Merge branch 'permission-manager' of openslx.org:openslx-ng/slx-admin into permission-manager

45 files changed, 250 insertions, 99 deletions

diff --git a/modules-available/backup/lang/de/permissions.json b/modules-available/backup/lang/de/permissions.json
new file mode 100644
index 00000000..e5f189b8
--- /dev/null
+++ b/modules-available/backup/lang/de/permissions.json
@@ -0,0 +1,4 @@
+{
+	"create": "Eine Sicherung erstellen und herunterladen.",
+	"restore": "Eine Sicherung hochladen und wiederherstellen."
+}
\ No newline at end of file
diff --git a/modules-available/backup/lang/en/permissions.json b/modules-available/backup/lang/en/permissions.json
new file mode 100644
index 00000000..ee1d87cb
--- /dev/null
+++ b/modules-available/backup/lang/en/permissions.json
@@ -0,0 +1,4 @@
+{
+	"create": "Create and download a backup.",
+	"restore": "Upload and restore a backup."
+}
\ No newline at end of file
diff --git a/modules-available/backup/page.inc.php b/modules-available/backup/page.inc.php
index 77d677c7..26182ca3 100644
--- a/modules-available/backup/page.inc.php
+++ b/modules-available/backup/page.inc.php
@@ -11,21 +11,21 @@ class Page_Backup extends Page
 	protected function doPreprocess()
 	{
 		User::load();
-		if (!User::hasPermission('superadmin')) {
+		if (!User::isLoggedIn()) {
 			Message::addError('main.no-permission');
 			Util::redirect('?do=Main');
 		}
 		$this->action = Request::post('action');
-		if ($this->action === 'backup') {
+		if ($this->action === 'backup' && User::hasPermission("create")) {
 			$this->backup();
-		} elseif ($this->action === 'restore') {
+		} elseif ($this->action === 'restore' && User::hasPermission("restore")) {
 			$this->restore();
 		}
 	}
 
 	protected function doRender()
 	{
-		if ($this->action === 'restore') {
+		if ($this->action === 'restore' && User::hasPermission("restore")) {
 			Render::addTemplate('restore', $this->templateData);
 		} else {
 			$lastBackup = (int)Property::get(self::LAST_BACKUP_PROP, 0);
@@ -34,7 +34,9 @@ class Page_Backup extends Page
 			} else {
 				$lastBackup = date('d.m.Y', $lastBackup);
 			}
-			Render::addTemplate('_page', ['last_backup' => $lastBackup]);
+			Render::addTemplate('_page', ['last_backup' => $lastBackup,
+																"createAllowed" => User::hasPermission("create"),
+																"restoreAllowed" => User::hasPermission("restore")]);
 		}
 	}
 
diff --git a/modules-available/backup/permissions/permissions.json b/modules-available/backup/permissions/permissions.json
new file mode 100644
index 00000000..feeffe33
--- /dev/null
+++ b/modules-available/backup/permissions/permissions.json
@@ -0,0 +1,4 @@
+[
+	"create",
+	"restore"
+]
\ No newline at end of file
diff --git a/modules-available/backup/style.css b/modules-available/backup/style.css
new file mode 100644
index 00000000..7b86af56
--- /dev/null
+++ b/modules-available/backup/style.css
@@ -0,0 +1,7 @@
+.disabledPanel {
+    cursor: not-allowed;
+}
+.disabledPanel > .panel-body {
+    pointer-events: none;
+    opacity: 0.8;
+}
diff --git a/modules-available/backup/templates/_page.html b/modules-available/backup/templates/_page.html
index 88815897..41e73091 100644
--- a/modules-available/backup/templates/_page.html
+++ b/modules-available/backup/templates/_page.html
@@ -3,7 +3,7 @@
 <form action="?do=Backup" method="post">
 	<input type="hidden" name="token" value="{{token}}">
 	<input type="hidden" name="action" value="backup">
-	<div class="panel panel-default">
+	<div class="panel panel-default {{^createAllowed}}disabledPanel{{/createAllowed}}">
 		<div class="panel-heading">{{lang_backup}}</div>
 		<div class="panel-body">
 			<p>{{lang_backupDescription}}</p>
@@ -20,7 +20,7 @@
 <form action="?do=Backup" method="post" enctype="multipart/form-data">
 	<input type="hidden" name="token" value="{{token}}">
 	<input type="hidden" name="action" value="restore">
-	<div class="panel panel-default">
+	<div class="panel panel-default {{^restoreAllowed}}disabledPanel{{/restoreAllowed}}">
 		<div class="panel-heading">{{lang_restore}}</div>
 		<div class="panel-body">
 			<p>{{lang_restoreDescription}}</p>
diff --git a/modules-available/dozmod/inc/pagedozmodlog.inc.php b/modules-available/dozmod/inc/pagedozmodlog.inc.php
index f31edf5b..957abd2f 100644
--- a/modules-available/dozmod/inc/pagedozmodlog.inc.php
+++ b/modules-available/dozmod/inc/pagedozmodlog.inc.php
@@ -29,9 +29,13 @@ class Page_dozmod_log extends Page
 				. " LEFT JOIN sat.lecture l ON (l.lectureid = targetid)"
 				. " ORDER BY al.dateline DESC LIMIT 500", array(), true, true);
 		} elseif ($this->action === 'showuser') {
-			$this->listUser();
+			if (User::hasPermission("log.showuser")) {
+				$this->listUser();
+			}
 		} else {
-			$this->listTarget();
+			if (User::hasPermission("log.showtarget")) {
+				$this->listTarget();
+			}
 		}
 	}
 
@@ -150,6 +154,9 @@ class Page_dozmod_log extends Page
 		if ($showTarget) {
 			$data['showTarget'] = true;
 		}
+
+		$data['allowedShowUser'] = User::hasPermission("log.showuser");
+		$data['allowedShowTarget'] = User::hasPermission("log.showtarget");
 		Render::addTemplate('actionlog-log', $data);
 	}
 
diff --git a/modules-available/dozmod/inc/pagedozmodusers.inc.php b/modules-available/dozmod/inc/pagedozmodusers.inc.php
index 621f7d34..f4ac852b 100644
--- a/modules-available/dozmod/inc/pagedozmodusers.inc.php
+++ b/modules-available/dozmod/inc/pagedozmodusers.inc.php
@@ -22,15 +22,10 @@ class Page_dozmod_users extends Page
 		if ($action === 'setmail' || $action === 'setsu' || $action == 'setlogin') {
 			if (User::hasPermission("users.".$action)) {
 				$this->setUserOption($action);
-			} else {
-				die("No permission.");
 			}
-
 		} elseif ($action === 'setorglogin') {
 			if (User::hasPermission("users.orglogin")) {
 				$this->setOrgOption($action);
-			} else {
-				die("No permission.");
 			}
 		} else {
 			die('No such action');
diff --git a/modules-available/dozmod/inc/pagemailtemplates.inc.php b/modules-available/dozmod/inc/pagemailtemplates.inc.php
index 90734a50..b7b5a8d4 100644
--- a/modules-available/dozmod/inc/pagemailtemplates.inc.php
+++ b/modules-available/dozmod/inc/pagemailtemplates.inc.php
@@ -15,16 +15,10 @@ class Page_mail_templates extends Page
 		} elseif ($action === 'save') {
 			if (User::hasPermission("templates.save")) {
 				$this->handleSave();
-			} else {
-				Message::addError('main.no-permission');
-				Util::redirect('?do=dozmod&section=templates');
 			}
 		} elseif ($action === 'reset') {
 			if(User::hasPermission("templates.reset")) {
 				$this->handleReset();
-			} else {
-				Message::addError('main.no-permission');
-				Util::redirect('?do=dozmod&section=templates');
 			}
 		} else {
 			Message::addError('main.invalid-action', $action);
@@ -70,6 +64,8 @@ class Page_mail_templates extends Page
 	protected function doRender()
 	{
 		$this->enrichHtml();
+		$this->templates['allowedReset'] = User::hasPermission("templates.reset");
+		$this->templates['allowedSave'] = User::hasPermission("templates.save");
 		Render::addTemplate('templates', ['templates' => $this->templates]);
 	}
 
diff --git a/modules-available/dozmod/lang/de/permissions.json b/modules-available/dozmod/lang/de/permissions.json
new file mode 100644
index 00000000..07158a1d
--- /dev/null
+++ b/modules-available/dozmod/lang/de/permissions.json
@@ -0,0 +1,14 @@
+{
+	"images.delete": "Zur Löschung vorgemerkete Abbilder löschen.",
+	"mail.save": "Änderungen an der SMTP-Konfiguration zum Versenden von Mails speichern.",
+	"mail.testmail": "Eine Test E-Mail verschicken.",
+	"runtimeconfig.save": "Änderungen an der Laufzeit-Konfiguration speichern.",
+	"templates.save": "E-Mail Templates speichern.",
+	"templates.reset": "E-Mail Templates zurücksetzen.",
+	"users.setmail": "E-Mail Benachrichtigungen für einzelne Benutzer aktivieren/deaktivieren.",
+	"users.setlogin": "Anmeldungen für einzelne Benutzer aktivieren/deaktivieren.",
+	"users.setsu": "Benutzer zu SuperUser ernennen.",
+	"users.orglogin": "Anmeldungen für Benutzer von bestimmten Einrichtungen aktivieren/deaktivieren.",
+	"log.showuser": "User Data im Aktions-Log anzeigen.",
+	"log.showtarget": "Target Data im Aktions-Log anzeigen."
+}
\ No newline at end of file
diff --git a/modules-available/dozmod/lang/en/permissions.json b/modules-available/dozmod/lang/en/permissions.json
new file mode 100644
index 00000000..923a8461
--- /dev/null
+++ b/modules-available/dozmod/lang/en/permissions.json
@@ -0,0 +1,14 @@
+{
+	"images.delete": "Delete images marked for deletion.",
+	"mail.save": "Save SMTP configuration for sending mails.",
+	"mail.testmail": "Send a testmail.",
+	"runtimeconfig.save": "Save limits and defaults of a runtime configuration.",
+	"templates.save": "Save email templates.",
+	"templates.reset": "Reset email templates.",
+	"users.setmail": "Enable/Disable Email Notification.",
+	"users.setlogin": "Enable/Disable Login.",
+	"users.setsu": "Set User to superuser.",
+	"users.orglogin": "Enalbe/Disable Login for Users from certain organisations.",
+	"log.showuser": "Show User Data in Log.",
+	"log.showtarget": "Show Target Data in Log."
+}
\ No newline at end of file
diff --git a/modules-available/dozmod/page.inc.php b/modules-available/dozmod/page.inc.php
index 93d38f48..b58d57aa 100644
--- a/modules-available/dozmod/page.inc.php
+++ b/modules-available/dozmod/page.inc.php
@@ -52,16 +52,10 @@ class Page_DozMod extends Page
 		if ($action === 'mail') {
 			if (User::hasPermission("mail.save")) {
 				$this->mailHandler();
-			} else {
-				Message::addError('main.no-permission');
-				Util::redirect('?do=dozmod&section=mailconfig');
 			}
 		} elseif ($action === 'runtime') {
 			if (User::hasPermission("runtimeconfig.save")) {
 				$this->runtimeHandler();
-			} else {
-				Message::addError('main.no-permission');
-				Util::redirect('?do=dozmod&section=runtimeconfig');
 			}
 		} elseif ($action === 'delimages') {
 			if (User::hasPermission("images.delete")) {
@@ -70,9 +64,6 @@ class Page_DozMod extends Page
 					Message::addInfo('delete-images', $result);
 				}
 				Util::redirect('?do=DozMod');
-			} else {
-				Message::addError('main.no-permission');
-				Util::redirect('?do=dozmod');
 			}
 		} elseif ($action !== false) {
 			Util::traceError('Invalid action: ' . $action);
@@ -102,7 +93,7 @@ class Page_DozMod extends Page
 			if (empty($expiredImages)) {
 				Message::addSuccess('no-expired-images');
 			} else {
-				Render::addTemplate('images-delete', array('images' => $expiredImages));
+				Render::addTemplate('images-delete', array('images' => $expiredImages, 'allowedDelete' => User::hasPermission("images.delete")));
 			}
 		}
 		if ($section === 'mailconfig') {
@@ -114,6 +105,8 @@ class Page_DozMod extends Page
 					$mailConf['set_' . $mailConf['ssl']] = 'selected="selected"';
 				}
 			}
+			$mailConf['allowedSave'] = User::hasPermission('mail.save');
+			$mailConf['allowedTest'] = User::hasPermission('mail.testmail');
 			Render::addTemplate('mailconfig', $mailConf);
 		}
 		if ($section === 'runtimeconfig') {
@@ -146,6 +139,7 @@ class Page_DozMod extends Page
 					$runtimeConf['allowLoginByDefault'] = 'checked';
 				}
 			}
+			$runtimeConf['allowedSave'] = User::hasPermission("runtimeconfig.save");
 			Render::addTemplate('runtimeconfig', $runtimeConf);
 		}
 		if ($section === 'blockstats') {
@@ -231,14 +225,10 @@ class Page_DozMod extends Page
 		if ($action === 'mail') {
 			if (User::hasPermission("mail.testmail")) {
 				$this->handleTestMail();
-			} else {
-				die('No permission');
 			}
 		} elseif ($action === 'delimages') {
 			if (User::hasPermission("images.delete")) {
 				die($this->handleDeleteImages());
-			} else {
-				die('No permission');
 			}
 		} elseif ($action === 'getblockinfo') {
 			$this->ajaxGetBlockInfo();
diff --git a/modules-available/dozmod/permissions/permissions.json b/modules-available/dozmod/permissions/permissions.json
index 8295d0f0..e8dfb558 100644
--- a/modules-available/dozmod/permissions/permissions.json
+++ b/modules-available/dozmod/permissions/permissions.json
@@ -1,12 +1,14 @@
-{
-	"images.delete": "Delete images marked for deletion.",
-	"mail.save": "Save SMTP configuration for sending mails.",
-	"mail.testmail": "Send a testmail.",
-	"runtimeconfig.save": "Save limits and defaults of a runtime configuration.",
-	"templates.save": "Save email templates",
-	"templates.reset": "Reset email templates",
-	"users.setmail": "Enable/Disable Email Notification",
-	"users.setlogin": "Enable/Disable Login",
-	"users.setsu": "Set User to superuser",
-	"users.orglogin": "Enalbe/Disable Login for Users from certain organisations."
-}
\ No newline at end of file
+[
+	"images.delete",
+	"mail.save",
+	"mail.testmail",
+	"runtimeconfig.save",
+	"templates.save",
+	"templates.reset",
+	"users.setmail",
+	"users.setlogin",
+	"users.setsu",
+	"users.orglogin",
+	"log.showuser",
+	"log.showtarget"
+]
\ No newline at end of file
diff --git a/modules-available/dozmod/templates/actionlog-log.html b/modules-available/dozmod/templates/actionlog-log.html
index 09f3a183..8aa57207 100644
--- a/modules-available/dozmod/templates/actionlog-log.html
+++ b/modules-available/dozmod/templates/actionlog-log.html
@@ -18,7 +18,7 @@
 			{{#showActor}}
 			<td style="min-width:140px">
 				{{#uuserid}}
-				<a href="?do=dozmod&amp;section=actionlog&amp;action=showuser&amp;uuid={{uuserid}}">{{ulastname}}, {{ufirstname}}</a>
+				{{#allowedShowUser}}<a href="?do=dozmod&amp;section=actionlog&amp;action=showuser&amp;uuid={{uuserid}}">{{/allowedShowUser}} {{ulastname}}, {{ufirstname}}{{#allowedShowUser}}</a>{{/allowedShowUser}}
 				{{/uuserid}}
 				{{^uuserid}}
 				{{lang_system}}
@@ -28,7 +28,7 @@
 			{{#showTarget}}
 			<td style="word-wrap: break-word">
 				{{#targeturl}}
-				<a href="{{targeturl}}">{{targetname}}</a>
+				{{#allowedShowTarget}}<a href="{{targeturl}}">{{/allowedShowTarget}}{{targetname}}{{#allowedShowTarget}}</a>{{/allowedShowTarget}}
 				{{/targeturl}}
 				{{^targeturl}}
 				{{targetname}}
diff --git a/modules-available/dozmod/templates/images-delete.html b/modules-available/dozmod/templates/images-delete.html
index dd4c61bc..ed75a0d2 100644
--- a/modules-available/dozmod/templates/images-delete.html
+++ b/modules-available/dozmod/templates/images-delete.html
@@ -45,7 +45,7 @@
 						{{/images}}
 					</tbody>
 				</table>
-				<button style="margin-left: 20px" id="delbtn" class="btn btn-danger pull-right" type="submit" name="button" value="save"><span class="glyphicon glyphicon-trash"></span> {{lang_delButton}}</button>
+				<button {{^allowedDelete}}disabled{{/allowedDelete}} style="margin-left: 20px" id="delbtn" class="btn btn-danger pull-right" type="submit" name="button" value="save"><span class="glyphicon glyphicon-trash"></span> {{lang_delButton}}</button>
 			</form>
 			<pre style="display:none" id="deloutput"></pre>
 		</div>
diff --git a/modules-available/dozmod/templates/mailconfig.html b/modules-available/dozmod/templates/mailconfig.html
index 6edc65ae..d5d4db29 100644
--- a/modules-available/dozmod/templates/mailconfig.html
+++ b/modules-available/dozmod/templates/mailconfig.html
@@ -55,10 +55,10 @@
 			</div>
 			<br>
 			<div class="text-right">
-				<button class="btn btn-warning" type="button" id="test-button" name="button" value="test" onclick="slxTestConfig()"><span class="glyphicon glyphicon-envelope"></span> {{lang_test}}</button>
+				<button {{^allowedTest}}disabled{{/allowedTest}} class="btn btn-warning" type="button" id="test-button" name="button" value="test" onclick="slxTestConfig()"><span class="glyphicon glyphicon-envelope"></span> {{lang_test}}</button>
 				<span id="test-spin" style="display:none"><span class="glyphicon glyphicon-refresh slx-rotation"></span></span>
 				<pre id="test-output" style="display:none"></pre>
-				<button class="btn btn-primary" type="submit" name="button" value="save"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
+				<button {{^allowedSave}}disabled{{/allowedSave}} class="btn btn-primary" type="submit" name="button" value="save"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
 				<br>
 				<input type="hidden" name="token" value="{{token}}">
 				<input type="hidden" name="action" value="mail">
diff --git a/modules-available/dozmod/templates/orglist.html b/modules-available/dozmod/templates/orglist.html
index 361421c5..5224c962 100644
--- a/modules-available/dozmod/templates/orglist.html
+++ b/modules-available/dozmod/templates/orglist.html
@@ -41,7 +41,19 @@ function seto(action, el, orgid) {
 
 		if (data !== '1' && data !== '0') {
 			el.checked = !old;
-			box.parent().css('background-color', 'red !important');
+			box.parent().css('background-color', '');
+			/* show success notification */
+			$notification = $('<span></span>')
+				.addClass('glyphicon glyphicon-remove')
+				.css('color', 'red')
+				.css('width', '0px')
+				.css('position', 'relative')
+				.css('right', '20px')
+				.hide();
+			box.before($notification);
+			$notification.fadeIn('fast', function () {
+				$notification.fadeOut('slow', function () { $notification.remove() });
+			});
 		} else {
 			el.checked = (data == 1);
 			box.parent().css('background-color', '');
diff --git a/modules-available/dozmod/templates/runtimeconfig.html b/modules-available/dozmod/templates/runtimeconfig.html
index a1992631..1d4cc6cb 100644
--- a/modules-available/dozmod/templates/runtimeconfig.html
+++ b/modules-available/dozmod/templates/runtimeconfig.html
@@ -117,7 +117,7 @@
 			<input type="hidden" name="token" value="{{token}}">
 			<input type="hidden" name="action" value="runtime">
 			<div class="text-right">
-				<button class="btn btn-primary" type="submit" name="button" value="save"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
+				<button {{^allowedSave}}disabled{{/allowedSave}} class="btn btn-primary" type="submit" name="button" value="save"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
 			</div>
 		</form>
 	</div>
diff --git a/modules-available/dozmod/templates/templates.html b/modules-available/dozmod/templates/templates.html
index 4764c0e9..3ee0ccbc 100644
--- a/modules-available/dozmod/templates/templates.html
+++ b/modules-available/dozmod/templates/templates.html
@@ -80,12 +80,12 @@
 			{{/templates}}
 			</div>
 
-			<button type="submit" onclick="return validateForm()" class="btn btn-primary pull-right"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
+			<button {{^allowedSave}}disabled{{/allowedSave}} type="submit" onclick="return validateForm()" class="btn btn-primary pull-right"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
 		</form>
 		<form method="POST" action="?do=dozmod&amp;section=templates">
 			<input type="hidden" name="token" value="{{token}}">
 			<div>
-				<button type="button" data-toggle="modal" data-target="#resetTemplatesModal" class="btn btn-danger">{{lang_loadDefaults}}</button>
+				<button {{^allowedReset}}disabled{{/allowedReset}} type="button" data-toggle="modal" data-target="#resetTemplatesModal" class="btn btn-danger">{{lang_loadDefaults}}</button>
 			</div>
 
 			<div id="resetTemplatesModal" class="modal fade" role="dialog">
diff --git a/modules-available/internetaccess/lang/de/permissions.json b/modules-available/internetaccess/lang/de/permissions.json
new file mode 100644
index 00000000..78d9e67c
--- /dev/null
+++ b/modules-available/internetaccess/lang/de/permissions.json
@@ -0,0 +1,3 @@
+{
+	"configuration.safe": "Konfiguration speichern."
+}
\ No newline at end of file
diff --git a/modules-available/internetaccess/lang/en/permissions.json b/modules-available/internetaccess/lang/en/permissions.json
new file mode 100644
index 00000000..afe8325d
--- /dev/null
+++ b/modules-available/internetaccess/lang/en/permissions.json
@@ -0,0 +1,3 @@
+{
+	"configuration.safe": "Safe configuration."
+}
\ No newline at end of file
diff --git a/modules-available/internetaccess/permissions/permissions.json b/modules-available/internetaccess/permissions/permissions.json
index 6d88ccc5..67998da7 100644
--- a/modules-available/internetaccess/permissions/permissions.json
+++ b/modules-available/internetaccess/permissions/permissions.json
@@ -1,3 +1,3 @@
-{
-	"configuration.safe": "Safe new configuration."
-}
\ No newline at end of file
+[
+	"configuration.safe"
+]
\ No newline at end of file
diff --git a/modules-available/locations/lang/de/permissions.json b/modules-available/locations/lang/de/permissions.json
new file mode 100644
index 00000000..46dea864
--- /dev/null
+++ b/modules-available/locations/lang/de/permissions.json
@@ -0,0 +1,9 @@
+{
+	"location.view": "Räume anschauen.",
+	"location.edit": "Räume bearbeiten.",
+	"location.add": "Räume hinzufügen.",
+	"location.delete": "Räume löschen.",
+	"subnet.edit": "Subnetze bearbeiten.",
+	"subnet.add": "Subnetze hinzufügen.",
+	"subnet.delete": "Subnetze löschen."
+}
\ No newline at end of file
diff --git a/modules-available/locations/lang/en/permissions.json b/modules-available/locations/lang/en/permissions.json
new file mode 100644
index 00000000..db0ac5f6
--- /dev/null
+++ b/modules-available/locations/lang/en/permissions.json
@@ -0,0 +1,9 @@
+{
+	"location.view": "View locations.",
+	"location.edit": "Edit locations.",
+	"location.add": "Add locations.",
+	"location.delete": "Delete locations.",
+	"subnet.edit": "Edit subnets.",
+	"subnet.add": "Add subnets.",
+	"subnet.delete": "Delete subnets."
+}
\ No newline at end of file
diff --git a/modules-available/locations/permissions/permissions.json b/modules-available/locations/permissions/permissions.json
index db0ac5f6..609a673a 100644
--- a/modules-available/locations/permissions/permissions.json
+++ b/modules-available/locations/permissions/permissions.json
@@ -1,9 +1,9 @@
-{
-	"location.view": "View locations.",
-	"location.edit": "Edit locations.",
-	"location.add": "Add locations.",
-	"location.delete": "Delete locations.",
-	"subnet.edit": "Edit subnets.",
-	"subnet.add": "Add subnets.",
-	"subnet.delete": "Delete subnets."
-}
\ No newline at end of file
+[
+	"location.view",
+	"location.edit",
+	"location.add",
+	"location.delete",
+	"subnet.edit",
+	"subnet.add",
+	"subnet.delete"
+]
\ No newline at end of file
diff --git a/modules-available/news/lang/de/permissions.json b/modules-available/news/lang/de/permissions.json
new file mode 100644
index 00000000..b2c6fb1b
--- /dev/null
+++ b/modules-available/news/lang/de/permissions.json
@@ -0,0 +1,6 @@
+{
+	"news.save": "Änderungen am News Text speichern.",
+	"news.delete": "Alte News Texte löschen.",
+	"help.save": "Änderungen am Hilfe Text speichern.",
+	"help.delete": "Alte Hilfe Texte löschen."
+}
\ No newline at end of file
diff --git a/modules-available/news/lang/en/permissions.json b/modules-available/news/lang/en/permissions.json
new file mode 100644
index 00000000..90d07aef
--- /dev/null
+++ b/modules-available/news/lang/en/permissions.json
@@ -0,0 +1,6 @@
+{
+	"news.save": "Save new news.",
+	"news.delete": "Delete old news.",
+	"help.save": "Save new help texts.",
+	"help.delete": "Delete old help texts"
+}
\ No newline at end of file
diff --git a/modules-available/news/permissions/permissions.json b/modules-available/news/permissions/permissions.json
index 90d07aef..321e73ea 100644
--- a/modules-available/news/permissions/permissions.json
+++ b/modules-available/news/permissions/permissions.json
@@ -1,6 +1,6 @@
-{
-	"news.save": "Save new news.",
-	"news.delete": "Delete old news.",
-	"help.save": "Save new help texts.",
-	"help.delete": "Delete old help texts"
-}
\ No newline at end of file
+[
+	"news.save",
+	"news.delete",
+	"help.save",
+	"help.delete"
+]
\ No newline at end of file
diff --git a/modules-available/permissionmanager/clientscript.js b/modules-available/permissionmanager/clientscript.js
index 700ebc11..65065e6e 100644
--- a/modules-available/permissionmanager/clientscript.js
+++ b/modules-available/permissionmanager/clientscript.js
@@ -42,6 +42,12 @@ document.addEventListener("DOMContentLoaded", function() {
 		});
 	}
 
+	$("tr").on('click', function (e) {
+		if (e.target.type !== "checkbox") {
+			$(this).find("input:checkbox").trigger("click");
+		}
+	});
+
 	$("form input").keydown(function(e) {
 		if (e.keyCode === 13) e.preventDefault();
 	});
diff --git a/modules-available/permissionmanager/inc/permissionutil.inc.php b/modules-available/permissionmanager/inc/permissionutil.inc.php
index 391cd047..64fe8f26 100644
--- a/modules-available/permissionmanager/inc/permissionutil.inc.php
+++ b/modules-available/permissionmanager/inc/permissionutil.inc.php
@@ -73,10 +73,9 @@ class PermissionUtil
 			if (!is_array($data))
 				continue;
 			preg_match('#^modules/([^/]+)/#', $file, $out);
-			$newData = array();
-			foreach( $data as $k => $v ) {
-				$newData[] = $v;
-				$permissions = self::putInPermissionTree($out[1].".".$k, $v, $permissions);
+			foreach( $data as $p ) {
+				$description = Dictionary::translateFileModule($out[1], "permissions", $p);
+				$permissions = self::putInPermissionTree($out[1].".".$p, $description, $permissions);
 			}
 		}
 		ksort($permissions);
diff --git a/modules-available/permissionmanager/style.css b/modules-available/permissionmanager/style.css
index bb03d153..49d631a8 100644
--- a/modules-available/permissionmanager/style.css
+++ b/modules-available/permissionmanager/style.css
@@ -13,6 +13,11 @@
     margin-left: 10px;
 }
 
+.missingInput {
+    border-color: rgba(255, 0, 0, 0.8);
+    box-shadow: 0 1px 1px rgba(255, 0, 0, 0.075) inset, 0 0 8px rgba(255, 0, 0, 0.6);
+}
+
 .table {
     margin-top: 20px;
 }
@@ -41,6 +46,10 @@
     margin-bottom: 20px;
 }
 
+.selectize-input {
+    overflow: visible;
+}
+
 
 .tree-container .selected {
     background-color: rgba(0, 182, 41, 0.23);
diff --git a/modules-available/permissionmanager/templates/roleeditor.html b/modules-available/permissionmanager/templates/roleeditor.html
index 14839ee2..b07e2112 100644
--- a/modules-available/permissionmanager/templates/roleeditor.html
+++ b/modules-available/permissionmanager/templates/roleeditor.html
@@ -64,7 +64,7 @@
 		$('form').submit(function () {
 			var name = $.trim($('#rolename').val());
 			if (name  === '') {
-				alert('{{lang_emptyNameWarning}}');
+				$("#rolename").addClass("missingInput");
 				return false;
 			}
 		});
diff --git a/modules-available/permissionmanager/templates/rolestable.html b/modules-available/permissionmanager/templates/rolestable.html
index 99401624..992feca1 100644
--- a/modules-available/permissionmanager/templates/rolestable.html
+++ b/modules-available/permissionmanager/templates/rolestable.html
@@ -3,11 +3,13 @@
 
 	<div class="row">
 		<div class="col-md-4">
-			<button class="btn btn-success" type="button" onclick="openRoleEditor()"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</button>
 		</div>
 		<div class="col-md-4">
 			<input type="text" class="form-control" id="roleNameSearchField" onkeyup="searchFieldFunction()" placeholder="{{lang_searchPlaceholder}}">
 		</div>
+		<div class="col-md-4 text-right">
+			<button class="btn btn-success" type="button" onclick="openRoleEditor()"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</button>
+		</div>
 	</div>
 
 	<div class="row">
diff --git a/modules-available/permissionmanager/templates/userstable.html b/modules-available/permissionmanager/templates/userstable.html
index bd48d16d..9f684e99 100644
--- a/modules-available/permissionmanager/templates/userstable.html
+++ b/modules-available/permissionmanager/templates/userstable.html
@@ -3,10 +3,8 @@
 
 	<div class="row">
 		<div class="col-md-4">
-			<button class="btn btn-success" type="button" data-toggle="modal" data-target="#addRoleToUserModal"><span class="glyphicon glyphicon-share-alt"></span> {{lang_addRole}}</button>
-			<button class="btn btn-danger" type="button" data-toggle="modal" data-target="#removeRoleFromUserModal"><span class="glyphicon glyphicon-trash"></span> {{lang_removeRole}}</button>
 		</div>
-		<div class="col-md-4 text-left">
+		<div class="col-md-4">
 			<select multiple name="roles[]" id="select-role">
 				<option value>{{lang_selectizePlaceholder}}</option>
 				{{#roles}}
@@ -14,6 +12,10 @@
 				{{/roles}}
 			</select>
 		</div>
+		<div class="col-md-4 text-right">
+			<button class="btn btn-success" type="button" data-toggle="modal" data-target="#addRoleToUserModal"><span class="glyphicon glyphicon-share-alt"></span> {{lang_addRole}}</button>
+			<button class="btn btn-danger" type="button" data-toggle="modal" data-target="#removeRoleFromUserModal"><span class="glyphicon glyphicon-trash"></span> {{lang_removeRole}}</button>
+		</div>
 	</div>
 
 	<div class="row">
@@ -152,6 +154,7 @@
 		});
 	});
 
+
 	// if remove-Role button is clicked, uncheck all checkboxes in add-role modal so they aren't submitted too
 	function clearAddRoleModal () {
 		$('#addRoleToUserModal')
diff --git a/modules-available/statistics_reporting/lang/de/permissions.json b/modules-available/statistics_reporting/lang/de/permissions.json
new file mode 100644
index 00000000..f90de252
--- /dev/null
+++ b/modules-available/statistics_reporting/lang/de/permissions.json
@@ -0,0 +1,10 @@
+{
+	"table.view.total": "Gesamt Tabelle anschauen.",
+	"table.view.location": "Orte Tabelle anschauen.",
+	"table.view.client": "Client Tabelle anschauen.",
+	"table.view.user": "Benutzer Tabelle anschauen.",
+	"table.view.vm": "Veranstaltungen Tabelle anschauen.",
+	"table.export": "Tabellen als JSON/CSV/XML exportieren. Dazu werden die Rechte um die jeweiligen Tabllen anzuschauen benötigt.",
+	"reporting.download": "Wöchentlichen Report herunterladen.",
+	"reporting.change": "Einstellungen zu dem wöchentlichen Report ändern."
+}
\ No newline at end of file
diff --git a/modules-available/statistics_reporting/lang/en/permissions.json b/modules-available/statistics_reporting/lang/en/permissions.json
new file mode 100644
index 00000000..e6e550eb
--- /dev/null
+++ b/modules-available/statistics_reporting/lang/en/permissions.json
@@ -0,0 +1,10 @@
+{
+	"table.view.total": "View total table.",
+	"table.view.location": "View location table.",
+	"table.view.client": "View client table.",
+	"table.view.user": "View user table.",
+	"table.view.vm": "View lecture table.",
+	"table.export": "Export tables as JSON/CSV/XML. Needs the permission to view the table to export it.",
+	"reporting.download": "Download weekly report.",
+	"reporting.change": "Change weekly reporting settings."
+}
\ No newline at end of file
diff --git a/modules-available/statistics_reporting/permissions/permissions.json b/modules-available/statistics_reporting/permissions/permissions.json
index e6e550eb..d967b75d 100644
--- a/modules-available/statistics_reporting/permissions/permissions.json
+++ b/modules-available/statistics_reporting/permissions/permissions.json
@@ -1,10 +1,10 @@
-{
-	"table.view.total": "View total table.",
-	"table.view.location": "View location table.",
-	"table.view.client": "View client table.",
-	"table.view.user": "View user table.",
-	"table.view.vm": "View lecture table.",
-	"table.export": "Export tables as JSON/CSV/XML. Needs the permission to view the table to export it.",
-	"reporting.download": "Download weekly report.",
-	"reporting.change": "Change weekly reporting settings."
-}
\ No newline at end of file
+[
+	"table.view.total",
+	"table.view.location",
+	"table.view.client",
+	"table.view.user",
+	"table.view.vm",
+	"table.export",
+	"reporting.download",
+	"reporting.change"
+]
\ No newline at end of file
diff --git a/modules-available/webinterface/lang/de/permissions.json b/modules-available/webinterface/lang/de/permissions.json
new file mode 100644
index 00000000..ee96810a
--- /dev/null
+++ b/modules-available/webinterface/lang/de/permissions.json
@@ -0,0 +1,5 @@
+{
+	"edit.https": "HTTPS Einstellungen bearbeiten.",
+	"edit.password": "Ändern, ob Passwortfelder in der Web-Schnittstelle maskiert werden sollen.",
+	"edit.design": "Seitentitel und Hintergrundfarbe des Logos bearbeiten."
+}
\ No newline at end of file
diff --git a/modules-available/webinterface/lang/en/permissions.json b/modules-available/webinterface/lang/en/permissions.json
new file mode 100644
index 00000000..caf6d0cb
--- /dev/null
+++ b/modules-available/webinterface/lang/en/permissions.json
@@ -0,0 +1,5 @@
+{
+	"edit.https": "Edit HTTPS settings.",
+	"edit.password": "Change whether password fields should be masked or not.",
+	"edit.design": "Edit page title and logo background color."
+}
\ No newline at end of file
diff --git a/modules-available/webinterface/page.inc.php b/modules-available/webinterface/page.inc.php
index 6dfc9faa..41636c19 100644
--- a/modules-available/webinterface/page.inc.php
+++ b/modules-available/webinterface/page.inc.php
@@ -10,19 +10,19 @@ class Page_WebInterface extends Page
 	protected function doPreprocess()
 	{
 		User::load();
-		if (!User::hasPermission('superadmin')) {
+		if (!User::isLoggedIn()) {
 			Message::addError('main.no-permission');
 			Util::redirect('?do=Main');
 		}
 		switch (Request::post('action')) {
 			case 'https':
-				$this->actionConfigureHttps();
+				if (User::hasPermission("edit.https")) $this->actionConfigureHttps();
 				break;
 			case 'password':
-				$this->actionShowHidePassword();
+				if (User::hasPermission("edit.password")) $this->actionShowHidePassword();
 				break;
 			case 'customization':
-				$this->actionCustomization();
+				if (User::hasPermission("edit.design")) $this->actionCustomization();
 				break;
 		}
 	}
@@ -123,6 +123,7 @@ class Page_WebInterface extends Page
 			}
 		}
 		$data[$type . 'Selected'] = true;
+		$data["editAllowed"] = User::hasPermission("edit.https");
 		Render::addTemplate('https', $data);
 		//
 		// Password fields
@@ -132,6 +133,7 @@ class Page_WebInterface extends Page
 			$data['selected_show'] = 'checked';
 		else
 			$data['selected_hide'] = 'checked';
+		$data["editAllowed"] = User::hasPermission("edit.password");
 		Render::addTemplate('passwords', $data);
 		$data = array('prefix' => Property::get('page-title-prefix'));
 		$data['colors'] = array_map(function ($i) { return array('color' => $i ? '#' . $i : '', 'text' => Render::readableColor($i)); },
@@ -148,6 +150,7 @@ class Page_WebInterface extends Page
 		if ($color) {
 			$data['colors'][] = array('color' => $color, 'selected' => 'selected');
 		}
+		$data["editAllowed"] = User::hasPermission("edit.design");
 		Render::addTemplate('customization', $data);
 	}
 
diff --git a/modules-available/webinterface/permissions/permissions.json b/modules-available/webinterface/permissions/permissions.json
new file mode 100644
index 00000000..45b5395d
--- /dev/null
+++ b/modules-available/webinterface/permissions/permissions.json
@@ -0,0 +1,5 @@
+[
+	"edit.https",
+	"edit.password",
+	"edit.design"
+]
\ No newline at end of file
diff --git a/modules-available/webinterface/style.css b/modules-available/webinterface/style.css
new file mode 100644
index 00000000..7b86af56
--- /dev/null
+++ b/modules-available/webinterface/style.css
@@ -0,0 +1,7 @@
+.disabledPanel {
+    cursor: not-allowed;
+}
+.disabledPanel > .panel-body {
+    pointer-events: none;
+    opacity: 0.8;
+}
diff --git a/modules-available/webinterface/templates/customization.html b/modules-available/webinterface/templates/customization.html
index c949c1f2..ad57eea7 100644
--- a/modules-available/webinterface/templates/customization.html
+++ b/modules-available/webinterface/templates/customization.html
@@ -1,7 +1,7 @@
 <form action="?do=WebInterface" method="post">
 	<input type="hidden" name="token" value="{{token}}">
 	<input type="hidden" name="action" value="customization">
-	<div class="panel panel-default">
+	<div class="panel panel-default {{^editAllowed}}disabledPanel{{/editAllowed}}">
 		<div class="panel-heading">{{lang_customization}}</div>
 		<div class="panel-body">
 			<p>{{lang_customizationDesc}}</p>
diff --git a/modules-available/webinterface/templates/https.html b/modules-available/webinterface/templates/https.html
index f0accb57..a212cce3 100644
--- a/modules-available/webinterface/templates/https.html
+++ b/modules-available/webinterface/templates/https.html
@@ -1,7 +1,7 @@
 <form action="?do=WebInterface" method="post">
 	<input type="hidden" name="token" value="{{token}}">
 	<input type="hidden" name="action" value="https">
-	<div class="panel panel-default">
+	<div class="panel panel-default {{^editAllowed}}disabledPanel{{/editAllowed}}">
 		<div class="panel-heading">{{lang_httpsSettings}}</div>
 		<div class="panel-body">
 			<p>{{lang_httpsDescription}}</p>
diff --git a/modules-available/webinterface/templates/passwords.html b/modules-available/webinterface/templates/passwords.html
index e190bb72..1d73c172 100644
--- a/modules-available/webinterface/templates/passwords.html
+++ b/modules-available/webinterface/templates/passwords.html
@@ -1,7 +1,7 @@
 <form action="?do=WebInterface" method="post">
 	<input type="hidden" name="token" value="{{token}}">
 	<input type="hidden" name="action" value="password">
-	<div class="panel panel-default">
+	<div class="panel panel-default {{^editAllowed}}disabledPanel{{/editAllowed}}">
 		<div class="panel-heading">{{lang_passwordFields}}</div>
 		<div class="panel-body">
 			<p>{{lang_passwordsDescription}}</p>