SonataAdmin: Prevent Admin From Deleting His Own Account - php

Question

I am using sonatadmin for a symfony 2 project. Sometimes admin user may accidently delete his own account. how to prevent admin user to delete his own account? Thanks!

Answer 1

To prevent admin to delete his own account you need define your own CRUDController for sonata user by following ADVANCED CONFIGURATION
admin: # Admin Classes
user:
class: Sonata\UserBundle\Admin\Entity\UserAdmin
controller: YourUserBundle:CRUD
translation: SonataUserBundle
and then in your controller override batchActionDelete() & deleteAction() functions in these functions check if request contains admin object/id then restrict here.
public function deleteAction($id)
{
$id = $this->get('request')->get($this->admin->getIdParameter());
$object = $this->admin->getObject($id);
if (!$object) {
throw new NotFoundHttpException(sprintf('unable to find the object with id : %s', $id));
}
$userid = $this->getUser()->getId() // get id of logged in user
if($userid == $id){
$this->addFlash(
'sonata_flash_error',
'Error you cannot delete your own account'
);
return $this->redirectTo($object);
}
// other code from base class
}
Same logic for batchActionDelete() function

Answer 2

I am using SonataUserBundle along with FOSUserBundle and I ended up with the following solution.
config.yml:
parameters:
sonata.user.admin.user.controller: AppBundle:CRUD\CRUD
AppBundle\Controller\CRUD\CRUDController:
<?php
namespace AppBundle\Controller\CRUD;
use Sonata\AdminBundle\Controller\CRUDController as Controller;
use Sonata\AdminBundle\Datagrid\ProxyQueryInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
class CRUDController extends Controller
{
public function deleteAction($id)
{
$request = $this->getRequest();
$id = $request->get($this->admin->getIdParameter());
$object = $this->admin->getObject($id);
if (!$object) {
throw $this->createNotFoundException(sprintf('unable to find the object with id: %s', $id));
}
$currentUserId = $this->getUser()->getId(); // ID of the current user
if ($currentUserId == $id) {
$this->addFlash(
'sonata_flash_error',
'You cannot delete your own account.'
);
return $this->redirectTo($object);
}
return parent::deleteAction($id);
}
public function batchActionDelete(ProxyQueryInterface $query)
{
$request = $this->getRequest();
$currentUserId = $this->getUser()->getId(); // ID of the current user
$selectedUsers = $query->execute();
foreach ($selectedUsers as $selectedUser) {
if ($selectedUser->getId() == $currentUserId) {
$this->addFlash(
'sonata_flash_error',
'You cannot delete your own account.'
);
return new RedirectResponse(
$this->admin->generateUrl('list', array('filter' => $this->admin->getFilterParameters()))
);
}
}
return parent::batchActionDelete($query);
}
}
References:
M Khalid Junaid's answer
https://sonata-project.org/bundles/admin/3-x/doc/cookbook/recipe_custom_action.html (Sonata documentation)
https://sonata-project.org/bundles/user/2-0/doc/reference/advanced_configuration.html
(advanced configuration)