class URLSpecialsMiddleware extends PermissionAwareConfirmationMiddleware (View source)

Check the request for the URL special variables.

Performs authorisation, confirmation and actions for some of those.

WARNING: Bypasses only disable authorisation and confirmation, but not actions nor redirects

The rules are:

  • flush GET parameter
  • isDev GET parameter
  • isTest GET parameter
  • dev/build URL

Traits

Schedule flush operation for a following request

Implements switching user session into Test and Dev environment types

Properties

protected string $confirmationId

The confirmation storage identifier

from  ConfirmationMiddleware
protected string $confirmationFormUrl

Confirmation form URL WARNING: excluding SS_BASE_URL

from  ConfirmationMiddleware
protected Rule[] $rules

The list of rules to check requests against

from  ConfirmationMiddleware
protected Bypass[] $bypasses

The list of bypasses

from  ConfirmationMiddleware

Methods

public
__construct()

Initializes the middleware with the required rules

protected
string
getConfirmationUrl(HTTPRequest $request, string $confirmationStorageId)

The URL of the confirmation form ("Security/confirm/middleware" by default)

protected
string
generateDeclineUrlForRequest(HTTPRequest $request)

Returns the URL where the user to be redirected when declining the action (on the confirmation form)

public
$this
setDeclineUrl(string $url)

Override the default decline url

public
bool
canBypass(HTTPRequest $request)

Check whether the rules can be bypassed without user confirmation

public
Item[]
getConfirmationItems(HTTPRequest $request)

Extract the confirmation items from the request and return

protected
buildConfirmationRedirect(HTTPRequest $request, Storage $storage, array $confirmationItems)

Initialize the confirmation session storage with the confirmation items and return an HTTPResponse redirecting to the according confirmation form.

protected
processItems(HTTPRequest $request, callable $delegate, Item[] $items)

Process the confirmation items and either perform the confirmedEffect and pass the request to the next middleware, or return a redirect to the confirmation form

protected
confirmedEffect(HTTPRequest $request)

The middleware own effects that should be performed on confirmation

public
process(HTTPRequest $request, callable $delegate)

Generate response for the given request

public
$this
setConfirmationStorageId(string $id)

Override the confirmation storage ID

public
$this
setConfirmationFormUrl(string $url)

Override the confirmation form url

public
$this
setBypasses(Bypass[] $bypasses)

Set the list of bypasses for the confirmation

public
string[]
getAffectedPermissions()

Returns the list of permissions that are affected

public
$this
setAffectedPermissions(string[] $permissions)

Set the list of affected permissions

public
bool
getEnforceAuthentication()

Returns flag whether we want to enforce authentication or not

public
$this
setEnforceAuthentication(bool $enforce)

Set whether we want to enforce authentication

public
bool
hasAccess(HTTPRequest $request)

Check whether the user has permissions to perform the target operation Otherwise we may want to skip the confirmation dialog.

protected
getAuthenticationRedirect(HTTPRequest $request)

Returns HTTPResponse with a redirect to a login page

public
bool
scheduleFlush(HTTPRequest $request)

Schedules the manifest flush operation for a following request

public
bool
setSessionEnvType(HTTPRequest $request)

Checks whether the request has GET flags to control environment type and amends the user session accordingly

public
buildImpactRedirect(HTTPRequest $request)

Looks up for the special flags passed in the request and schedules the changes accordingly for the next request.

Details

__construct()

Initializes the middleware with the required rules

protected string getConfirmationUrl(HTTPRequest $request, string $confirmationStorageId)

The URL of the confirmation form ("Security/confirm/middleware" by default)

Parameters

HTTPRequest $request

Active request

string $confirmationStorageId

ID of the confirmation storage to be used

Return Value

string

URL of the confirmation form

protected string generateDeclineUrlForRequest(HTTPRequest $request)

Returns the URL where the user to be redirected when declining the action (on the confirmation form)

Parameters

HTTPRequest $request

Active request

Return Value

string URL

$this setDeclineUrl(string $url)

Override the default decline url

Parameters

string $url

Return Value

$this

bool canBypass(HTTPRequest $request)

Check whether the rules can be bypassed without user confirmation

Parameters

HTTPRequest $request

Return Value

bool

Item[] getConfirmationItems(HTTPRequest $request)

Extract the confirmation items from the request and return

Parameters

HTTPRequest $request

Return Value

Item[]

list of confirmation items

protected HTTPResponse buildConfirmationRedirect(HTTPRequest $request, Storage $storage, array $confirmationItems)

Initialize the confirmation session storage with the confirmation items and return an HTTPResponse redirecting to the according confirmation form.

Parameters

HTTPRequest $request
Storage $storage
array $confirmationItems

Return Value

HTTPResponse

protected HTTPResponse processItems(HTTPRequest $request, callable $delegate, Item[] $items)

Process the confirmation items and either perform the confirmedEffect and pass the request to the next middleware, or return a redirect to the confirmation form

Parameters

HTTPRequest $request
callable $delegate
Item[] $items

Return Value

HTTPResponse

protected null|HTTPResponse confirmedEffect(HTTPRequest $request)

The middleware own effects that should be performed on confirmation

This method is getting called before the confirmation storage cleanup so that any responses returned here don't trigger a new confirmtation for the same request traits

Parameters

HTTPRequest $request

Return Value

null|HTTPResponse

HTTPResponse process(HTTPRequest $request, callable $delegate)

Generate response for the given request

Parameters

HTTPRequest $request
callable $delegate

Return Value

HTTPResponse

$this setConfirmationStorageId(string $id)

Override the confirmation storage ID

Parameters

string $id

Return Value

$this

$this setConfirmationFormUrl(string $url)

Override the confirmation form url

Parameters

string $url

Return Value

$this

$this setBypasses(Bypass[] $bypasses)

Set the list of bypasses for the confirmation

Parameters

Bypass[] $bypasses

Return Value

$this

string[] getAffectedPermissions()

Returns the list of permissions that are affected

Return Value

string[]

$this setAffectedPermissions(string[] $permissions)

Set the list of affected permissions

If the user doesn't have at least one of these, we assume they don't have access to the protected action, so we don't ask for a confirmation

Parameters

string[] $permissions

list of affected permissions

Return Value

$this

bool getEnforceAuthentication()

Returns flag whether we want to enforce authentication or not

Return Value

bool

$this setEnforceAuthentication(bool $enforce)

Set whether we want to enforce authentication

We either enforce authentication (redirect to a login form) or silently assume the user does not have permissions and so we don't have to ask for a confirmation

Parameters

bool $enforce

Return Value

$this

bool hasAccess(HTTPRequest $request)

Check whether the user has permissions to perform the target operation Otherwise we may want to skip the confirmation dialog.

WARNING! The user has to be authenticated beforehand

Parameters

HTTPRequest $request

Return Value

bool

protected HTTPResponse getAuthenticationRedirect(HTTPRequest $request)

Returns HTTPResponse with a redirect to a login page

Parameters

HTTPRequest $request

Return Value

HTTPResponse

redirect to a login page

bool scheduleFlush(HTTPRequest $request)

Schedules the manifest flush operation for a following request

WARNING! Does not perform flush, but schedules it for another request

Parameters

HTTPRequest $request

Return Value

bool

true if flush has been scheduled, false otherwise

bool setSessionEnvType(HTTPRequest $request)

Checks whether the request has GET flags to control environment type and amends the user session accordingly

Parameters

HTTPRequest $request

Return Value

bool

true if changed the user session state, false otherwise

null|HTTPResponse buildImpactRedirect(HTTPRequest $request)

Looks up for the special flags passed in the request and schedules the changes accordingly for the next request.

Returns a redirect to the same page (with a random token) if there are changes introduced by the flags. Returns null if there is no impact introduced by the flags.

Parameters

HTTPRequest $request

Return Value

null|HTTPResponse

redirect to the same url