mirror of
https://github.com/chenasraf/nextcloud-forum.git
synced 2026-05-18 01:28:58 +00:00
Chen Asraf
d2baf2a813
Implement opt-in guest access system allowing unauthenticated users to view forum content with configurable permissions. Features Added: - Guest access toggle in admin settings for forum-wide control - Guest role with configurable category-level permissions (view/post/reply) - Role type system (admin, moderator, default, guest, custom) for enhanced access control - Public page support in routing with automatic redirect to login when disabled - Public settings API endpoint for unauthenticated access to forum metadata - Guest role permissions UI in admin panel with clear capability restrictions - Database migration with automatic role type assignment and guest role seeding Security & Permission Improvements: - Permission middleware now validates permissions on public pages instead of skipping checks - Admin/moderator roles have full access; guest/default roles restricted from moderation - Guest role cannot be assigned to authenticated users Breaking Changes: - Forum title/subtitle moved from system config to app config (auto-migrated) - Permission middleware behavior changed for PublicPage routes (now checks permissions)
77 lines
2.0 KiB
PHP
77 lines
2.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace OCA\Forum\Controller;
|
|
|
|
use OCA\Forum\AppInfo\Application;
|
|
use OCP\AppFramework\Controller;
|
|
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
|
|
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
|
|
use OCP\AppFramework\Http\Attribute\PublicPage;
|
|
use OCP\AppFramework\Http\ContentSecurityPolicy;
|
|
use OCP\AppFramework\Http\Template\PublicTemplateResponse;
|
|
use OCP\AppFramework\Http\TemplateResponse;
|
|
use OCP\IRequest;
|
|
use OCP\IUserSession;
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
class PageController extends Controller {
|
|
public function __construct(
|
|
string $appName,
|
|
IRequest $request,
|
|
private IUserSession $userSession,
|
|
private LoggerInterface $logger,
|
|
) {
|
|
parent::__construct($appName, $request);
|
|
}
|
|
|
|
/**
|
|
* Main app page
|
|
*
|
|
* @return TemplateResponse<Http::STATUS_OK,array{}>|PublicTemplateResponse<Http::STATUS_OK,array{}>
|
|
*
|
|
* 200: OK
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[NoCSRFRequired]
|
|
#[PublicPage]
|
|
public function index(): TemplateResponse|PublicTemplateResponse {
|
|
$user = $this->userSession->getUser();
|
|
$templateData = [
|
|
'script' => Application::getViteEntryScript('app.ts'),
|
|
'style' => Application::getViteEntryScript('style.css'),
|
|
];
|
|
|
|
$response = null;
|
|
|
|
if ($user) {
|
|
$response = new TemplateResponse(Application::APP_ID, 'app', $templateData);
|
|
} else {
|
|
$response = new PublicTemplateResponse(Application::APP_ID, 'app', $templateData);
|
|
}
|
|
|
|
// Allow loading images from external sources in forum posts
|
|
$csp = new ContentSecurityPolicy();
|
|
$csp->addAllowedImageDomain('*');
|
|
$csp->addAllowedMediaDomain('*');
|
|
$response->setContentSecurityPolicy($csp);
|
|
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* Main app page - catch all route
|
|
*
|
|
* @return TemplateResponse<Http::STATUS_OK,array{}>|PublicTemplateResponse<Http::STATUS_OK,array{}>
|
|
*
|
|
* 200: OK
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[NoCSRFRequired]
|
|
#[PublicPage]
|
|
public function catchAll(string $path = ''): TemplateResponse|PublicTemplateResponse {
|
|
return $this->index();
|
|
}
|
|
}
|