Merge pull request #240 from H2-invent/feature/team-hierarchy-minor-e…

…dits Team hierarchy minor edits
H2-invent · Jan 15, 2024 · d76e700 · d76e700
2 parents 162d6fb + 762b08f
commit d76e700
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 12 deletions.
diff --git a/src/Controller/LoeschkonzeptController.php b/src/Controller/LoeschkonzeptController.php
@@ -177,12 +177,14 @@ public function new(
     }
 
     #[Route(path: '/{id}/details', name: 'app_loeschkonzept_show', methods: ['GET'])]
-    public function show(Loeschkonzept $loeschkonzept): Response
+    public function show(Loeschkonzept $loeschkonzept, CurrentTeamService $teamService): Response
     {
         $this->setBackButton($this->generateUrl('app_loeschkonzept_index'));
+        $currentTeam = $teamService->getCurrentTeam($this->getUser());
 
         return $this->render('loeschkonzept/show.html.twig', [
             'loeschkonzept' => $loeschkonzept,
+            'current_team' => $currentTeam,
         ]);
     }
 }
diff --git a/src/Controller/VVTDatenkategorieController.php b/src/Controller/VVTDatenkategorieController.php
@@ -140,12 +140,14 @@ public function new(
     }
 
     #[Route(path: '/show/{id}', name: 'app_vvtdatenkategorie_show', methods: ['GET'])]
-    public function show(VVTDatenkategorie $vVTDatenkategorie): Response
+    public function show(VVTDatenkategorie $vVTDatenkategorie, CurrentTeamService $teamService): Response
     {
         $this->setBackButton($this->generateUrl('app_vvtdatenkategorie_index'));
+        $currentTeam = $teamService->getCurrentTeam($this->getUser());
 
         return $this->render('vvt_datenkategorie/show.html.twig', [
             'vvtdatenkategorie' => $vVTDatenkategorie,
+            'current_team' => $currentTeam,
         ]);
     }
 }
diff --git a/src/Service/SecurityService.php b/src/Service/SecurityService.php
@@ -126,8 +126,9 @@ public function teamDataCheck($data, $team): bool
         }
 
         //Sicherheitsfunktion, dass nur eigene Daten bearbeitet werden können
-        if ($team === $data->getTeam()) {
+        if ($team !== $data->getTeam()) {
             $this->logAccessDenied($team);
+            return false;
         }
 
         return true;

diff --git a/templates/loeschkonzept/show.html.twig b/templates/loeschkonzept/show.html.twig
@@ -6,10 +6,12 @@
 {% endblock %}
 
 {% block CTA %}
-    <a href="{{ path('app_loeschkonzept_edit',{'id': loeschkonzept.id}) }}" class="btn">
-        <span>{% trans from 'general' %}edit{% endtrans %}</span>
-    </a>
-    {{ include('loeschkonzept/_delete_form.html.twig') }}
+    {% if current_team == loeschkonzept.team %}
+        <a href="{{ path('app_loeschkonzept_edit',{'id': loeschkonzept.id}) }}" class="btn">
+            <span>{% trans from 'general' %}edit{% endtrans %}</span>
+        </a>
+        {{ include('loeschkonzept/_delete_form.html.twig') }}
+    {% endif %}
 {% endblock %}
 
 {% block body %}

diff --git a/templates/vvt_datenkategorie/show.html.twig b/templates/vvt_datenkategorie/show.html.twig
@@ -5,11 +5,14 @@
     {% trans %}dataCategory.word{% endtrans %}
 {% endblock %}
 
- {% block CTA %}
-    <a href="{{ path('app_vvtdatenkategorie_edit',{'id': vvtdatenkategorie.id}) }}" class="btn">
-        <span>{% trans from 'general' %}edit{% endtrans %}</span>
-    </a>
-    {{ include('vvt_datenkategorie/_delete_form.html.twig') }}
+{% block CTA %}
+    {# TODO Can vvtdatenkategorie.team really be null? #}
+    {% if vvtdatenkategorie.team is null or current_team == vvtdatenkategorie.team %}
+        <a href="{{ path('app_vvtdatenkategorie_edit',{'id': vvtdatenkategorie.id}) }}" class="btn">
+            <span>{% trans from 'general' %}edit{% endtrans %}</span>
+        </a>
+        {{ include('vvt_datenkategorie/_delete_form.html.twig') }}
+    {% endif %}
 {% endblock %}
 
 {% block body %}