[permissionmanager] Implement permissions:

Permissinmanager is now protected by permissions.
In order to prevent complete lockout, the user with
userid == 1 will always be able to edit and assign permissions.
(TODO: Communicate this somehow)

16 files changed, 164 insertions, 50 deletions

diff --git a/inc/permission.inc.php b/inc/permission.inc.php
index e61c7423..aaef6ba6 100644
--- a/inc/permission.inc.php
+++ b/inc/permission.inc.php
@@ -33,7 +33,7 @@ class Permission
 			}
 			$temp =& $array;
 			foreach (explode('.', $perm) as $sub) {
-				if (empty($sub))
+				if (empty($sub) || $sub === '*')
 					continue;
 				$temp =& $temp[$sub];
 			}
diff --git a/modules-available/permissionmanager/inc/getpermissiondata.inc.php b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
index dd100d42..496c8224 100644
--- a/modules-available/permissionmanager/inc/getpermissiondata.inc.php
+++ b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
@@ -3,6 +3,9 @@
 class GetPermissionData
 {
 
+	const WITH_USER_COUNT = 1;
+	const WITH_LOCATION_COUNT = 2;
+
 	/**
 	 * Get data for all users.
 	 *
@@ -64,11 +67,26 @@ class GetPermissionData
 	/**
 	 * Get all roles.
 	 *
+	 * @param int $flags Bitmask specifying additional data to fetch (WITH_* constants of this class)
 	 * @return array array roles (each with roleid and rolename)
 	 */
-	public static function getRoles()
+	public static function getRoles($flags = 0)
 	{
-		return Database::queryAll("SELECT roleid, rolename FROM role ORDER BY rolename ASC");
+		$cols = $joins = '';
+		if ($flags & self::WITH_USER_COUNT) {
+			$cols .= ', Count(DISTINCT rxu.userid) AS users';
+			$joins .= ' LEFT JOIN user_x_role rxu ON (r.roleid = rxu.roleid)';
+		}
+		if ($flags & self::WITH_LOCATION_COUNT) {
+			$cols .= ', Count(DISTINCT rxl.locationid) AS locations';
+			$joins .= ' LEFT JOIN role_x_location rxl ON (r.roleid = rxl.roleid)';
+		}
+		if (!empty($joins)) {
+			$joins .= ' GROUP BY r.roleid';
+		}
+		return Database::queryAll("SELECT r.roleid, r.rolename $cols FROM role r
+			$joins
+			ORDER BY rolename ASC");
 	}
 
 	/**
diff --git a/modules-available/permissionmanager/inc/permissionutil.inc.php b/modules-available/permissionmanager/inc/permissionutil.inc.php
index b4d54055..bc42c5a0 100644
--- a/modules-available/permissionmanager/inc/permissionutil.inc.php
+++ b/modules-available/permissionmanager/inc/permissionutil.inc.php
@@ -53,6 +53,9 @@ class PermissionUtil
 		$permissionid = strtolower($permissionid);
 		self::validatePermission($permissionid);
 		$parts = explode('.', $permissionid);
+		// Special case: To prevent lockout, userid === 1 always has permissionmanager.*
+		if ($parts[0] === 'permissionmanager' && User::getId() === 1)
+			return true;
 		// Limit query to first part of permissionid, which is always the module id
 		$prefix = $parts[0] . '.%';
 		if (is_null($locationid)) {
@@ -103,21 +106,26 @@ class PermissionUtil
 		$permissionid = strtolower($permissionid);
 		self::validatePermission($permissionid);
 		$parts = explode('.', $permissionid);
-		// Limit query to first part of permissionid, which is always the module id
-		$prefix = $parts[0] . '.%';
-		$res = Database::simpleQuery("SELECT permissionid, locationid FROM role_x_permission
-					INNER JOIN user_x_role USING (roleid)
-					INNER JOIN role_x_location USING (roleid)
-					WHERE user_x_role.userid = :userid AND (permissionid LIKE :prefix OR permissionid LIKE '*')",
-			compact('userid', 'prefix'));
+		// Special case: To prevent lockout, userid === 1 always has permissionmanager.*
+		if ($parts[0] === 'permissionmanager' && User::getId() === 1) {
+			$allowedLocations = [true];
+		} else {
+			// Limit query to first part of permissionid, which is always the module id
+			$prefix = $parts[0] . '.%';
+			$res = Database::simpleQuery("SELECT permissionid, locationid FROM role_x_permission
+						INNER JOIN user_x_role USING (roleid)
+						INNER JOIN role_x_location USING (roleid)
+						WHERE user_x_role.userid = :userid AND (permissionid LIKE :prefix OR permissionid LIKE '*')",
+				compact('userid', 'prefix'));
 
-		// Gather locationid from relevant rows
-		self::makeComparisonVariants($parts, $compare, $wildcard, $wclen);
-		$allowedLocations = array();
-		while ($row = $res->fetch(PDO::FETCH_ASSOC)) {
-			if (in_array($row['permissionid'], $compare, true)
+			// Gather locationid from relevant rows
+			self::makeComparisonVariants($parts, $compare, $wildcard, $wclen);
+			$allowedLocations = array();
+			while ($row = $res->fetch(PDO::FETCH_ASSOC)) {
+				if (in_array($row['permissionid'], $compare, true)
 					|| ($wildcard !== false && strncmp($row['permissionid'], $wildcard, $wclen) === 0)) {
-				$allowedLocations[(int)$row['locationid']] = true;
+					$allowedLocations[(int)$row['locationid']] = true;
+				}
 			}
 		}
 		$locations = Location::getTree();
diff --git a/modules-available/permissionmanager/lang/de/permissions.json b/modules-available/permissionmanager/lang/de/permissions.json
new file mode 100644
index 00000000..444c1e8c
--- /dev/null
+++ b/modules-available/permissionmanager/lang/de/permissions.json
@@ -0,0 +1,7 @@
+{
+    "locations.view": "Orte mit zugewiesenen Rollen sehen.",
+    "roles.edit": "Rollen bearbeiten.",
+    "roles.view": "Rollen sehen.",
+    "users.edit-roles": "Benutzern Rollen zuweisen oder entziehen.",
+    "users.view": "Benutzer mit zugewiesenen Rolen sehen."
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/de/template-tags.json b/modules-available/permissionmanager/lang/de/template-tags.json
index 2ec25b37..52073dee 100644
--- a/modules-available/permissionmanager/lang/de/template-tags.json
+++ b/modules-available/permissionmanager/lang/de/template-tags.json
@@ -1,18 +1,20 @@
 {
     "lang_addRole": "Rollen erteilen",
     "lang_addRoleHeading": "Neue Rolle hinzuf\u00fcgen",
-    "lang_deleteCheck": "Sind Sie sich sicher, dass Sie diese Rolle l\u00f6schen wollen?",
     "lang_editRoleHeading": "Rolle bearbeiten",
     "lang_locationAwareDesc": "Berechtigungen mit diesem Symbol k\u00f6nnen auf bestimmte R\u00e4ume\/Orte beschr\u00e4nkt werden. Alle anderen Berechtigungen sind unabh\u00e4ngig von den f\u00fcr diese Rolle ausgew\u00e4hlten Orten.",
     "lang_locations": "R\u00e4ume",
     "lang_moduleName": "Rechtemanager",
     "lang_name": "Name",
     "lang_newRole": "Rolle anlegen",
+    "lang_numAssignedUsers": "Benutzer mit dieser Rolle",
     "lang_permissions": "Rechte",
     "lang_removeRole": "Rollen entziehen",
+    "lang_roleDeleteConfirm": "Sind Sie sich sicher, dass Sie diese Rolle l\u00f6schen m\u00f6chten? Benutzer, denen diese Rolle zugewiesen ist, werden die entsprechenden Berechtigungen verlieren.",
     "lang_roles": "Rollen",
     "lang_searchPlaceholder": "Nach Rollen suchen...",
     "lang_selected": "ausgew\u00e4hlte",
     "lang_selectizePlaceholder": "Nach Rollen filtern...",
-    "lang_users": "Nutzer"
+    "lang_users": "Nutzer",
+    "lang_view": "Anzeigen"
 }
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/en/permissions.json b/modules-available/permissionmanager/lang/en/permissions.json
new file mode 100644
index 00000000..9f7263db
--- /dev/null
+++ b/modules-available/permissionmanager/lang/en/permissions.json
@@ -0,0 +1,7 @@
+{
+    "locations.view": "See locations with assigned roles.",
+    "roles.edit": "Edit roles.",
+    "roles.view": "Show roles.",
+    "users.edit-roles": "Assign or remove roles from users.",
+    "users.view": "See users with assigned roles."
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/en/template-tags.json b/modules-available/permissionmanager/lang/en/template-tags.json
index cef23422..b7a1d77a 100644
--- a/modules-available/permissionmanager/lang/en/template-tags.json
+++ b/modules-available/permissionmanager/lang/en/template-tags.json
@@ -1,18 +1,20 @@
 {
     "lang_addRole": "Grant Roles",
     "lang_addRoleHeading": "Add new role",
-    "lang_deleteCheck": "Are you sure you want to delete this role?",
     "lang_editRoleHeading": "Edit role",
     "lang_locationAwareDesc": "Permissions with this symbol can be restricted to certain locations. All other permissions are independent of the locations selected for this role.",
     "lang_locations": "Locations",
     "lang_moduleName": "Permission Manager",
     "lang_name": "Name",
     "lang_newRole": "New Role",
+    "lang_numAssignedUsers": "Users with this role",
     "lang_permissions": "Permissions",
     "lang_removeRole": "Revoke Roles",
+    "lang_roleDeleteConfirm": "Are you sure you want to delete this role? Users currently assigned to this role will lose the according permissions.",
     "lang_roles": "Roles",
     "lang_searchPlaceholder": "Search for roles...",
     "lang_selected": "selected",
     "lang_selectizePlaceholder": "Filter for roles...",
-    "lang_users": "Users"
+    "lang_users": "Users",
+    "lang_view": "View"
 }
\ No newline at end of file
diff --git a/modules-available/permissionmanager/page.inc.php b/modules-available/permissionmanager/page.inc.php
index 1c2d56bf..a78f935f 100644
--- a/modules-available/permissionmanager/page.inc.php
+++ b/modules-available/permissionmanager/page.inc.php
@@ -17,17 +17,21 @@ class Page_PermissionManager extends Page
 
 		$action = Request::any('action', 'show', 'string');
 		if ($action === 'addRoleToUser') {
+			User::assertPermission('users.edit-roles');
 			$users = Request::post('users', '');
 			$roles = Request::post('roles', '');
 			PermissionDbUpdate::addRoleToUser($users, $roles);
 		} elseif ($action === 'removeRoleFromUser') {
+			User::assertPermission('users.edit-roles');
 			$users = Request::post('users', '');
 			$roles = Request::post('roles', '');
 			PermissionDbUpdate::removeRoleFromUser($users, $roles);
 		} elseif ($action === 'deleteRole') {
+			User::assertPermission('roles.edit');
 			$id = Request::post('deleteId', false, 'string');
 			PermissionDbUpdate::deleteRole($id);
 		} elseif ($action === 'saveRole') {
+			User::assertPermission('roles.edit');
 			$roleID = Request::post("roleid", false);
 			$rolename = Request::post("rolename");
 			$locations = self::processLocations(Request::post("locations"));
@@ -44,33 +48,51 @@ class Page_PermissionManager extends Page
 	 */
 	protected function doRender()
 	{
-		$show = Request::get("show", "roles");
+		$show = Request::get("show", false, 'string');
+
+		if ($show === false) {
+			foreach (['roles', 'users', 'locations'] as $show) {
+				if (User::hasPermission($show . '.*'))
+					break;
+			}
+		}
 
 		// switch between tables, but always show menu to switch tables
 		// get menu button colors
-		$buttonColors = array();
+		$data = array();
 		if ($show === "roleEditor") {
-			$buttonColors['groupClass'] = 'slx-fade';
-			$buttonColors['rolesButtonClass'] = 'active';
+			$data['groupClass'] = 'btn-group-muted';
+			$data['rolesButtonClass'] = 'active';
 		} else {
-			$buttonColors[$show . 'ButtonClass'] = 'active';
+			$data[$show . 'ButtonClass'] = 'active';
 		}
+		Permission::addGlobalTags($data['perms'], null, ['roles.*', 'users.*', 'locations.*']);
 
-		Render::addtemplate('header-menu', $buttonColors);
+		Render::addtemplate('header-menu', $data);
 
 		if ($show === "roles") {
-			$data = array("roles" => GetPermissionData::getRoles());
+			User::assertPermission('roles.*');
+			$data = array("roles" => GetPermissionData::getRoles(GetPermissionData::WITH_USER_COUNT));
+			Permission::addGlobalTags($data['perms'], null, ['roles.edit']);
 			Render::addTemplate('rolestable', $data);
 		} elseif ($show === "users") {
-			$data = array("user" => GetPermissionData::getUserData(), "allroles" => GetPermissionData::getRoles());
+			User::assertPermission('users.*');
+			$data = array("user" => GetPermissionData::getUserData());
+			if (User::hasPermission('users.edit-roles')) {
+				$data['allroles'] = GetPermissionData::getRoles();
+			}
+			Permission::addGlobalTags($data['perms'], null, ['users.edit-roles']);
 			Render::addTemplate('role-filter-selectize', $data);
 			Render::addTemplate('userstable', $data);
 		} elseif ($show === "locations") {
+			User::assertPermission('locations.*');
 			$data = array("location" => GetPermissionData::getLocationData(), "allroles" => GetPermissionData::getRoles());
 			Render::addTemplate('role-filter-selectize', $data);
 			Render::addTemplate('locationstable', $data);
 		} elseif ($show === "roleEditor") {
+			User::assertPermission('roles.*');
 			$data = array("cancelShow" => Request::get("cancel", "roles"));
+			Permission::addGlobalTags($data['perms'], null, ['roles.edit']);
 
 			$selectedPermissions = array();
 			$selectedLocations = array();
@@ -83,8 +105,10 @@ class Page_PermissionManager extends Page
 				$selectedLocations = $roleData["locations"];
 			}
 
-			$data["permissionHTML"] = self::generatePermissionHTML(PermissionUtil::getPermissions(), $selectedPermissions);
-			$data["locationHTML"] = self::generateLocationHTML(Location::getTree(), $selectedLocations);
+			$data["permissionHTML"] = self::generatePermissionHTML(PermissionUtil::getPermissions(), $selectedPermissions,
+				false, '', ['perms' => $data['perms']]);
+			$data["locationHTML"] = self::generateLocationHTML(Location::getTree(), $selectedLocations,
+				false, '', ['perms' => $data['perms']]);
 
 			Render::addTemplate('roleeditor', $data);
 		}
@@ -99,7 +123,7 @@ class Page_PermissionManager extends Page
 	 * @param string $permString the prefix permission string with which all permissions in the permission tree should start
 	 * @return string generated html code
 	 */
-	private static function generatePermissionHTML($permissions, $selectedPermissions = array(), $selectAll = false, $permString = "")
+	private static function generatePermissionHTML($permissions, $selectedPermissions = array(), $selectAll = false, $permString = "", $tags = [])
 	{
 		$res = "";
 		$toplevel = $permString == "";
@@ -132,12 +156,12 @@ class Page_PermissionManager extends Page
 				"toplevel" => $toplevel,
 				"checkboxname" => "permissions",
 				"selected" => $selected,
-				"HTML" => $leaf ? "" : self::generatePermissionHTML($v, $selectedPermissions, $selected, $nextPermString),
+				"HTML" => $leaf ? "" : self::generatePermissionHTML($v, $selectedPermissions, $selected, $nextPermString, $tags),
 			);
 			if ($leaf) {
 				$data += $v;
 			}
-			$res .= Render::parse("treenode", $data);
+			$res .= Render::parse("treenode", $data + $tags);
 		}
 		if ($toplevel) {
 			$res = Render::parse("treepanel",
@@ -145,7 +169,7 @@ class Page_PermissionManager extends Page
 					"name" => Dictionary::translateFile("template-tags", "lang_permissions"),
 					"checkboxname" => "permissions",
 					"selected" => $selectAll,
-					"HTML" => $res));
+					"HTML" => $res) + $tags);
 		}
 		return $res;
 	}
@@ -159,7 +183,7 @@ class Page_PermissionManager extends Page
 	 * @param array $toplevel true if the location tree are the children of the root location, false if not
 	 * @return string generated html code
 	 */
-	private static function generateLocationHTML($locations, $selectedLocations = array(), $selectAll = false, $toplevel = true)
+	private static function generateLocationHTML($locations, $selectedLocations = array(), $selectAll = false, $toplevel = true, $tags = [])
 	{
 		$res = "";
 		if ($toplevel && in_array(0, $selectedLocations)) {
@@ -174,7 +198,8 @@ class Page_PermissionManager extends Page
 					"checkboxname" => "locations",
 					"selected" => $selected,
 					"HTML" => array_key_exists("children", $location) ?
-						self::generateLocationHTML($location["children"], $selectedLocations, $selected, false) : ""));
+						self::generateLocationHTML($location["children"], $selectedLocations, $selected, false, $tags) : "")
+				+ $tags);
 		}
 		if ($toplevel) {
 			$res = Render::parse("treepanel",
@@ -182,7 +207,7 @@ class Page_PermissionManager extends Page
 					"name" => Dictionary::translateFile("template-tags", "lang_locations"),
 					"checkboxname" => "locations",
 					"selected" => $selectAll,
-					"HTML" => $res));
+					"HTML" => $res) + $tags);
 		}
 		return $res;
 	}
diff --git a/modules-available/permissionmanager/permissions/permissions.json b/modules-available/permissionmanager/permissions/permissions.json
new file mode 100644
index 00000000..3981a2c3
--- /dev/null
+++ b/modules-available/permissionmanager/permissions/permissions.json
@@ -0,0 +1,17 @@
+{
+	"roles.view": {
+		"location-aware": false
+	},
+	"roles.edit": {
+		"location-aware": false
+	},
+	"users.view": {
+		"location-aware": false
+	},
+	"users.edit-roles": {
+		"location-aware": false
+	},
+	"locations.view": {
+		"location-aware": false
+	}
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/style.css b/modules-available/permissionmanager/style.css
index 8285fdd2..6169b26f 100644
--- a/modules-available/permissionmanager/style.css
+++ b/modules-available/permissionmanager/style.css
@@ -55,3 +55,7 @@ td > .label {
         column-count: 3;
     }
 }
+
+.btn-group-muted > button {
+    color: #aaa;
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/templates/header-menu.html b/modules-available/permissionmanager/templates/header-menu.html
index ce31d237..91bfa3af 100644
--- a/modules-available/permissionmanager/templates/header-menu.html
+++ b/modules-available/permissionmanager/templates/header-menu.html
@@ -4,17 +4,17 @@
 			<input type="hidden" name="do" value="permissionmanager">
 
 			<div class="btn-group {{groupClass}}">
-				<button class="btn btn-default {{rolesButtonClass}}" type="submit" name="show" value="roles">
+				<button class="btn btn-default {{rolesButtonClass}}" type="submit" name="show" value="roles" {{perms.roles.disabled}}>
 					<span class="glyphicon glyphicon-education"></span>
 					{{lang_roles}}
 				</button>
 
-				<button class="btn btn-default {{usersButtonClass}}" type="submit" name="show" value="users">
+				<button class="btn btn-default {{usersButtonClass}}" type="submit" name="show" value="users" {{perms.users.disabled}}>
 					<span class="glyphicon glyphicon-user"></span>
 					{{lang_users}}
 				</button>
 
-				<button class="btn btn-default {{locationsButtonClass}}" type="submit" name="show" value="locations">
+				<button class="btn btn-default {{locationsButtonClass}}" type="submit" name="show" value="locations" {{perms.locations.disabled}}>
 					<span class="glyphicon glyphicon-home"></span>
 					{{lang_locations}}
 				</button>
diff --git a/modules-available/permissionmanager/templates/roleeditor.html b/modules-available/permissionmanager/templates/roleeditor.html
index d50f2145..8524427b 100644
--- a/modules-available/permissionmanager/templates/roleeditor.html
+++ b/modules-available/permissionmanager/templates/roleeditor.html
@@ -22,7 +22,10 @@
 
 	<div class="pull-right">
 		<a href="?do=permissionmanager&amp;show={{cancelShow}}" class="btn btn-default">{{lang_cancel}}</a>
-		<button type="submit" class="btn btn-primary"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
+		<button type="submit" class="btn btn-primary" {{perms.roles.edit.disabled}}>
+			<span class="glyphicon glyphicon-floppy-disk"></span>
+			{{lang_save}}
+		</button>
 	</div>
 	<ul class="nav nav-tabs text-center" role="tablist">
 		<li role="presentation" class="active"><a href="#permissions" role="tab" data-toggle="tab">{{lang_permissions}}</a></li>
diff --git a/modules-available/permissionmanager/templates/rolestable.html b/modules-available/permissionmanager/templates/rolestable.html
index 944ab3ae..9ba8d85c 100644
--- a/modules-available/permissionmanager/templates/rolestable.html
+++ b/modules-available/permissionmanager/templates/rolestable.html
@@ -11,7 +11,14 @@
 				<thead>
 					<tr>
 						<th data-sort="string">{{lang_roles}}</th>
-						<th class="text-center slx-smallcol">{{lang_edit}}</th>
+						<th class="text-center slx-smallcol">
+							{{#perms.roles.edit.disabled}}
+							{{lang_view}}
+							{{/perms.roles.edit.disabled}}
+							{{^perms.roles.edit.disabled}}
+							{{lang_edit}}
+							{{/perms.roles.edit.disabled}}
+						</th>
 						<th class="text-center slx-smallcol">{{lang_delete}}</th>
 					</tr>
 				</thead>
@@ -24,7 +31,9 @@
 							<a class="btn btn-xs btn-primary" href="?do=permissionmanager&show=roleEditor&roleid={{roleid}}"><span class="glyphicon glyphicon-edit"></span></a>
 						</td>
 						<td class="text-center">
-							<a class="btn btn-xs btn-danger" href="#deleteModal" data-toggle="modal" data-target="#deleteModal" onclick="deleteRole('{{roleid}}')"><span class="glyphicon glyphicon-trash"></span></a>
+							<button type="button" class="btn btn-xs btn-danger" data-toggle="modal" data-target="#deleteModal" onclick="deleteRole('{{roleid}}', '{{users}}')" {{perms.roles.edit.disabled}}>
+								<span class="glyphicon glyphicon-trash"></span>
+							</button>
 						</td>
 					</tr>
 				{{/roles}}
@@ -42,10 +51,11 @@
 					<h4 class="modal-title" id="myModalLabel">{{lang_delete}}</h4>
 				</div>
 				<div class="modal-body">
-					{{lang_deleteCheck}}
+					<p>{{lang_roleDeleteConfirm}}</p>
+					{{lang_numAssignedUsers}}: <span id="delete-role-users"></span>
 				</div>
 				<div class="modal-footer">
-					<input type="hidden" id="deleteId" name="deleteId" value=""/>
+					<input type="hidden" id="delete-role-id" name="deleteId" value="">
 					<button type="button" class="btn btn-default" data-dismiss="modal">{{lang_cancel}}</button>
 					<button type="submit" name="action" value="deleteRole" class="btn btn-danger"><span class="glyphicon glyphicon-trash"></span> {{lang_delete}}</button>
 				</div>
@@ -56,12 +66,13 @@
 </form>
 
 <div class="text-right">
-	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
+	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success {{perms.roles.edit.disabled}}"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
 </div>
 
 <script>
-	function deleteRole($roleid) {
-		$(".modal-footer #deleteId").val($roleid);
+	function deleteRole(roleid, users) {
+		$("#delete-role-id").val(roleid);
+		$("#delete-role-users").text(users);
 	}
 
 	function searchFieldFunction() {
diff --git a/modules-available/permissionmanager/templates/treenode.html b/modules-available/permissionmanager/templates/treenode.html
index a4a3d7b5..f8ee3df5 100644
--- a/modules-available/permissionmanager/templates/treenode.html
+++ b/modules-available/permissionmanager/templates/treenode.html
@@ -1,7 +1,7 @@
 {{#toplevel}}<ul>{{/toplevel}}
 <li {{#description}}title="{{description}}" data-toggle="tooltip" data-placement="left"{{/description}}>
 	<div class='checkbox'>
-		<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" {{#selected}}checked{{/selected}}>
+		<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" {{#selected}}checked{{/selected}} {{edit_disabled}} {{perms.roles.edit.disabled}}>
 		<label for="{{id}}">
 			{{name}}
 			{{#location-aware}}<span class="glyphicon glyphicon-home text-muted"></span>{{/location-aware}}
diff --git a/modules-available/permissionmanager/templates/treepanel.html b/modules-available/permissionmanager/templates/treepanel.html
index cda848a0..eccecb58 100644
--- a/modules-available/permissionmanager/templates/treepanel.html
+++ b/modules-available/permissionmanager/templates/treepanel.html
@@ -1,7 +1,7 @@
 <div class="panel panel-primary tree-panel">
 	<div class="panel-heading">
 		<div class="checkbox">
-			<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" class="master-checkbox" {{#selected}}checked{{/selected}}>
+			<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" class="master-checkbox" {{#selected}}checked{{/selected}} {{perms.roles.edit.disabled}}>
 			<label for="{{id}}">{{name}}</label>
 		</div>
 	</div>
diff --git a/modules-available/roomplanner/permissions/permissions.json b/modules-available/roomplanner/permissions/permissions.json
new file mode 100644
index 00000000..f7bc3479
--- /dev/null
+++ b/modules-available/roomplanner/permissions/permissions.json
@@ -0,0 +1,10 @@
+{
+	"compilerOptions": {
+		"module": "commonjs",
+		"target": "es5",
+		"sourceMap": true
+	},
+	"exclude": [
+		"node_modules"
+	]
+}
\ No newline at end of file