Add super user check to the before method in authorization policies.

statamic · Feb 28, 2025 · 639a059 · 639a059
1 parent f34eafa
commit 639a059
Show file tree

Hide file tree

Showing 15 changed files with 71 additions and 11 deletions.
diff --git a/src/Policies/AssetContainerPolicy.php b/src/Policies/AssetContainerPolicy.php
@@ -9,7 +9,12 @@ class AssetContainerPolicy
 {
     public function before($user, $ability)
     {
-        if (User::fromUser($user)->hasPermission('configure asset containers')) {
+        $user = User::fromUser($user);
+
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure asset containers')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/AssetFolderPolicy.php b/src/Policies/AssetFolderPolicy.php
@@ -12,6 +12,10 @@ public function create($user, $assetContainer)
     {
         $user = User::fromUser($user);
 
+        if ($user->isSuper()) {
+            return true;
+        }
+
         if (! $user->hasPermission("upload {$assetContainer->handle()} assets")) {
             return false;
         }

diff --git a/src/Policies/AssetPolicy.php b/src/Policies/AssetPolicy.php
@@ -10,7 +10,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure asset containers')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure asset containers')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/CollectionPolicy.php b/src/Policies/CollectionPolicy.php
@@ -13,7 +13,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure collections')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure collections')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/EntryPolicy.php b/src/Policies/EntryPolicy.php
@@ -12,7 +12,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure collections')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure collections')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/FieldsetPolicy.php b/src/Policies/FieldsetPolicy.php
@@ -10,7 +10,10 @@ public function before($user, $ability, $fieldset)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure fields')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure fields')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/FormPolicy.php b/src/Policies/FormPolicy.php
@@ -11,7 +11,10 @@ public function before($user, $ability)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure forms')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure forms')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/FormSubmissionPolicy.php b/src/Policies/FormSubmissionPolicy.php
@@ -10,7 +10,10 @@ public function before($user, $ability)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure forms')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure forms')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/GlobalSetPolicy.php b/src/Policies/GlobalSetPolicy.php
@@ -13,7 +13,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure globals')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure globals')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/NavPolicy.php b/src/Policies/NavPolicy.php
@@ -13,7 +13,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure navs')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure navs')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/NavTreePolicy.php b/src/Policies/NavTreePolicy.php
@@ -8,6 +8,13 @@ class NavTreePolicy extends NavPolicy
 {
     use Concerns\HasMultisitePolicy;
 
+    public function before($user)
+    {
+        if (User::fromUser($user)->isSuper()) {
+            return true;
+        }
+    }
+
     public function view($user, $nav)
     {
         $user = User::fromUser($user);

diff --git a/src/Policies/SitePolicy.php b/src/Policies/SitePolicy.php
@@ -7,6 +7,13 @@
 
 class SitePolicy
 {
+    public function before($user)
+    {
+        if (User::fromUser($user)->isSuper()) {
+            return true;
+        }
+    }
+
     public function view($user, $site)
     {
         if (! Site::multiEnabled()) {

diff --git a/src/Policies/TaxonomyPolicy.php b/src/Policies/TaxonomyPolicy.php
@@ -13,7 +13,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure taxonomies')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure taxonomies')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/TermPolicy.php b/src/Policies/TermPolicy.php
@@ -12,7 +12,10 @@ public function before($user)
     {
         $user = User::fromUser($user);
 
-        if ($user->hasPermission('configure taxonomies')) {
+        if (
+            $user->isSuper() ||
+            $user->hasPermission('configure taxonomies')
+        ) {
             return true;
         }
     }

diff --git a/src/Policies/UserPolicy.php b/src/Policies/UserPolicy.php
@@ -6,6 +6,13 @@
 
 class UserPolicy
 {
+    public function before($user)
+    {
+        if (User::fromUser($user)->isSuper()) {
+            return true;
+        }
+    }
+
     public function index($authed)
     {
         $authed = User::fromUser($authed);