SonataAdmin：阻止管理员删除自己的帐户

Question

I am using sonatadmin for a symfony 2 project. Sometimes admin user may accidently delete his own account. how to prevent admin user to delete his own account? Thanks!

Answer 1

To prevent admin to delete his own account you need define your own CRUDController for sonata user by following ADVANCED CONFIGURATION

admin:                  # Admin Classes
    user:
        class:          Sonata\UserBundle\Admin\Entity\UserAdmin
        controller:     YourUserBundle:CRUD
        translation:    SonataUserBundle

and then in your controller override batchActionDelete() & deleteAction() functions in these functions check if request contains admin object/id then restrict here.

 public function deleteAction($id)
   {
       $id     = $this->get('request')->get($this->admin->getIdParameter());
       $object = $this->admin->getObject($id);

       if (!$object) {
           throw new NotFoundHttpException(sprintf('unable to find the object with id : %s', $id));
       }
       $userid  = $this->getUser()->getId() // get id of logged in user
       if($userid == $id){
               $this->addFlash(
                   'sonata_flash_error',
                   'Error you cannot delete your own account'
               );
             return $this->redirectTo($object);
       }
  // other code from base class

   }

Same logic for batchActionDelete() function

Answer 2

I am using SonataUserBundle along with FOSUserBundle and I ended up with the following solution.

config.yml:

parameters:
    sonata.user.admin.user.controller: AppBundle:CRUD\CRUD

AppBundle\\Controller\\CRUD\\CRUDController:

<?php

namespace AppBundle\Controller\CRUD;

use Sonata\AdminBundle\Controller\CRUDController as Controller;
use Sonata\AdminBundle\Datagrid\ProxyQueryInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;

class CRUDController extends Controller
{
    public function deleteAction($id)
    {
        $request = $this->getRequest();
        $id      = $request->get($this->admin->getIdParameter());
        $object  = $this->admin->getObject($id);

        if (!$object) {
            throw $this->createNotFoundException(sprintf('unable to find the object with id: %s', $id));
        }

        $currentUserId = $this->getUser()->getId(); // ID of the current user
        if ($currentUserId == $id) {
            $this->addFlash(
                'sonata_flash_error',
                'You cannot delete your own account.'
            );

            return $this->redirectTo($object);
        }

        return parent::deleteAction($id);
    }

    public function batchActionDelete(ProxyQueryInterface $query)
    {
        $request       = $this->getRequest();
        $currentUserId = $this->getUser()->getId(); // ID of the current user
        $selectedUsers = $query->execute();

        foreach ($selectedUsers as $selectedUser) {
            if ($selectedUser->getId() == $currentUserId) {
                $this->addFlash(
                    'sonata_flash_error',
                    'You cannot delete your own account.'
                );

                return new RedirectResponse(
                    $this->admin->generateUrl('list', array('filter' => $this->admin->getFilterParameters()))
                );
            }
        }

        return parent::batchActionDelete($query);
    }
}

References:

• M Khalid Junaid's answer
• https://sonata-project.org/bundles/admin/3-x/doc/cookbook/recipe_custom_action.html (Sonata documentation)
• https://sonata-project.org/bundles/user/2-0/doc/reference/advanced_configuration.html (advanced configuration)