vendor/pimcore/pimcore/bundles/AdminBundle/Controller/Admin/DataObject/DataObjectController.php line 57

Open in your IDE?
  1. <?php
  3. /**
  4.  * Pimcore
  5.  *
  6.  * This source file is available under two different licenses:
  7.  * - GNU General Public License version 3 (GPLv3)
  8.  * - Pimcore Commercial License (PCL)
  9.  * Full copyright and license information is available in
  10.  * LICENSE.md which is distributed with this source code.
  11.  *
  12.  *  @copyright  Copyright (c) Pimcore GmbH (http://www.pimcore.org)
  13.  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  14.  */
  16. namespace Pimcore\Bundle\AdminBundle\Controller\Admin\DataObject;
  18. use Pimcore\Bundle\AdminBundle\Controller\Admin\ElementControllerBase;
  19. use Pimcore\Bundle\AdminBundle\Controller\Traits\AdminStyleTrait;
  20. use Pimcore\Bundle\AdminBundle\Controller\Traits\ApplySchedulerDataTrait;
  21. use Pimcore\Bundle\AdminBundle\Helper\GridHelperService;
  22. use Pimcore\Bundle\AdminBundle\Security\CsrfProtectionHandler;
  23. use Pimcore\Controller\KernelControllerEventInterface;
  24. use Pimcore\Controller\Traits\ElementEditLockHelperTrait;
  25. use Pimcore\Db;
  26. use Pimcore\Event\Admin\ElementAdminStyleEvent;
  27. use Pimcore\Event\AdminEvents;
  28. use Pimcore\Localization\LocaleServiceInterface;
  29. use Pimcore\Logger;
  30. use Pimcore\Model;
  31. use Pimcore\Model\DataObject;
  32. use Pimcore\Model\DataObject\ClassDefinition\Data\ManyToManyObjectRelation;
  33. use Pimcore\Model\DataObject\ClassDefinition\Data\Relations\AbstractRelations;
  34. use Pimcore\Model\DataObject\ClassDefinition\Data\ReverseObjectRelation;
  35. use Pimcore\Model\DataObject\ClassDefinition\PreviewGeneratorInterface;
  36. use Pimcore\Model\Element;
  37. use Pimcore\Model\Element\ElementInterface;
  38. use Pimcore\Model\Schedule\Task;
  39. use Pimcore\Model\Version;
  40. use Pimcore\Tool;
  41. use Symfony\Component\EventDispatcher\GenericEvent;
  42. use Symfony\Component\HttpFoundation\JsonResponse;
  43. use Symfony\Component\HttpFoundation\RedirectResponse;
  44. use Symfony\Component\HttpFoundation\Request;
  45. use Symfony\Component\HttpFoundation\Response;
  46. use Symfony\Component\HttpFoundation\Session\Attribute\AttributeBagInterface;
  47. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  48. use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
  49. use Symfony\Component\Routing\Annotation\Route;
  50. use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  52. /**
  53.  * @Route("/object", name="pimcore_admin_dataobject_dataobject_")
  54.  *
  55.  * @internal
  56.  */
  57. class DataObjectController extends ElementControllerBase implements KernelControllerEventInterface
  58. {
  59.     use AdminStyleTrait;
  60.     use ElementEditLockHelperTrait;
  61.     use ApplySchedulerDataTrait;
  62.     use DataObjectActionsTrait;
  64.     /**
  65.      * @var DataObject\Service
  66.      */
  67.     protected DataObject\Service $_objectService;
  69.     /**
  70.      * @var array
  71.      */
  72.     private array $objectData = [];
  74.     /**
  75.      * @var array
  76.      */
  77.     private array $metaData = [];
  79.     private array $classFieldDefinitions = [];
  81.     /**
  82.      * @Route("/tree-get-childs-by-id", name="treegetchildsbyid", methods={"GET"})
  83.      *
  84.      * @param Request $request
  85.      * @param EventDispatcherInterface $eventDispatcher
  86.      *
  87.      * @return JsonResponse
  88.      */
  89.     public function treeGetChildsByIdAction(Request $request, EventDispatcherInterface $eventDispatcher)
  90.     {
  91.         $allParams = array_merge($request->request->all(), $request->query->all());
  92.         $filter = $request->get('filter');
  93.         $object = DataObject::getById((int) $request->get('node'));
  94.         $objectTypes = [DataObject::OBJECT_TYPE_OBJECT, DataObject::OBJECT_TYPE_FOLDER];
  95.         $objects = [];
  96.         $cv = false;
  97.         $offset = $total = $limit = $filteredTotalCount = 0;
  99.         if ($object instanceof DataObject\Concrete) {
  100.             $class = $object->getClass();
  101.             if ($class->getShowVariants()) {
  102.                 $objectTypes = DataObject::$types;
  103.             }
  104.         }
  106.         if ($object->hasChildren($objectTypes)) {
  107.             $offset = (int)$request->get('start');
  108.             $limit = (int)$request->get('limit', 100000000);
  109.             if ($view = $request->get('view', false)) {
  110.                 $cv = Element\Service::getCustomViewById($request->get('view'));
  111.             }
  113.             if (!is_null($filter)) {
  114.                 if (substr($filter, -1) != '*') {
  115.                     $filter .= '*';
  116.                 }
  117.                 $filter = str_replace('*', '%', $filter);
  118.                 $limit = 100;
  119.             }
  121.             $childrenList = new DataObject\Listing();
  122.             $childrenList->setCondition($this->buildChildrenCondition($object, $filter, $view));
  123.             $childrenList->setLimit($limit);
  124.             $childrenList->setOffset($offset);
  126.             if ($object->getChildrenSortBy() === 'index') {
  127.                 $childrenList->setOrderKey('objects.o_index ASC', false);
  128.             } else {
  129.                 $childrenList->setOrderKey(
  130.                     sprintf(
  131.                         'CAST(objects.o_%s AS CHAR CHARACTER SET utf8) COLLATE utf8_general_ci %s',
  132.                         $object->getChildrenSortBy(), $object->getChildrenSortOrder()
  133.                     ),
  134.                     false
  135.                 );
  136.             }
  137.             $childrenList->setObjectTypes($objectTypes);
  139.             Element\Service::addTreeFilterJoins($cv, $childrenList);
  141.             $beforeListLoadEvent = new GenericEvent($this, [
  142.                 'list' => $childrenList,
  143.                 'context' => $allParams,
  144.             ]);
  145.             $eventDispatcher->dispatch($beforeListLoadEvent, AdminEvents::OBJECT_LIST_BEFORE_LIST_LOAD);
  147.             /** @var DataObject\Listing $childrenList */
  148.             $childrenList = $beforeListLoadEvent->getArgument('list');
  150.             $children = $childrenList->load();
  151.             $filteredTotalCount = $childrenList->getTotalCount();
  153.             foreach ($children as $child) {
  154.                 $objectTreeNode = $this->getTreeNodeConfig($child);
  155.                 // this if is obsolete since as long as the change with #11714 about list on line 175-179 are working fine, we already filter the list=1 there
  156.                 if ($objectTreeNode['permissions']['list'] == 1) {
  157.                     $objects[] = $objectTreeNode;
  158.                 }
  159.             }
  161.             //pagination for custom view
  162.             $total = $cv
  163.                 ? $filteredTotalCount
  164.                 : $object->getChildAmount(null, $this->getAdminUser());
  165.         }
  167.         //Hook for modifying return value - e.g. for changing permissions based on object data
  168.         //data need to wrapped into a container in order to pass parameter to event listeners by reference so that they can change the values
  169.         $event = new GenericEvent($this, [
  170.             'objects' => $objects,
  171.         ]);
  172.         $eventDispatcher->dispatch($event, AdminEvents::OBJECT_TREE_GET_CHILDREN_BY_ID_PRE_SEND_DATA);
  174.         $objects = $event->getArgument('objects');
  176.         if ($limit) {
  177.             return $this->adminJson([
  178.                 'offset' => $offset,
  179.                 'limit' => $limit,
  180.                 'total' => $total,
  181.                 'overflow' => !is_null($filter) && ($filteredTotalCount > $limit),
  182.                 'nodes' => $objects,
  183.                 'fromPaging' => (int)$request->get('fromPaging'),
  184.                 'filter' => $request->get('filter') ? $request->get('filter') : '',
  185.                 'inSearch' => (int)$request->get('inSearch'),
  186.             ]);
  187.         }
  189.         return $this->adminJson($objects);
  190.     }
  192.     /**
  193.      * @param DataObject\AbstractObject $object
  194.      * @param string|null $filter
  195.      * @param string|null $view
  196.      *
  197.      * @return string
  198.      */
  199.     private function buildChildrenCondition(DataObject\AbstractObject $object, ?string $filter, ?string $view): string
  200.     {
  201.         $condition = "objects.o_parentId = '" . $object->getId() . "'";
  203.         // custom views start
  204.         if ($view) {
  205.             $cv = Element\Service::getCustomViewById($view);
  207.             if (!empty($cv['classes'])) {
  208.                 $cvConditions = [];
  209.                 $cvClasses = $cv['classes'];
  210.                 foreach ($cvClasses as $key => $cvClass) {
  211.                     $cvConditions[] = "objects.o_classId = '" . $key . "'";
  212.                 }
  214.                 $cvConditions[] = "objects.o_type = 'folder'";
  215.                 $condition .= ' AND (' . implode(' OR ', $cvConditions) . ')';
  216.             }
  217.         }
  218.         // custom views end
  220.         if (!$this->getAdminUser()->isAdmin()) {
  221.             $userIds = $this->getAdminUser()->getRoles();
  222.             $currentUserId = $this->getAdminUser()->getId();
  223.             $userIds[] = $currentUserId;
  225.             $inheritedPermission = $object->getDao()->isInheritingPermission('list', $userIds);
  227.             $anyAllowedRowOrChildren = 'EXISTS(SELECT list FROM users_workspaces_object uwo WHERE userId IN (' . implode(',', $userIds) . ') AND list=1 AND LOCATE(CONCAT(objects.o_path,objects.o_key),cpath)=1 AND
  228.                 NOT EXISTS(SELECT list FROM users_workspaces_object WHERE userId =' . $currentUserId . '  AND list=0 AND cpath = uwo.cpath))';
  229.             $isDisallowedCurrentRow = 'EXISTS(SELECT list FROM users_workspaces_object WHERE userId IN (' . implode(',', $userIds) . ')  AND cid = objects.o_id AND list=0)';
  231.             $condition .= ' AND IF(' . $anyAllowedRowOrChildren . ',1,IF(' . $inheritedPermission . ', ' . $isDisallowedCurrentRow . ' = 0, 0)) = 1';
  232.         }
  234.         if (!is_null($filter)) {
  235.             $db = Db::get();
  236.             $condition .= ' AND CAST(objects.o_key AS CHAR CHARACTER SET utf8) COLLATE utf8_general_ci LIKE ' . $db->quote($filter);
  237.         }
  239.         return $condition;
  240.     }
  242.     /**
  243.      * @param ElementInterface $element
  244.      *
  245.      * @return array
  246.      *
  247.      * @throws \Exception
  248.      */
  249.     protected function getTreeNodeConfig($element): array
  250.     {
  251.         /** @var DataObject $child */
  252.         $child = $element;
  254.         $tmpObject = [
  255.             'id' => $child->getId(),
  256.             'idx' => (int)$child->getIndex(),
  257.             'key' => $child->getKey(),
  258.             'sortBy' => $child->getChildrenSortBy(),
  259.             'sortOrder' => $child->getChildrenSortOrder(),
  260.             'text' => htmlspecialchars($child->getKey()),
  261.             'type' => $child->getType(),
  262.             'path' => $child->getRealFullPath(),
  263.             'basePath' => $child->getRealPath(),
  264.             'elementType' => 'object',
  265.             'locked' => $child->isLocked(),
  266.             'lockOwner' => $child->getLocked() ? true : false,
  267.         ];
  269.         $allowedTypes = [DataObject::OBJECT_TYPE_OBJECT, DataObject::OBJECT_TYPE_FOLDER];
  270.         if ($child instanceof DataObject\Concrete && $child->getClass()->getShowVariants()) {
  271.             $allowedTypes[] = DataObject::OBJECT_TYPE_VARIANT;
  272.         }
  274.         $hasChildren = $child->getDao()->hasChildren($allowedTypes, null, $this->getAdminUser());
  276.         $tmpObject['allowDrop'] = false;
  278.         $tmpObject['isTarget'] = true;
  279.         if ($tmpObject['type'] != DataObject::OBJECT_TYPE_VARIANT) {
  280.             $tmpObject['allowDrop'] = true;
  281.         }
  283.         $tmpObject['allowChildren'] = true;
  284.         $tmpObject['leaf'] = !$hasChildren;
  285.         $tmpObject['cls'] = 'pimcore_class_icon ';
  287.         if ($child instanceof DataObject\Concrete) {
  288.             $tmpObject['published'] = $child->isPublished();
  289.             $tmpObject['className'] = $child->getClass()->getName();
  291.             if (!$child->isPublished()) {
  292.                 $tmpObject['cls'] .= 'pimcore_unpublished ';
  293.             }
  295.             $tmpObject['allowVariants'] = $child->getClass()->getAllowVariants();
  296.         }
  298.         $this->addAdminStyle($child, ElementAdminStyleEvent::CONTEXT_TREE, $tmpObject);
  300.         $tmpObject['expanded'] = !$hasChildren;
  301.         $tmpObject['permissions'] = $child->getUserPermissions($this->getAdminUser());
  303.         if ($child->isLocked()) {
  304.             $tmpObject['cls'] .= 'pimcore_treenode_locked ';
  305.         }
  306.         if ($child->getLocked()) {
  307.             $tmpObject['cls'] .= 'pimcore_treenode_lockOwner ';
  308.         }
  310.         if ($tmpObject['leaf']) {
  311.             $tmpObject['expandable'] = false;
  312.             $tmpObject['leaf'] = false; //this is required to allow drag&drop
  313.             $tmpObject['expanded'] = true;
  314.             $tmpObject['loaded'] = true;
  315.         }
  317.         return $tmpObject;
  318.     }
  320.     /**
  321.      * @Route("/get-id-path-paging-info", name="getidpathpaginginfo", methods={"GET"})
  322.      *
  323.      * @param Request $request
  324.      *
  325.      * @return JsonResponse
  326.      */
  327.     public function getIdPathPagingInfoAction(Request $request): JsonResponse
  328.     {
  329.         $path = $request->get('path');
  330.         $pathParts = explode('/', $path);
  331.         $id = (int) array_pop($pathParts);
  333.         $limit = $request->get('limit');
  335.         if (empty($limit)) {
  336.             $limit = 30;
  337.         }
  339.         $data = [];
  341.         $targetObject = DataObject::getById($id);
  342.         $object = $targetObject;
  344.         while ($parent = $object->getParent()) {
  345.             $list = new DataObject\Listing();
  346.             $list->setCondition('o_parentId = ?', $parent->getId());
  347.             $list->setUnpublished(true);
  348.             $total = $list->getTotalCount();
  350.             $info = [
  351.                 'total' => $total,
  352.             ];
  354.             if ($total > $limit) {
  355.                 $idList = $list->loadIdList();
  356.                 $position = array_search($object->getId(), $idList);
  357.                 $info['position'] = $position + 1;
  358.                 $info['page'] = ceil($info['position'] / $limit);
  359.             }
  361.             $data[$parent->getId()] = $info;
  363.             $object = $parent;
  364.         }
  366.         return $this->adminJson($data);
  367.     }
  369.     /**
  370.      * @Route("/get", name="get", methods={"GET"})
  371.      *
  372.      * @param Request $request
  373.      * @param EventDispatcherInterface $eventDispatcher
  374.      * @param PreviewGeneratorInterface $defaultPreviewGenerator
  375.      *
  376.      * @return JsonResponse
  377.      *
  378.      * @throws \Exception
  379.      */
  380.     public function getAction(Request $request, EventDispatcherInterface $eventDispatcher, PreviewGeneratorInterface $defaultPreviewGenerator): JsonResponse
  381.     {
  382.         $objectId = (int)$request->get('id');
  383.         $objectFromDatabase = DataObject\Concrete::getById($objectId);
  384.         if ($objectFromDatabase === null) {
  385.             return $this->adminJson(['success' => false, 'message' => 'element_not_found'], JsonResponse::HTTP_NOT_FOUND);
  386.         }
  387.         $objectFromDatabase = clone $objectFromDatabase;
  389.         // set the latest available version for editmode
  390.         $draftVersion = null;
  391.         $object = $this->getLatestVersion($objectFromDatabase, $draftVersion);
  393.         // check for lock
  394.         if ($object->isAllowed('save') || $object->isAllowed('publish') || $object->isAllowed('unpublish') || $object->isAllowed('delete')) {
  395.             if (Element\Editlock::isLocked($objectId, 'object')) {
  396.                 return $this->getEditLockResponse($objectId, 'object');
  397.             }
  399.             Element\Editlock::lock($request->get('id'), 'object');
  400.         }
  402.         // we need to know if the latest version is published or not (a version), because of lazy loaded fields in $this->getDataForObject()
  403.         $objectFromVersion = $object !== $objectFromDatabase;
  405.         if ($object->isAllowed('view')) {
  406.             $objectData = [];
  408.             /** -------------------------------------------------------------
  409.              *   Load some general data from published object (if existing)
  410.              *  ------------------------------------------------------------- */
  411.             $objectData['idPath'] = Element\Service::getIdPath($objectFromDatabase);
  413.             $linkGeneratorReference = $objectFromDatabase->getClass()->getLinkGeneratorReference();
  414.             $previewGenerator = $objectFromDatabase->getClass()->getPreviewGenerator();
  415.             if (empty($previewGenerator) && !empty($linkGeneratorReference)) {
  416.                 $previewGenerator = $defaultPreviewGenerator;
  417.             }
  419.             $objectData['hasPreview'] = false;
  420.             if ($objectFromDatabase->getClass()->getPreviewUrl() || $linkGeneratorReference || $previewGenerator) {
  421.                 $objectData['hasPreview'] = true;
  422.             }
  424.             if ($draftVersion && $objectFromDatabase->getModificationDate() < $draftVersion->getDate()) {
  425.                 $objectData['draft'] = [
  426.                     'id' => $draftVersion->getId(),
  427.                     'modificationDate' => $draftVersion->getDate(),
  428.                     'isAutoSave' => $draftVersion->isAutoSave(),
  429.                 ];
  430.             }
  432.             $objectData['general'] = [];
  434.             $allowedKeys = ['o_published', 'o_key', 'o_id', 'o_creationDate', 'o_classId', 'o_className', 'o_type', 'o_parentId', 'o_userOwner'];
  435.             foreach ($objectFromDatabase->getObjectVars() as $key => $value) {
  436.                 if (in_array($key, $allowedKeys)) {
  437.                     $objectData['general'][$key] = $value;
  438.                 }
  439.             }
  440.             $objectData['general']['fullpath'] = $objectFromDatabase->getRealFullPath();
  441.             $objectData['general']['o_locked'] = $objectFromDatabase->isLocked();
  442.             $objectData['general']['php'] = [
  443.                 'classes' => array_merge([get_class($objectFromDatabase)], array_values(class_parents($objectFromDatabase))),
  444.                 'interfaces' => array_values(class_implements($objectFromDatabase)),
  445.             ];
  446.             $objectData['general']['allowInheritance'] = $objectFromDatabase->getClass()->getAllowInherit();
  447.             $objectData['general']['allowVariants'] = $objectFromDatabase->getClass()->getAllowVariants();
  448.             $objectData['general']['showVariants'] = $objectFromDatabase->getClass()->getShowVariants();
  449.             $objectData['general']['showAppLoggerTab'] = $objectFromDatabase->getClass()->getShowAppLoggerTab();
  450.             $objectData['general']['showFieldLookup'] = $objectFromDatabase->getClass()->getShowFieldLookup();
  451.             if ($objectFromDatabase instanceof DataObject\Concrete) {
  452.                 $objectData['general']['linkGeneratorReference'] = $linkGeneratorReference;
  453.                 if ($previewGenerator) {
  454.                     $objectData['general']['previewConfig'] = $previewGenerator->getPreviewConfig($objectFromDatabase);
  455.                 }
  456.             }
  458.             $objectData['layout'] = $objectFromDatabase->getClass()->getLayoutDefinitions();
  459.             $objectData['userPermissions'] = $objectFromDatabase->getUserPermissions($this->getAdminUser());
  460.             $objectVersions = Element\Service::getSafeVersionInfo($objectFromDatabase->getVersions());
  461.             $objectData['versions'] = array_splice($objectVersions, -1, 1);
  462.             $objectData['scheduledTasks'] = array_map(
  463.                 static function (Task $task) {
  464.                     return $task->getObjectVars();
  465.                 },
  466.                 $objectFromDatabase->getScheduledTasks()
  467.             );
  469.             $objectData['childdata']['id'] = $objectFromDatabase->getId();
  470.             $objectData['childdata']['data']['classes'] = $this->prepareChildClasses($objectFromDatabase->getDao()->getClasses());
  471.             $objectData['childdata']['data']['general'] = $objectData['general'];
  472.             /** -------------------------------------------------------------
  473.              *   Load remaining general data from latest version
  474.              *  ------------------------------------------------------------- */
  475.             $allowedKeys = ['o_modificationDate', 'o_userModification'];
  476.             foreach ($object->getObjectVars() as $key => $value) {
  477.                 if (in_array($key, $allowedKeys)) {
  478.                     $objectData['general'][$key] = $value;
  479.                 }
  480.             }
  482.             $this->getDataForObject($object, $objectFromVersion);
  483.             $objectData['data'] = $this->objectData;
  484.             $objectData['metaData'] = $this->metaData;
  485.             $objectData['properties'] = Element\Service::minimizePropertiesForEditmode($object->getProperties());
  487.             // this used for the "this is not a published version" hint
  488.             // and for adding the published icon to version overview
  489.             $objectData['general']['versionDate'] = $objectFromDatabase->getModificationDate();
  490.             $objectData['general']['versionCount'] = $objectFromDatabase->getVersionCount();
  492.             $this->addAdminStyle($object, ElementAdminStyleEvent::CONTEXT_EDITOR, $objectData['general']);
  494.             $currentLayoutId = $request->get('layoutId');
  496.             $validLayouts = DataObject\Service::getValidLayouts($object);
  498.             //Fallback if $currentLayoutId is not set or empty string
  499.             //Uses first valid layout instead of admin layout when empty
  500.             $ok = false;
  501.             foreach ($validLayouts as $layout) {
  502.                 if ($currentLayoutId == $layout->getId()) {
  503.                     $ok = true;
  504.                 }
  505.             }
  507.             if (!$ok) {
  508.                 $currentLayoutId = null;
  509.             }
  511.             //main layout has id 0 so we check for is_null()
  512.             if ($currentLayoutId === null && !empty($validLayouts)) {
  513.                 if (count($validLayouts) === 1) {
  514.                     $firstLayout = reset($validLayouts);
  515.                     $currentLayoutId = $firstLayout->getId();
  516.                 } else {
  517.                     foreach ($validLayouts as $checkDefaultLayout) {
  518.                         if ($checkDefaultLayout->getDefault()) {
  519.                             $currentLayoutId = $checkDefaultLayout->getId();
  520.                         }
  521.                     }
  522.                 }
  523.             }
  525.             if ($currentLayoutId === null && count($validLayouts) > 0) {
  526.                 $currentLayoutId = reset($validLayouts)->getId();
  527.             }
  529.             if (!empty($validLayouts)) {
  530.                 $objectData['validLayouts'] = [];
  532.                 foreach ($validLayouts as $validLayout) {
  533.                     $objectData['validLayouts'][] = ['id' => $validLayout->getId(), 'name' => $validLayout->getName()];
  534.                 }
  536.                 usort($objectData['validLayouts'], static function ($layoutData1, $layoutData2) {
  537.                     if ($layoutData2['id'] === '-1') {
  538.                         return 1;
  539.                     }
  541.                     if ($layoutData1['id'] === '-1') {
  542.                         return -1;
  543.                     }
  545.                     if ($layoutData2['id'] === '0') {
  546.                         return 1;
  547.                     }
  548.                     if ($layoutData1['id'] === '0') {
  549.                         return -1;
  550.                     }
  552.                     return strcasecmp($layoutData1['name'], $layoutData2['name']);
  553.                 });
  555.                 $user = Tool\Admin::getCurrentUser();
  557.                 if ($currentLayoutId == -1 && $user->isAdmin()) {
  558.                     $layout = DataObject\Service::getSuperLayoutDefinition($object);
  559.                     $objectData['layout'] = $layout;
  560.                 } elseif (!empty($currentLayoutId)) {
  561.                     $objectData['layout'] = $validLayouts[$currentLayoutId]->getLayoutDefinitions();
  562.                 }
  564.                 $objectData['currentLayoutId'] = $currentLayoutId;
  565.             }
  567.             //Hook for modifying return value - e.g. for changing permissions based on object data
  568.             //data need to wrapped into a container in order to pass parameter to event listeners by reference so that they can change the values
  569.             $event = new GenericEvent($this, [
  570.                 'data' => $objectData,
  571.                 'object' => $object,
  572.             ]);
  574.             DataObject\Service::enrichLayoutDefinition($objectData['layout'], $object);
  575.             $eventDispatcher->dispatch($event, AdminEvents::OBJECT_GET_PRE_SEND_DATA);
  576.             $data = $event->getArgument('data');
  578.             DataObject\Service::removeElementFromSession('object', $object->getId());
  580.             if ($data['layout'] ?? false) {
  581.                 $layoutArray = json_decode($this->encodeJson($data['layout']), true);
  582.                 $this->classFieldDefinitions = json_decode($this->encodeJson($object->getClass()->getFieldDefinitions()), true);
  583.                 $this->injectValuesForCustomLayout($layoutArray);
  584.                 $data['layout'] = $layoutArray;
  585.             }
  587.             return $this->adminJson($data);
  588.         }
  590.         throw $this->createAccessDeniedHttpException();
  591.     }
  593.     private function injectValuesForCustomLayout(array &$layout): void
  594.     {
  595.         foreach ($layout['children'] as &$child) {
  596.             if ($child['datatype'] === 'layout') {
  597.                 $this->injectValuesForCustomLayout($child);
  598.             } else {
  599.                 foreach ($this->classFieldDefinitions[$child['name']] as $key => $value) {
  600.                     if (array_key_exists($key, $child) && ($child[$key] === null || $child[$key] === '' || (is_array($child[$key]) && empty($child[$key])))) {
  601.                         $child[$key] = $value;
  602.                     }
  603.                 }
  604.             }
  605.         }
  607.         //TODO remove in Pimcore 11
  608.         if (isset($layout['childs'])) {
  609.             foreach ($layout['childs'] as &$child) {
  610.                 if ($child['datatype'] === 'layout') {
  611.                     $this->injectValuesForCustomLayout($child);
  612.                 } else {
  613.                     foreach ($this->classFieldDefinitions[$child['name']] as $key => $value) {
  614.                         if (array_key_exists($key, $child) && ($child[$key] === null || $child[$key] === '' || (is_array($child[$key]) && empty($child[$key])))) {
  615.                             $child[$key] = $value;
  616.                         }
  617.                     }
  618.                 }
  619.             }
  620.         }
  621.     }
  623.     /**
  624.      * @param DataObject\Concrete $object
  625.      * @param bool $objectFromVersion
  626.      */
  627.     private function getDataForObject(DataObject\Concrete $object, $objectFromVersion = false)
  628.     {
  629.         foreach ($object->getClass()->getFieldDefinitions(['object' => $object]) as $key => $def) {
  630.             $this->getDataForField($object, $key, $def, $objectFromVersion);
  631.         }
  632.     }
  634.     /**
  635.      * gets recursively attribute data from parent and fills objectData and metaData
  636.      *
  637.      * @param DataObject\Concrete $object
  638.      * @param string $key
  639.      * @param DataObject\ClassDefinition\Data $fielddefinition
  640.      * @param bool $objectFromVersion
  641.      * @param int $level
  642.      */
  643.     private function getDataForField($object, $key, $fielddefinition, $objectFromVersion, $level = 0)
  644.     {
  645.         $parent = DataObject\Service::hasInheritableParentObject($object);
  646.         $getter = 'get' . ucfirst($key);
  648.         // Editmode optimization for lazy loaded relations (note that this is just for AbstractRelations, not for all
  649.         // LazyLoadingSupportInterface types. It tries to optimize fetching the data needed for the editmode without
  650.         // loading the entire target element.
  651.         // ReverseObjectRelation should go in there anyway (regardless if it a version or not),
  652.         // so that the values can be loaded.
  653.         if (
  654.             (!$objectFromVersion && $fielddefinition instanceof AbstractRelations)
  655.             || $fielddefinition instanceof ReverseObjectRelation
  656.         ) {
  657.             $refId = null;
  659.             if ($fielddefinition instanceof ReverseObjectRelation) {
  660.                 $refKey = $fielddefinition->getOwnerFieldName();
  661.                 $refClass = DataObject\ClassDefinition::getByName($fielddefinition->getOwnerClassName());
  662.                 if ($refClass) {
  663.                     $refId = $refClass->getId();
  664.                 }
  665.             } else {
  666.                 $refKey = $key;
  667.             }
  669.             $relations = $object->getRelationData($refKey, !$fielddefinition instanceof ReverseObjectRelation, $refId);
  671.             if ($fielddefinition->supportsInheritance() && empty($relations) && !empty($parent)) {
  672.                 $this->getDataForField($parent, $key, $fielddefinition, $objectFromVersion, $level + 1);
  673.             } else {
  674.                 $data = [];
  676.                 if ($fielddefinition instanceof DataObject\ClassDefinition\Data\ManyToOneRelation) {
  677.                     if (isset($relations[0])) {
  678.                         $data = $relations[0];
  679.                         $data['published'] = (bool)$data['published'];
  680.                     } else {
  681.                         $data = null;
  682.                     }
  683.                 } elseif (
  684.                     ($fielddefinition instanceof DataObject\ClassDefinition\Data\OptimizedAdminLoadingInterface && $fielddefinition->isOptimizedAdminLoading())
  685.                     || ($fielddefinition instanceof ManyToManyObjectRelation && !$fielddefinition->getVisibleFields() && !$fielddefinition instanceof DataObject\ClassDefinition\Data\AdvancedManyToManyObjectRelation)
  686.                 ) {
  687.                     foreach ($relations as $rkey => $rel) {
  688.                         $index = $rkey + 1;
  689.                         $rel['fullpath'] = $rel['path'];
  690.                         $rel['classname'] = $rel['subtype'];
  691.                         $rel['rowId'] = $rel['id'] . AbstractRelations::RELATION_ID_SEPARATOR . $index . AbstractRelations::RELATION_ID_SEPARATOR . $rel['type'];
  692.                         $rel['published'] = (bool)$rel['published'];
  693.                         $data[] = $rel;
  694.                     }
  695.                 } else {
  696.                     $fieldData = $object->$getter();
  697.                     $data = $fielddefinition->getDataForEditmode($fieldData, $object, ['objectFromVersion' => $objectFromVersion]);
  698.                 }
  699.                 $this->objectData[$key] = $data;
  700.                 $this->metaData[$key]['objectid'] = $object->getId();
  701.                 $this->metaData[$key]['inherited'] = $level != 0;
  702.             }
  703.         } else {
  704.             $fieldData = $object->$getter();
  705.             $isInheritedValue = false;
  707.             if ($fielddefinition instanceof DataObject\ClassDefinition\Data\CalculatedValue) {
  708.                 $fieldData = new DataObject\Data\CalculatedValue($fielddefinition->getName());
  709.                 $fieldData->setContextualData('object', null, null, null, null, null, $fielddefinition);
  710.                 $value = $fielddefinition->getDataForEditmode($fieldData, $object, ['objectFromVersion' => $objectFromVersion]);
  711.             } else {
  712.                 $value = $fielddefinition->getDataForEditmode($fieldData, $object, ['objectFromVersion' => $objectFromVersion]);
  713.             }
  715.             // following some exceptions for special data types (localizedfields, objectbricks)
  716.             if ($value && ($fieldData instanceof DataObject\Localizedfield || $fieldData instanceof DataObject\Classificationstore)) {
  717.                 // make sure that the localized field participates in the inheritance detection process
  718.                 $isInheritedValue = $value['inherited'];
  719.             }
  720.             if ($fielddefinition instanceof DataObject\ClassDefinition\Data\Objectbricks && is_array($value)) {
  721.                 // make sure that the objectbricks participate in the inheritance detection process
  722.                 foreach ($value as $singleBrickData) {
  723.                     if (!empty($singleBrickData['inherited'])) {
  724.                         $isInheritedValue = true;
  725.                     }
  726.                 }
  727.             }
  729.             if ($fielddefinition->isEmpty($fieldData) && !empty($parent)) {
  730.                 $this->getDataForField($parent, $key, $fielddefinition, $objectFromVersion, $level + 1);
  731.                 // exception for classification store. if there are no items then it is empty by definition.
  732.                 // consequence is that we have to preserve the metadata information
  733.                 // see https://github.com/pimcore/pimcore/issues/9329
  734.                 if ($fielddefinition instanceof DataObject\ClassDefinition\Data\Classificationstore && $level == 0) {
  735.                     $this->objectData[$key]['metaData'] = $value['metaData'] ?? [];
  736.                     $this->objectData[$key]['inherited'] = true;
  737.                 }
  738.             } else {
  739.                 $isInheritedValue = $isInheritedValue || ($level != 0);
  740.                 $this->metaData[$key]['objectid'] = $object->getId();
  742.                 $this->objectData[$key] = $value;
  743.                 $this->metaData[$key]['inherited'] = $isInheritedValue;
  745.                 if ($isInheritedValue && !$fielddefinition->isEmpty($fieldData) && !$fielddefinition->supportsInheritance()) {
  746.                     $this->objectData[$key] = null;
  747.                     $this->metaData[$key]['inherited'] = false;
  748.                     $this->metaData[$key]['hasParentValue'] = true;
  749.                 }
  750.             }
  751.         }
  752.     }
  754.     /**
  755.      * @Route("/get-folder", name="getfolder", methods={"GET"})
  756.      *
  757.      * @param Request $request
  758.      * @param EventDispatcherInterface $eventDispatcher
  759.      *
  760.      * @return JsonResponse
  761.      */
  762.     public function getFolderAction(Request $request, EventDispatcherInterface $eventDispatcher)
  763.     {
  764.         $objectId = (int)$request->get('id');
  765.         $object = DataObject::getById($objectId);
  767.         if (!$object) {
  768.             throw $this->createNotFoundException();
  769.         }
  771.         if ($object->isAllowed('view')) {
  772.             $objectData = [];
  774.             $objectData['general'] = [];
  775.             $objectData['idPath'] = Element\Service::getIdPath($object);
  776.             $objectData['type'] = $object->getType();
  777.             $allowedKeys = ['o_published', 'o_key', 'o_id', 'o_type', 'o_path', 'o_modificationDate', 'o_creationDate', 'o_userOwner', 'o_userModification'];
  778.             foreach ($object->getObjectVars() as $key => $value) {
  779.                 if (strstr($key, 'o_') && in_array($key, $allowedKeys)) {
  780.                     $objectData['general'][$key] = $value;
  781.                 }
  782.             }
  783.             $objectData['general']['fullpath'] = $object->getRealFullPath();
  785.             $objectData['general']['o_locked'] = $object->isLocked();
  787.             $objectData['properties'] = Element\Service::minimizePropertiesForEditmode($object->getProperties());
  788.             $objectData['userPermissions'] = $object->getUserPermissions($this->getAdminUser());
  789.             $objectData['classes'] = $this->prepareChildClasses($object->getDao()->getClasses());
  791.             // grid-config
  792.             $configFile = PIMCORE_CONFIGURATION_DIRECTORY . '/object/grid/' . $object->getId() . '-user_' . $this->getAdminUser()->getId() . '.psf';
  793.             if (is_file($configFile)) {
  794.                 $gridConfig = Tool\Serialize::unserialize(file_get_contents($configFile));
  795.                 if ($gridConfig) {
  796.                     $selectedClassId = $gridConfig['classId'];
  798.                     foreach ($objectData['classes'] as $class) {
  799.                         if ($class['id'] == $selectedClassId) {
  800.                             $objectData['selectedClass'] = $selectedClassId;
  802.                             break;
  803.                         }
  804.                     }
  805.                 }
  806.             }
  808.             //Hook for modifying return value - e.g. for changing permissions based on object data
  809.             //data need to wrapped into a container in order to pass parameter to event listeners by reference so that they can change the values
  810.             $event = new GenericEvent($this, [
  811.                 'data' => $objectData,
  812.                 'object' => $object,
  813.             ]);
  814.             $eventDispatcher->dispatch($event, AdminEvents::OBJECT_GET_PRE_SEND_DATA);
  815.             $objectData = $event->getArgument('data');
  817.             return $this->adminJson($objectData);
  818.         }
  820.         throw $this->createAccessDeniedHttpException();
  821.     }
  823.     /**
  824.      * @param DataObject\ClassDefinition[] $classes
  825.      *
  826.      * @return array
  827.      */
  828.     protected function prepareChildClasses(array $classes): array
  829.     {
  830.         $reduced = [];
  831.         foreach ($classes as $class) {
  832.             $reduced[] = [
  833.                 'id' => $class->getId(),
  834.                 'name' => $class->getName(),
  835.                 'inheritance' => $class->getAllowInherit(),
  836.             ];
  837.         }
  839.         return $reduced;
  840.     }
  842.     /**
  843.      * @Route("/add", name="add", methods={"POST"})
  844.      *
  845.      * @param Request $request
  846.      * @param Model\FactoryInterface $modelFactory
  847.      *
  848.      * @return JsonResponse
  849.      */
  850.     public function addAction(Request $request, Model\FactoryInterface $modelFactory): JsonResponse
  851.     {
  852.         $message = '';
  853.         $parent = DataObject::getById((int) $request->get('parentId'));
  855.         if (!$parent->isAllowed('create')) {
  856.             $message = 'prevented adding object because of missing permissions';
  857.             Logger::debug($message);
  858.         }
  860.         $intendedPath = $parent->getRealFullPath() . '/' . $request->get('key');
  861.         if (DataObject\Service::pathExists($intendedPath)) {
  862.             $message = 'prevented creating object because object with same path+key already exists';
  863.             Logger::debug($message);
  864.         }
  866.         //return false if missing permissions or path+key already exists
  867.         if (!empty($message)) {
  868.             return $this->adminJson([
  869.                 'success' => false,
  870.                 'message' => $message,
  871.             ]);
  872.         }
  874.         $className = 'Pimcore\\Model\\DataObject\\' . ucfirst($request->get('className'));
  875.         /** @var DataObject\Concrete $object */
  876.         $object = $modelFactory->build($className);
  877.         $object->setOmitMandatoryCheck(true); // allow to save the object although there are mandatory fields
  878.         $object->setClassId($request->get('classId'));
  880.         if ($request->get('variantViaTree')) {
  881.             $parentId = $request->get('parentId');
  882.             $parent = DataObject\Concrete::getById($parentId);
  883.             $object->setClassId($parent->getClass()->getId());
  884.         }
  886.         $object->setClassName($request->get('className'));
  887.         $object->setParentId($request->get('parentId'));
  888.         $object->setKey($request->get('key'));
  889.         $object->setCreationDate(time());
  890.         $object->setUserOwner($this->getAdminUser()->getId());
  891.         $object->setUserModification($this->getAdminUser()->getId());
  892.         $object->setPublished(false);
  894.         $objectType = $request->get('objecttype');
  895.         if (in_array($objectType, [DataObject::OBJECT_TYPE_OBJECT, DataObject::OBJECT_TYPE_VARIANT])) {
  896.             $object->setType($objectType);
  897.         }
  899.         try {
  900.             $object->save();
  901.             $return = [
  902.                 'success' => true,
  903.                 'id' => $object->getId(),
  904.                 'type' => $object->getType(),
  905.                 'message' => $message,
  906.             ];
  907.         } catch (\Exception $e) {
  908.             $return = [
  909.                 'success' => false,
  910.                 'message' => $e->getMessage(),
  911.             ];
  912.         }
  914.         return $this->adminJson($return);
  915.     }
  917.     /**
  918.      * @Route("/add-folder", name="addfolder", methods={"POST"})
  919.      *
  920.      * @param Request $request
  921.      *
  922.      * @return JsonResponse
  923.      */
  924.     public function addFolderAction(Request $request)
  925.     {
  926.         $success = false;
  928.         $parent = DataObject::getById((int) $request->get('parentId'));
  929.         if ($parent->isAllowed('create')) {
  930.             if (!DataObject\Service::pathExists($parent->getRealFullPath() . '/' . $request->get('key'))) {
  931.                 $folder = DataObject\Folder::create([
  932.                     'o_parentId' => $request->get('parentId'),
  933.                     'o_creationDate' => time(),
  934.                     'o_userOwner' => $this->getAdminUser()->getId(),
  935.                     'o_userModification' => $this->getAdminUser()->getId(),
  936.                     'o_key' => $request->get('key'),
  937.                     'o_published' => true,
  938.                 ]);
  940.                 try {
  941.                     $folder->save();
  942.                     $success = true;
  943.                 } catch (\Exception $e) {
  944.                     return $this->adminJson(['success' => false, 'message' => $e->getMessage()]);
  945.                 }
  946.             }
  947.         } else {
  948.             Logger::debug('prevented creating object id because of missing permissions');
  949.         }
  951.         return $this->adminJson(['success' => $success]);
  952.     }
  954.     /**
  955.      * @Route("/delete", name="delete", methods={"DELETE"})
  956.      *
  957.      * @param Request $request
  958.      *
  959.      * @return JsonResponse
  960.      *
  961.      * @throws \Exception
  962.      */
  963.     public function deleteAction(Request $request)
  964.     {
  965.         $type = $request->get('type');
  967.         if ($type === 'childs') {
  968.             trigger_deprecation(
  969.                 'pimcore/pimcore',
  970.                 '10.4',
  971.                 'Type childs is deprecated. Use children instead'
  972.             );
  973.             $type = 'children';
  974.         }
  975.         if ($type === 'children') {
  976.             $parentObject = DataObject::getById((int) $request->get('id'));
  978.             $list = new DataObject\Listing();
  979.             $list->setCondition('o_path LIKE ' . $list->quote($list->escapeLike($parentObject->getRealFullPath()) . '/%'));
  980.             $list->setLimit((int)$request->get('amount'));
  981.             $list->setOrderKey('LENGTH(o_path)', false);
  982.             $list->setOrder('DESC');
  984.             $deletedItems = [];
  985.             foreach ($list as $object) {
  986.                 $deletedItems[$object->getId()] = $object->getRealFullPath();
  987.                 if ($object->isAllowed('delete') && !$object->isLocked()) {
  988.                     $object->delete();
  989.                 }
  990.             }
  992.             return $this->adminJson(['success' => true, 'deleted' => $deletedItems]);
  993.         }
  994.         if ($id = $request->get('id')) {
  995.             $object = DataObject::getById((int) $id);
  996.             if ($object) {
  997.                 if (!$object->isAllowed('delete')) {
  998.                     throw $this->createAccessDeniedHttpException();
  999.                 }
  1000.                 if ($object->isLocked()) {
  1001.                     return $this->adminJson(['success' => false, 'message' => 'prevented deleting object, because it is locked: ID: ' . $object->getId()]);
  1002.                 }
  1003.                 $object->delete();
  1004.             }
  1006.             // return true, even when the object doesn't exist, this can be the case when using batch delete incl. children
  1007.             return $this->adminJson(['success' => true]);
  1008.         }
  1010.         return $this->adminJson(['success' => false]);
  1011.     }
  1013.     /**
  1014.      * @Route("/change-children-sort-by", name="changechildrensortby", methods={"PUT"})
  1015.      *
  1016.      * @param Request $request
  1017.      *
  1018.      * @return JsonResponse
  1019.      *
  1020.      * @throws \Exception
  1021.      */
  1022.     public function changeChildrenSortByAction(Request $request)
  1023.     {
  1024.         $object = DataObject::getById((int) $request->get('id'));
  1025.         if ($object) {
  1026.             $sortBy = $request->get('sortBy');
  1027.             $sortOrder = $request->get('childrenSortOrder');
  1028.             if (!\in_array($sortOrder, ['ASC', 'DESC'])) {
  1029.                 $sortOrder = 'ASC';
  1030.             }
  1032.             $currentSortBy = $object->getChildrenSortBy();
  1034.             $object->setChildrenSortBy($sortBy);
  1035.             $object->setChildrenSortOrder($sortOrder);
  1037.             if ($currentSortBy != $sortBy) {
  1038.                 $user = Tool\Admin::getCurrentUser();
  1040.                 if (!$user->isAdmin() && !$user->isAllowed('objects_sort_method')) {
  1041.                     return $this->json(['success' => false, 'message' => 'Changing the sort method is only allowed for admin users']);
  1042.                 }
  1044.                 if ($sortBy == 'index') {
  1045.                     $this->reindexBasedOnSortOrder($object, $sortOrder);
  1046.                 }
  1047.             }
  1049.             $object->save();
  1051.             return $this->json(['success' => true]);
  1052.         }
  1054.         return $this->json(['success' => false, 'message' => 'Unable to change a sorting way of children items.']);
  1055.     }
  1057.     /**
  1058.      * @Route("/update", name="update", methods={"PUT"})
  1059.      *
  1060.      * @param Request $request
  1061.      *
  1062.      * @return JsonResponse
  1063.      *
  1064.      * @throws \Exception
  1065.      */
  1066.     public function updateAction(Request $request)
  1067.     {
  1068.         $values = $this->decodeJson($request->get('values'));
  1070.         $ids = $this->decodeJson($request->get('id'));
  1072.         if (is_array($ids)) {
  1073.             $return = ['success' => true];
  1074.             foreach ($ids as $id) {
  1075.                 $object = DataObject::getById((int)$id);
  1076.                 $return = $this->executeUpdateAction($object, $values);
  1077.                 if (!$return['success']) {
  1078.                     return $this->adminJson($return);
  1079.                 }
  1080.             }
  1081.         } else {
  1082.             $object = DataObject::getById((int)$ids);
  1083.             $return = $this->executeUpdateAction($object, $values);
  1084.         }
  1086.         return $this->adminJson($return);
  1087.     }
  1089.     /**
  1090.      * @return array{success: bool, message?: string}
  1091.      *
  1092.      * @throws \Exception
  1093.      */
  1094.     private function executeUpdateAction(DataObject $object, mixed $values): array
  1095.     {
  1096.         $success = false;
  1098.         if ($object instanceof DataObject\Concrete) {
  1099.             $object->setOmitMandatoryCheck(true);
  1100.         }
  1102.         // this prevents the user from renaming, relocating (actions in the tree) if the newest version isn't the published one
  1103.         // the reason is that otherwise the content of the newer not published version will be overwritten
  1104.         if ($object instanceof DataObject\Concrete) {
  1105.             $latestVersion = $object->getLatestVersion();
  1106.             if ($latestVersion && $latestVersion->getData()->getModificationDate() != $object->getModificationDate()) {
  1107.                 return ['success' => false, 'message' => "You can't rename or relocate if there's a newer not published version"];
  1108.             }
  1109.         }
  1111.         $key = $values['key'] ?? null;
  1113.         if ($object->isAllowed('settings')) {
  1114.             if ($key) {
  1115.                 if ($object->isAllowed('rename')) {
  1116.                     $object->setKey($key);
  1117.                 } elseif ($key !== $object->getKey()) {
  1118.                     Logger::debug('prevented renaming object because of missing permissions ');
  1119.                 }
  1120.             }
  1122.             if (!empty($values['parentId'])) {
  1123.                 $parent = DataObject::getById($values['parentId']);
  1125.                 //check if parent is changed
  1126.                 if ($object->getParentId() != $parent->getId()) {
  1127.                     if (!$parent->isAllowed('create')) {
  1128.                         throw new \Exception('Prevented moving object - no create permission on new parent ');
  1129.                     }
  1131.                     $objectWithSamePath = DataObject::getByPath($parent->getRealFullPath() . '/' . $object->getKey());
  1133.                     if ($objectWithSamePath != null) {
  1134.                         return ['success' => false, 'message' => 'prevented creating object because object with same path+key already exists'];
  1135.                     }
  1137.                     if ($object->isLocked()) {
  1138.                         return ['success' => false, 'message' => 'prevented moving object, because it is locked: ID: ' . $object->getId()];
  1139.                     }
  1141.                     $object->setParentId($values['parentId']);
  1142.                 }
  1143.             }
  1145.             if (array_key_exists('locked', $values)) {
  1146.                 $object->setLocked($values['locked']);
  1147.             }
  1149.             $object->setModificationDate(time());
  1150.             $object->setUserModification($this->getAdminUser()->getId());
  1152.             try {
  1153.                 $isIndexUpdate = isset($values['indices']);
  1155.                 if ($isIndexUpdate) {
  1156.                     // Ensure the update sort index is already available in the postUpdate eventListener
  1157.                     $indexUpdate = is_int($values['indices']) ? $values['indices'] : $values['indices'][$object->getId()];
  1158.                     $object->setIndex($indexUpdate);
  1159.                 }
  1161.                 $object->save();
  1163.                 if ($isIndexUpdate) {
  1164.                     $this->updateIndexesOfObjectSiblings($object, $indexUpdate);
  1165.                 }
  1167.                 $success = true;
  1168.             } catch (\Exception $e) {
  1169.                 Logger::error((string) $e);
  1171.                 return ['success' => false, 'message' => $e->getMessage()];
  1172.             }
  1173.         } elseif ($key && $object->isAllowed('rename')) {
  1174.             return $this->renameObject($object, $key);
  1175.         } else {
  1176.             Logger::debug('prevented update object because of missing permissions.');
  1177.         }
  1179.         return ['success' => $success];
  1180.     }
  1182.     private function executeInsideTransaction(callable $fn)
  1183.     {
  1184.         $maxRetries = 5;
  1185.         for ($retries = 0; $retries < $maxRetries; $retries++) {
  1186.             try {
  1187.                 Db::get()->beginTransaction();
  1189.                 $fn();
  1191.                 Db::get()->commit();
  1193.                 break;
  1194.             } catch (\Exception $e) {
  1195.                 Db::get()->rollBack();
  1197.                 // we try to start the transaction $maxRetries times again (deadlocks, ...)
  1198.                 if ($retries < ($maxRetries - 1)) {
  1199.                     $run = $retries + 1;
  1200.                     $waitTime = rand(1, 5) * 100000; // microseconds
  1201.                     Logger::warn('Unable to finish transaction (' . $run . ". run) because of the following reason '" . $e->getMessage() . "'. --> Retrying in " . $waitTime . ' microseconds ... (' . ($run + 1) . ' of ' . $maxRetries . ')');
  1203.                     usleep($waitTime); // wait specified time until we restart the transaction
  1204.                 } else {
  1205.                     // if the transaction still fail after $maxRetries retries, we throw out the exception
  1206.                     Logger::error('Finally giving up restarting the same transaction again and again, last message: ' . $e->getMessage());
  1208.                     throw $e;
  1209.                 }
  1210.             }
  1211.         }
  1212.     }
  1214.     /**
  1215.      * @param DataObject\AbstractObject $parentObject
  1216.      * @param string $currentSortOrder
  1217.      */
  1218.     protected function reindexBasedOnSortOrder(DataObject\AbstractObject $parentObject, string $currentSortOrder)
  1219.     {
  1220.         $fn = function () use ($parentObject, $currentSortOrder) {
  1221.             $list = new DataObject\Listing();
  1223.             $db = Db::get();
  1224.             $result = $db->executeStatement(
  1225.                 'UPDATE '.$list->getDao()->getTableName().' o,
  1226.                     (
  1227.                     SELECT newIndex, o_id FROM (
  1228.                         SELECT @n := @n +1 AS newIndex, o_id
  1229.                         FROM '.$list->getDao()->getTableName().',
  1230.                                 (SELECT @n := -1) variable
  1231.                                  WHERE o_parentId = ? ORDER BY o_key ' . $currentSortOrder
  1232.                                .') tmp
  1233.                     ) order_table
  1234.                     SET o.o_index = order_table.newIndex
  1235.                     WHERE o.o_id=order_table.o_id',
  1236.                 [
  1237.                     $parentObject->getId(),
  1238.                 ]
  1239.             );
  1241.             $db = Db::get();
  1242.             $children = $db->fetchAllAssociative(
  1243.                 'SELECT o_id, o_modificationDate, o_versionCount FROM objects'
  1244.                 .' WHERE o_parentId = ? ORDER BY o_index ASC',
  1245.                 [$parentObject->getId()]
  1246.             );
  1247.             $index = 0;
  1249.             foreach ($children as $child) {
  1250.                 $this->updateLatestVersionIndex($child['o_id'], $child['o_modificationDate']);
  1251.                 $index++;
  1253.                 DataObject::clearDependentCacheByObjectId($child['o_id']);
  1254.             }
  1255.         };
  1257.         $this->executeInsideTransaction($fn);
  1258.     }
  1260.     private function updateLatestVersionIndex($objectId, $newIndex)
  1261.     {
  1262.         $object = DataObject\Concrete::getById($objectId);
  1264.         if (
  1265.             $object &&
  1266.             $object->getType() != DataObject::OBJECT_TYPE_FOLDER &&
  1267.             $latestVersion = $object->getLatestVersion()
  1268.         ) {
  1269.             // don't renew references (which means loading the target elements)
  1270.             // Not needed as we just save a new version with the updated index
  1271.             $object = $latestVersion->loadData(false);
  1272.             if ($newIndex !== $object->getIndex()) {
  1273.                 $object->setIndex($newIndex);
  1274.             }
  1275.             $latestVersion->save();
  1276.         }
  1277.     }
  1279.     /**
  1280.      * @param DataObject\AbstractObject $updatedObject
  1281.      * @param int $newIndex
  1282.      */
  1283.     protected function updateIndexesOfObjectSiblings(DataObject\AbstractObject $updatedObject, $newIndex)
  1284.     {
  1285.         $fn = function () use ($updatedObject, $newIndex) {
  1286.             $list = new DataObject\Listing();
  1287.             $updatedObject->saveIndex($newIndex);
  1289.             // The cte and the limit are needed to order the data before the newIndex is set
  1290.             $db = Db::get();
  1291.             $db->executeStatement(
  1292.                 'UPDATE '.$list->getDao()->getTableName().' o,
  1293.                     (
  1294.                         SELECT newIndex, o_id
  1295.                         FROM (
  1296.                             With cte As (SELECT o_index, o_id FROM ' . $list->getDao()->getTableName() . ' WHERE o_parentId = ? AND o_id != ? AND o_type IN (\''.implode(
  1297.                     "','", [
  1298.                         DataObject::OBJECT_TYPE_OBJECT,
  1299.                         DataObject::OBJECT_TYPE_VARIANT,
  1300.                         DataObject::OBJECT_TYPE_FOLDER,
  1301.                     ]
  1302.                 ).'\') ORDER BY o_index LIMIT '. $updatedObject->getParent()->getChildAmount([
  1303.                             DataObject::OBJECT_TYPE_OBJECT,
  1304.                             DataObject::OBJECT_TYPE_VARIANT,
  1305.                             DataObject::OBJECT_TYPE_FOLDER,
  1306.                         ]) .')
  1307.                             SELECT @n := IF(@n = ? - 1,@n + 2,@n + 1) AS newIndex, o_id
  1308.                             FROM cte,
  1309.                             (SELECT @n := -1) variable
  1310.                         ) tmp
  1311.                     ) order_table
  1312.                     SET o.o_index = order_table.newIndex
  1313.                     WHERE o.o_id=order_table.o_id',
  1314.                 [
  1315.                     $updatedObject->getParentId(),
  1316.                     $updatedObject->getId(),
  1317.                     $newIndex,
  1318.                 ]
  1319.             );
  1321.             $siblings = $db->fetchAllAssociative(
  1322.                 'SELECT o_id, o_modificationDate, o_versionCount, o_key, o_index FROM objects'
  1323.                 ." WHERE o_parentId = ? AND o_id != ? AND o_type IN ('object', 'variant','folder') ORDER BY o_index ASC",
  1324.                 [$updatedObject->getParentId(), $updatedObject->getId()]
  1325.             );
  1326.             $index = 0;
  1328.             foreach ($siblings as $sibling) {
  1329.                 if ($index == $newIndex) {
  1330.                     $index++;
  1331.                 }
  1333.                 $this->updateLatestVersionIndex($sibling['o_id'], $index);
  1334.                 $index++;
  1336.                 DataObject::clearDependentCacheByObjectId($sibling['o_id']);
  1337.             }
  1338.         };
  1340.         $this->executeInsideTransaction($fn);
  1341.     }
  1343.     /**
  1344.      * @Route("/save", name="save", methods={"POST", "PUT"})
  1345.      *
  1346.      * @param Request $request
  1347.      *
  1348.      * @return JsonResponse
  1349.      *
  1350.      * @throws \Exception
  1351.      */
  1352.     public function saveAction(Request $request)
  1353.     {
  1354.         $objectFromDatabase = DataObject\Concrete::getById((int) $request->get('id'));
  1356.         if (!$objectFromDatabase instanceof DataObject\Concrete) {
  1357.             return $this->adminJson(['success' => false, 'message' => 'Could not find object']);
  1358.         }
  1360.         // set the latest available version for editmode
  1361.         $object = $this->getLatestVersion($objectFromDatabase);
  1362.         $object->setUserModification($this->getAdminUser()->getId());
  1364.         $objectFromVersion = $object !== $objectFromDatabase;
  1365.         $originalModificationDate = $objectFromVersion ? $object->getModificationDate() : $objectFromDatabase->getModificationDate();
  1366.         if ($objectFromVersion) {
  1367.             if (method_exists($object, 'getLocalizedFields')) {
  1368.                 /** @var DataObject\Localizedfield $localizedFields */
  1369.                 $localizedFields = $object->getLocalizedFields();
  1370.                 $localizedFields->setLoadedAllLazyData();
  1371.             }
  1372.         }
  1374.         // data
  1375.         $data = [];
  1376.         if ($request->get('data')) {
  1377.             $data = $this->decodeJson($request->get('data'));
  1378.             foreach ($data as $key => $value) {
  1379.                 $fd = $object->getClass()->getFieldDefinition($key);
  1380.                 if ($fd) {
  1381.                     if ($fd instanceof DataObject\ClassDefinition\Data\Localizedfields) {
  1382.                         $user = Tool\Admin::getCurrentUser();
  1383.                         if (!$user->getAdmin()) {
  1384.                             $allowedLanguages = DataObject\Service::getLanguagePermissions($object, $user, 'lEdit');
  1385.                             if (!is_null($allowedLanguages)) {
  1386.                                 $allowedLanguages = array_keys($allowedLanguages);
  1387.                                 $submittedLanguages = array_keys($data[$key]);
  1388.                                 foreach ($submittedLanguages as $submittedLanguage) {
  1389.                                     if (!in_array($submittedLanguage, $allowedLanguages)) {
  1390.                                         unset($value[$submittedLanguage]);
  1391.                                     }
  1392.                                 }
  1393.                             }
  1394.                         }
  1395.                     }
  1397.                     if ($fd instanceof ReverseObjectRelation) {
  1398.                         $remoteClass = DataObject\ClassDefinition::getByName($fd->getOwnerClassName());
  1399.                         $relations = $object->getRelationData($fd->getOwnerFieldName(), false, $remoteClass->getId());
  1400.                         $toAdd = $this->detectAddedRemoteOwnerRelations($relations, $value);
  1401.                         $toDelete = $this->detectDeletedRemoteOwnerRelations($relations, $value);
  1402.                         if (count($toAdd) > 0 || count($toDelete) > 0) {
  1403.                             $this->processRemoteOwnerRelations($object, $toDelete, $toAdd, $fd->getOwnerFieldName());
  1404.                         }
  1405.                     } else {
  1406.                         $object->setValue($key, $fd->getDataFromEditmode($value, $object, ['objectFromVersion' => $objectFromVersion]));
  1407.                     }
  1408.                 }
  1409.             }
  1410.         }
  1412.         // general settings
  1413.         // @TODO: IS THIS STILL NECESSARY?
  1414.         if ($request->get('general')) {
  1415.             $general = $this->decodeJson($request->get('general'));
  1417.             // do not allow all values to be set, will cause problems (eg. icon)
  1418.             if (is_array($general) && count($general) > 0) {
  1419.                 foreach ($general as $key => $value) {
  1420.                     if (!in_array($key, ['o_id', 'o_classId', 'o_className', 'o_type', 'icon', 'o_userOwner', 'o_userModification', 'o_modificationDate'])) {
  1421.                         $object->setValue($key, $value);
  1422.                     }
  1423.                 }
  1424.             }
  1425.         }
  1427.         $this->assignPropertiesFromEditmode($request, $object);
  1428.         $this->applySchedulerDataToElement($request, $object);
  1430.         if (($request->get('task') === 'unpublish' && !$object->isAllowed('unpublish')) || ($request->get('task') === 'publish' && !$object->isAllowed('publish'))) {
  1431.             throw $this->createAccessDeniedHttpException();
  1432.         }
  1434.         if ($request->get('task') == 'unpublish') {
  1435.             $object->setPublished(false);
  1436.         }
  1438.         if ($request->get('task') == 'publish') {
  1439.             $object->setPublished(true);
  1440.         }
  1442.         // unpublish and save version is possible without checking mandatory fields
  1443.         if (in_array($request->get('task'), ['unpublish', 'version', 'autoSave'])) {
  1444.             $object->setOmitMandatoryCheck(true);
  1445.         }
  1447.         if (($request->get('task') == 'publish') || ($request->get('task') == 'unpublish')) {
  1448.             // disabled for now: see different approach [Elements] Show users who are working on the same element #9381
  1449.             // https://github.com/pimcore/pimcore/issues/9381
  1450.             //            if ($data) {
  1451.             //                if (!$this->performFieldcollectionModificationCheck($request, $object, $originalModificationDate, $data)) {
  1452.             //                    return $this->adminJson(['success' => false, 'message' => 'Could be that someone messed around with the fieldcollection in the meantime. Please reload and try again']);
  1453.             //                }
  1454.             //            }
  1456.             $object->save();
  1457.             $treeData = $this->getTreeNodeConfig($object);
  1459.             $newObject = DataObject::getById($object->getId(), ['force' => true]);
  1461.             if ($request->get('task') == 'publish') {
  1462.                 $object->deleteAutoSaveVersions($this->getAdminUser()->getId());
  1463.             }
  1465.             return $this->adminJson([
  1466.                 'success' => true,
  1467.                 'general' => ['o_modificationDate' => $object->getModificationDate(),
  1468.                     'versionDate' => $newObject->getModificationDate(),
  1469.                     'versionCount' => $newObject->getVersionCount(),
  1470.                 ],
  1471.                 'treeData' => $treeData,
  1472.             ]);
  1473.         } elseif ($request->get('task') == 'session') {
  1474.             //TODO https://github.com/pimcore/pimcore/issues/9536
  1475.             DataObject\Service::saveElementToSession($object, '', true);
  1477.             return $this->adminJson(['success' => true]);
  1478.         } elseif ($request->get('task') == 'scheduler') {
  1479.             if ($object->isAllowed('settings')) {
  1480.                 $object->saveScheduledTasks();
  1482.                 return $this->adminJson(['success' => true]);
  1483.             }
  1484.         } elseif ($object->isAllowed('save') || $object->isAllowed('publish')) {
  1485.             $isAutoSave = $request->get('task') == 'autoSave';
  1486.             $draftData = [];
  1488.             if ($object->isPublished() || $isAutoSave) {
  1489.                 $version = $object->saveVersion(true, true, null, $isAutoSave);
  1490.                 $draftData = [
  1491.                     'id' => $version->getId(),
  1492.                     'modificationDate' => $version->getDate(),
  1493.                     'isAutoSave' => $version->isAutoSave(),
  1494.                 ];
  1495.             } else {
  1496.                 $object->save();
  1497.             }
  1499.             if ($request->get('task') == 'version') {
  1500.                 $object->deleteAutoSaveVersions($this->getAdminUser()->getId());
  1501.             }
  1503.             $treeData = $this->getTreeNodeConfig($object);
  1505.             $newObject = DataObject::getById($object->getId(), ['force' => true]);
  1507.             return $this->adminJson([
  1508.                 'success' => true,
  1509.                 'general' => ['o_modificationDate' => $object->getModificationDate(),
  1510.                     'versionDate' => $newObject->getModificationDate(),
  1511.                     'versionCount' => $newObject->getVersionCount(),
  1512.                 ],
  1513.                 'draft' => $draftData,
  1514.                 'treeData' => $treeData,
  1515.             ]);
  1516.         }
  1518.         throw $this->createAccessDeniedHttpException();
  1519.     }
  1521.     /**
  1522.      * @param Request $request
  1523.      * @param DataObject\Concrete $object
  1524.      * @param int $originalModificationDate
  1525.      * @param array $data
  1526.      *
  1527.      * @return bool
  1528.      *
  1529.      * @throws \Exception
  1530.      */
  1531.     protected function performFieldcollectionModificationCheck(Request $request, DataObject\Concrete $object, $originalModificationDate, $data)
  1532.     {
  1533.         $modificationDate = $request->get('modificationDate');
  1534.         if ($modificationDate != $originalModificationDate) {
  1535.             $fielddefinitions = $object->getClass()->getFieldDefinitions();
  1536.             foreach ($fielddefinitions as $fd) {
  1537.                 if ($fd instanceof DataObject\ClassDefinition\Data\Fieldcollections) {
  1538.                     if (isset($data[$fd->getName()])) {
  1539.                         $allowedTypes = $fd->getAllowedTypes();
  1540.                         foreach ($allowedTypes as $type) {
  1541.                             /** @var DataObject\Fieldcollection\Definition $fdDef */
  1542.                             $fdDef = DataObject\Fieldcollection\Definition::getByKey($type);
  1543.                             $childDefinitions = $fdDef->getFieldDefinitions();
  1544.                             foreach ($childDefinitions as $childDef) {
  1545.                                 if ($childDef instanceof DataObject\ClassDefinition\Data\Localizedfields) {
  1546.                                     return false;
  1547.                                 }
  1548.                             }
  1549.                         }
  1550.                     }
  1551.                 }
  1552.             }
  1553.         }
  1555.         return true;
  1556.     }
  1558.     /**
  1559.      * @Route("/save-folder", name="savefolder", methods={"PUT"})
  1560.      *
  1561.      * @param Request $request
  1562.      *
  1563.      * @return JsonResponse
  1564.      */
  1565.     public function saveFolderAction(Request $request)
  1566.     {
  1567.         $object = DataObject::getById((int) $request->get('id'));
  1569.         if (!$object) {
  1570.             throw $this->createNotFoundException('Object not found');
  1571.         }
  1573.         if ($object->isAllowed('publish')) {
  1574.             try {
  1575.                 // general settings
  1576.                 $general = $this->decodeJson($request->get('general'));
  1577.                 $object->setValues($general);
  1578.                 $object->setUserModification($this->getAdminUser()->getId());
  1580.                 $this->assignPropertiesFromEditmode($request, $object);
  1582.                 $object->save();
  1584.                 return $this->adminJson(['success' => true]);
  1585.             } catch (\Exception $e) {
  1586.                 return $this->adminJson(['success' => false, 'message' => $e->getMessage()]);
  1587.             }
  1588.         }
  1590.         throw $this->createAccessDeniedHttpException();
  1591.     }
  1593.     /**
  1594.      * @param Request $request
  1595.      * @param DataObject\AbstractObject $object
  1596.      */
  1597.     protected function assignPropertiesFromEditmode(Request $request, $object)
  1598.     {
  1599.         if ($request->get('properties')) {
  1600.             $properties = [];
  1601.             // assign inherited properties
  1602.             foreach ($object->getProperties() as $p) {
  1603.                 if ($p->isInherited()) {
  1604.                     $properties[$p->getName()] = $p;
  1605.                 }
  1606.             }
  1608.             $propertiesData = $this->decodeJson($request->get('properties'));
  1610.             if (is_array($propertiesData)) {
  1611.                 foreach ($propertiesData as $propertyName => $propertyData) {
  1612.                     $value = $propertyData['data'];
  1614.                     try {
  1615.                         $property = new Model\Property();
  1616.                         $property->setType($propertyData['type']);
  1617.                         $property->setName($propertyName);
  1618.                         $property->setCtype('object');
  1619.                         $property->setDataFromEditmode($value);
  1620.                         $property->setInheritable($propertyData['inheritable']);
  1622.                         $properties[$propertyName] = $property;
  1623.                     } catch (\Exception $e) {
  1624.                         Logger::err("Can't add " . $propertyName . ' to object ' . $object->getRealFullPath());
  1625.                     }
  1626.                 }
  1627.             }
  1628.             $object->setProperties($properties);
  1629.         }
  1630.     }
  1632.     /**
  1633.      * @Route("/publish-version", name="publishversion", methods={"POST"})
  1634.      *
  1635.      * @param Request $request
  1636.      *
  1637.      * @return JsonResponse
  1638.      */
  1639.     public function publishVersionAction(Request $request)
  1640.     {
  1641.         $id = (int)$request->get('id');
  1642.         $version = Model\Version::getById($id);
  1643.         $object = $version?->loadData();
  1644.         if (!$object) {
  1645.             throw $this->createNotFoundException('Version with id [' . $id . "] doesn't exist");
  1646.         }
  1648.         $currentObject = DataObject::getById($object->getId());
  1649.         if ($currentObject->isAllowed('publish')) {
  1650.             $object->setPublished(true);
  1651.             $object->setUserModification($this->getAdminUser()->getId());
  1653.             try {
  1654.                 $object->save();
  1656.                 $this->addAdminStyle($object, ElementAdminStyleEvent::CONTEXT_TREE, $treeData);
  1658.                 return $this->adminJson(
  1659.                     [
  1660.                         'success' => true,
  1661.                         'general' => ['o_modificationDate' => $object->getModificationDate() ],
  1662.                         'treeData' => $treeData, ]
  1663.                 );
  1664.             } catch (\Exception $e) {
  1665.                 return $this->adminJson(['success' => false, 'message' => $e->getMessage()]);
  1666.             }
  1667.         }
  1669.         throw $this->createAccessDeniedHttpException();
  1670.     }
  1672.     /**
  1673.      * @Route("/preview-version", name="previewversion", methods={"GET"})
  1674.      *
  1675.      * @param Request $request
  1676.      *
  1677.      * @throws \Exception
  1678.      *
  1679.      * @return Response
  1680.      */
  1681.     public function previewVersionAction(Request $request)
  1682.     {
  1683.         DataObject::setDoNotRestoreKeyAndPath(true);
  1685.         $id = (int)$request->get('id');
  1686.         $version = Model\Version::getById($id);
  1687.         $object = $version?->loadData();
  1689.         if ($object) {
  1690.             if (method_exists($object, 'getLocalizedFields')) {
  1691.                 /** @var DataObject\Localizedfield $localizedFields */
  1692.                 $localizedFields = $object->getLocalizedFields();
  1693.                 $localizedFields->setLoadedAllLazyData();
  1694.             }
  1696.             DataObject::setDoNotRestoreKeyAndPath(false);
  1698.             if ($object->isAllowed('versions')) {
  1699.                 return $this->render('@PimcoreAdmin/Admin/DataObject/DataObject/previewVersion.html.twig',
  1700.                     [
  1701.                         'object' => $object,
  1702.                         'versionNote' => $version->getNote(),
  1703.                         'validLanguages' => Tool::getValidLanguages(),
  1704.                     ]);
  1705.             }
  1707.             throw $this->createAccessDeniedException('Permission denied, version id [' . $id . ']');
  1708.         }
  1710.         throw $this->createNotFoundException('Version with id [' . $id . "] doesn't exist");
  1711.     }
  1713.     /**
  1714.      * @Route("/diff-versions/from/{from}/to/{to}", name="diffversions", methods={"GET"})
  1715.      *
  1716.      * @param Request $request
  1717.      * @param int $from
  1718.      * @param int $to
  1719.      *
  1720.      * @return Response
  1721.      *
  1722.      * @throws \Exception
  1723.      */
  1724.     public function diffVersionsAction(Request $request, $from, $to)
  1725.     {
  1726.         DataObject::setDoNotRestoreKeyAndPath(true);
  1728.         $id1 = (int)$from;
  1729.         $id2 = (int)$to;
  1731.         $version1 = Model\Version::getById($id1);
  1732.         $object1 = $version1?->loadData();
  1734.         if (!$object1) {
  1735.             throw $this->createNotFoundException('Version with id [' . $id1 . "] doesn't exist");
  1736.         }
  1738.         if (method_exists($object1, 'getLocalizedFields')) {
  1739.             /** @var DataObject\Localizedfield $localizedFields1 */
  1740.             $localizedFields1 = $object1->getLocalizedFields();
  1741.             $localizedFields1->setLoadedAllLazyData();
  1742.         }
  1744.         $version2 = Model\Version::getById($id2);
  1745.         $object2 = $version2?->loadData();
  1747.         if (!$object2) {
  1748.             throw $this->createNotFoundException('Version with id [' . $id2 . "] doesn't exist");
  1749.         }
  1751.         if (method_exists($object2, 'getLocalizedFields')) {
  1752.             /** @var DataObject\Localizedfield $localizedFields2 */
  1753.             $localizedFields2 = $object2->getLocalizedFields();
  1754.             $localizedFields2->setLoadedAllLazyData();
  1755.         }
  1757.         DataObject::setDoNotRestoreKeyAndPath(false);
  1759.         if ($object1->isAllowed('versions') && $object2->isAllowed('versions')) {
  1760.             return $this->render('@PimcoreAdmin/Admin/DataObject/DataObject/diffVersions.html.twig',
  1761.                 [
  1762.                     'object1' => $object1,
  1763.                     'versionNote1' => $version1->getNote(),
  1764.                     'object2' => $object2,
  1765.                     'versionNote2' => $version2->getNote(),
  1766.                     'validLanguages' => Tool::getValidLanguages(),
  1767.                 ]);
  1768.         }
  1770.         throw $this->createAccessDeniedException('Permission denied, version ids [' . $id1 . ', ' . $id2 . ']');
  1771.     }
  1773.     /**
  1774.      * @Route("/grid-proxy", name="gridproxy", methods={"GET", "POST", "PUT"})
  1775.      *
  1776.      * @param Request $request
  1777.      * @param EventDispatcherInterface $eventDispatcher
  1778.      * @param GridHelperService $gridHelperService
  1779.      * @param LocaleServiceInterface $localeService
  1780.      * @param CsrfProtectionHandler $csrfProtection
  1781.      *
  1782.      * @return JsonResponse
  1783.      */
  1784.     public function gridProxyAction(
  1785.         Request $request,
  1786.         EventDispatcherInterface $eventDispatcher,
  1787.         GridHelperService $gridHelperService,
  1788.         LocaleServiceInterface $localeService,
  1789.         CsrfProtectionHandler $csrfProtection
  1790.     ): JsonResponse {
  1791.         $allParams = array_merge($request->request->all(), $request->query->all());
  1792.         if (isset($allParams['context']) && $allParams['context']) {
  1793.             $allParams['context'] = json_decode($allParams['context'], true);
  1794.         } else {
  1795.             $allParams['context'] = [];
  1796.         }
  1798.         $filterPrepareEvent = new GenericEvent($this, [
  1799.             'requestParams' => $allParams,
  1800.         ]);
  1801.         $eventDispatcher->dispatch($filterPrepareEvent, AdminEvents::OBJECT_LIST_BEFORE_FILTER_PREPARE);
  1803.         $allParams = $filterPrepareEvent->getArgument('requestParams');
  1805.         $csrfProtection->checkCsrfToken($request);
  1807.         $result = $this->gridProxy(
  1808.             $allParams,
  1809.             DataObject::OBJECT_TYPE_OBJECT,
  1810.             $request,
  1811.             $eventDispatcher,
  1812.             $gridHelperService,
  1813.             $localeService
  1814.         );
  1816.         return $this->adminJson($result);
  1817.     }
  1819.     /**
  1820.      * @Route("/copy-info", name="copyinfo", methods={"GET"})
  1821.      *
  1822.      * @param Request $request
  1823.      *
  1824.      * @return JsonResponse
  1825.      */
  1826.     public function copyInfoAction(Request $request)
  1827.     {
  1828.         $transactionId = time();
  1829.         $pasteJobs = [];
  1831.         Tool\Session::useSession(function (AttributeBagInterface $session) use ($transactionId) {
  1832.             $session->set((string) $transactionId, ['idMapping' => []]);
  1833.         }, 'pimcore_copy');
  1835.         if ($request->get('type') == 'recursive' || $request->get('type') == 'recursive-update-references') {
  1836.             $object = DataObject::getById((int) $request->get('sourceId'));
  1838.             // first of all the new parent
  1839.             $pasteJobs[] = [[
  1840.                 'url' => $this->generateUrl('pimcore_admin_dataobject_dataobject_copy'),
  1841.                 'method' => 'POST',
  1842.                 'params' => [
  1843.                     'sourceId' => $request->get('sourceId'),
  1844.                     'targetId' => $request->get('targetId'),
  1845.                     'type' => 'child',
  1846.                     'transactionId' => $transactionId,
  1847.                     'saveParentId' => true,
  1848.                 ],
  1849.             ]];
  1851.             if ($object->hasChildren(DataObject::$types)) {
  1852.                 // get amount of children
  1853.                 $list = new DataObject\Listing();
  1854.                 $list->setCondition('o_path LIKE ' . $list->quote($list->escapeLike($object->getRealFullPath()) . '/%'));
  1855.                 $list->setOrderKey('LENGTH(o_path)', false);
  1856.                 $list->setOrder('ASC');
  1857.                 $list->setObjectTypes(DataObject::$types);
  1858.                 $childIds = $list->loadIdList();
  1860.                 if (count($childIds) > 0) {
  1861.                     foreach ($childIds as $id) {
  1862.                         $pasteJobs[] = [[
  1863.                             'url' => $this->generateUrl('pimcore_admin_dataobject_dataobject_copy'),
  1864.                             'method' => 'POST',
  1865.                             'params' => [
  1866.                                 'sourceId' => $id,
  1867.                                 'targetParentId' => $request->get('targetId'),
  1868.                                 'sourceParentId' => $request->get('sourceId'),
  1869.                                 'type' => 'child',
  1870.                                 'transactionId' => $transactionId,
  1871.                             ],
  1872.                         ]];
  1873.                     }
  1874.                 }
  1876.                 // add id-rewrite steps
  1877.                 if ($request->get('type') == 'recursive-update-references') {
  1878.                     for ($i = 0; $i < (count($childIds) + 1); $i++) {
  1879.                         $pasteJobs[] = [[
  1880.                             'url' => $this->generateUrl('pimcore_admin_dataobject_dataobject_copyrewriteids'),
  1881.                             'method' => 'PUT',
  1882.                             'params' => [
  1883.                                 'transactionId' => $transactionId,
  1884.                                 '_dc' => uniqid(),
  1885.                             ],
  1886.                         ]];
  1887.                     }
  1888.                 }
  1889.             }
  1890.         } elseif ($request->get('type') == 'child' || $request->get('type') == 'replace') {
  1891.             // the object itself is the last one
  1892.             $pasteJobs[] = [[
  1893.                 'url' => $this->generateUrl('pimcore_admin_dataobject_dataobject_copy'),
  1894.                 'method' => 'POST',
  1895.                 'params' => [
  1896.                     'sourceId' => $request->get('sourceId'),
  1897.                     'targetId' => $request->get('targetId'),
  1898.                     'type' => $request->get('type'),
  1899.                     'transactionId' => $transactionId,
  1900.                 ],
  1901.             ]];
  1902.         }
  1904.         return $this->adminJson([
  1905.             'pastejobs' => $pasteJobs,
  1906.         ]);
  1907.     }
  1909.     /**
  1910.      * @Route("/copy-rewrite-ids", name="copyrewriteids", methods={"PUT"})
  1911.      *
  1912.      * @param Request $request
  1913.      *
  1914.      * @return JsonResponse
  1915.      *
  1916.      * @throws \Exception
  1917.      */
  1918.     public function copyRewriteIdsAction(Request $request)
  1919.     {
  1920.         $transactionId = $request->get('transactionId');
  1922.         $idStore = Tool\Session::useSession(function (AttributeBagInterface $session) use ($transactionId) {
  1923.             return $session->get($transactionId);
  1924.         }, 'pimcore_copy');
  1926.         if (!array_key_exists('rewrite-stack', $idStore)) {
  1927.             $idStore['rewrite-stack'] = array_values($idStore['idMapping']);
  1928.         }
  1930.         $id = array_shift($idStore['rewrite-stack']);
  1931.         $object = DataObject::getById($id);
  1933.         // create rewriteIds() config parameter
  1934.         $rewriteConfig = ['object' => $idStore['idMapping']];
  1936.         $object = DataObject\Service::rewriteIds($object, $rewriteConfig);
  1938.         $object->setUserModification($this->getAdminUser()->getId());
  1939.         $object->save();
  1941.         // write the store back to the session
  1942.         Tool\Session::useSession(function (AttributeBagInterface $session) use ($transactionId, $idStore) {
  1943.             $session->set($transactionId, $idStore);
  1944.         }, 'pimcore_copy');
  1946.         return $this->adminJson([
  1947.             'success' => true,
  1948.             'id' => $id,
  1949.         ]);
  1950.     }
  1952.     /**
  1953.      * @Route("/copy", name="copy", methods={"POST"})
  1954.      *
  1955.      * @param Request $request
  1956.      *
  1957.      * @return JsonResponse
  1958.      */
  1959.     public function copyAction(Request $request)
  1960.     {
  1961.         $message = '';
  1962.         $sourceId = (int)$request->get('sourceId');
  1963.         $source = DataObject::getById($sourceId);
  1965.         $session = Tool\Session::get('pimcore_copy');
  1966.         $sessionBag = $session->get($request->get('transactionId'));
  1968.         $targetId = (int)$request->get('targetId');
  1969.         if ($request->get('targetParentId')) {
  1970.             $sourceParent = DataObject::getById((int) $request->get('sourceParentId'));
  1972.             // this is because the key can get the prefix "_copy" if the target does already exists
  1973.             if ($sessionBag['parentId']) {
  1974.                 $targetParent = DataObject::getById($sessionBag['parentId']);
  1975.             } else {
  1976.                 $targetParent = DataObject::getById((int) $request->get('targetParentId'));
  1977.             }
  1979.             $targetPath = preg_replace('@^' . preg_quote($sourceParent->getRealFullPath(), '@') . '@', $targetParent . '/', $source->getRealPath());
  1980.             $target = DataObject::getByPath($targetPath);
  1981.         } else {
  1982.             $target = DataObject::getById($targetId);
  1983.         }
  1985.         if ($target->isAllowed('create')) {
  1986.             $source = DataObject::getById($sourceId);
  1987.             if ($source != null) {
  1988.                 if ($source instanceof DataObject\Concrete && $latestVersion = $source->getLatestVersion()) {
  1989.                     $source = $latestVersion->loadData();
  1990.                     $source->setPublished(false); //as latest version is used which is not published
  1991.                 }
  1993.                 if ($request->get('type') == 'child') {
  1994.                     $newObject = $this->_objectService->copyAsChild($target, $source);
  1996.                     $sessionBag['idMapping'][(int)$source->getId()] = (int)$newObject->getId();
  1998.                     // this is because the key can get the prefix "_copy" if the target does already exists
  1999.                     if ($request->get('saveParentId')) {
  2000.                         $sessionBag['parentId'] = $newObject->getId();
  2001.                     }
  2002.                 } elseif ($request->get('type') == 'replace') {
  2003.                     $this->_objectService->copyContents($target, $source);
  2004.                 }
  2006.                 $session->set($request->get('transactionId'), $sessionBag);
  2007.                 Tool\Session::writeClose();
  2009.                 return $this->adminJson(['success' => true, 'message' => $message]);
  2010.             } else {
  2011.                 Logger::error("could not execute copy/paste, source object with id [ $sourceId ] not found");
  2013.                 return $this->adminJson(['success' => false, 'message' => 'source object not found']);
  2014.             }
  2015.         } else {
  2016.             throw $this->createAccessDeniedHttpException();
  2017.         }
  2018.     }
  2020.     /**
  2021.      * @Route("/preview", name="preview", methods={"GET"})
  2022.      *
  2023.      * @param Request $request
  2024.      * @param PreviewGeneratorInterface $defaultPreviewGenerator
  2025.      *
  2026.      * @return Response|RedirectResponse
  2027.      */
  2028.     public function previewAction(Request $request, PreviewGeneratorInterface $defaultPreviewGenerator)
  2029.     {
  2030.         $id = $request->get('id');
  2031.         $object = DataObject\Service::getElementFromSession('object', $id);
  2033.         if ($object instanceof DataObject\Concrete) {
  2034.             $url = $object->getClass()->getPreviewUrl();
  2035.             if ($url) {
  2036.                 // replace named variables
  2037.                 $vars = $object->getObjectVars();
  2038.                 foreach ($vars as $key => $value) {
  2039.                     if (!empty($value) && \is_scalar($value)) {
  2040.                         $url = str_replace('%' . $key, urlencode($value), $url);
  2041.                     } else {
  2042.                         if (strpos($url, '%' . $key) !== false) {
  2043.                             return new Response('No preview available, please ensure that all fields which are required for the preview are filled correctly.');
  2044.                         }
  2045.                     }
  2046.                 }
  2047.                 $url = str_replace('%_locale', $this->getAdminUser()->getLanguage(), $url);
  2048.             } elseif ($previewService = $object->getClass()->getPreviewGenerator()) {
  2049.                 $url = $previewService->generatePreviewUrl($object, array_merge(['preview' => true, 'context' => $this], $request->query->all()));
  2050.             } elseif ($object->getClass()->getLinkGenerator()) {
  2051.                 $parameters = [
  2052.                     'preview' => true,
  2053.                     'context' => $this,
  2054.                 ];
  2056.                 $url = $defaultPreviewGenerator->generatePreviewUrl($object, array_merge($parameters, $request->query->all()));
  2057.             }
  2059.             if (!$url) {
  2060.                 throw new NotFoundHttpException('Cannot render preview due to empty URL');
  2061.             }
  2063.             // replace all remaining % signs which are not an url encoded characters
  2064.             $url = preg_replace('/%(?![0-9A-F]{2})/i', '%25', $url);
  2066.             $urlParts = parse_url($url);
  2068.             $redirectParameters = array_filter([
  2069.                 'pimcore_object_preview' => $id,
  2070.                 'site' => $request->query->getInt(PreviewGeneratorInterface::PARAMETER_SITE),
  2071.                 'dc' => time(),
  2072.             ]);
  2074.             $redirectUrl = $urlParts['path'] . '?' . http_build_query($redirectParameters) . (isset($urlParts['query']) ? '&' . $urlParts['query'] : '');
  2076.             return $this->redirect($redirectUrl);
  2077.         } else {
  2078.             throw new NotFoundHttpException(sprintf('Expected an object of type "%s", got "%s"', DataObject\Concrete::class, get_debug_type($object)));
  2079.         }
  2080.     }
  2082.     /**
  2083.      * @param  DataObject\Concrete $object
  2084.      * @param  array $toDelete
  2085.      * @param  array $toAdd
  2086.      * @param  string $ownerFieldName
  2087.      */
  2088.     protected function processRemoteOwnerRelations($object, $toDelete, $toAdd, $ownerFieldName)
  2089.     {
  2090.         $getter = 'get' . ucfirst($ownerFieldName);
  2091.         $setter = 'set' . ucfirst($ownerFieldName);
  2093.         foreach ($toDelete as $id) {
  2094.             $owner = DataObject::getById($id);
  2095.             //TODO: lock ?!
  2096.             if (method_exists($owner, $getter)) {
  2097.                 $currentData = $owner->$getter();
  2098.                 if (is_array($currentData)) {
  2099.                     for ($i = 0; $i < count($currentData); $i++) {
  2100.                         if ($currentData[$i]->getId() == $object->getId()) {
  2101.                             unset($currentData[$i]);
  2102.                             $owner->$setter($currentData);
  2104.                             break;
  2105.                         }
  2106.                     }
  2107.                 } else {
  2108.                     if ($currentData->getId() == $object->getId()) {
  2109.                         $owner->$setter(null);
  2110.                     }
  2111.                 }
  2112.             }
  2113.             $owner->setUserModification($this->getAdminUser()->getId());
  2114.             $owner->save();
  2115.             Logger::debug('Saved object id [ ' . $owner->getId() . ' ] by remote modification through [' . $object->getId() . '], Action: deleted [ ' . $object->getId() . " ] from [ $ownerFieldName]");
  2116.         }
  2118.         foreach ($toAdd as $id) {
  2119.             $owner = DataObject::getById($id);
  2120.             //TODO: lock ?!
  2121.             if (method_exists($owner, $getter)) {
  2122.                 $currentData = $owner->$getter();
  2123.                 if (is_array($currentData)) {
  2124.                     $currentData[] = $object;
  2125.                 } else {
  2126.                     $currentData = $object;
  2127.                 }
  2128.                 $owner->$setter($currentData);
  2129.                 $owner->setUserModification($this->getAdminUser()->getId());
  2130.                 $owner->save();
  2131.                 Logger::debug('Saved object id [ ' . $owner->getId() . ' ] by remote modification through [' . $object->getId() . '], Action: added [ ' . $object->getId() . " ] to [ $ownerFieldName ]");
  2132.             }
  2133.         }
  2134.     }
  2136.     /**
  2137.      * @param  array $relations
  2138.      * @param  array $value
  2139.      *
  2140.      * @return array
  2141.      */
  2142.     protected function detectDeletedRemoteOwnerRelations($relations, $value)
  2143.     {
  2144.         $originals = [];
  2145.         $changed = [];
  2146.         foreach ($relations as $r) {
  2147.             $originals[] = $r['dest_id'];
  2148.         }
  2149.         if (is_array($value)) {
  2150.             foreach ($value as $row) {
  2151.                 $changed[] = $row['id'];
  2152.             }
  2153.         }
  2154.         $diff = array_diff($originals, $changed);
  2156.         return $diff;
  2157.     }
  2159.     /**
  2160.      * @param  array $relations
  2161.      * @param  array $value
  2162.      *
  2163.      * @return array
  2164.      */
  2165.     protected function detectAddedRemoteOwnerRelations($relations, $value)
  2166.     {
  2167.         $originals = [];
  2168.         $changed = [];
  2169.         foreach ($relations as $r) {
  2170.             $originals[] = $r['dest_id'];
  2171.         }
  2172.         if (is_array($value)) {
  2173.             foreach ($value as $row) {
  2174.                 $changed[] = $row['id'];
  2175.             }
  2176.         }
  2177.         $diff = array_diff($changed, $originals);
  2179.         return $diff;
  2180.     }
  2182.     /**
  2183.      * @template T of DataObject\Concrete
  2184.      *
  2185.      * @param T $object
  2186.      * @param null|Version $draftVersion
  2187.      *
  2188.      * @return T
  2189.      */
  2190.     protected function getLatestVersion(DataObject\Concrete $object, &$draftVersion = null): ?DataObject\Concrete
  2191.     {
  2192.         $latestVersion = $object->getLatestVersion($this->getAdminUser()->getId());
  2193.         if ($latestVersion) {
  2194.             $latestObj = $latestVersion->loadData();
  2195.             if ($latestObj instanceof DataObject\Concrete) {
  2196.                 $draftVersion = $latestVersion;
  2198.                 return $latestObj;
  2199.             }
  2200.         }
  2202.         return $object;
  2203.     }
  2205.     /**
  2206.      * @param ControllerEvent $event
  2207.      */
  2208.     public function onKernelControllerEvent(ControllerEvent $event)
  2209.     {
  2210.         if (!$event->isMainRequest()) {
  2211.             return;
  2212.         }
  2214.         // check permissions
  2215.         $this->checkPermission('objects');
  2217.         $this->_objectService = new DataObject\Service($this->getAdminUser());
  2218.     }
  2219. }