1. class
  2. SilverStripe
  3. \
  4. Control
  5. \
  6. Middleware
  7. \
  8. PermissionAwareConfirmationMiddleware

PermissionAwareConfirmationMiddleware

class PermissionAwareConfirmationMiddleware extends ConfirmationMiddleware

Extends the ConfirmationMiddleware with checks for user permissions

Respects users who don't have enough access and does not ask them for confirmation

By default it enforces authentication by redirecting users to a login page.

How it works: - if user can bypass the middleware, then pass request further - if there are no confirmation items, then pass request further - if user is not authenticated and enforceAuthentication is false, then pass request further - if user does not have at least one of the affected permissions, then pass request further - otherwise, pass handling to the parent (ConfirmationMiddleware)

Methods

__construct(Rule[] $rules)

Init the middleware with the rules

from ConfirmationMiddleware
$this
setDeclineUrl(string $url)

Override the default decline url

from ConfirmationMiddleware
bool
canBypass(HTTPRequest $request)

Check whether the rules can be bypassed without user confirmation

from ConfirmationMiddleware
Item[]
getConfirmationItems(HTTPRequest $request)

Extract the confirmation items from the request and return

from ConfirmationMiddleware
HTTPResponse
process(HTTPRequest $request, callable $delegate)

Generate response for the given request

from ConfirmationMiddleware
$this
setConfirmationStorageId(string $id)

Override the confirmation storage ID

from ConfirmationMiddleware
$this
setConfirmationFormUrl(string $url)

Override the confirmation form url

from ConfirmationMiddleware
$this
setBypasses(Bypass[] $bypasses)

Set the list of bypasses for the confirmation

from ConfirmationMiddleware
string[]
getAffectedPermissions()

Returns the list of permissions that are affected

$this
setAffectedPermissions(string[] $permissions)

Set the list of affected permissions

bool
getEnforceAuthentication()

Returns flag whether we want to enforce authentication or not

$this
setEnforceAuthentication(bool $enforce)

Set whether we want to enforce authentication

bool
hasAccess(HTTPRequest $request)

Check whether the user has permissions to perform the target operation Otherwise we may want to skip the confirmation dialog.

Details

in ConfirmationMiddleware at line 69
__construct(Rule[] $rules)

Init the middleware with the rules

Parameters

Rule[] $rules Rules to check requests against

in ConfirmationMiddleware at line 118
$this setDeclineUrl(string $url)

Override the default decline url

Parameters

string $url

Return Value

$this

in ConfirmationMiddleware at line 132
bool canBypass(HTTPRequest $request)

Check whether the rules can be bypassed without user confirmation

Parameters

HTTPRequest $request

Return Value

bool

in ConfirmationMiddleware at line 150
Item[] getConfirmationItems(HTTPRequest $request)

Extract the confirmation items from the request and return

Parameters

HTTPRequest $request

Return Value

Item[] list of confirmation items

in ConfirmationMiddleware at line 248
HTTPResponse process(HTTPRequest $request, callable $delegate)

Generate response for the given request

Parameters

HTTPRequest $request
callable $delegate

Return Value

HTTPResponse

in ConfirmationMiddleware at line 272
$this setConfirmationStorageId(string $id)

Override the confirmation storage ID

Parameters

string $id

Return Value

$this

in ConfirmationMiddleware at line 285
$this setConfirmationFormUrl(string $url)

Override the confirmation form url

Parameters

string $url

Return Value

$this

in ConfirmationMiddleware at line 298
$this setBypasses(Bypass[] $bypasses)

Set the list of bypasses for the confirmation

Parameters

Bypass[] $bypasses

Return Value

$this

at line 50
string[] getAffectedPermissions()

Returns the list of permissions that are affected

Return Value

string[]

at line 66
$this setAffectedPermissions(string[] $permissions)

Set the list of affected permissions

If the user doesn't have at least one of these, we assume they don't have access to the protected action, so we don't ask for a confirmation

Parameters

string[] $permissions list of affected permissions

Return Value

$this

at line 77
bool getEnforceAuthentication()

Returns flag whether we want to enforce authentication or not

Return Value

bool

at line 93
$this setEnforceAuthentication(bool $enforce)

Set whether we want to enforce authentication

We either enforce authentication (redirect to a login form) or silently assume the user does not have permissions and so we don't have to ask for a confirmation

Parameters

bool $enforce

Return Value

$this

at line 109
bool hasAccess(HTTPRequest $request)

Check whether the user has permissions to perform the target operation Otherwise we may want to skip the confirmation dialog.

WARNING! The user has to be authenticated beforehand

Parameters

HTTPRequest $request

Return Value

bool