[v1.16] Deny access for files from template of hidden content

docs/CHANGELOG.md

@@ -1,9 +1,10 @@
 Changelog
 =========
 
-1.10.8 (Unreleased)
-----------------------------
+1.10.8 (September 24, 2024)
+---------------------------
 - Fix #347: Fix errors after save a new page
+- Enh #308: Deny access for files from template of hidden content
 
 1.10.7 (September 19, 2024)
 ----------------------------

module.json

@@ -6,6 +6,6 @@
     "version": "1.10.8",
     "homepage": "https://github.com/humhub/custom-pages",
     "humhub": {
-        "minVersion": "1.14"
+        "minVersion": "1.16"
     }
 }

modules/template/models/TemplateContentActiveRecord.php

@@ -2,13 +2,19 @@
 
 namespace humhub\modules\custom_pages\modules\template\models;
 
-use Yii;
 use humhub\components\ActiveRecord;
+use humhub\interfaces\ViewableInterface;
+use humhub\modules\content\components\ContentActiveRecord;
+use humhub\modules\custom_pages\models\CustomContentContainer;
+use Yii;
+use yii\db\ActiveQuery;
 
 /**
  * This is the base class for all TemplateContent types.
+ *
+ * @property-read OwnerContent $ownerContent
  */
-abstract class TemplateContentActiveRecord extends ActiveRecord
+abstract class TemplateContentActiveRecord extends ActiveRecord implements ViewableInterface
 {
 
     const SCENARIO_CREATE = 'create';
@@ -325,4 +331,43 @@ public function isEmpty(): bool
         return false;
     }
 
+    public function getOwnerContent(): ActiveQuery
+    {
+        return $this->hasOne(OwnerContent::class, ['content_id' => 'id'])
+            ->andWhere([OwnerContent::tableName() . '.content_type' => get_class($this)]);
+    }
+
+    public function getCustomContentContainer(): ?CustomContentContainer
+    {
+        $ownerContent = $this->ownerContent;
+        if (!$ownerContent instanceof OwnerContent) {
+            return null;
+        }
+
+        $ownerModel = $ownerContent->getOwner();
+        if (!$ownerModel instanceof TemplateInstance) {
+            return null;
+        }
+
+        return $ownerModel->getObject();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function canView($user = null): bool
+    {
+        $customContentContainer = $this->getCustomContentContainer();
+
+        if ($customContentContainer instanceof ContentActiveRecord) {
+            return $customContentContainer->content->canView($user);
+        }
+
+        if ($customContentContainer instanceof ViewableInterface) {
+            return $customContentContainer->canView($user);
+        }
+
+        return false;
+    }
+
 }

modules/template/models/TemplateInstance.php

@@ -4,6 +4,7 @@
 
 use humhub\components\ActiveRecord;
 use humhub\modules\content\models\Content;
+use humhub\modules\custom_pages\models\CustomContentContainer;
 use yii\db\ActiveQuery;
 
 /**
@@ -98,6 +99,15 @@ public function getTemplate()
         return $this->hasOne(Template::class, ['id' => 'template_id']);
     }
 
+    public function getObject(): ?CustomContentContainer
+    {
+        if (empty($this->object_model) || empty($this->object_id)) {
+            return null;
+        }
+
+        return call_user_func($this->object_model . '::findOne', ['id' => $this->object_id]);
+    }
+
     public function getTemplateId()
     {
         return $this->template_id;