#19 - permissions check in Notes

modules/boonex/notes/classes/BxNotesFormNote.php

@@ -67,7 +67,7 @@ class BxNotesFormNote extends BxTemplFormView {
                 'summary_id' => BxNotesConfig::$FIELD_SUMMARY_ID,
                 'thumb_id' => $aContentInfo[BxNotesConfig::$FIELD_THUMB],
                 'bx_if:set_thumb' => array (
-                    'condition' => CHECK_ACTION_RESULT_ALLOWED == $this->_oModule->isAllowedSetThumb(),
+                    'condition' => CHECK_ACTION_RESULT_ALLOWED === $this->_oModule->isAllowedSetThumb(),
                     'content' => array (
                         'name_thumb' => BxNotesConfig::$FIELD_THUMB,
                     ),
@@ -85,7 +85,7 @@ class BxNotesFormNote extends BxTemplFormView {
         $aValsToAdd[BxNotesConfig::$FIELD_ADDED] = time();
         $aValsToAdd[BxNotesConfig::$FIELD_CHANGED] = time();
 
-        if (CHECK_ACTION_RESULT_ALLOWED == $this->_oModule->isAllowedSetThumb()) {
+        if (CHECK_ACTION_RESULT_ALLOWED === $this->_oModule->isAllowedSetThumb()) {
             $aThumb = isset($_POST[BxNotesConfig::$FIELD_THUMB]) ? bx_process_input ($_POST[BxNotesConfig::$FIELD_THUMB], BX_DATA_INT) : false;
             $aValsToAdd[BxNotesConfig::$FIELD_THUMB] = 0;
             if (!empty($aThumb) && is_array($aThumb) && ($iFileThumb = array_pop($aThumb)))
@@ -101,7 +101,7 @@ class BxNotesFormNote extends BxTemplFormView {
 
         $aValsToAdd[BxNotesConfig::$FIELD_CHANGED] = time();
 
-        if (CHECK_ACTION_RESULT_ALLOWED == $this->_oModule->isAllowedSetThumb()) {
+        if (CHECK_ACTION_RESULT_ALLOWED === $this->_oModule->isAllowedSetThumb()) {
             $aThumb = bx_process_input ($_POST[BxNotesConfig::$FIELD_THUMB], BX_DATA_INT);
             $aValsToAdd[BxNotesConfig::$FIELD_THUMB] = 0;
             if (!empty($aThumb) && is_array($aThumb) && ($iFileThumb = array_pop($aThumb)))

modules/boonex/notes/classes/BxNotesMenuViewNote.php

@@ -31,6 +31,12 @@ class BxNotesMenuViewNote extends BxTemplMenu {
             $this->addMarkers(array('content_id' => $this->_aContentInfo['id']));
     }
 
+    public function getCode () {
+        if (!bx_get_logged_profile_id())
+            return false;
+        return parent::getCode ();
+    }
+
     /**
      * Check if menu items is visible.
      * @param $a menu item array
@@ -44,9 +50,20 @@ class BxNotesMenuViewNote extends BxTemplMenu {
         if ($this->_aContentInfo['author'] == $iProfileId)
             return true;
 
-        // all links are visible for admin/moderator
-        $aCheck = checkActionModule($iProfileId, 'edit any note', 'bx_notes');
-        if ($aCheck[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED)
+        $sFuncCheckAccess = false;
+        switch ($a['name']) {
+            case 'view-note':
+                $sFuncCheckAccess = 'isAllowedView';
+                break;
+            case 'edit-note':
+                $sFuncCheckAccess = 'isAllowedEdit';
+                break;
+            case 'delete-note':
+                $sFuncCheckAccess = 'isAllowedDelete';
+                break;
+        }
+
+        if ($sFuncCheckAccess && CHECK_ACTION_RESULT_ALLOWED === $this->_oModule->$sFuncCheckAccess($this->_aContentInfo))
             return true;
 
         // default visible settings

modules/boonex/notes/classes/BxNotesModule.php

@@ -181,7 +181,7 @@ class BxNotesModule extends BxDolModule {
             $sValue = uri2title($sValue);
 */
 
-        if (CHECK_ACTION_RESULT_ALLOWED != $this->isAllowedBrowse()) {
+        if (CHECK_ACTION_RESULT_ALLOWED !== $this->isAllowedBrowse()) {
             $this->_oTemplate->displayAccessDenied ();
             return;
         }
@@ -221,7 +221,7 @@ class BxNotesModule extends BxDolModule {
     function _checkModeratorAccess ($isPerformAction = false) {
         // check moderator ACnoteL
         $aCheck = checkActionModule($this->_iProfileId, 'edit any note', $this->getName(), $isPerformAction); 
-        return $aCheck[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED;
+        return $aCheck[CHECK_ACTION_RESULT] === CHECK_ACTION_RESULT_ALLOWED;
     }
 
     /**
@@ -235,7 +235,7 @@ class BxNotesModule extends BxDolModule {
 
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'view note', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
+        if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)
             return $aCheck[CHECK_ACTION_MESSAGE];
 
         // TODO: check privacy
@@ -256,7 +256,7 @@ class BxNotesModule extends BxDolModule {
     function isAllowedAdd ($isPerformAction = false) {
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'create note', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
+        if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)
             return $aCheck[CHECK_ACTION_MESSAGE];
         return CHECK_ACTION_RESULT_ALLOWED;
     }
@@ -281,10 +281,10 @@ class BxNotesModule extends BxDolModule {
 
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'delete note', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
-            return $aCheck[CHECK_ACTION_MESSAGE];
+        if ($aDataEntry[BxNotesConfig::$FIELD_AUTHOR] == $this->_iProfileId && $aCheck[CHECK_ACTION_RESULT] === CHECK_ACTION_RESULT_ALLOWED)
+            return CHECK_ACTION_RESULT_ALLOWED;
 
-        return CHECK_ACTION_RESULT_ALLOWED;
+        return _t('_sys_txt_access_denied');
     }
 
     /**
@@ -293,7 +293,7 @@ class BxNotesModule extends BxDolModule {
     function isAllowedSetThumb () {
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'set thumb', $this->getName(), false);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
+        if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)
             return $aCheck[CHECK_ACTION_MESSAGE];
         return CHECK_ACTION_RESULT_ALLOWED;
     }

modules/boonex/notes/install/sql/enable.sql

@@ -120,9 +120,9 @@ INSERT INTO `sys_menu_sets`(`set_name`, `module`, `title`, `deletable`) VALUES
 ('bx_notes_view', 'bx_notes', '_bx_notes_menu_set_title_view_note', 0);
 
 INSERT INTO `sys_menu_items`(`set_name`, `module`, `name`, `title_system`, `title`, `link`, `onclick`, `target`, `icon`, `submenu_object`, `visible_for_levels`, `active`, `copyable`, `order`) VALUES 
-('bx_notes_view', 'bx_notes', 'view-note', '_bx_notes_menu_item_title_system_view_note', '_bx_notes_menu_item_title_view_note', 'page.php?i=view-note&id={content_id}', '', '', 'eye-open', '', 2147483647, 1, 0, 0),
-('bx_notes_view', 'bx_notes', 'edit-note', '_bx_notes_menu_item_title_system_edit_note', '_bx_notes_menu_item_title_edit_note', 'page.php?i=edit-note&id={content_id}', '', '', 'pencil', '', 2147483647, 1, 0, 1),
-('bx_notes_view', 'bx_notes', 'delete-note', '_bx_notes_menu_item_title_system_delete_note', '_bx_notes_menu_item_title_delete_note', 'page.php?i=delete-note&id={content_id}', '', '', 'remove', '', 2147483647, 1, 0, 2);
+('bx_notes_view', 'bx_notes', 'view-note', '_bx_notes_menu_item_title_system_view_note', '_bx_notes_menu_item_title_view_note', 'page.php?i=view-note&id={content_id}', '', '', 'eye-open', '', 0, 1, 0, 0),
+('bx_notes_view', 'bx_notes', 'edit-note', '_bx_notes_menu_item_title_system_edit_note', '_bx_notes_menu_item_title_edit_note', 'page.php?i=edit-note&id={content_id}', '', '', 'pencil', '', 0, 1, 0, 1),
+('bx_notes_view', 'bx_notes', 'delete-note', '_bx_notes_menu_item_title_system_delete_note', '_bx_notes_menu_item_title_delete_note', 'page.php?i=delete-note&id={content_id}', '', '', 'remove', '', 0, 1, 0, 2);
 
 --
 -- Dumping data for 'bx_notes_submenu' menu

template/scripts/BxBaseMenuAction.php

@@ -40,6 +40,8 @@ class BxBaseMenuAction extends BxTemplMenu
 
         $oMenu = BxTemplMenu::getObjectInstance($this->_sMenu);
         $sMenu = $oMenu ? $oMenu->getCode () : '';
+        if (!$sMenu)
+            return false;
 
         $a['popup'] = BxTemplFunctions::getInstance()->transBox('<div class="bx-def-padding bx-def-color-bg-block">' . $sMenu . '</div>');