xref: /webtrees/app/Http/RequestHandlers/ModuleAction.php (revision c9e6b69934bcd82295d33d368c560aa2e64627c3) 
1<?php
2/**
3 * webtrees: online genealogy
4 * Copyright (C) 2019 webtrees development team
5 * This program is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 3 of the License, or
8 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License
14 * along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16declare(strict_types=1);
17
18namespace Fisharebest\Webtrees\Http\RequestHandlers;
19
20use Fisharebest\Webtrees\Auth;
21use Fisharebest\Webtrees\Contracts\UserInterface;
22use Fisharebest\Webtrees\Services\ModuleService;
23use Psr\Http\Message\ResponseInterface;
24use Psr\Http\Message\ServerRequestInterface;
25use Psr\Http\Server\RequestHandlerInterface;
26use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
27use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
28use function app;
29use function method_exists;
30use function strpos;
31use function strtolower;
32
33/**
34 * Controller for module actions.
35 */
36class ModuleAction implements RequestHandlerInterface
37{
38    /** @var ModuleService */
39    private $module_service;
40
41    /** @var UserInterface */
42    private $user;
43
44    /**
45     * ModuleController constructor.
46     *
47     * @param ModuleService $module_service
48     * @param UserInterface $user
49     */
50    public function __construct(ModuleService $module_service, UserInterface $user)
51    {
52        $this->module_service = $module_service;
53        $this->user           = $user;
54    }
55
56    /**
57     * Perform an HTTP action for one of the modules.
58     *
59     * @param ServerRequestInterface $request
60     *
61     * @return ResponseInterface
62     */
63    public function handle(ServerRequestInterface $request): ResponseInterface
64    {
65        $module_name = $request->getQueryParams()['module'] ?? $request->getParsedBody()['module'] ?? '';
66        $action      = $request->getQueryParams()['action'] ?? $request->getParsedBody()['action'] ?? '';
67
68        // Check that the module is enabled.
69        // The module itself will need to check any tree-level access,
70        // which may be different for each component (tab, menu, etc.) of the module.
71        $module = $this->module_service->findByName($module_name);
72
73        if ($module === null) {
74            throw new NotFoundHttpException('Module ' . $module_name . ' does not exist');
75        }
76
77        // We'll call a function such as Module::getFooBarAction()
78        $verb   = strtolower($request->getMethod());
79        $method = $verb . $action . 'Action';
80
81        // Actions with "Admin" in the name are for administrators only.
82        if (strpos($action, 'Admin') !== false && !Auth::isAdmin($this->user)) {
83            throw new AccessDeniedHttpException('Admin only action');
84        }
85
86        if (!method_exists($module, $method)) {
87            throw new NotFoundHttpException('Method ' . $method . '() not found in ' . $module_name);
88        }
89
90        return app()->dispatch($module, $method);
91    }
92}
93