Skip to content

Commit 2f59195

Browse files
author
Roman Lytvynenko
committed
Merge branch 'MC-36647' of https://github.com/magento-tango/magento2ce into TANGO-PR-09-01-2020_24
2 parents 66968b9 + cbc1023 commit 2f59195

File tree

10 files changed

+363
-57
lines changed

10 files changed

+363
-57
lines changed

‎app/code/Magento/Customer/Model/Customer/Authorization.php

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?php
2+
/**
3+
*
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
declare(strict_types=1);
8+
9+
namespace Magento\Customer\Model\Customer;
10+
11+
use Magento\Authorization\Model\UserContextInterface;
12+
use Magento\Customer\Model\CustomerFactory;
13+
use Magento\Customer\Model\ResourceModel\Customer as CustomerResource;
14+
use Magento\Framework\AuthorizationInterface;
15+
use Magento\Integration\Api\AuthorizationServiceInterface as AuthorizationService;
16+
use Magento\Store\Model\StoreManagerInterface;
17+
18+
/**
19+
* Checks if customer is logged in and authorized in the current store
20+
*/
21+
class Authorization implements AuthorizationInterface
22+
{
23+
/**
24+
* @var UserContextInterface
25+
*/
26+
private $userContext;
27+
28+
/**
29+
* @var CustomerFactory
30+
*/
31+
private $customerFactory;
32+
33+
/**
34+
* @var CustomerResource
35+
*/
36+
private $customerResource;
37+
38+
/**
39+
* @var StoreManagerInterface
40+
*/
41+
private $storeManager;
42+
43+
/**
44+
* Authorization constructor.
45+
*
46+
* @param UserContextInterface $userContext
47+
* @param CustomerFactory $customerFactory
48+
* @param CustomerResource $customerResource
49+
* @param StoreManagerInterface $storeManager
50+
*/
51+
public function __construct(
52+
UserContextInterface $userContext,
53+
CustomerFactory $customerFactory,
54+
CustomerResource $customerResource,
55+
StoreManagerInterface $storeManager
56+
) {
57+
$this->userContext = $userContext;
58+
$this->customerFactory = $customerFactory;
59+
$this->customerResource = $customerResource;
60+
$this->storeManager = $storeManager;
61+
}
62+
63+
/**
64+
* @inheritdoc
65+
*/
66+
public function isAllowed($resource, $privilege = null)
67+
{
68+
if ($resource === AuthorizationService::PERMISSION_SELF
69+
&& $this->userContext->getUserId()
70+
&& $this->userContext->getUserType() === UserContextInterface::USER_TYPE_CUSTOMER
71+
) {
72+
$customer = $this->customerFactory->create();
73+
$this->customerResource->load($customer, $this->userContext->getUserId());
74+
$currentStoreId = $this->storeManager->getStore()->getId();
75+
$sharedStoreIds = $customer->getSharedStoreIds();
76+
77+
return in_array($currentStoreId, $sharedStoreIds);
78+
}
79+
80+
return false;
81+
}
82+
}

‎app/code/Magento/Customer/Model/Customer/AuthorizationComposite.php

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?php
2+
/**
3+
*
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
declare(strict_types=1);
8+
9+
namespace Magento\Customer\Model\Customer;
10+
11+
use Magento\Framework\AuthorizationInterface;
12+
13+
/**
14+
* Class to invalidate user credentials
15+
*/
16+
class AuthorizationComposite implements AuthorizationInterface
17+
{
18+
/**
19+
* @var AuthorizationInterface[]
20+
*/
21+
private $authorizationChecks;
22+
23+
/**
24+
* AuthorizationComposite constructor.
25+
*
26+
* @param AuthorizationInterface[] $authorizationChecks
27+
*/
28+
public function __construct(
29+
array $authorizationChecks
30+
) {
31+
$this->authorizationChecks = $authorizationChecks;
32+
}
33+
34+
/**
35+
* @inheritdoc
36+
*/
37+
public function isAllowed($resource, $privilege = null)
38+
{
39+
$result = false;
40+
41+
foreach ($this->authorizationChecks as $authorizationCheck) {
42+
$result = $authorizationCheck->isAllowed($resource, $privilege);
43+
if (!$result) {
44+
break;
45+
}
46+
}
47+
48+
return $result;
49+
}
50+
}

‎app/code/Magento/Customer/Model/Plugin/CustomerAuthorization.php

Lines changed: 19 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,9 @@
66

77
namespace Magento\Customer\Model\Plugin;
88

9-
use Magento\Authorization\Model\UserContextInterface;
10-
use Magento\Customer\Model\CustomerFactory;
11-
use Magento\Customer\Model\ResourceModel\Customer as CustomerResource;
12-
use Magento\Integration\Api\AuthorizationServiceInterface as AuthorizationService;
13-
use Magento\Store\Model\StoreManagerInterface;
9+
use Closure;
10+
use Magento\Customer\Model\Customer\AuthorizationComposite;
11+
use Magento\Framework\Authorization;
1412

1513
/**
1614
* Plugin around \Magento\Framework\Authorization::isAllowed
@@ -20,74 +18,38 @@
2018
class CustomerAuthorization
2119
{
2220
/**
23-
* @var UserContextInterface
21+
* @var AuthorizationComposite
2422
*/
25-
private $userContext;
26-
27-
/**
28-
* @var CustomerFactory
29-
*/
30-
private $customerFactory;
31-
32-
/**
33-
* @var CustomerResource
34-
*/
35-
private $customerResource;
36-
37-
/**
38-
* @var StoreManagerInterface
39-
*/
40-
private $storeManager;
23+
private $authorizationComposite;
4124

4225
/**
4326
* Inject dependencies.
44-
*
45-
* @param UserContextInterface $userContext
46-
* @param CustomerFactory $customerFactory
47-
* @param CustomerResource $customerResource
48-
* @param StoreManagerInterface $storeManager
27+
* @param AuthorizationComposite $composite
4928
*/
5029
public function __construct(
51-
UserContextInterface $userContext,
52-
CustomerFactory $customerFactory,
53-
CustomerResource $customerResource,
54-
StoreManagerInterface $storeManager
30+
AuthorizationComposite $composite
5531
) {
56-
$this->userContext = $userContext;
57-
$this->customerFactory = $customerFactory;
58-
$this->customerResource = $customerResource;
59-
$this->storeManager = $storeManager;
32+
$this->authorizationComposite = $composite;
6033
}
6134

6235
/**
63-
* Check if resource for which access is needed has self permissions defined in webapi config.
36+
* Verify if to allow customer users to access resources with self permission
6437
*
65-
* @param \Magento\Framework\Authorization $subject
66-
* @param callable $proceed
67-
* @param string $resource
68-
* @param string $privilege
69-
*
70-
* @return bool true If resource permission is self, to allow
71-
* customer access without further checks in parent method
7238
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
39+
* @param Authorization $subject
40+
* @param Closure $proceed
41+
* @param string $resource
42+
* @param mixed $privilege
43+
* @return bool
7344
*/
7445
public function aroundIsAllowed(
75-
\Magento\Framework\Authorization $subject,
76-
\Closure $proceed,
77-
$resource,
46+
Authorization $subject,
47+
Closure $proceed,
48+
string $resource,
7849
$privilege = null
7950
) {
80-
if ($resource == AuthorizationService::PERMISSION_SELF
81-
&& $this->userContext->getUserId()
82-
&& $this->userContext->getUserType() === UserContextInterface::USER_TYPE_CUSTOMER
83-
) {
84-
$customer = $this->customerFactory->create();
85-
$this->customerResource->load($customer, $this->userContext->getUserId());
86-
$currentStoreId = $this->storeManager->getStore()->getId();
87-
$sharedStoreIds = $customer->getSharedStoreIds();
88-
if (in_array($currentStoreId, $sharedStoreIds)) {
89-
return true;
90-
}
51+
if ($this->authorizationComposite->isAllowed($resource, $privilege)) {
52+
return true;
9153
}
9254

9355
return $proceed($resource, $privilege);

‎app/code/Magento/Customer/etc/webapi_rest/di.xml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,13 @@
2222
<type name="Magento\Customer\Api\CustomerRepositoryInterface">
2323
<plugin name="updateCustomerByIdFromRequest" type="Magento\Customer\Model\Plugin\UpdateCustomer" />
2424
</type>
25+
<type name="Magento\Customer\Model\Customer\AuthorizationComposite">
26+
<arguments>
27+
<argument name="authorizationChecks" xsi:type="array">
28+
<item name="rest_customer_authorization" xsi:type="object">
29+
Magento\Customer\Model\Customer\Authorization
30+
</item>
31+
</argument>
32+
</arguments>
33+
</type>
2534
</config>

‎app/code/Magento/Customer/etc/webapi_soap/di.xml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,13 @@
99
<type name="Magento\Framework\Authorization">
1010
<plugin name="customerAuthorization" type="Magento\Customer\Model\Plugin\CustomerAuthorization" />
1111
</type>
12+
<type name="Magento\Customer\Model\Customer\AuthorizationComposite">
13+
<arguments>
14+
<argument name="authorizationChecks" xsi:type="array">
15+
<item name="soap_customer_authorization" xsi:type="object">
16+
Magento\Customer\Model\Customer\Authorization
17+
</item>
18+
</argument>
19+
</arguments>
20+
</type>
1221
</config>

‎app/code/Magento/Persistent/Model/Customer/Authorization.php

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\Persistent\Model\Customer;
9+
10+
use Magento\Customer\Model\Session as CustomerSession;
11+
use Magento\Framework\AuthorizationInterface;
12+
use Magento\Persistent\Helper\Session as PersistentSession;
13+
14+
/**
15+
* Authorization logic for persistent customers
16+
*
17+
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
18+
*/
19+
class Authorization implements AuthorizationInterface
20+
{
21+
/**
22+
* @var CustomerSession
23+
*/
24+
private $customerSession;
25+
26+
/**
27+
* @var PersistentSession
28+
*/
29+
private $persistentSession;
30+
31+
/**
32+
* @param CustomerSession $customerSession
33+
* @param PersistentSession $persistentSession
34+
*/
35+
public function __construct(
36+
CustomerSession $customerSession,
37+
PersistentSession $persistentSession
38+
) {
39+
$this->customerSession = $customerSession;
40+
$this->persistentSession = $persistentSession;
41+
}
42+
43+
/**
44+
* @inheritdoc
45+
*
46+
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
47+
*/
48+
public function isAllowed(
49+
$resource,
50+
$privilege = null
51+
) {
52+
if ($this->persistentSession->isPersistent() && !$this->customerSession->isLoggedIn()) {
53+
return false;
54+
}
55+
56+
return true;
57+
}
58+
}

0 commit comments

Comments
 (0)