Merge remote-tracking branch 'origin/permission-manager' into permission-manager

5 files changed, 73 insertions, 64 deletions

diff --git a/modules-available/internetaccess/page.inc.php b/modules-available/internetaccess/page.inc.php
index 89897fa4..a92ba3e3 100644
--- a/modules-available/internetaccess/page.inc.php
+++ b/modules-available/internetaccess/page.inc.php
@@ -15,23 +15,25 @@ class Page_InternetAccess extends Page
 		$action = Request::any('action', 'show');
 
 		if ($action == 'save') {
-			if (isset($_POST['PROXY_CONF'])) {
-				$data = array();
-				foreach (array('PROXY_CONF', 'PROXY_ADDR', 'PROXY_PORT', 'PROXY_USERNAME', 'PROXY_PASSWORD') as $key) {
-					$data[$key] = Request::post($key, '');
-				}
-				if (!FileUtil::arrayToFile(CONFIG_PROXY_CONF, $data)) {
-					Message::addError('main.error-write', CONFIG_PROXY_CONF);
-					Util::redirect();
-				} else {
-					Message::addSuccess('settings-updated');
-					Taskmanager::release(Taskmanager::submit('ReloadProxy'));
-					$taskids = array();
-					Trigger::stopDaemons(NULL, $taskids);
-					$taskids = array();
-					Trigger::startDaemons(NULL, $taskids);
-					Session::set('ia-restart', $taskids);
-					Util::redirect('?do=InternetAccess&show=update');
+			if (User::hasPermission("configuration.safe")) {
+				if (isset($_POST['PROXY_CONF'])) {
+					$data = array();
+					foreach (array('PROXY_CONF', 'PROXY_ADDR', 'PROXY_PORT', 'PROXY_USERNAME', 'PROXY_PASSWORD') as $key) {
+						$data[$key] = Request::post($key, '');
+					}
+					if (!FileUtil::arrayToFile(CONFIG_PROXY_CONF, $data)) {
+						Message::addError('main.error-write', CONFIG_PROXY_CONF);
+						Util::redirect();
+					} else {
+						Message::addSuccess('settings-updated');
+						Taskmanager::release(Taskmanager::submit('ReloadProxy'));
+						$taskids = array();
+						Trigger::stopDaemons(null, $taskids);
+						$taskids = array();
+						Trigger::startDaemons(null, $taskids);
+						Session::set('ia-restart', $taskids);
+						Util::redirect('?do=InternetAccess&show=update');
+					}
 				}
 			}
 		}
diff --git a/modules-available/news/page.inc.php b/modules-available/news/page.inc.php
index 920b9861..5ad79b0e 100644
--- a/modules-available/news/page.inc.php
+++ b/modules-available/news/page.inc.php
@@ -64,20 +64,24 @@ class Page_News extends Page
             $pageType = Request::post('news-type');
 
             if ($pageType == 'news') {
-					if (!$this->saveNews()) {
-						// re-set the fields we got
-						Request::post('news-title') ? $this->newsTitle = Request::post('news-title') : $this->newsTitle = false;
-						Request::post('news-content') ? $this->newsContent = Request::post('news-content') : $this->newsContent = false;
-					} else {
-						Message::addSuccess('news-save-success');
-						$lastId = Database::lastInsertId();
-						Util::redirect("?do=News&newsid=$lastId");
+            	if (User::hasPermission("news.save")) {
+						if (!$this->saveNews()) {
+							// re-set the fields we got
+							Request::post('news-title') ? $this->newsTitle = Request::post('news-title') : $this->newsTitle = false;
+							Request::post('news-content') ? $this->newsContent = Request::post('news-content') : $this->newsContent = false;
+						} else {
+							Message::addSuccess('news-save-success');
+							$lastId = Database::lastInsertId();
+							Util::redirect("?do=News&newsid=$lastId");
+						}
 					}
             } elseif ($pageType == 'help') {
-					if ($this->saveHelp()) {
-						Message::addSuccess('help-save-success');
-						$lastId = Database::lastInsertId();
-						Util::redirect("?do=News&newsid=$lastId");
+            	if (User::hasPermission("help.save")) {
+						if ($this->saveHelp()) {
+							Message::addSuccess('help-save-success');
+							$lastId = Database::lastInsertId();
+							Util::redirect("?do=News&newsid=$lastId");
+						}
 					}
             }
         } elseif ($action === 'delete') {
@@ -85,11 +89,15 @@ class Page_News extends Page
 			  $pageType = Request::post('news-type');
 
 			  if ($pageType == 'news') {
-					$this->delNews(Request::post('newsid'));
-					Util::redirect('?do=News&editHelp='.Request::any('editHelp'));
+			  		if(User::hasPermission("news.delete")) {
+						$this->delNews(Request::post('newsid'));
+						Util::redirect('?do=News&editHelp='.Request::any('editHelp'));
+					}
 			  } elseif ($pageType == 'help') {
-			  		$this->delNews(Request::post('newsid'));
-				   Util::redirect('?do=News&editHelp='.Request::any('editHelp'));
+			  		if(User::hasPermission("help.delete")) {
+						$this->delNews(Request::post('newsid'));
+						Util::redirect('?do=News&editHelp='.Request::any('editHelp'));
+					}
 			  }
         } else {
             // unknown action, redirect user
diff --git a/modules-available/statistics_reporting/page.inc.php b/modules-available/statistics_reporting/page.inc.php
index 9862a82e..5d586b6c 100644
--- a/modules-available/statistics_reporting/page.inc.php
+++ b/modules-available/statistics_reporting/page.inc.php
@@ -55,8 +55,6 @@ class Page_Statistics_Reporting extends Page
 			if (User::hasPermission("table.export") && User::hasPermission("table.view.$this->type")) {
 				$this->doExport();
 				// Does not return
-			} else {
-				Message::addError('main.no-permission');
 			}
 		}
 		// Get report - fetch data exactly the way it would automatically be reported
@@ -67,10 +65,7 @@ class Page_Statistics_Reporting extends Page
 				Header('Content-Disposition: attachment; filename=remote-report.json');
 				Header('Content-Type: application/json; charset=utf-8');
 				die(json_encode($report));
-			} else {
-				Message::addError('main.no-permission');
 			}
-
 		}
 	}
 
@@ -109,6 +104,7 @@ class Page_Statistics_Reporting extends Page
 				$data['tables'][] = array(
 					'name' => Dictionary::translate('table_' . $table, true),
 					'value' => $table,
+					'allowed' => User::hasPermission("table.view.$table"),
 					'selected' => ($this->type === $table) ? 'selected' : '',
 				);
 			}
@@ -130,15 +126,17 @@ class Page_Statistics_Reporting extends Page
 				$data['settingsButtonClass'] = 'danger';
 			}
 
+			$data['allowedExport'] = User::hasPermission("table.export") && User::hasPermission("table.view.$this->type");
+			$data['allowedDownload'] = User::hasPermission("reporting.download");
+			$data['allowedReportChange'] = User::hasPermission("reporting.change");
+
 			Render::addTemplate('columnChooser', $data);
 
 			$data['data'] = $this->fetchData(GETDATA_PRINTABLE);
 
-			if (User::hasPermission("table.view.$this->type"))
+			if (User::hasPermission("table.view.$this->type")) {
 				Render::addTemplate('table-' . $this->type, $data);
-			else
-				Message::addError('main.no-permission');
-
+			}
 		}
 	}
 
@@ -146,23 +144,24 @@ class Page_Statistics_Reporting extends Page
 	{
 		$this->action = Request::any('action', false, 'string');
 		if ($this->action === 'setReporting') {
-			if (!User::hasPermission("reporting.change")) {
-				die("Permission denied.");
-			}
-			$state = Request::post('reporting', false, 'string');
-			if ($state === false) {
-				die('Missing setting value.');
-			}
-			RemoteReport::setReportingEnabled($state);
-			$data = array();
-			if (RemoteReport::isReportingEnabled()) {
-				$data['class'] = 'default';
-				$data['checked'] = true;
+			if (User::hasPermission("reporting.change")) {
+				$state = Request::post('reporting', false, 'string');
+				if ($state === false) {
+					die('Missing setting value.');
+				}
+				RemoteReport::setReportingEnabled($state);
+				$data = array();
+				if (RemoteReport::isReportingEnabled()) {
+					$data['class'] = 'default';
+					$data['checked'] = true;
+				} else {
+					$data['class'] = 'danger';
+				}
+				Header('Content-Type: application/json; charset=utf-8');
+				die(json_encode($data));
 			} else {
-				$data['class'] = 'danger';
+				die('No permission.');
 			}
-			Header('Content-Type: application/json; charset=utf-8');
-			die(json_encode($data));
 		} else {
 			echo 'Invalid action.';
 		}
diff --git a/modules-available/statistics_reporting/permissions/permissions.json b/modules-available/statistics_reporting/permissions/permissions.json
index 14f4ff3b..e6e550eb 100644
--- a/modules-available/statistics_reporting/permissions/permissions.json
+++ b/modules-available/statistics_reporting/permissions/permissions.json
@@ -4,7 +4,7 @@
 	"table.view.client": "View client table.",
 	"table.view.user": "View user table.",
 	"table.view.vm": "View lecture table.",
-	"table.export": "Export tables as JSON/CSV/XML.",
+	"table.export": "Export tables as JSON/CSV/XML. Needs the permission to view the table to export it.",
 	"reporting.download": "Download weekly report.",
 	"reporting.change": "Change weekly reporting settings."
 }
\ No newline at end of file
diff --git a/modules-available/statistics_reporting/templates/columnChooser.html b/modules-available/statistics_reporting/templates/columnChooser.html
index 0059e681..a6561c47 100644
--- a/modules-available/statistics_reporting/templates/columnChooser.html
+++ b/modules-available/statistics_reporting/templates/columnChooser.html
@@ -15,7 +15,7 @@
 				<div class="col-md-2">
 					<select name="type" id="select-table" class="form-control">
 						{{#tables}}
-						<option value="{{value}}" {{selected}}>{{name}}</option>
+						<option {{^allowed}}disabled{{/allowed}} value="{{value}}" {{selected}}>{{name}}</option>
 						{{/tables}}
 					</select>
 				</div>
@@ -45,7 +45,7 @@
 							<option value="xml">XML</option>
 						</select>
 						<div class="input-group-btn">
-							<button type="submit" class="btn btn-default" name="action" value="export">{{lang_export}}</button>
+							<button {{^allowedExport}}disabled {{/allowedExport}} type="submit" class="btn btn-default" name="action" value="export">{{lang_export}}</button>
 						</div>
 					</div>
 				</div>
@@ -86,18 +86,18 @@
 			</div>
 			<div class="modal-body">
 				<div class="checkbox">
-					<input id="checkbox-reporting" type="checkbox" value="on" {{reportChecked}}>
-					<label for="checkbox-reporting" style="padding-left: 40px">{{lang_reportingLabel}}</label>
+					<input {{^allowedReportChange}}disabled {{/allowedReportChange}} id="checkbox-reporting" type="checkbox" value="on" {{reportChecked}}>
+					<label for="checkbox-reporting" style="padding-left: 20px">{{lang_reportingLabel}}</label>
 				</div>
 				<div>
 					<p>{{lang_reportingDescription}}</p>
 					<p><a href="https://www.bwlehrpool.de/doku.php/satellite/statistics_reporting" target="_blank">{{lang_reportMoreInfo}}</a></p>
-					<a class="btn btn-success" href="?do=statistics_reporting&amp;action=getreport">{{lang_downloadReport}}</a>
 				</div>
 			</div>
 			<div class="modal-footer">
+				<button {{^allowedDownload}}disabled {{/allowedDownload}} class="btn btn-warning pull-left" onclick="window.location.href='?do=statistics_reporting&amp;action=getreport'">{{lang_downloadReport}}</button>
 				<button type="button" class="btn btn-default" data-dismiss="modal">{{lang_cancel}}</button>
-				<button type="button" class="btn btn-primary" data-dismiss="modal" onclick="saveSettings()">{{lang_save}}</button>
+				<button {{^allowedReportChange}}disabled {{/allowedReportChange}} type="button" class="btn btn-primary" data-dismiss="modal" onclick="saveSettings()">{{lang_save}}</button>
 			</div>
 		</div>