Security update for permissions_by_term

[yaffs-website] / web / modules / contrib / permissions_by_term / src / Listener / KernelEventListener.php

diff --git a/web/modules/contrib/permissions_by_term/src/KernelEventListener.php b/web/modules/contrib/permissions_by_term/src/Listener/KernelEventListener.php
similarity index 79%
rename from web/modules/contrib/permissions_by_term/src/KernelEventListener.php
rename to web/modules/contrib/permissions_by_term/src/Listener/KernelEventListener.php
index 276583de381bb200ccaf8ce73c21836bc650d962..e3a8df074810c0d4857b38013c3125cc0d0f8cb1 100644 (file)
--- a/web/modules/contrib/permissions_by_term/src/KernelEventListener.php
+++ b/web/modules/contrib/permissions_by_term/src/Listener/KernelEventListener.php
@@ -1,7 +1,9 @@
 <?php
 
-namespace Drupal\permissions_by_term;
+namespace Drupal\permissions_by_term\Listener;
 
+use Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher;
+use Drupal\permissions_by_term\Event\PermissionsByTermDeniedEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\HttpFoundation\JsonResponse;
@@ -9,6 +11,8 @@ use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Drupal\permissions_by_term\Service\AccessCheck;
+use Drupal\permissions_by_term\Service\Term;
 
 /**
  * Class KernelEventListener.
@@ -18,13 +22,29 @@ use Symfony\Component\HttpFoundation\Request;
 class KernelEventListener implements EventSubscriberInterface
 {
 
+  /**
+   * @var AccessCheck
+   */
+  private $accessCheckService;
+
+  /**
+   * @var Term
+   */
+  private $term;
+
+  /**
+   * @var ContainerAwareEventDispatcher
+   */
+  private $eventDispatcher;
+
   /**
    * Instantiating of objects on class construction.
    */
   public function __construct()
   {
     $this->accessCheckService = \Drupal::service('permissions_by_term.access_check');
-    $this->accessStorageService = \Drupal::service('permissions_by_term.access_storage');
+    $this->term = \Drupal::service('permissions_by_term.term');
+    $this->eventDispatcher = \Drupal::service('event_dispatcher');
   }
 
   /**
@@ -36,6 +56,9 @@ class KernelEventListener implements EventSubscriberInterface
     if ($this->canRequestGetNode($event->getRequest())) {
       $nid = $event->getRequest()->attributes->get('node')->get('nid')->getValue()['0']['value'];
       if (!$this->accessCheckService->canUserAccessByNodeId($nid)) {
+        $accessDeniedEvent = new PermissionsByTermDeniedEvent($nid);
+        $this->eventDispatcher->dispatch(PermissionsByTermDeniedEvent::NAME, $accessDeniedEvent);
+
         $this->sendUserToAccessDeniedPage();
       }
     }
@@ -46,7 +69,7 @@ class KernelEventListener implements EventSubscriberInterface
       $query_string = $event->getRequest()->get('q');
       $query_string = trim($query_string);
 
-      $tid = $this->accessStorageService->getTermIdByName($query_string);
+      $tid = $this->term->getTermIdByName($query_string);
       if (!$this->accessCheckService->isAccessAllowedByDatabase($tid)) {
         $this->sendUserToAccessDeniedPage();
       }
@@ -71,7 +94,7 @@ class KernelEventListener implements EventSubscriberInterface
       $suggested_terms = json_decode($json_suggested_terms);
       $allowed_terms = [];
       foreach ($suggested_terms as $term) {
-        $tid = $this->accessStorageService->getTermIdByName($term->label);
+        $tid = $this->term->getTermIdByName($term->label);
         if ($this->accessCheckService->isAccessAllowedByDatabase($tid)) {
           $allowed_terms[] = [
             'value' => $term->value,