diff --git a/src/AppBundle/Security/TaskVoter.php b/src/AppBundle/Security/TaskVoter.php index 22fe84b..e6a3069 100644 --- a/src/AppBundle/Security/TaskVoter.php +++ b/src/AppBundle/Security/TaskVoter.php @@ -60,6 +60,8 @@ protected function supports($attribute, $subject) /** * Perform a single access check operation on a given attribute, subject and token. * + * @SuppressWarnings(PHPMD.UnusedFormalParameter) + * * @param string $attribute * @param Task $subject * @param TokenInterface $token @@ -94,6 +96,13 @@ private function canDelete(Task $task, User $user, TokenInterface $token) { $author = $task->getUser(); + // SCENARIO 1: The task is linked to an "anonymous" author (or has no author). + // Only admins (ROLE_ADMIN) are allowed to delete these tasks. + if ($author === null || $author->getUsername() === 'anonyme') { + return $this->decisionManager->decide($token, ['ROLE_ADMIN']); + } + + // SCENARIO 2: The task has a valid author. // The logged-in user must be the strict author of the task. return $user->getId() === $author->getId(); } diff --git a/tests/AppBundle/Controller/TaskControllerTest.php b/tests/AppBundle/Controller/TaskControllerTest.php index 28df067..0cde0a4 100644 --- a/tests/AppBundle/Controller/TaskControllerTest.php +++ b/tests/AppBundle/Controller/TaskControllerTest.php @@ -97,7 +97,7 @@ public function testUserCanDeleteOwnTask() // 4. Verify that he is redirected (302) to the list page $this->assertEquals(302, $client->getResponse()->getStatusCode()); - $crawler = $client->followRedirect(); + $client->followRedirect(); $this->assertContains('La tâche a bien été supprimée.', $client->getResponse()->getContent()); } }