3 files changed, 42 insertions, 9 deletions

diff --git a/application/bookmark/BookmarkFileService.php b/application/bookmark/BookmarkFileService.php
index 3d15d4c9..6e04f3b7 100644
--- a/application/bookmark/BookmarkFileService.php
+++ b/application/bookmark/BookmarkFileService.php
@@ -46,6 +46,9 @@ class BookmarkFileService implements BookmarkServiceInterface
     /** @var bool true for logged in users. Default value to retrieve private bookmarks. */
     protected $isLoggedIn;
 
+    /** @var bool Allow datastore alteration from not logged in users. */
+    protected $anonymousPermission = false;
+
     /**
      * @inheritDoc
      */
@@ -64,7 +67,7 @@ class BookmarkFileService implements BookmarkServiceInterface
                 $this->bookmarks = $this->bookmarksIO->read();
             } catch (EmptyDataStoreException $e) {
                 $this->bookmarks = new BookmarkArray();
-                if ($isLoggedIn) {
+                if ($this->isLoggedIn) {
                     $this->save();
                 }
             }
@@ -154,7 +157,7 @@ class BookmarkFileService implements BookmarkServiceInterface
      */
     public function set($bookmark, $save = true)
     {
-        if ($this->isLoggedIn !== true) {
+        if (true !== $this->isLoggedIn && true !== $this->anonymousPermission) {
             throw new Exception(t('You\'re not authorized to alter the datastore'));
         }
         if (! $bookmark instanceof Bookmark) {
@@ -179,7 +182,7 @@ class BookmarkFileService implements BookmarkServiceInterface
      */
     public function add($bookmark, $save = true)
     {
-        if ($this->isLoggedIn !== true) {
+        if (true !== $this->isLoggedIn && true !== $this->anonymousPermission) {
             throw new Exception(t('You\'re not authorized to alter the datastore'));
         }
         if (! $bookmark instanceof Bookmark) {
@@ -204,7 +207,7 @@ class BookmarkFileService implements BookmarkServiceInterface
      */
     public function addOrSet($bookmark, $save = true)
     {
-        if ($this->isLoggedIn !== true) {
+        if (true !== $this->isLoggedIn && true !== $this->anonymousPermission) {
             throw new Exception(t('You\'re not authorized to alter the datastore'));
         }
         if (! $bookmark instanceof Bookmark) {
@@ -221,7 +224,7 @@ class BookmarkFileService implements BookmarkServiceInterface
      */
     public function remove($bookmark, $save = true)
     {
-        if ($this->isLoggedIn !== true) {
+        if (true !== $this->isLoggedIn && true !== $this->anonymousPermission) {
             throw new Exception(t('You\'re not authorized to alter the datastore'));
         }
         if (! $bookmark instanceof Bookmark) {
@@ -274,10 +277,11 @@ class BookmarkFileService implements BookmarkServiceInterface
      */
     public function save()
     {
-        if (!$this->isLoggedIn) {
+        if (true !== $this->isLoggedIn && true !== $this->anonymousPermission) {
             // TODO: raise an Exception instead
             die('You are not authorized to change the database.');
         }
+
         $this->bookmarks->reorder();
         $this->bookmarksIO->write($this->bookmarks);
         $this->pageCacheManager->invalidateCaches();
@@ -357,6 +361,16 @@ class BookmarkFileService implements BookmarkServiceInterface
         $initializer->initialize();
     }
 
+    public function enableAnonymousPermission(): void
+    {
+        $this->anonymousPermission = true;
+    }
+
+    public function disableAnonymousPermission(): void
+    {
+        $this->anonymousPermission = false;
+    }
+
     /**
      * Handles migration to the new database format (BookmarksArray).
      */
diff --git a/application/bookmark/BookmarkInitializer.php b/application/bookmark/BookmarkInitializer.php
index 9eee9a35..479ee9a9 100644
--- a/application/bookmark/BookmarkInitializer.php
+++ b/application/bookmark/BookmarkInitializer.php
@@ -34,13 +34,15 @@ class BookmarkInitializer
      */
     public function initialize()
     {
+        $this->bookmarkService->enableAnonymousPermission();
+
         $bookmark = new Bookmark();
         $bookmark->setTitle(t('My secret stuff... - Pastebin.com'));
-        $bookmark->setUrl('http://sebsauvage.net/paste/?8434b27936c09649#bR7XsXhoTiLcqCpQbmOpBi3rq2zzQUC5hBI7ZT1O3x8=', []);
+        $bookmark->setUrl('http://sebsauvage.net/paste/?8434b27936c09649#bR7XsXhoTiLcqCpQbmOpBi3rq2zzQUC5hBI7ZT1O3x8=');
         $bookmark->setDescription(t('Shhhh! I\'m a private link only YOU can see. You can delete me too.'));
         $bookmark->setTagsString('secretstuff');
         $bookmark->setPrivate(true);
-        $this->bookmarkService->add($bookmark);
+        $this->bookmarkService->add($bookmark, false);
 
         $bookmark = new Bookmark();
         $bookmark->setTitle(t('The personal, minimalist, super-fast, database free, bookmarking service'));
@@ -54,6 +56,10 @@ To learn how to use Shaarli, consult the link "Documentation" at the bottom of t
 You use the community supported version of the original Shaarli project, by Sebastien Sauvage.'
         ));
         $bookmark->setTagsString('opensource software');
-        $this->bookmarkService->add($bookmark);
+        $this->bookmarkService->add($bookmark, false);
+
+        $this->bookmarkService->save();
+
+        $this->bookmarkService->disableAnonymousPermission();
     }
 }
diff --git a/application/bookmark/BookmarkServiceInterface.php b/application/bookmark/BookmarkServiceInterface.php
index 7b7a4f09..37fbda89 100644
--- a/application/bookmark/BookmarkServiceInterface.php
+++ b/application/bookmark/BookmarkServiceInterface.php
@@ -177,4 +177,17 @@ interface BookmarkServiceInterface
      * Creates the default database after a fresh install.
      */
     public function initialize();
+
+    /**
+     * Allow to write the datastore from anonymous session (not logged in).
+     *
+     * This covers a few specific use cases, such as datastore initialization,
+     * but it should be used carefully as it can lead to security issues.
+     */
+    public function enableAnonymousPermission();
+
+    /**
+     * Disable anonymous permission.
+     */
+    public function disableAnonymousPermission();
 }