]>
Commit | Line | Data |
---|---|---|
f8bf8952 NL |
1 | <?php |
2 | ||
769e19dc | 3 | namespace Wallabag\ApiBundle\Controller; |
f8bf8952 | 4 | |
fcb1fba5 | 5 | use FOS\RestBundle\Controller\FOSRestController; |
b0b893ea | 6 | use Symfony\Component\Security\Core\Exception\AccessDeniedException; |
be463487 | 7 | use Wallabag\CoreBundle\Entity\Entry; |
f8bf8952 | 8 | |
fcb1fba5 | 9 | class WallabagRestController extends FOSRestController |
f8bf8952 | 10 | { |
900c8448 | 11 | protected function validateAuthentication() |
77273253 | 12 | { |
18f8f32f | 13 | if (false === $this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_FULLY')) { |
77273253 NL |
14 | throw new AccessDeniedException(); |
15 | } | |
16 | } | |
17 | ||
769e19dc J |
18 | /** |
19 | * Validate that the first id is equal to the second one. | |
4346a860 | 20 | * If not, throw exception. It means a user try to access information from an other user. |
769e19dc | 21 | * |
4346a860 | 22 | * @param int $requestUserId User id from the requested source |
769e19dc | 23 | */ |
900c8448 | 24 | protected function validateUserAccess($requestUserId) |
769e19dc | 25 | { |
18f8f32f | 26 | $user = $this->get('security.token_storage')->getToken()->getUser(); |
fcb1fba5 NL |
27 | if ($requestUserId != $user->getId()) { |
28 | throw $this->createAccessDeniedException('Access forbidden. Entry user id: '.$requestUserId.', logged user id: '.$user->getId()); | |
769e19dc J |
29 | } |
30 | } | |
7df80cb3 | 31 | } |