@@ -11,21 +11,23 @@ site. This is similar to the `Symfony2 Security component`_. But contrary to the
11
11
security context, the publish check can be executed even when no firewall is in
12
12
place and the security context thus has no token (see `Symfony2 Authorization `_).
13
13
14
- The publish workflow is also tied into the security workflow: The core bundle
14
+ The publish workflow is also tied into the security workflow: The CoreBundle
15
15
registers a security voter that forwards security checks to the publish
16
16
workflow. This means that if you always have a firewall, you can just use
17
17
the normal security context and the twig function ``is_granted `` to check for
18
18
publication.
19
19
20
- A good introduction to the Symfony core security is the `Security Chapter `_ in
21
- the Symfony2 book.
20
+ .. tip ::
21
+
22
+ A good introduction to the Symfony core security can be found in the
23
+ `Security Chapter `_ of the Symfony2 book.
22
24
23
25
Check if Content is Published
24
26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
25
27
26
- The Bundle provides the ``cmf_core.publish_workflow.checker `` service which
28
+ The Bundle provides the ``cmf_core.publish_workflow.checker `` service, which
27
29
implements the :class: `Symfony\\ Component\\ Security\\ Core\\ SecurityContextInterface `
28
- of the Symfony security component. The method to check publication is
30
+ of the Symfony Security component. The method to check publication is
29
31
:method: `Symfony\\ Component\\ Security\\ Core\\ SecurityContextInterface::isGranted `,
30
32
same as with the security context.
31
33
@@ -55,9 +57,15 @@ given to editors. The default name of the role is ``ROLE_CAN_VIEW_NON_PUBLISHED`
55
57
.. code-block :: xml
56
58
57
59
<!-- app/config/security.xml -->
58
- <config xmlns =" http://symfony.com/schema/dic/security" >
59
- <role id =" ROLE_EDITOR" >ROLE_CAN_VIEW_NON_PUBLISHED</role >
60
- </config >
60
+ <?xml version =" 1.0" encoding =" UTF-8" ?>
61
+ <srv : container xmlns =" http://symfony.com/schema/dic/security"
62
+ xmlns : srv =" http://symfony.com/schema/dic/services" >
63
+
64
+ <config >
65
+ <role id =" ROLE_EDITOR" >ROLE_CAN_VIEW_NON_PUBLISHED</role >
66
+ </config >
67
+
68
+ </srv : container >
61
69
62
70
.. code-block :: php
63
71
@@ -76,18 +84,21 @@ the path in question - he will have the permission to view unpublished content a
76
84
// check if current user is allowed to see this document
77
85
$publishWorkflowChecker = $container->get('cmf_core.publish_workflow.checker');
78
86
if ($publishWorkflowChecker->isGranted(
79
- PublishWorkflowChecker::VIEW_ATTRIBUTE,
80
- $document)
87
+ PublishWorkflowChecker::VIEW_ATTRIBUTE,
88
+ $document
89
+ )
81
90
) {
82
91
// ...
83
92
}
93
+
84
94
// check if the document is published. even if the current role would allow
85
95
// to see the document, this will still return false if the documet is not
86
96
// published
87
97
if ($publishWorkflowChecker->isGranted(
88
- PublishWorkflowChecker::VIEW_ANONYMOUS_ATTRIBUTE,
89
- $document
90
- )) {
98
+ PublishWorkflowChecker::VIEW_ANONYMOUS_ATTRIBUTE,
99
+ $document
100
+ )
101
+ ) {
91
102
// ...
92
103
}
93
104
@@ -113,7 +124,7 @@ To check publication in a template, use the twig function ``cmf_is_published``:
113
124
{# ... output the document #}
114
125
{% endif %}
115
126
116
- .. code-block :: php
127
+ .. code-block :: html+ php
117
128
118
129
<!-- check if document is published, regardless of current users role -->
119
130
<?php if ($view['cmf']->isPublished($page)) : ?>
@@ -158,14 +169,14 @@ content is still considered published.
158
169
Publish Voters
159
170
~~~~~~~~~~~~~~
160
171
161
- A voter has to implement the
172
+ A voter must implement the
162
173
:class: `Symfony\\ Component\\ Security\\ Core\\ Authorization\\ Voter\\ VoterInterface `.
163
- It will get passed a content object and has to decide whether it is published
174
+ A content object will be passed and it has to decide whether it is published
164
175
according to its rules. The CoreBundle provides a couple of generic voters
165
- that check the content for having an interface exposing the methods they need.
166
- If the content implements the interface, they check the parameter and return
167
- `` ACCESS_GRANTED `` or `` ACCESS_DENIED ``, otherwise they return
168
- ``ACCESS_ABSTAIN ``.
176
+ (` PublishableVoter `_ and ` TimePeriodVoter `_) that check the content for having
177
+ an interface exposing the methods they need. If the content implements the
178
+ interface, they check the parameter and return `` ACCESS_GRANTED `` or
179
+ ``ACCESS_DENIED ``, otherwise they return `` ACCESS_ABSTAIN ``.
169
180
170
181
As voting is unanimous, each voter returns ``ACCESS_GRANTED `` if its criteria
171
182
is met, but if a single voter returns ``ACCESS_DENIED ``, the content is
@@ -219,9 +230,14 @@ you can lower the priority of those voters.
219
230
220
231
.. code-block :: xml
221
232
222
- <service id =" acme.security.publishable_voter" class =" %acme.security.publishable_voter.class%" >
223
- <tag name =" cmf_published_voter" priority =" 30" />
224
- </service >
233
+ <?xml version =" 1.0" encoding =" UTF-8" ?>
234
+ <container xmlns =" http://symfony.com/schema/dic/services" >
235
+ <service id =" acme.security.publishable_voter"
236
+ class =" %acme.security.publishable_voter.class%" >
237
+
238
+ <tag name =" cmf_published_voter" priority =" 30" />
239
+ </service >
240
+ </container >
225
241
226
242
.. code-block :: php
227
243
@@ -235,14 +251,14 @@ you can lower the priority of those voters.
235
251
->addTag('cmf_published_voter', array('priority' => 30))
236
252
;
237
253
238
- As the workflow checker will create an
254
+ The workflow checker will create an
239
255
:class: `Symfony\\ Component\\ Security\\ Core\\ Authentication\\ Token\\ AnonymousToken ` on
240
- the fly if the security context has none, voters must be able to handle this
241
- situation when accessing the user. Also when accessing the security context,
242
- they first must check if it has a token and otherwise not call it to avoid
243
- triggering an exception. If a voter only gives access if there is a current
244
- user fulfills some requirement, it simply has to return `` ACCESS_DENIED `` if
245
- there is no current user.
256
+ the fly if the securty context has none. This means that voters must be able
257
+ to handle this situation when accessing the user. Also when accessing the
258
+ security context, they first must check if it has a token and otherwise they
259
+ should not call it to avoid triggering an exception. If a voter only gives
260
+ access if the current user fulfills some requirement, it simply has to return
261
+ `` ACCESS_DENIED `` if there is no current user.
246
262
247
263
.. _bundle-core-workflow-request_listener :
248
264
@@ -292,24 +308,29 @@ configuration in the ``sonata_admin`` section of your project configuration:
292
308
.. code-block :: xml
293
309
294
310
<!-- app/config/config.xml -->
295
- <config xmlns =" http://sonata-project.org/schema/dic/admin" >
296
- <!-- ... -->
297
- <extension id =" cmf_core.admin_extension.publish_workflow.publishable" >
298
- <implement >
299
- Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishableInterface
300
- </implement >
301
- </extension >
302
- <extension id =" cmf_core.admin_extension.publish_workflow.time_period" >
303
- <implement >
304
- Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishTimePeriodInterface
305
- </implement >
306
- </extension >
307
- </config >
311
+ <?xml version =" 1.0" encoding =" UTF-8" ?>
312
+ <container xmlns =" http://symfony.com/schema/dic/services" >
313
+ <config xmlns =" http://sonata-project.org/schema/dic/admin" >
314
+ <!-- ... -->
315
+ <extension id =" cmf_core.admin_extension.publish_workflow.publishable" >
316
+ <implement >
317
+ Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishableInterface
318
+ </implement >
319
+ </extension >
320
+
321
+ <extension id =" cmf_core.admin_extension.publish_workflow.time_period" >
322
+ <implement >
323
+ Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishTimePeriodInterface
324
+ </implement >
325
+ </extension >
326
+ </config >
327
+ </container >
308
328
309
329
.. code-block :: php
310
330
311
331
// app/config/config.php
312
332
$container->loadFromExtension('sonata_admin', array(
333
+ // ...
313
334
'extensions' => array(
314
335
'cmf_core.admin_extension.publish_workflow.publishable' => array(
315
336
'implements' => array(
0 commit comments