#19 - permissions check in Persons

modules/boonex/persons/classes/BxPersonsFormPerson.php

@@ -93,7 +93,7 @@ class BxPersonsFormPerson extends BxTemplFormView {
 
     function deleteGhost ($iFileId, $iContentId, $isRestoreOriginal = true) {
 
-        if (CHECK_ACTION_RESULT_ALLOWED != ($sMsg = $this->_oModule->isAllowedAdd()))
+        if (CHECK_ACTION_RESULT_ALLOWED !== ($sMsg = $this->_oModule->isAllowedAdd()))
             return $sMsg;
 
         bx_import('BxDolStorage');
@@ -111,7 +111,7 @@ class BxPersonsFormPerson extends BxTemplFormView {
 
     function discardGhost ($iFileId, $iContentId, $isRestoreOriginal = true) {
 
-        if (CHECK_ACTION_RESULT_ALLOWED != ($sMsg = $this->_oModule->isAllowedAdd()))
+        if (CHECK_ACTION_RESULT_ALLOWED !== ($sMsg = $this->_oModule->isAllowedAdd()))
             return $sMsg;
 
         bx_import('BxDolStorage');

modules/boonex/persons/classes/BxPersonsMenuViewPerson.php

@@ -17,14 +17,15 @@ bx_import('BxTemplMenu');
 class BxPersonsMenuViewPerson extends BxTemplMenu {
 
     protected $_aContentInfo;
+    protected $_oModule;
 
     public function __construct($aObject, $oTemplate = false) {
         parent::__construct($aObject, $oTemplate);
 
         $iContentId = bx_process_input(bx_get('id'), BX_DATA_INT);
 
-        $oModuleMain = BxDolModule::getInstance('bx_persons');
-        $this->_aContentInfo = $oModuleMain->_oDb->getContentInfoById($iContentId);
+        $this->_oModule = BxDolModule::getInstance('bx_persons');
+        $this->_aContentInfo = $this->_oModule->_oDb->getContentInfoById($iContentId);
         if ($this->_aContentInfo)
             $this->addMarkers(array('content_id' => $this->_aContentInfo['id']));
     }
@@ -36,23 +37,22 @@ class BxPersonsMenuViewPerson extends BxTemplMenu {
      */ 
     protected function _isVisible ($a) {
 
-        bx_import('BxDolProfile');
-        $oAccountProfile = BxDolProfile::getInstanceAccountProfile();
-        $iAccountProfileId = $oAccountProfile->id();
-
-        // TODO: separate checking for every menu item
-
-        // all links are visible for owner
-        if ($this->_aContentInfo['author'] == $iAccountProfileId)
+        $sFuncCheckAccess = false;
+        switch ($a['name']) {
+            case 'view-persons-profile':
+                $sFuncCheckAccess = 'isAllowedView';
+                break;
+            case 'edit-persons-profile':
+                $sFuncCheckAccess = 'isAllowedEdit';
+                break;
+            case 'delete-persons-profile':
+                $sFuncCheckAccess = 'isAllowedDelete';
+                break;
+        }
+
+        if ($sFuncCheckAccess && CHECK_ACTION_RESULT_ALLOWED === $this->_oModule->$sFuncCheckAccess($this->_aContentInfo))
             return true;
 
-        // all links are visible for admin/moderator
-        $aCheck = checkActionModule($iAccountProfileId, 'edit any person profile', 'bx_persons'); 
-        if ($aCheck[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED)
-            return true;
-
-        return false; // TODO: since default visible settings are overriden - hide it from builder.
-
         // default visible settings
         bx_import('BxDolAcl');
         return BxDolAcl::getInstance()->isMemberLevelInSet($a['visible_for_levels']);

modules/boonex/persons/classes/BxPersonsModule.php

@@ -20,10 +20,12 @@ bx_import ('BxDolAcl');
 class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
 
     protected $_iProfileId;
+    protected $_iAccountId;
 
     function __construct(&$aModule) {
         parent::__construct($aModule);
         $this->_iProfileId = bx_get_logged_profile_id();
+        $this->_iAccountId = getLoggedId();
     }
 
     // ====== SERVICE METHODS
@@ -188,7 +190,7 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
             $sValue = uri2title($sValue);
 */
 
-        if (CHECK_ACTION_RESULT_ALLOWED != $this->isAllowedBrowse()) {
+        if (CHECK_ACTION_RESULT_ALLOWED !== $this->isAllowedBrowse()) {
             $this->_oTemplate->displayAccessDenied ();
             return;
         }
@@ -254,7 +256,7 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
     function _checkModeratorAccess ($isPerformAction = false) {
         // check moderator ACL
         $aCheck = checkActionModule($this->_iProfileId, 'edit any person profile', $this->getName(), $isPerformAction); 
-        return $aCheck[CHECK_ACTION_RESULT] == CHECK_ACTION_RESULT_ALLOWED;
+        return $aCheck[CHECK_ACTION_RESULT] === CHECK_ACTION_RESULT_ALLOWED;
     }
 
     /**
@@ -268,7 +270,7 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
 
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'view person profile', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
+        if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)
             return $aCheck[CHECK_ACTION_MESSAGE];
 
         // TODO: check privacy
@@ -289,7 +291,7 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
     function isAllowedAdd ($isPerformAction = false) {
         // check ACL
         $aCheck = checkActionModule($this->_iProfileId, 'create person profile', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
+        if ($aCheck[CHECK_ACTION_RESULT] !== CHECK_ACTION_RESULT_ALLOWED)
             return $aCheck[CHECK_ACTION_MESSAGE];
         return CHECK_ACTION_RESULT_ALLOWED;
     }
@@ -298,9 +300,16 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
      * @return CHECK_ACTION_RESULT_ALLOWED if access is granted or error message if access is forbidden. 
      */
     function isAllowedEdit ($aDataEntry, $isPerformAction = false) {
-        // moderator and owner always have access
-        if ($aDataEntry[BxPersonsConfig::$FIELD_AUTHOR] == $this->_iProfileId || $this->_checkModeratorAccess($isPerformAction))
+        // moderator always has access
+        if ($this->_checkModeratorAccess($isPerformAction))
             return CHECK_ACTION_RESULT_ALLOWED;
+
+        // owner (checked by account! not as profile as ususal) always have access
+        bx_import('BxDolProfile');
+        $oProfileAurhor = BxDolProfile::getInstance($aDataEntry[BxPersonsConfig::$FIELD_AUTHOR]);
+        if ($oProfileAurhor->getAccountId() == $this->_iAccountId)
+            return CHECK_ACTION_RESULT_ALLOWED;
+
         return _t('_sys_txt_access_denied');
     }
 
@@ -312,12 +321,15 @@ class BxPersonsModule extends BxDolModule implements iBxDolProfileService {
         if ($this->_checkModeratorAccess($isPerformAction))
             return CHECK_ACTION_RESULT_ALLOWED;
 
-        // check ACL
+        // check ACL and owner (checked by account! not as profile as ususal)
+        bx_import('BxDolProfile');
+        $oProfileAurhor = BxDolProfile::getInstance($aDataEntry[BxPersonsConfig::$FIELD_AUTHOR]);
+
         $aCheck = checkActionModule($this->_iProfileId, 'delete person profile', $this->getName(), $isPerformAction);
-        if ($aCheck[CHECK_ACTION_RESULT] != CHECK_ACTION_RESULT_ALLOWED)
-            return $aCheck[CHECK_ACTION_MESSAGE];
+        if ($oProfileAurhor->getAccountId() == $this->_iAccountId && $aCheck[CHECK_ACTION_RESULT] === CHECK_ACTION_RESULT_ALLOWED)
+            return CHECK_ACTION_RESULT_ALLOWED;
 
-        return CHECK_ACTION_RESULT_ALLOWED;
+        return _t('_sys_txt_access_denied');
     }
 
 }

modules/boonex/persons/install/sql/enable.sql

@@ -107,9 +107,9 @@ INSERT INTO `sys_menu_sets`(`set_name`, `module`, `title`, `deletable`) VALUES
 ('bx_persons_view', 'bx_persons', '_bx_persons_menu_set_title_view_person', 0);
 
 INSERT INTO `sys_menu_items`(`set_name`, `module`, `name`, `title_system`, `title`, `link`, `onclick`, `target`, `icon`, `submenu_object`, `visible_for_levels`, `active`, `copyable`, `order`) VALUES 
-('bx_persons_view', 'bx_persons', 'view-persons-profile', '_bx_persons_menu_item_title_system_view_person', '_bx_persons_menu_item_title_view_person', 'page.php?i=view-persons-profile&id={content_id}', '', '', 'user', '', 2147483647, 1, 0, 0),
-('bx_persons_view', 'bx_persons', 'edit-persons-profile', '_bx_persons_menu_item_title_system_edit_person', '_bx_persons_menu_item_title_edit_person', 'page.php?i=edit-persons-profile&id={content_id}', '', '', 'pencil', '', 2147483647, 1, 0, 1),
-('bx_persons_view', 'bx_persons', 'delete-persons-profile', '_bx_persons_menu_item_title_system_delete_person', '_bx_persons_menu_item_title_delete_person', 'page.php?i=delete-persons-profile&id={content_id}', '', '', 'remove', '', 2147483647, 1, 0, 2);
+('bx_persons_view', 'bx_persons', 'view-persons-profile', '_bx_persons_menu_item_title_system_view_person', '_bx_persons_menu_item_title_view_person', 'page.php?i=view-persons-profile&id={content_id}', '', '', 'user', '', 0, 1, 0, 0),
+('bx_persons_view', 'bx_persons', 'edit-persons-profile', '_bx_persons_menu_item_title_system_edit_person', '_bx_persons_menu_item_title_edit_person', 'page.php?i=edit-persons-profile&id={content_id}', '', '', 'pencil', '', 0, 1, 0, 1),
+('bx_persons_view', 'bx_persons', 'delete-persons-profile', '_bx_persons_menu_item_title_system_delete_person', '_bx_persons_menu_item_title_delete_person', 'page.php?i=delete-persons-profile&id={content_id}', '', '', 'remove', '', 0, 1, 0, 2);
 
 
 -- ACL