TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:00 +02:00
commit f9941541b7
1178 changed files with 135377 additions and 0 deletions
@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Backend\Backend\Bookmark\Security;
+
+use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+
+/**
+ * @internal This class is a specific Backend implementation and is not considered part of the Public TYPO3 API.
+ */
+#[Autoconfigure(public: true)]
+final readonly class BookmarkGroupVoter
+{
+    public const string READ = 'read';
+    public const string CREATE = 'create';
+    public const string EDIT = 'edit';
+    public const string DELETE = 'delete';
+    public const string SELECT = 'select';
+
+    public function vote(string $attribute, array $group, BackendUserAuthentication $user): bool
+    {
+        return match ($attribute) {
+            self::READ => $this->canRead($group, $user),
+            self::CREATE => $this->canCreate($user),
+            self::EDIT => $this->canEdit($group, $user),
+            self::DELETE => $this->canDelete($group, $user),
+            self::SELECT => $this->canSelect($group, $user),
+            default => false,
+        };
+    }
+
+    private function canCreate(BackendUserAuthentication $user): bool
+    {
+        return isset($user->user['uid']) && (int)$user->user['uid'] > 0;
+    }
+
+    private function canRead(array $group, BackendUserAuthentication $user): bool
+    {
+        $userId = (int)$user->user['uid'];
+        return (int)$group['userid'] === $userId;
+    }
+
+    private function canEdit(array $group, BackendUserAuthentication $user): bool
+    {
+        $groupId = $group['id'] ?? null;
+
+        // System/global groups (integer IDs) are not editable
+        if (is_int($groupId) || is_numeric($groupId)) {
+            return false;
+        }
+
+        // User-created groups (UUID strings) are editable only if user owns them
+        if (!isset($group['userid'])) {
+            return false;
+        }
+
+        $userId = (int)$user->user['uid'];
+        return (int)$group['userid'] === $userId;
+    }
+
+    private function canDelete(array $group, BackendUserAuthentication $user): bool
+    {
+        // Delete permission mirrors edit permission
+        return $this->canEdit($group, $user);
+    }
+
+    private function canSelect(array $group, BackendUserAuthentication $user): bool
+    {
+        $groupId = $group['id'] ?? 0;
+
+        // Global groups (negative IDs) are only selectable by admins
+        if (is_int($groupId) && $groupId < 0) {
+            return $user->isAdmin();
+        }
+
+        return true;
+    }
+}