1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2022 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <https://www.gnu.org/licenses/>. 16 */ 17 18declare(strict_types=1); 19 20namespace Fisharebest\Webtrees\Http\RequestHandlers; 21 22use Fisharebest\Webtrees\Auth; 23use Fisharebest\Webtrees\Http\Exceptions\HttpAccessDeniedException; 24use Fisharebest\Webtrees\Http\Exceptions\HttpNotFoundException; 25use Fisharebest\Webtrees\Services\ModuleService; 26use Fisharebest\Webtrees\Validator; 27use Psr\Http\Message\ResponseInterface; 28use Psr\Http\Message\ServerRequestInterface; 29use Psr\Http\Server\RequestHandlerInterface; 30 31use function method_exists; 32use function str_contains; 33use function strtolower; 34 35/** 36 * Controller for module actions. 37 */ 38class ModuleAction implements RequestHandlerInterface 39{ 40 private ModuleService $module_service; 41 42 /** 43 * @param ModuleService $module_service 44 */ 45 public function __construct(ModuleService $module_service) 46 { 47 $this->module_service = $module_service; 48 } 49 50 /** 51 * Perform an HTTP action for one of the modules. 52 * 53 * @param ServerRequestInterface $request 54 * 55 * @return ResponseInterface 56 */ 57 public function handle(ServerRequestInterface $request): ResponseInterface 58 { 59 $module_name = $request->getAttribute('module'); 60 $action = $request->getAttribute('action'); 61 $user = Validator::attributes($request)->user(); 62 63 // Check that the module is enabled. 64 // The module itself will need to check any tree-level access, 65 // which may be different for each component (tab, menu, etc.) of the module. 66 $module = $this->module_service->findByName($module_name); 67 68 if ($module === null) { 69 throw new HttpNotFoundException('Module ' . $module_name . ' does not exist'); 70 } 71 72 // We'll call a function such as Module::getFooBarAction() 73 $verb = strtolower($request->getMethod()); 74 $method = $verb . $action . 'Action'; 75 76 // Actions with "Admin" in the name are for administrators only. 77 if (str_contains($action, 'Admin') && !Auth::isAdmin($user)) { 78 throw new HttpAccessDeniedException('Admin only action'); 79 } 80 81 if (!method_exists($module, $method)) { 82 throw new HttpNotFoundException('Method ' . $method . '() not found in ' . $module_name); 83 } 84 85 return $module->$method($request); 86 } 87} 88