Skip to content

TIGER-335 batch 1: _isAdmin()→_isAllowed() in identity/matomo/schedule/backup/ally #350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WebTigers merged 1 commit into from
Oct 21, 2026
Merged

TIGER-335 batch 1: _isAdmin()→_isAllowed() in identity/matomo/schedule/backup/ally #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,17 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows

## [Unreleased]

## [1.32.0] — 2026-10-21

### Changed
- **TIGER-335 migration (batch 1 of the per-module sweep)** — replaced the deprecated resource-level
`_isAdmin()` guards with privilege-scoped `_isAllowed('<method>')` in five admin-only modules:
**identity** (TIGER-356), **matomo** (TIGER-355), **schedule** (TIGER-351), **backup** (TIGER-349),
**ally** (TIGER-350). Behavior-preserving (each service is granted to `admin` at the resource, so the
wildcard grant covers every method privilege); the in-method guard stays as defense-in-depth for any
in-process caller, now expressed without a role comparer. The deprecated comparers are removed in a
later release once every module is migrated (TIGER-358).

## [1.31.0] — 2026-10-21

### Added
Expand Down
2 changes: 1 addition & 1 deletion library/Tiger/Version.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,5 @@
class Tiger_Version
{
/** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */
const VERSION = '1.31.0';
const VERSION = '1.32.0';
}
8 changes: 4 additions & 4 deletions modules/ally/services/Scan.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ class Ally_Service_Scan extends Tiger_Service_Service
*/
public function scan(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('scan')) { $this->_error('core.api.error.not_allowed'); return; }

$html = (string) ($params['html'] ?? '');
$pageId = trim((string) ($params['page_id'] ?? ''));
Expand Down Expand Up @@ -63,7 +63,7 @@ public function scan(array $params): void
*/
public function scanModule(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('scanModule')) { $this->_error('core.api.error.not_allowed'); return; }
$mod = preg_replace('/[^a-zA-Z0-9_-]/', '', (string) ($params['module'] ?? ''));
if ($mod === '' || !defined('MODULES_PATH')) { $this->_error('ally.scan.module_not_found'); return; }

Expand Down Expand Up @@ -106,7 +106,7 @@ public function scanModule(array $params): void
*/
public function pages(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('pages')) { $this->_error('core.api.error.not_allowed'); return; }
$this->_success(['pages' => $this->_pageList()], 'core.api.success');
}

Expand All @@ -118,7 +118,7 @@ public function pages(array $params): void
*/
public function scanAll(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('scanAll')) { $this->_error('core.api.error.not_allowed'); return; }

$renderer = new Tiger_Cms_Renderer();
$results = [];
Expand Down
8 changes: 4 additions & 4 deletions modules/backup/services/Backup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class Backup_Service_Backup extends Tiger_Service_Service
*/
public function run(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('run')) { $this->_error('core.api.error.not_allowed'); return; }

$components = $this->_components($params);
if (!$components) { $this->_error('backup.bad_component', ['field' => 'components']); return; }
Expand Down Expand Up @@ -53,7 +53,7 @@ public function run(array $params): void
*/
public function remove(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('remove')) { $this->_error('core.api.error.not_allowed'); return; }
$id = (string) ($params['backup_id'] ?? '');
if ($id === '' || !(new Tiger_Model_Backup())->findById($id)) { $this->_error('backup.not_found'); return; }
Tiger_Backup::delete($id);
Expand All @@ -68,7 +68,7 @@ public function remove(array $params): void
*/
public function restore(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('restore')) { $this->_error('core.api.error.not_allowed'); return; }
if ((string) ($params['confirm'] ?? '') !== 'RESTORE') { $this->_error('backup.restore.confirm', ['field' => 'confirm']); return; }

$model = new Tiger_Model_Backup();
Expand Down Expand Up @@ -103,7 +103,7 @@ public function restore(array $params): void
*/
public function saveSettings(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('saveSettings')) { $this->_error('core.api.error.not_allowed'); return; }

$components = $this->_components($params);
$disk = $this->_disk($params['disk'] ?? 'local');
Expand Down
2 changes: 1 addition & 1 deletion modules/identity/services/Identity.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ class Identity_Service_Identity extends Tiger_Service_Service
*/
public function save(array $params): void
{
if (!$this->_isAdmin()) {
if (!$this->_isAllowed('save')) {
$this->_error('core.api.error.not_allowed');
return;
}
Expand Down
2 changes: 1 addition & 1 deletion modules/matomo/services/Matomo.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ class Matomo_Service_Matomo extends Tiger_Service_Service
*/
public function save(array $params): void
{
if (!$this->_isAdmin()) {
if (!$this->_isAllowed('save')) {
$this->_error('core.api.error.not_allowed');
return;
}
Expand Down
6 changes: 3 additions & 3 deletions modules/schedule/services/Schedule.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class Schedule_Service_Schedule extends Tiger_Service_Service
*/
public function jobs(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('jobs')) { $this->_error('core.api.error.not_allowed'); return; }

$latest = (new Tiger_Model_ScheduleRun())->latestPerJob();
$now = time();
Expand Down Expand Up @@ -65,7 +65,7 @@ public function jobs(array $params): void
*/
public function setSchedule(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('setSchedule')) { $this->_error('core.api.error.not_allowed'); return; }
$key = preg_replace('/[^a-zA-Z0-9._-]/', '', (string) ($params['key'] ?? ''));
if ($key === '' || !Tiger_Schedule::get($key)) { $this->_error('schedule.unknown_job'); return; }

Expand Down Expand Up @@ -96,7 +96,7 @@ public function setSchedule(array $params): void
*/
public function runNow(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('runNow')) { $this->_error('core.api.error.not_allowed'); return; }
$key = preg_replace('/[^a-zA-Z0-9._-]/', '', (string) ($params['key'] ?? ''));
if ($key === '' || !Tiger_Schedule::get($key)) { $this->_error('schedule.unknown_job'); return; }
$r = Tiger_Schedule::runNow($key);
Expand Down
Loading