Sonata Admin ACL 隐藏列表中的元素

Question

经过大量努力，我终于能够按照本指南使用 ACL 配置 Sonata Admin：

https://sonata-project.org/bundles/admin/master/doc/reference/security.html

我希望用户只能查看和编辑与用户具有相同 country 属性的项目。

这是我的 config.yml:

parameters:
    locale: en
    sonata.user.admin.user.class: AppBundle\Admin\UserAdmin
    sonata.admin.security.mask.builder.class: Sonata\AdminBundle\Security\Acl\Permission\MaskBuilder

# SonataAdminBundle Configuration
sonata_admin:
    security:
        handler: sonata.admin.security.handler.acl

        role_admin: ROLE_ADMIN
        role_super_admin: ROLE_SUPER_ADMIN

        # acl security information
        information:
            GUEST:    [VIEW, LIST]
            STAFF:    [EDIT, LIST, CREATE]
            EDITOR:   [OPERATOR, EXPORT]
            ADMIN:    [MASTER]

        # permissions not related to an object instance and also to be available when objects do not exist
        # the DELETE admin permission means the user is allowed to batch delete objects
        admin_permissions: [CREATE, LIST, DELETE, UNDELETE, EXPORT, OPERATOR, MASTER]

        # permission related to the objects
        object_permissions: [VIEW, EDIT, DELETE, UNDELETE, OPERATOR, MASTER, OWNER]

我创建了一个 AclVoter 以 show/hides 个元素：

services:
    security.acl.voter.country_owned_permissions:
        class: AppBundle\Security\Authorization\Voter\CountryOwnedAclVoter
        arguments:
            - "@security.acl.provider"
            - "@security.acl.object_identity_retrieval_strategy"
            - "@security.acl.security_identity_retrieval_strategy"
            - "@security.acl.permission.map"
            - "@logger"
        tags:
            - { name: monolog.logger, channel: security }
            - { name: security.voter, priority: 255 }
        public: false

这是实际的 class:

<?php

namespace AppBundle\Security\Authorization\Voter;

use FOS\UserBundle\Model\UserInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Acl\Voter\AclVoter;

class CountryOwnedAclVoter extends AclVoter
{
    public function supportsClass($class)
    {
        // support the Class-Scope ACL for votes with the custom permission map
        // return $class === 'Sonata\UserBundle\Admin\Entity\UserAdmin' || is_subclass_of($class, 'FOS\UserBundle\Model\UserInterface');
        // if you use php >=5.3.7 you can check the inheritance with is_a($class, 'Sonata\UserBundle\Admin\Entity\UserAdmin');
        // support the Object-Scope ACL
        return is_subclass_of($class, 'AppBundle\Model\CountryOwnedInterface');
    }

    public function supportsAttribute($attribute)
    {
        return in_array($attribute, array(
            'LIST',
            'VIEW',
            'EDIT',
            'DELETE',
            'EXPORT',
        ));
    }

    public function vote(TokenInterface $token, $object, array $attributes)
    {
        if (!$this->supportsClass(get_class($object))) {
            return self::ACCESS_ABSTAIN;
        }

        foreach ($attributes as $attribute) {
            if ($this->supportsAttribute($attribute)) {
                if ($object->getCountry() != $token->getUser()->getCountry()) {
                //if ($object->isSuperAdmin() && !$token->getUser()->isSuperAdmin()) {
                    // deny a non super admin user to edit a super admin user
                    return self::ACCESS_DENIED;
                }
            }
        }

        // use the parent vote with the custom permission map:
        // return parent::vote($token, $object, $attributes);
        // otherwise leave the permission voting to the AclVoter that is using the default permission map
        return self::ACCESS_ABSTAIN;
    }
}

它似乎工作正常，因为用户只能编辑与用户具有相同国家/地区的项目。问题是他仍然可以查看列表中的项目。

我做错了什么？

Answer 1

按照官方文档中的说明，我只需要安装一个特定的包：

5.4.6. LIST FILTERING
List filtering using ACL is available as a third party bundle: CoopTilleulsAclSonataAdminExtensionBundle. When enabled, the logged in user will only see the objects for which it has the VIEW right (or superior).

这就足够了：

composer require tilleuls/acl-sonata-admin-extension-bundle

在AppKernel.php中：

// ACL list filter
new CoopTilleuls\Bundle\AclSonataAdminExtensionBundle\CoopTilleulsAclSonataAdminExtensionBundle(),

Sonata Admin ACL 隐藏列表中的元素

Sonata Admin ACL hide element in list

php

symfony

acl

sonata-admin