Merge pull request #4400 from Icinga/feature/username-in-navigation-items

Support $user.local_name$ macro in navigation items

doc/06-Security.md

@@ -154,10 +154,13 @@ application/share/groups  | which groups a user can share navigation items with
 ### Username placeholder
 
 It is possible to reference the local username (without the domain part) of the user in restrictions. To accomplish
-this, put the macro `$user:local_name$` in the restriction where you want it to appear.
+this, put the macro `$user.local_name$` in the restriction where you want it to appear.
 
 This can come in handy if you have e.g. an attribute on hosts or services defining which user is responsible for it:
-`_host_deputy=$user:local_name$|_service_deputy=$user:local_name$`
+`_host_deputy=$user.local_name$|_service_deputy=$user.local_name$`
+
+> Please note that since version 2.9 the use of `user.local_name` instead of `user:local_name` is supported and
+> recommended. `user:local_name` is deprecated and will be removed in version 2.11.
 
 ### Filter Expressions
 

doc/80-Upgrading.md

@@ -10,6 +10,8 @@ v2.6 to v2.8 requires to follow the instructions for v2.7 too.
 * Support for EOL PHP versions (5.6, 7.0, 7.1 and 7.2) will be removed with version 2.11
 * Support for Internet Explorer will be completely removed with version 2.11
   * New features after v2.9 will already not (necessarily) be available in Internet Explorer
+* `user.local_name` replaces the `user:local_name` macro in restrictions, and the latter will be removed with
+  version 2.11
 
 ## Upgrading to Icinga Web 2 2.8.x
 

library/Icinga/Authentication/AdmissionLoader.php

@@ -204,7 +204,14 @@ class AdmissionLoader
 
                     $roleRestrictions = $role->getRestrictions();
                     foreach ($roleRestrictions as $name => & $restriction) {
-                        $restriction = str_replace('$user:local_name$', $user->getLocalUsername(), $restriction);
+                        // TODO(el): user.local_name is supported since version 2.9.
+                        // and therefore user:local_name is deprecated.
+                        // The latter will be removed in version 2.11.
+                        $restriction = str_replace(
+                            ['$user.local_name$', '$user:local_name$'],
+                            $user->getLocalUsername(),
+                            $restriction
+                        );
                         $restrictions[$name][] = $restriction;
                     }
 

library/Icinga/Web/Navigation/NavigationItem.php

@@ -4,6 +4,7 @@
 namespace Icinga\Web\Navigation;
 
 use Exception;
+use Icinga\Authentication\Auth;
 use InvalidArgumentException;
 use IteratorAggregate;
 use Icinga\Application\Icinga;
@@ -601,12 +602,15 @@ class NavigationItem implements IteratorAggregate
     public function setUrl($url)
     {
         if (is_string($url)) {
-            $url = Url::fromPath($url);
-        } elseif (! $url instanceof Url) {
+            $url = Url::fromPath($this->resolveMacros($url));
+        } elseif ($url instanceof Url) {
+            $url = Url::fromPath($this->resolveMacros($url->getAbsoluteUrl()));
+        } else {
             throw new InvalidArgumentException('Argument $url must be of type string or Url');
         }
 
         $this->url = $url;
+
         return $this;
     }
 
@@ -915,4 +919,28 @@ class NavigationItem implements IteratorAggregate
             return IcingaException::describe($e);
         }
     }
+
+    /**
+     * Resolve all macros in the given URL
+     *
+     * @param string $url
+     *
+     * @return  string
+     */
+    protected function resolveMacros($url)
+    {
+        if (strpos($url, '$') === false) {
+            return $url;
+        }
+
+        $macros = [];
+        if (Auth::getInstance()->isAuthenticated()) {
+            $macros['$user.local_name$'] = Auth::getInstance()->getUser()->getLocalUsername();
+        }
+        if (! empty($macros)) {
+            $url = str_replace(array_keys($macros), array_values($macros), $url);
+        }
+
+        return $url;
+    }
 }