From ef2b4041fb3791554e93b4180777adbfdcf9afa2 Mon Sep 17 00:00:00 2001
From: Jeremy Benoist <jeremy.benoist@gmail.com>
Date: Wed, 22 Nov 2017 09:59:11 +0100
Subject: [PATCH] Disable controller access if feature disabled

If `restricted_access` is disabled, accessing `/site-credentials/` must be disabled.
---
 .../Controller/SiteCredentialController.php    | 18 ++++++++++++++++++
 .../SiteCredentialControllerTest.php           | 14 ++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/Wallabag/CoreBundle/Controller/SiteCredentialController.php b/src/Wallabag/CoreBundle/Controller/SiteCredentialController.php
index fa2066dc..548de744 100644
--- a/src/Wallabag/CoreBundle/Controller/SiteCredentialController.php
+++ b/src/Wallabag/CoreBundle/Controller/SiteCredentialController.php
@@ -24,6 +24,8 @@ class SiteCredentialController extends Controller
      */
     public function indexAction()
     {
+        $this->isSiteCredentialsEnabled();
+
         $credentials = $this->get('wallabag_core.site_credential_repository')->findByUser($this->getUser());
 
         return $this->render('WallabagCoreBundle:SiteCredential:index.html.twig', [
@@ -43,6 +45,8 @@ class SiteCredentialController extends Controller
      */
     public function newAction(Request $request)
     {
+        $this->isSiteCredentialsEnabled();
+
         $credential = new SiteCredential($this->getUser());
 
         $form = $this->createForm('Wallabag\CoreBundle\Form\Type\SiteCredentialType', $credential);
@@ -83,6 +87,8 @@ class SiteCredentialController extends Controller
      */
     public function editAction(Request $request, SiteCredential $siteCredential)
     {
+        $this->isSiteCredentialsEnabled();
+
         $this->checkUserAction($siteCredential);
 
         $deleteForm = $this->createDeleteForm($siteCredential);
@@ -125,6 +131,8 @@ class SiteCredentialController extends Controller
      */
     public function deleteAction(Request $request, SiteCredential $siteCredential)
     {
+        $this->isSiteCredentialsEnabled();
+
         $this->checkUserAction($siteCredential);
 
         $form = $this->createDeleteForm($siteCredential);
@@ -144,6 +152,16 @@ class SiteCredentialController extends Controller
         return $this->redirectToRoute('site_credentials_index');
     }
 
+    /**
+     * Throw a 404 if the feature is disabled.
+     */
+    private function isSiteCredentialsEnabled()
+    {
+        if (!$this->get('craue_config')->get('restricted_access')) {
+            throw $this->createNotFoundException('Feature "restricted_access" is disabled, controllers too.');
+        }
+    }
+
     /**
      * Creates a form to delete a site credential entity.
      *
diff --git a/tests/Wallabag/CoreBundle/Controller/SiteCredentialControllerTest.php b/tests/Wallabag/CoreBundle/Controller/SiteCredentialControllerTest.php
index 87ea2867..f5074403 100644
--- a/tests/Wallabag/CoreBundle/Controller/SiteCredentialControllerTest.php
+++ b/tests/Wallabag/CoreBundle/Controller/SiteCredentialControllerTest.php
@@ -8,6 +8,20 @@ use Wallabag\CoreBundle\Entity\SiteCredential;
 
 class SiteCredentialControllerTest extends WallabagCoreTestCase
 {
+    public function testAccessDeniedBecauseFeatureDisabled()
+    {
+        $this->logInAs('admin');
+        $client = $this->getClient();
+
+        $client->getContainer()->get('craue_config')->set('restricted_access', 0);
+
+        $client->request('GET', '/site-credentials/');
+
+        $this->assertSame(404, $client->getResponse()->getStatusCode());
+
+        $client->getContainer()->get('craue_config')->set('restricted_access', 1);
+    }
+
     public function testListSiteCredential()
     {
         $this->logInAs('admin');
-- 
2.41.0