Skip to content

Commit 27ec513

Browse files
author
Mastiuhin Olexandr
committed
MAGETWO-99591: Restricted admin cannot edit reviews from pending reviews grid
1 parent 6e534ad commit 27ec513

File tree

12 files changed

+601
-27
lines changed

12 files changed

+601
-27
lines changed

‎app/code/Magento/Review/Block/Adminhtml/Edit.php

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
namespace Magento\Review\Block\Adminhtml;
77

88
/**
9-
* Review edit form
9+
* Review edit form.
1010
*/
1111
class Edit extends \Magento\Backend\Block\Widget\Form\Container
1212
{
@@ -77,7 +77,13 @@ protected function _construct()
7777
'previous',
7878
[
7979
'label' => __('Previous'),
80-
'onclick' => 'setLocation(\'' . $this->getUrl('review/*/*', ['id' => $prevId]) . '\')'
80+
'onclick' => 'setLocation(\'' . $this->getUrl(
81+
'review/*/*',
82+
[
83+
'id' => $prevId,
84+
'ret' => $this->getRequest()->getParam('ret'),
85+
]
86+
) . '\')'
8187
],
8288
3,
8389
10
@@ -93,7 +99,10 @@ protected function _construct()
9399
'button' => [
94100
'event' => 'save',
95101
'target' => '#edit_form',
96-
'eventData' => ['action' => ['args' => ['next_item' => $prevId]]],
102+
'eventData' => ['action' => ['args' => [
103+
'next_item' => $prevId,
104+
'ret' => $this->getRequest()->getParam('ret'),
105+
]]],
97106
],
98107
],
99108
]
@@ -113,7 +122,10 @@ protected function _construct()
113122
'button' => [
114123
'event' => 'save',
115124
'target' => '#edit_form',
116-
'eventData' => ['action' => ['args' => ['next_item' => $nextId]]],
125+
'eventData' => ['action' => ['args' => [
126+
'next_item' => $nextId,
127+
'ret' => $this->getRequest()->getParam('ret'),
128+
]]],
117129
],
118130
],
119131
]
@@ -126,7 +138,13 @@ protected function _construct()
126138
'next',
127139
[
128140
'label' => __('Next'),
129-
'onclick' => 'setLocation(\'' . $this->getUrl('review/*/*', ['id' => $nextId]) . '\')'
141+
'onclick' => 'setLocation(\'' . $this->getUrl(
142+
'review/*/*',
143+
[
144+
'id' => $nextId,
145+
'ret' => $this->getRequest()->getParam('ret'),
146+
]
147+
) . '\')'
130148
],
131149
3,
132150
105

‎app/code/Magento/Review/Controller/Adminhtml/Product.php

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
use Magento\Review\Model\RatingFactory;
1313

1414
/**
15-
* Reviews admin controller
15+
* Reviews admin controller.
1616
*/
1717
abstract class Product extends Action
1818
{
@@ -63,17 +63,10 @@ public function __construct(
6363
}
6464

6565
/**
66-
* @return bool
66+
* @inheritdoc
6767
*/
6868
protected function _isAllowed()
6969
{
70-
switch ($this->getRequest()->getActionName()) {
71-
case 'pending':
72-
return $this->_authorization->isAllowed('Magento_Review::pending');
73-
break;
74-
default:
75-
return $this->_authorization->isAllowed('Magento_Review::reviews_all');
76-
break;
77-
}
70+
return $this->_authorization->isAllowed('Magento_Review::reviews_all');
7871
}
7972
}

‎app/code/Magento/Review/Controller/Adminhtml/Product/Delete.php

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,25 @@
55
*/
66
namespace Magento\Review\Controller\Adminhtml\Product;
77

8+
use Magento\Framework\App\Action\HttpPostActionInterface;
89
use Magento\Review\Controller\Adminhtml\Product as ProductController;
910
use Magento\Framework\Controller\ResultFactory;
11+
use Magento\Review\Model\Review;
12+
use Magento\Framework\App\Action\HttpGetActionInterface;
1013

11-
class Delete extends ProductController
14+
/**
15+
* Delete action.
16+
*/
17+
class Delete extends ProductController implements HttpGetActionInterface, HttpPostActionInterface
1218
{
1319
/**
20+
* @var Review
21+
*/
22+
private $model;
23+
24+
/**
25+
* Execute action.
26+
*
1427
* @return \Magento\Backend\Model\View\Result\Redirect
1528
*/
1629
public function execute()
@@ -19,7 +32,7 @@ public function execute()
1932
$resultRedirect = $this->resultFactory->create(ResultFactory::TYPE_REDIRECT);
2033
$reviewId = $this->getRequest()->getParam('id', false);
2134
try {
22-
$this->reviewFactory->create()->setId($reviewId)->aggregate()->delete();
35+
$this->getModel()->aggregate()->delete();
2336

2437
$this->messageManager->addSuccess(__('The review has been deleted.'));
2538
if ($this->getRequest()->getParam('ret') == 'pending') {
@@ -36,4 +49,43 @@ public function execute()
3649

3750
return $resultRedirect->setPath('review/*/edit/', ['id' => $reviewId]);
3851
}
52+
53+
/**
54+
* @inheritdoc
55+
*/
56+
protected function _isAllowed()
57+
{
58+
if ($this->_authorization->isAllowed('Magento_Review::reviews_all')) {
59+
return true;
60+
}
61+
62+
if (!$this->_authorization->isAllowed('Magento_Review::pending')) {
63+
return false;
64+
}
65+
66+
if ($this->getModel()->getStatusId() != Review::STATUS_PENDING) {
67+
$this->messageManager->addErrorMessage(
68+
__('Sorry, You have not permission to do this. The Review is not in Pending status.')
69+
);
70+
71+
return false;
72+
}
73+
74+
return true;
75+
}
76+
77+
/**
78+
* Returns requested model.
79+
*
80+
* @return Review
81+
*/
82+
private function getModel(): Review
83+
{
84+
if (!$this->model) {
85+
$this->model = $this->reviewFactory->create()
86+
->load($this->getRequest()->getParam('id', false));
87+
}
88+
89+
return $this->model;
90+
}
3991
}

‎app/code/Magento/Review/Controller/Adminhtml/Product/Edit.php

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,21 @@
88
use Magento\Framework\App\Action\HttpGetActionInterface as HttpGetActionInterface;
99
use Magento\Review\Controller\Adminhtml\Product as ProductController;
1010
use Magento\Framework\Controller\ResultFactory;
11+
use Magento\Review\Model\Review;
1112

13+
/**
14+
* Edit action.
15+
*/
1216
class Edit extends ProductController implements HttpGetActionInterface
1317
{
1418
/**
19+
* @var Review
20+
*/
21+
private $review;
22+
23+
/**
24+
* Execute action.
25+
*
1526
* @return \Magento\Backend\Model\View\Result\Page
1627
*/
1728
public function execute()
@@ -24,4 +35,43 @@ public function execute()
2435
$resultPage->addContent($resultPage->getLayout()->createBlock(\Magento\Review\Block\Adminhtml\Edit::class));
2536
return $resultPage;
2637
}
38+
39+
/**
40+
* @inheritdoc
41+
*/
42+
protected function _isAllowed()
43+
{
44+
if ($this->_authorization->isAllowed('Magento_Review::reviews_all')) {
45+
return true;
46+
}
47+
48+
if (!$this->_authorization->isAllowed('Magento_Review::pending')) {
49+
return false;
50+
}
51+
52+
if ($this->getModel()->getStatusId() != Review::STATUS_PENDING) {
53+
$this->messageManager->addErrorMessage(
54+
__('Sorry, You have not permission to do this. The Review is not in Pending status.')
55+
);
56+
57+
return false;
58+
}
59+
60+
return true;
61+
}
62+
63+
/**
64+
* Returns requested model.
65+
*
66+
* @return Review
67+
*/
68+
private function getModel(): Review
69+
{
70+
if (!$this->review) {
71+
$this->review = $this->reviewFactory->create()
72+
->load($this->getRequest()->getParam('id', false));
73+
}
74+
75+
return $this->review;
76+
}
2777
}

‎app/code/Magento/Review/Controller/Adminhtml/Product/MassDelete.php

Lines changed: 93 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,54 @@
55
*/
66
namespace Magento\Review\Controller\Adminhtml\Product;
77

8+
use Magento\Backend\App\Action\Context;
9+
use Magento\Framework\Registry;
810
use Magento\Review\Controller\Adminhtml\Product as ProductController;
911
use Magento\Framework\Exception\LocalizedException;
1012
use Magento\Framework\Controller\ResultFactory;
13+
use Magento\Review\Model\RatingFactory;
14+
use Magento\Review\Model\Review;
15+
use Magento\Review\Model\ResourceModel\Review\Collection;
16+
use Magento\Review\Model\ResourceModel\Review\CollectionFactory;
17+
use Magento\Review\Model\ReviewFactory;
18+
use Magento\Framework\App\Action\HttpPostActionInterface;
1119

12-
class MassDelete extends ProductController
20+
/**
21+
* Mass Delete action.
22+
*/
23+
class MassDelete extends ProductController implements HttpPostActionInterface
1324
{
1425
/**
26+
* @var Collection
27+
*/
28+
private $collection;
29+
30+
/**
31+
* @var CollectionFactory
32+
*/
33+
private $collectionFactory;
34+
35+
/**
36+
* @param Context $context
37+
* @param Registry $coreRegistry
38+
* @param ReviewFactory $reviewFactory
39+
* @param RatingFactory $ratingFactory
40+
* @param CollectionFactory $collectionFactory
41+
*/
42+
public function __construct(
43+
Context $context,
44+
Registry $coreRegistry,
45+
ReviewFactory $reviewFactory,
46+
RatingFactory $ratingFactory,
47+
CollectionFactory $collectionFactory
48+
) {
49+
parent::__construct($context, $coreRegistry, $reviewFactory, $ratingFactory);
50+
$this->collectionFactory = $collectionFactory;
51+
}
52+
53+
/**
54+
* Execute action.
55+
*
1556
* @return \Magento\Backend\Model\View\Result\Redirect
1657
*/
1758
public function execute()
@@ -21,8 +62,7 @@ public function execute()
2162
$this->messageManager->addError(__('Please select review(s).'));
2263
} else {
2364
try {
24-
foreach ($reviewsIds as $reviewId) {
25-
$model = $this->reviewFactory->create()->load($reviewId);
65+
foreach ($this->getCollection() as $model) {
2666
$model->delete();
2767
}
2868
$this->messageManager->addSuccess(
@@ -39,4 +79,54 @@ public function execute()
3979
$resultRedirect->setPath('review/*/' . $this->getRequest()->getParam('ret', 'index'));
4080
return $resultRedirect;
4181
}
82+
83+
/**
84+
* @inheritdoc
85+
*/
86+
protected function _isAllowed()
87+
{
88+
if ($this->_authorization->isAllowed('Magento_Review::reviews_all')) {
89+
return true;
90+
}
91+
92+
if (!$this->_authorization->isAllowed('Magento_Review::pending')) {
93+
return false;
94+
}
95+
96+
foreach ($this->getCollection() as $model) {
97+
if ($model->getStatusId() != Review::STATUS_PENDING) {
98+
$this->messageManager->addErrorMessage(
99+
__(
100+
'Sorry, You have not permission to do this.'
101+
. ' One or more of the reviews are not in Pending Status.'
102+
)
103+
);
104+
105+
return false;
106+
}
107+
}
108+
109+
return true;
110+
}
111+
112+
/**
113+
* Returns requested collection.
114+
*
115+
* @return Collection
116+
*/
117+
private function getCollection(): Collection
118+
{
119+
if (!$this->collection) {
120+
$collection = $this->collectionFactory->create();
121+
$collection->addFieldToFilter(
122+
'main_table.' . $collection->getResource()
123+
->getIdFieldName(),
124+
$this->getRequest()->getParam('reviews')
125+
);
126+
127+
$this->collection = $collection;
128+
}
129+
130+
return $this->collection;
131+
}
42132
}

0 commit comments

Comments
 (0)