1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2019 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <http://www.gnu.org/licenses/>. 16 */ 17declare(strict_types=1); 18 19namespace Fisharebest\Webtrees\Http\Middleware; 20 21use Fig\Http\Message\RequestMethodInterface; 22use Fisharebest\Webtrees\Auth; 23use Fisharebest\Webtrees\Contracts\UserInterface; 24use Fisharebest\Webtrees\FlashMessages; 25use Fisharebest\Webtrees\I18N; 26use Fisharebest\Webtrees\Session; 27use Fisharebest\Webtrees\Tree; 28use Fisharebest\Webtrees\User; 29use Psr\Http\Message\ResponseInterface; 30use Psr\Http\Message\ServerRequestInterface; 31use Psr\Http\Server\MiddlewareInterface; 32use Psr\Http\Server\RequestHandlerInterface; 33 34use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; 35use function in_array; 36use function redirect; 37 38/** 39 * Middleware to restrict access to moderators. 40 */ 41class AuthModerator implements MiddlewareInterface 42{ 43 /** 44 * @param ServerRequestInterface $request 45 * @param RequestHandlerInterface $handler 46 * 47 * @return ResponseInterface 48 */ 49 public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface 50 { 51 $tree = $request->getAttribute('tree'); 52 $user = $request->getAttribute('user'); 53 54 // Logged in with the correct role? 55 if ($tree instanceof Tree && Auth::isModerator($tree, $user)) { 56 return $handler->handle($request); 57 } 58 59 // Logged in, but without the correct role? 60 if ($user instanceof User) { 61 throw new AccessDeniedHttpException(); 62 } 63 64 // Not logged in. 65 return redirect(route('login', ['url' => $request->getAttribute('request_uri')])); 66 67 } 68} 69