf !== "" + ) { + sysPassApp.sk.set(response.csrf); + } + callbackOk(response); }, error: function (jqXHR, textStatus, errorThrown) { @@ -182,14 +189,6 @@ sysPass.Requests = function (sysPassApp) { sysPassApp.theme.loading.hide(); } - if (opts.type === "json" - && response.responseJSON !== undefined - && response.responseJSON.csrf !== undefined - && response.responseJSON.csrf !== "" - ) { - sysPassApp.sk.set(response.responseJSON.csrf); - } - if (sysPassApp.theme !== undefined) { sysPassApp.theme.ajax.complete(); } diff --git a/public/js/app-requests.min.js b/public/js/app-requests.min.js index f782c35e..f1fd343e 100644 --- a/public/js/app-requests.min.js +++ b/public/js/app-requests.min.js @@ -1,5 +1,5 @@ -sysPass.Requests=function(c){var e=c.log,b=[],g={type:"json",url:"",method:"post",callback:"",async:!0,data:"",cache:!1,processData:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",timeout:0,addHistory:!1,hash:"",useLoading:!0,useFullLoading:!1};Object.seal(g);var h={get:function(){return b},add:function(a){var f=""===a.hash?c.util.hash.md5(JSON.stringify(a)):a.hash;if(0

      "+b.responseText+"

      ",e.error(d),"html"===a.type&&$("#content").html(c.msg.html.error(d)),c.msg.error(d)):l()},complete:function(b){!0===a.useLoading&& -c.theme.loading.hide();"json"===a.type&&void 0!==b.responseJSON&&void 0!==b.responseJSON.csrf&&""!==b.responseJSON.csrf&&c.sk.set(b.responseJSON.csrf);void 0!==c.theme&&c.theme.ajax.complete()}})},getActionEvent:function(a,b,c){var f=k(a.url);f+="?"+$.param(a.data);var d=new EventSource(f);d.addEventListener("message",function(a){a=JSON.parse(a.data);e.debug(a);1===a.end?(e.info("getActionEvent:Ending"),d.close(),"function"===typeof c&&c(a)):"function"===typeof b&&b(a)});d.addEventListener("error", -function(a){e.error("getActionEvent:Error occured");d.close()});return d},getRouteForQuery:function(a,b){return"object"===typeof b?{r:a+"/"+b.join("/")}:{r:a+"/"+b}},history:h}}; +sysPass.Requests=function(c){var e=c.log,b=[],h={type:"json",url:"",method:"post",callback:"",async:!0,data:"",cache:!1,processData:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",timeout:0,addHistory:!1,hash:"",useLoading:!0,useFullLoading:!1};Object.seal(h);var k={get:function(){return b},add:function(a){var f=""===a.hash?c.util.hash.md5(JSON.stringify(a)):a.hash;if(0

      "+b.responseText+"

      ",e.error(d),"html"===a.type&&$("#content").html(c.msg.html.error(d)), +c.msg.error(d)):m()},complete:function(b){!0===a.useLoading&&c.theme.loading.hide();void 0!==c.theme&&c.theme.ajax.complete()}})},getActionEvent:function(a,b,c){var f=l(a.url);f+="?"+$.param(a.data);var d=new EventSource(f);d.addEventListener("message",function(a){a=JSON.parse(a.data);e.debug(a);1===a.end?(e.info("getActionEvent:Ending"),d.close(),"function"===typeof c&&c(a)):"function"===typeof b&&b(a)});d.addEventListener("error",function(a){e.error("getActionEvent:Error occured");d.close()});return d}, +getRouteForQuery:function(a,b){return"object"===typeof b?{r:a+"/"+b.join("/")}:{r:a+"/"+b}},history:k}}; diff --git a/public/js/app-triggers.js b/public/js/app-triggers.js index 914d144b..259e32f4 100644 --- a/public/js/app-triggers.js +++ b/public/js/app-triggers.js @@ -178,6 +178,8 @@ sysPass.Triggers = function (log) { const lastHistory = sysPassApp.requests.history.del(); + lastHistory.data.sk = sysPassApp.sk.get(); + sysPassApp.requests.getActionCall(lastHistory, lastHistory.callback); } }).on("submit", ".form-action", function (e) { @@ -238,19 +240,20 @@ sysPass.Triggers = function (log) { sysPassApp.requests.history.reset(); } - sysPassApp.actions.doAction({r: $this.data("route")}, $this.data("view")); + sysPassApp.actions.getContent({r: $this.data("route")}, $this.data("view")); }); - if (sysPassApp.config.STATUS.CHECK_NOTIFICATIONS) { - sysPassApp.actions.notification.getActive(); + sysPassApp.actions.notification.getActive(); + + if (sysPassApp.config.STATUS.CHECK_NOTIFICATIONS) { setInterval(function () { sysPassApp.actions.notification.getActive(); }, 120000); } if ($obj.data("upgraded") === 0) { - sysPassApp.actions.doAction({r: "account/index"}, "search"); + sysPassApp.actions.getContent({r: "account/index"}, "search"); } else { const $content = $("#content"); const page = $content.data('page'); @@ -349,17 +352,17 @@ sysPass.Triggers = function (log) { selectDetect($container); - const $sk = $container.find(":input [name='sk']"); + const $sk = $container.find(":input[name='sk']"); - if ($sk.length > 0) { - sysPassApp.sk.set($sk.val()); + if ($sk.length > 0 && $sk[0].value !== "") { + sysPassApp.sk.set($sk[0].value); } if (typeof sysPassApp.theme.viewsTriggers.common === "function") { sysPassApp.theme.viewsTriggers.common($container); } - initializeTags(); + initializeTags($container); sysPassApp.triggers.updateFormHash($container); }, @@ -455,10 +458,11 @@ sysPass.Triggers = function (log) { } }; - const initializeTags = function () { + const initializeTags = function ($container) { log.info("initializeTags"); - $(".select-box-tags").selectize({ + $container + .find(".select-box-tags").selectize({ persist: false, valueField: 'id', labelField: 'name', @@ -467,8 +471,11 @@ sysPass.Triggers = function (log) { onInitialize: function () { const $wrapper = $(this.$wrapper[0]); const $input = $(this.$input[0]); + const value = this.getValue(); - $input.attr("data-hash", sysPassApp.util.hash.md5(this.getValue().join())); + if (value !== "") { + $input.attr("data-hash", sysPassApp.util.hash.md5(value.join())); + } const currentItemId = $input.data("currentItemId"); diff --git a/public/js/app-triggers.min.js b/public/js/app-triggers.min.js index 36d25299..84503527 100644 --- a/public/js/app-triggers.min.js +++ b/public/js/app-triggers.min.js @@ -1,19 +1,19 @@ -var $jscomp=$jscomp||{};$jscomp.scope={};$jscomp.findInternal=function(c,f,e){c instanceof String&&(c=String(c));for(var g=c.length,a=0;aform").each(function(){var a=$(this);a.find("button.btn-clear").on("click",function(b){b.preventDefault();a.trigger("reset")})})},config:function(){c.info("views:config");var a=$("#drop-import-files");if(0form").each(function(){var a=$(this);a.find("button.btn-clear").on("click",function(c){c.preventDefault();a.trigger("reset")})})},config:function(){b.info("views:config");var a=$("#drop-import-files");if(0