Merge pull request #209 from vtsykun/fix/acl-ref

Check ACL for all version with the same reference
vtsykun · Dec 27, 2023 · 2dcc873 · 2dcc873
2 parents e90da30 + f26beef
commit 2dcc873
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/src/Controller/ZipballController.php b/src/Controller/ZipballController.php
@@ -87,8 +87,11 @@ public function zipballAction(#[Vars('name')] Package $package, string $hash): R
             return $this->createNotFound();
         }
 
-        $version = $package->getVersionByReference($reference);
-        if (!$this->isGranted('ROLE_FULL_CUSTOMER', $version) && !$this->isGranted('VIEW_ALL_VERSION', $package)) {
+        $isGranted = $this->isGranted('VIEW_ALL_VERSION', $package);
+        foreach ($package->getAllVersionsByReference($reference) as $version) {
+            $isGranted |= $this->isGranted('ROLE_FULL_CUSTOMER', $version);
+        }
+        if (!$isGranted) {
             return $this->createNotFound();
         }
 

diff --git a/src/Entity/Package.php b/src/Entity/Package.php
@@ -536,6 +536,15 @@ public function getVersionByReference(string $reference): ?Version
         return $this->versions->findFirst(fn($k, $v) => $v->getReference() === $reference);
     }
 
+    /**
+     * @param string $reference
+     * @return Version[]
+     */
+    public function getAllVersionsByReference(string $reference): array
+    {
+        return $this->versions->filter(fn(Version $v, $k) => $v->getReference() === $reference)->toArray();
+    }
+
     public function getVersion($normalizedVersion)
     {
         if (null === $this->cachedVersions) {