← All changes | app/Http/Policies/PortalPolicy.php +50 -7 2.3.0 → 2.4.5 View file →

		@@ -10,16 +10,35 @@
10	10
11	11	class PortalPolicy extends Policy
12	12	{
13	13	/**
14		- * Check user permission for any method
15		- * @param \FluentSupport\Framework\Request\Request $request
	14	+ * Whether the current user may act on_behalf of a customer. See verifyRequest().
	15	+ *
	16	+ * @return bool
	17	+ */
	18	+ public static function canActOnBehalf()
	19	+ {
	20	+ return current_user_can('manage_options') || (
	21	+ PermissionManager::userCan('fst_sensitive_data')
	22	+ && PermissionManager::userCan('fst_manage_other_tickets')
	23	+ && PermissionManager::userCan('fst_manage_settings')
	24	+ && Helper::getAgentByUserId()
	25	+ );
	26	+ }
	27	+
	28	+ /**
	29	+ * @param \FluentSupport\Framework\Http\Request\Request $request
16	30	* @return Boolean
17	31	*/
18	32	public function verifyRequest(Request $request)
19	33	{
	34	+ // on_behalf lets a remote API client act as a customer: a site admin (who need not
	35	+ // be an agent), or a senior agent who manages customers, all tickets and settings. An agent is
	36	+ // still held to their own ticket access in CustomerPortalService::getCustomer().
	37	+ // The agent record is required because mailbox restrictions live on it; leftover
	38	+ // permission meta without one would otherwise carry no restrictions at all.
20	39	if ($request->get('on_behalf')) {
21		- return PermissionManager::userCan(['fst_sensitive_data', 'fst_manage_other_tickets']);
	40	+ return self::canActOnBehalf();
22	41	}
23	42
24	43	$hasAccess = !!get_current_user_id();
25	44
		@@ -41,9 +60,9 @@
41	60	return $canAccess['status'];
42	61	}
43	62
44	63	/**
45		- * @param \FluentSupport\Framework\Request\Request $request
	64	+ * @param \FluentSupport\Framework\Http\Request\Request $request
46	65	* @return Boolean
47	66	*/
48	67	public function getTicket(Request $request)
49	68	{
		@@ -64,14 +83,32 @@
64	83	{
65	84	return $this->maybePublicSignedRequest($request);
66	85	}
67	86
	87	+ /**
	88	+ * Agents need a write capability here: the ticket ones mirror createResponse(),
	89	+ * the settings pair covers the editor's paste-to-upload.
	90	+ *
	91	+ * @param \FluentSupport\Framework\Http\Request\Request $request
	92	+ * @return Boolean
	93	+ */
68	94	public function uploadTicketFiles(Request $request)
69	95	{
70		- if ($person = Helper::getCurrentAgent()) {
71		- return true;
	96	+ // An on_behalf upload can create or update a customer, so it needs the same
	97	+ // rights as every other on_behalf portal call, not just upload rights.
	98	+ if ($request->get('on_behalf')) {
	99	+ return self::canActOnBehalf();
72	100	}
73	101
	102	+ if (Helper::getCurrentAgent()) {
	103	+ return PermissionManager::canManageTickets()
	104	+ || PermissionManager::userCan([
	105	+ 'fst_draft_reply',
	106	+ 'fst_manage_settings',
	107	+ 'fst_manage_saved_replies'
	108	+ ]);
	109	+ }
	110	+
74	111	return $this->maybePublicSignedRequest($request);
75	112	}
76	113
77	114	public function getCountries(Request $request)
		@@ -83,9 +120,9 @@
83	120	return $this->maybePublicSignedRequest($request);
84	121	}
85	122
86	123	/**
87		- * @param \FluentSupport\Framework\Request\Request $request
	124	+ * @param \FluentSupport\Framework\Http\Request\Request $request
88	125	* @return Boolean
89	126	*/
90	127	protected function maybePublicSignedRequest($request)
91	128	{
		@@ -96,8 +133,14 @@
96	133	$ticketId = isset($urlParams['ticket_id']) ? (int) $urlParams['ticket_id'] : $request->getSafe('ticket_id', 'intval');
97	134	return !!Ticket::where('hash', $ticketHash)
98	135	->wherePublicIdentifier($ticketId)
99	136	->first();
	137	+ }
	138	+
	139	+ // With signed links off, a hash only comes from a remote portal relaying an
	140	+ // anonymous visitor. Falling through would make them the API user's customer.
	141	+ if ($ticketHash && !$request->get('on_behalf') && self::canActOnBehalf()) {
	142	+ return false;
100	143	}
101	144
102	145	return $this->verifyRequest($request);
103	146	}