Skip to content

Commit

Permalink
BUGFIX: Use withoutAuthorizationChecks to remove site via user interface
Browse files Browse the repository at this point in the history
The CR security was introduced with

#5298

And now fails when fetching the content graph or deleting nodes:

> Read access denied for workspace "user-editor": User is a Neos Administrator without explicit role for workspace "user-editor"

The herby proposed fix is not perfect but so is the whole site deletion, instead only the base workspace should need to be deleted and the others need to be rebased.
  • Loading branch information
mhsdesign committed Jan 20, 2025
1 parent a816c4c commit 2ade422
Showing 1 changed file with 14 additions and 8 deletions.
22 changes: 14 additions & 8 deletions Neos.Neos/Classes/Domain/Service/SiteServiceInternals.php
Original file line number Diff line number Diff line change
Expand Up @@ -68,9 +68,13 @@ public function removeSiteNode(SiteNodeName $siteNodeName): void
);
}

// todo only remove site node in base workspace and rebase dependant workspaces to avoid also the security hacks here.
foreach ($this->contentRepository->findWorkspaces() as $workspace) {
$contentGraph = $this->contentRepository->getContentGraph($workspace->workspaceName);
$sitesNodeAggregate = $contentGraph->findRootNodeAggregateByType(
$contentGraph = null;
$this->securityContext->withoutAuthorizationChecks(function () use (&$contentGraph, $workspace) {
$contentGraph = $this->contentRepository->getContentGraph($workspace->workspaceName);
});
$sitesNodeAggregate = $contentGraph?->findRootNodeAggregateByType(
NodeTypeNameFactory::forSites()
);
if (!$sitesNodeAggregate) {
Expand All @@ -82,12 +86,14 @@ public function removeSiteNode(SiteNodeName $siteNodeName): void
$siteNodeName->toNodeName()
);
if ($siteNodeAggregate instanceof NodeAggregate) {
$this->contentRepository->handle(RemoveNodeAggregate::create(
$workspace->workspaceName,
$siteNodeAggregate->nodeAggregateId,
$arbitraryDimensionSpacePoint,
NodeVariantSelectionStrategy::STRATEGY_ALL_VARIANTS,
));
$this->securityContext->withoutAuthorizationChecks(
fn () => $this->contentRepository->handle(RemoveNodeAggregate::create(
$workspace->workspaceName,
$siteNodeAggregate->nodeAggregateId,
$arbitraryDimensionSpacePoint,
NodeVariantSelectionStrategy::STRATEGY_ALL_VARIANTS,
))
);
}
}
}
Expand Down

0 comments on commit 2ade422

Please sign in to comment.