core-bundle/src/Resources/contao/dca/tl_article.php
public function checkPermission()
	{
		if ($this->User->isAdmin)
		{
			return;
		}

		/** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */
		$objSession = Contao\System::getContainer()->get('session');

		$session = $objSession->all();

		// Set the default page user and group
		$GLOBALS['TL_DCA']['tl_page']['fields']['cuser']['default'] = (int) Contao\Config::get('defaultUser') ?: $this->User->id;
		$GLOBALS['TL_DCA']['tl_page']['fields']['cgroup']['default'] = (int) Contao\Config::get('defaultGroup') ?: (int) $this->User->groups[0];

		// Restrict the page tree
		if (empty($this->User->pagemounts) || !\is_array($this->User->pagemounts))
		{
			$root = array(0);
		}
		else
		{
			$root = $this->User->pagemounts;
		}

		$GLOBALS['TL_DCA']['tl_page']['list']['sorting']['root'] = $root;

		// Set allowed page IDs (edit multiple)
		if (\is_array($session['CURRENT']['IDS']))
		{
			$edit_all = array();
			$delete_all = array();

			foreach ($session['CURRENT']['IDS'] as $id)
			{
				$objArticle = $this->Database->prepare("SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id")
											 ->limit(1)
											 ->execute($id);

				if ($objArticle->numRows < 1)
				{
					continue;
				}

				$row = $objArticle->row();

				if ($this->User->isAllowed(Contao\BackendUser::CAN_EDIT_ARTICLES, $row))
				{
					$edit_all[] = $id;
				}

				if ($this->User->isAllowed(Contao\BackendUser::CAN_DELETE_ARTICLES, $row))
				{
					$delete_all[] = $id;
				}
			}

			$session['CURRENT']['IDS'] = (Contao\Input::get('act') == 'deleteAll') ? $delete_all : $edit_all;
		}

		// Set allowed clipboard IDs
		if (isset($session['CLIPBOARD']['tl_article']) && \is_array($session['CLIPBOARD']['tl_article']['id']))
		{
			$clipboard = array();

			foreach ($session['CLIPBOARD']['tl_article']['id'] as $id)
			{
				$objArticle = $this->Database->prepare("SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id")
											 ->limit(1)
											 ->execute($id);

				if ($objArticle->numRows < 1)
				{
					continue;
				}

				if ($this->User->isAllowed(Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY, $objArticle->row()))
				{
					$clipboard[] = $id;
				}
			}

			$session['CLIPBOARD']['tl_article']['id'] = $clipboard;
		}

		$permission = 0;

		// Overwrite the session
		$objSession->replace($session);

		// Check current action
		if (Contao\Input::get('act') && Contao\Input::get('act') != 'paste')
		{
			// Set ID of the article's page
			$objPage = $this->Database->prepare("SELECT pid FROM tl_article WHERE id=?")
									  ->limit(1)
									  ->execute(Contao\Input::get('id'));

			$ids = $objPage->numRows ? array($objPage->pid) : array();

			// Set permission
			switch (Contao\Input::get('act'))
			{
				case 'edit':
				case 'toggle':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLES;
					break;

				case 'move':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY;
					$ids[] = Contao\Input::get('sid');
					break;

				// Do not insert articles into a website root page
				case 'create':
				case 'copy':
				case 'copyAll':
				case 'cut':
				case 'cutAll':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY;

					// Insert into a page
					if (Contao\Input::get('mode') == 2)
					{
						$objParent = $this->Database->prepare("SELECT id, type FROM tl_page WHERE id=?")
													->limit(1)
													->execute(Contao\Input::get('pid'));

						$ids[] = Contao\Input::get('pid');
					}

					// Insert after an article
					else
					{
						$objParent = $this->Database->prepare("SELECT id, type FROM tl_page WHERE id=(SELECT pid FROM tl_article WHERE id=?)")
													->limit(1)
													->execute(Contao\Input::get('pid'));

						$ids[] = $objParent->id;
					}

					if ($objParent->numRows && $objParent->type == 'root')
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Attempt to insert an article into website root page ID ' . Contao\Input::get('pid') . '.');
					}
					break;

				case 'delete':
					$permission = Contao\BackendUser::CAN_DELETE_ARTICLES;
					break;
			}

			// Check user permissions
			if (Contao\Input::get('act') != 'show')
			{
				$pagemounts = array();

				// Get all allowed pages for the current user
				foreach ($this->User->pagemounts as $root)
				{
					$pagemounts[] = array($root);
					$pagemounts[] = $this->Database->getChildRecords($root, 'tl_page');
				}

				if (!empty($pagemounts))
				{
					$pagemounts = array_merge(...$pagemounts);
				}

				$pagemounts = array_unique($pagemounts);

				// Check each page
				foreach ($ids as $id)
				{
					if (!\in_array($id, $pagemounts))
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Page ID ' . $id . ' is not mounted.');
					}

					$objPage = Contao\PageModel::findById($id);

					// Check whether the current user has permission for the current page
					if ($objPage !== null && !$this->User->isAllowed($permission, $objPage->row()))
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' ' . (\strlen(Contao\Input::get('id')) ? 'article ID ' . Contao\Input::get('id') : ' articles') . ' on page ID ' . $id . ' or to paste it/them into page ID ' . $id . '.');
					}
				}
			}
		}
	}
public function checkPermission()
	{
		if ($this->User->isAdmin)
		{
			return;
		}

		/** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */
		$objSession = Contao\System::getContainer()->get('session');

		$session = $objSession->all();

		// Set the default page user and group
		$GLOBALS['TL_DCA']['tl_page']['fields']['cuser']['default'] = (int) Contao\Config::get('defaultUser') ?: $this->User->id;
		$GLOBALS['TL_DCA']['tl_page']['fields']['cgroup']['default'] = (int) Contao\Config::get('defaultGroup') ?: (int) $this->User->groups[0];

		// Restrict the page tree
		if (empty($this->User->pagemounts) || !\is_array($this->User->pagemounts))
		{
			$root = array(0);
		}
		else
		{
			$root = $this->User->pagemounts;
		}

		$GLOBALS['TL_DCA']['tl_page']['list']['sorting']['root'] = $root;

		// Set allowed page IDs (edit multiple)
		if (\is_array($session['CURRENT']['IDS']))
		{
			$edit_all = array();
			$delete_all = array();

			foreach ($session['CURRENT']['IDS'] as $id)
			{
				$objArticle = $this->Database->prepare("SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id")
											 ->limit(1)
											 ->execute($id);

				if ($objArticle->numRows < 1)
				{
					continue;
				}

				$row = $objArticle->row();

				if ($this->User->isAllowed(Contao\BackendUser::CAN_EDIT_ARTICLES, $row))
				{
					$edit_all[] = $id;
				}

				if ($this->User->isAllowed(Contao\BackendUser::CAN_DELETE_ARTICLES, $row))
				{
					$delete_all[] = $id;
				}
			}

			$session['CURRENT']['IDS'] = (Contao\Input::get('act') == 'deleteAll') ? $delete_all : $edit_all;
		}

		// Set allowed clipboard IDs
		if (isset($session['CLIPBOARD']['tl_article']) && \is_array($session['CLIPBOARD']['tl_article']['id']))
		{
			$clipboard = array();

			foreach ($session['CLIPBOARD']['tl_article']['id'] as $id)
			{
				$objArticle = $this->Database->prepare("SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id")
											 ->limit(1)
											 ->execute($id);

				if ($objArticle->numRows < 1)
				{
					continue;
				}

				if ($this->User->isAllowed(Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY, $objArticle->row()))
				{
					$clipboard[] = $id;
				}
			}

			$session['CLIPBOARD']['tl_article']['id'] = $clipboard;
		}

		$permission = 0;

		// Overwrite the session
		$objSession->replace($session);

		// Check current action
		if (Contao\Input::get('act') && Contao\Input::get('act') != 'paste')
		{
			// Set ID of the article's page
			$objPage = $this->Database->prepare("SELECT pid FROM tl_article WHERE id=?")
									  ->limit(1)
									  ->execute(Contao\Input::get('id'));

			$ids = $objPage->numRows ? array($objPage->pid) : array();

			// Set permission
			switch (Contao\Input::get('act'))
			{
				case 'edit':
				case 'toggle':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLES;
					break;

				case 'move':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY;
					$ids[] = Contao\Input::get('sid');
					break;

				// Do not insert articles into a website root page
				case 'create':
				case 'copy':
				case 'copyAll':
				case 'cut':
				case 'cutAll':
					$permission = Contao\BackendUser::CAN_EDIT_ARTICLE_HIERARCHY;

					// Insert into a page
					if (Contao\Input::get('mode') == 2)
					{
						$objParent = $this->Database->prepare("SELECT id, type FROM tl_page WHERE id=?")
													->limit(1)
													->execute(Contao\Input::get('pid'));

						$ids[] = Contao\Input::get('pid');
					}

					// Insert after an article
					else
					{
						$objParent = $this->Database->prepare("SELECT id, type FROM tl_page WHERE id=(SELECT pid FROM tl_article WHERE id=?)")
													->limit(1)
													->execute(Contao\Input::get('pid'));

						$ids[] = $objParent->id;
					}

					if ($objParent->numRows && $objParent->type == 'root')
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Attempt to insert an article into website root page ID ' . Contao\Input::get('pid') . '.');
					}
					break;

				case 'delete':
					$permission = Contao\BackendUser::CAN_DELETE_ARTICLES;
					break;
			}

			// Check user permissions
			if (Contao\Input::get('act') != 'show')
			{
				$pagemounts = array();

				// Get all allowed pages for the current user
				foreach ($this->User->pagemounts as $root)
				{
					$pagemounts[] = array($root);
					$pagemounts[] = $this->Database->getChildRecords($root, 'tl_page');
				}

				if (!empty($pagemounts))
				{
					$pagemounts = array_merge(...$pagemounts);
				}

				$pagemounts = array_unique($pagemounts);

				// Check each page
				foreach ($ids as $id)
				{
					if (!\in_array($id, $pagemounts))
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Page ID ' . $id . ' is not mounted.');
					}

					$objPage = Contao\PageModel::findById($id);

					// Check whether the current user has permission for the current page
					if ($objPage !== null && !$this->User->isAllowed($permission, $objPage->row()))
					{
						throw new Contao\CoreBundle\Exception\AccessDeniedException('Not enough permissions to ' . Contao\Input::get('act') . ' ' . (\strlen(Contao\Input::get('id')) ? 'article ID ' . Contao\Input::get('id') : ' articles') . ' on page ID ' . $id . ' or to paste it/them into page ID ' . $id . '.');
					}
				}
			}
		}
	}
public function checkPermission ( ) { if ( $ this -> User -> isAdmin ) { return ; } /** @var Symfony\Component\HttpFoundation\Session\SessionInterface $objSession */ $ objSession = Contao \ System :: getContainer ( ) -> get ( 'session' ) ; $ session = $ objSession -> all ( ) ; // Set the default page user and group $ GLOBALS [ 'TL_DCA' ] [ 'tl_page' ] [ 'fields' ] [ 'cuser' ] [ 'default' ] = ( int ) Contao \ Config :: get ( 'defaultUser' ) ? : $ this -> User -> id ; $ GLOBALS [ 'TL_DCA' ] [ 'tl_page' ] [ 'fields' ] [ 'cgroup' ] [ 'default' ] = ( int ) Contao \ Config :: get ( 'defaultGroup' ) ? : ( int ) $ this -> User -> groups [ 0 ] ; // Restrict the page tree if ( empty ( $ this -> User -> pagemounts ) || ! \ is_array ( $ this -> User -> pagemounts ) ) { $ root = array ( 0 ) ; } else { $ root = $ this -> User -> pagemounts ; } $ GLOBALS [ 'TL_DCA' ] [ 'tl_page' ] [ 'list' ] [ 'sorting' ] [ 'root' ] = $ root ; // Set allowed page IDs (edit multiple) if ( \ is_array ( $ session [ 'CURRENT' ] [ 'IDS' ] ) ) { $ edit_all = array ( ) ; $ delete_all = array ( ) ; foreach ( $ session [ 'CURRENT' ] [ 'IDS' ] as $ id ) { $ objArticle = $ this -> Database -> prepare ( "SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id" ) -> limit ( 1 ) -> execute ( $ id ) ; if ( $ objArticle -> numRows < 1 ) { continue ; } $ row = $ objArticle -> row ( ) ; if ( $ this -> User -> isAllowed ( Contao \ BackendUser :: CAN_EDIT_ARTICLES , $ row ) ) { $ edit_all [ ] = $ id ; } if ( $ this -> User -> isAllowed ( Contao \ BackendUser :: CAN_DELETE_ARTICLES , $ row ) ) { $ delete_all [ ] = $ id ; } } $ session [ 'CURRENT' ] [ 'IDS' ] = ( Contao \ Input :: get ( 'act' ) == 'deleteAll' ) ? $ delete_all : $ edit_all ; } // Set allowed clipboard IDs if ( isset ( $ session [ 'CLIPBOARD' ] [ 'tl_article' ] ) && \ is_array ( $ session [ 'CLIPBOARD' ] [ 'tl_article' ] [ 'id' ] ) ) { $ clipboard = array ( ) ; foreach ( $ session [ 'CLIPBOARD' ] [ 'tl_article' ] [ 'id' ] as $ id ) { $ objArticle = $ this -> Database -> prepare ( "SELECT p.pid, p.includeChmod, p.chmod, p.cuser, p.cgroup FROM tl_article a, tl_page p WHERE a.id=? AND a.pid=p.id" ) -> limit ( 1 ) -> execute ( $ id ) ; if ( $ objArticle -> numRows < 1 ) { continue ; } if ( $ this -> User -> isAllowed ( Contao \ BackendUser :: CAN_EDIT_ARTICLE_HIERARCHY , $ objArticle -> row ( ) ) ) { $ clipboard [ ] = $ id ; } } $ session [ 'CLIPBOARD' ] [ 'tl_article' ] [ 'id' ] = $ clipboard ; } $ permission = 0 ; // Overwrite the session $ objSession -> replace ( $ session ) ; // Check current action if ( Contao \ Input :: get ( 'act' ) && Contao \ Input :: get ( 'act' ) != 'paste' ) { // Set ID of the article's page $ objPage = $ this -> Database -> prepare ( "SELECT pid FROM tl_article WHERE id=?" ) -> limit ( 1 ) -> execute ( Contao \ Input :: get ( 'id' ) ) ; $ ids = $ objPage -> numRows ? array ( $ objPage -> pid ) : array ( ) ; // Set permission switch ( Contao \ Input :: get ( 'act' ) ) { case 'edit' : case 'toggle' : $ permission = Contao \ BackendUser :: CAN_EDIT_ARTICLES ; break ; case 'move' : $ permission = Contao \ BackendUser :: CAN_EDIT_ARTICLE_HIERARCHY ; $ ids [ ] = Contao \ Input :: get ( 'sid' ) ; break ; // Do not insert articles into a website root page case 'create' : case 'copy' : case 'copyAll' : case 'cut' : case 'cutAll' : $ permission = Contao \ BackendUser :: CAN_EDIT_ARTICLE_HIERARCHY ; // Insert into a page if ( Contao \ Input :: get ( 'mode' ) == 2 ) { $ objParent = $ this -> Database -> prepare ( "SELECT id, type FROM tl_page WHERE id=?" ) -> limit ( 1 ) -> execute ( Contao \ Input :: get ( 'pid' ) ) ; $ ids [ ] = Contao \ Input :: get ( 'pid' ) ; } // Insert after an article else { $ objParent = $ this -> Database -> prepare ( "SELECT id, type FROM tl_page WHERE id=(SELECT pid FROM tl_article WHERE id=?)" ) -> limit ( 1 ) -> execute ( Contao \ Input :: get ( 'pid' ) ) ; $ ids [ ] = $ objParent -> id ; } if ( $ objParent -> numRows && $ objParent -> type == 'root' ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Attempt to insert an article into website root page ID ' . Contao \ Input :: get ( 'pid' ) . '.' ) ; } break ; case 'delete' : $ permission = Contao \ BackendUser :: CAN_DELETE_ARTICLES ; break ; } // Check user permissions if ( Contao \ Input :: get ( 'act' ) != 'show' ) { $ pagemounts = array ( ) ; // Get all allowed pages for the current user foreach ( $ this -> User -> pagemounts as $ root ) { $ pagemounts [ ] = array ( $ root ) ; $ pagemounts [ ] = $ this -> Database -> getChildRecords ( $ root , 'tl_page' ) ; } if ( ! empty ( $ pagemounts ) ) { $ pagemounts = array_merge ( ... $ pagemounts ) ; } $ pagemounts = array_unique ( $ pagemounts ) ; // Check each page foreach ( $ ids as $ id ) { if ( ! \ in_array ( $ id , $ pagemounts ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Page ID ' . $ id . ' is not mounted.' ) ; } $ objPage = Contao \ PageModel :: findById ( $ id ) ; // Check whether the current user has permission for the current page if ( $ objPage !== null && ! $ this -> User -> isAllowed ( $ permission , $ objPage -> row ( ) ) ) { throw new Contao \ CoreBundle \ Exception \ AccessDeniedException ( 'Not enough permissions to ' . Contao \ Input :: get ( 'act' ) . ' ' . ( \ strlen ( Contao \ Input :: get ( 'id' ) ) ? 'article ID ' . Contao \ Input :: get ( 'id' ) : ' articles' ) . ' on page ID ' . $ id . ' or to paste it/them into page ID ' . $ id . '.' ) ; } } } } }
Check permissions to edit table tl_page

@throws Contao\CoreBundle\Exception\AccessDeniedException
Check permissions to edit table tl_page