prepareReport($data); foreach ($report->getJoinedReportIdList() as $subReportId) { $subReport = $this->entityManager->getRDBRepositoryByClass(Report::class)->getById($subReportId); if (!$subReport) { continue; } $this->reportHelper->checkReportCanBeRun($subReport); if (!$this->acl->checkEntityRead($subReport)) { throw new Forbidden("No access to sub-report."); } } $this->reportHelper->checkReportCanBeRun($report); $this->accessCheck($report); return $report; } /** * @throws Forbidden */ private function accessCheck(Report $report): void { if ( !$this->user->isAdmin() && ($report->isInternal() || $report->getInternalClassName()) ) { throw Forbidden::createWithBody('onlyAdminCanPreviewInternalReports', Body::create()->withMessageTranslation('onlyAdminCanPreviewInternalReports', Report::ENTITY_TYPE) ); } if ( $report->getTargetEntityType() && !$this->acl->checkScope($report->getTargetEntityType(), AclTable::ACTION_READ) ) { throw new Forbidden("No 'read' access to target entity."); } } /** * @throws BadRequest */ private function prepareReport(stdClass $data): Report { $report = $this->entityManager->getRDBRepositoryByClass(Report::class)->getNew(); $attributeList = [ 'entityType', 'type', 'data', 'columns', 'groupBy', 'orderBy', 'orderByList', 'filters', 'filtersDataList', 'runtimeFilters', 'filtersData', 'columnsData', 'chartColors', 'chartDataList', 'chartOneColumns', 'chartOneY2Columns', 'chartType', 'joinedReports', 'joinedReportLabel', 'joinedReportDataList', 'isInternal', 'internalClassName', 'internalParams', ]; foreach (array_keys(get_object_vars($data)) as $attribute) { if (!in_array($attribute, $attributeList)) { unset($data->$attribute); } } $report->setMultiple($data); $report ->setApplyAcl() ->setName('Unnamed'); if ($report->getInternalClassName()) { $this->internalReportHelper->populateFields($report); } $this->serviceContainer->getByClass(Report::class)->processValidation($report, $data); return $report; } }