From af5c4258439341fd2153a951fb871269bd754e58 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Mon, 12 Feb 2018 17:18:45 +0100
Subject: [permissionmanager] Tweak style, fix role filtering (and make it
 AND), minor cleanups

---
 .../permissionmanager/templates/rolestable.html      | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

(limited to 'modules-available/permissionmanager/templates/rolestable.html')

diff --git a/modules-available/permissionmanager/templates/rolestable.html b/modules-available/permissionmanager/templates/rolestable.html
index b121a9e0..944ab3ae 100644
--- a/modules-available/permissionmanager/templates/rolestable.html
+++ b/modules-available/permissionmanager/templates/rolestable.html
@@ -1,15 +1,8 @@
 <form method="post" action="?do=permissionmanager">
 	<input type="hidden" name="token" value="{{token}}">
 
-	<div class="row">
-		<div class="col-md-4">
-		</div>
-		<div class="col-md-4">
-			<input type="text" class="form-control" id="roleNameSearchField" onkeyup="searchFieldFunction()" placeholder="{{lang_searchPlaceholder}}">
-		</div>
-		<div class="col-md-4 text-right">
-			<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
-		</div>
+	<div>
+		<input type="text" class="form-control" id="roleNameSearchField" onkeyup="searchFieldFunction()" placeholder="{{lang_searchPlaceholder}}">
 	</div>
 
 	<div class="row">
@@ -18,8 +11,8 @@
 				<thead>
 					<tr>
 						<th data-sort="string">{{lang_roles}}</th>
-						<th class="text-center">{{lang_edit}}</th>
-						<th class="text-center">{{lang_delete}}</th>
+						<th class="text-center slx-smallcol">{{lang_edit}}</th>
+						<th class="text-center slx-smallcol">{{lang_delete}}</th>
 					</tr>
 				</thead>
 
@@ -40,7 +33,6 @@
 		</div>
 	</div>
 
-
 	<!-- Modals -->
 	<div class ="modal fade" id="deleteModal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel">
 		<div class="modal-dialog" role="document">
@@ -63,6 +55,10 @@
 
 </form>
 
+<div class="text-right">
+	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
+</div>
+
 <script>
 	function deleteRole($roleid) {
 		$(".modal-footer #deleteId").val($roleid);
-- 
cgit v1.2.3-55-g7522


From 7afe5a3ffee64ff5c1ee7692a2ac4c83d46d6a78 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Mon, 19 Feb 2018 13:36:35 +0100
Subject: [permissionmanager] Implement permissions:

Permissinmanager is now protected by permissions.
In order to prevent complete lockout, the user with
userid == 1 will always be able to edit and assign permissions.
(TODO: Communicate this somehow)
---
 inc/permission.inc.php                             |  2 +-
 .../inc/getpermissiondata.inc.php                  | 22 +++++++-
 .../permissionmanager/inc/permissionutil.inc.php   | 34 ++++++++-----
 .../permissionmanager/lang/de/permissions.json     |  7 +++
 .../permissionmanager/lang/de/template-tags.json   |  6 ++-
 .../permissionmanager/lang/en/permissions.json     |  7 +++
 .../permissionmanager/lang/en/template-tags.json   |  6 ++-
 modules-available/permissionmanager/page.inc.php   | 59 +++++++++++++++-------
 .../permissionmanager/permissions/permissions.json | 17 +++++++
 modules-available/permissionmanager/style.css      |  4 ++
 .../permissionmanager/templates/header-menu.html   |  6 +--
 .../permissionmanager/templates/roleeditor.html    |  5 +-
 .../permissionmanager/templates/rolestable.html    | 25 ++++++---
 .../permissionmanager/templates/treenode.html      |  2 +-
 .../permissionmanager/templates/treepanel.html     |  2 +-
 .../roomplanner/permissions/permissions.json       | 10 ++++
 16 files changed, 164 insertions(+), 50 deletions(-)
 create mode 100644 modules-available/permissionmanager/lang/de/permissions.json
 create mode 100644 modules-available/permissionmanager/lang/en/permissions.json
 create mode 100644 modules-available/permissionmanager/permissions/permissions.json
 create mode 100644 modules-available/roomplanner/permissions/permissions.json

(limited to 'modules-available/permissionmanager/templates/rolestable.html')

diff --git a/inc/permission.inc.php b/inc/permission.inc.php
index e61c7423..aaef6ba6 100644
--- a/inc/permission.inc.php
+++ b/inc/permission.inc.php
@@ -33,7 +33,7 @@ class Permission
 			}
 			$temp =& $array;
 			foreach (explode('.', $perm) as $sub) {
-				if (empty($sub))
+				if (empty($sub) || $sub === '*')
 					continue;
 				$temp =& $temp[$sub];
 			}
diff --git a/modules-available/permissionmanager/inc/getpermissiondata.inc.php b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
index dd100d42..496c8224 100644
--- a/modules-available/permissionmanager/inc/getpermissiondata.inc.php
+++ b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
@@ -3,6 +3,9 @@
 class GetPermissionData
 {
 
+	const WITH_USER_COUNT = 1;
+	const WITH_LOCATION_COUNT = 2;
+
 	/**
 	 * Get data for all users.
 	 *
@@ -64,11 +67,26 @@ class GetPermissionData
 	/**
 	 * Get all roles.
 	 *
+	 * @param int $flags Bitmask specifying additional data to fetch (WITH_* constants of this class)
 	 * @return array array roles (each with roleid and rolename)
 	 */
-	public static function getRoles()
+	public static function getRoles($flags = 0)
 	{
-		return Database::queryAll("SELECT roleid, rolename FROM role ORDER BY rolename ASC");
+		$cols = $joins = '';
+		if ($flags & self::WITH_USER_COUNT) {
+			$cols .= ', Count(DISTINCT rxu.userid) AS users';
+			$joins .= ' LEFT JOIN user_x_role rxu ON (r.roleid = rxu.roleid)';
+		}
+		if ($flags & self::WITH_LOCATION_COUNT) {
+			$cols .= ', Count(DISTINCT rxl.locationid) AS locations';
+			$joins .= ' LEFT JOIN role_x_location rxl ON (r.roleid = rxl.roleid)';
+		}
+		if (!empty($joins)) {
+			$joins .= ' GROUP BY r.roleid';
+		}
+		return Database::queryAll("SELECT r.roleid, r.rolename $cols FROM role r
+			$joins
+			ORDER BY rolename ASC");
 	}
 
 	/**
diff --git a/modules-available/permissionmanager/inc/permissionutil.inc.php b/modules-available/permissionmanager/inc/permissionutil.inc.php
index b4d54055..bc42c5a0 100644
--- a/modules-available/permissionmanager/inc/permissionutil.inc.php
+++ b/modules-available/permissionmanager/inc/permissionutil.inc.php
@@ -53,6 +53,9 @@ class PermissionUtil
 		$permissionid = strtolower($permissionid);
 		self::validatePermission($permissionid);
 		$parts = explode('.', $permissionid);
+		// Special case: To prevent lockout, userid === 1 always has permissionmanager.*
+		if ($parts[0] === 'permissionmanager' && User::getId() === 1)
+			return true;
 		// Limit query to first part of permissionid, which is always the module id
 		$prefix = $parts[0] . '.%';
 		if (is_null($locationid)) {
@@ -103,21 +106,26 @@ class PermissionUtil
 		$permissionid = strtolower($permissionid);
 		self::validatePermission($permissionid);
 		$parts = explode('.', $permissionid);
-		// Limit query to first part of permissionid, which is always the module id
-		$prefix = $parts[0] . '.%';
-		$res = Database::simpleQuery("SELECT permissionid, locationid FROM role_x_permission
-					INNER JOIN user_x_role USING (roleid)
-					INNER JOIN role_x_location USING (roleid)
-					WHERE user_x_role.userid = :userid AND (permissionid LIKE :prefix OR permissionid LIKE '*')",
-			compact('userid', 'prefix'));
+		// Special case: To prevent lockout, userid === 1 always has permissionmanager.*
+		if ($parts[0] === 'permissionmanager' && User::getId() === 1) {
+			$allowedLocations = [true];
+		} else {
+			// Limit query to first part of permissionid, which is always the module id
+			$prefix = $parts[0] . '.%';
+			$res = Database::simpleQuery("SELECT permissionid, locationid FROM role_x_permission
+						INNER JOIN user_x_role USING (roleid)
+						INNER JOIN role_x_location USING (roleid)
+						WHERE user_x_role.userid = :userid AND (permissionid LIKE :prefix OR permissionid LIKE '*')",
+				compact('userid', 'prefix'));
 
-		// Gather locationid from relevant rows
-		self::makeComparisonVariants($parts, $compare, $wildcard, $wclen);
-		$allowedLocations = array();
-		while ($row = $res->fetch(PDO::FETCH_ASSOC)) {
-			if (in_array($row['permissionid'], $compare, true)
+			// Gather locationid from relevant rows
+			self::makeComparisonVariants($parts, $compare, $wildcard, $wclen);
+			$allowedLocations = array();
+			while ($row = $res->fetch(PDO::FETCH_ASSOC)) {
+				if (in_array($row['permissionid'], $compare, true)
 					|| ($wildcard !== false && strncmp($row['permissionid'], $wildcard, $wclen) === 0)) {
-				$allowedLocations[(int)$row['locationid']] = true;
+					$allowedLocations[(int)$row['locationid']] = true;
+				}
 			}
 		}
 		$locations = Location::getTree();
diff --git a/modules-available/permissionmanager/lang/de/permissions.json b/modules-available/permissionmanager/lang/de/permissions.json
new file mode 100644
index 00000000..444c1e8c
--- /dev/null
+++ b/modules-available/permissionmanager/lang/de/permissions.json
@@ -0,0 +1,7 @@
+{
+    "locations.view": "Orte mit zugewiesenen Rollen sehen.",
+    "roles.edit": "Rollen bearbeiten.",
+    "roles.view": "Rollen sehen.",
+    "users.edit-roles": "Benutzern Rollen zuweisen oder entziehen.",
+    "users.view": "Benutzer mit zugewiesenen Rolen sehen."
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/de/template-tags.json b/modules-available/permissionmanager/lang/de/template-tags.json
index 2ec25b37..52073dee 100644
--- a/modules-available/permissionmanager/lang/de/template-tags.json
+++ b/modules-available/permissionmanager/lang/de/template-tags.json
@@ -1,18 +1,20 @@
 {
     "lang_addRole": "Rollen erteilen",
     "lang_addRoleHeading": "Neue Rolle hinzuf\u00fcgen",
-    "lang_deleteCheck": "Sind Sie sich sicher, dass Sie diese Rolle l\u00f6schen wollen?",
     "lang_editRoleHeading": "Rolle bearbeiten",
     "lang_locationAwareDesc": "Berechtigungen mit diesem Symbol k\u00f6nnen auf bestimmte R\u00e4ume\/Orte beschr\u00e4nkt werden. Alle anderen Berechtigungen sind unabh\u00e4ngig von den f\u00fcr diese Rolle ausgew\u00e4hlten Orten.",
     "lang_locations": "R\u00e4ume",
     "lang_moduleName": "Rechtemanager",
     "lang_name": "Name",
     "lang_newRole": "Rolle anlegen",
+    "lang_numAssignedUsers": "Benutzer mit dieser Rolle",
     "lang_permissions": "Rechte",
     "lang_removeRole": "Rollen entziehen",
+    "lang_roleDeleteConfirm": "Sind Sie sich sicher, dass Sie diese Rolle l\u00f6schen m\u00f6chten? Benutzer, denen diese Rolle zugewiesen ist, werden die entsprechenden Berechtigungen verlieren.",
     "lang_roles": "Rollen",
     "lang_searchPlaceholder": "Nach Rollen suchen...",
     "lang_selected": "ausgew\u00e4hlte",
     "lang_selectizePlaceholder": "Nach Rollen filtern...",
-    "lang_users": "Nutzer"
+    "lang_users": "Nutzer",
+    "lang_view": "Anzeigen"
 }
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/en/permissions.json b/modules-available/permissionmanager/lang/en/permissions.json
new file mode 100644
index 00000000..9f7263db
--- /dev/null
+++ b/modules-available/permissionmanager/lang/en/permissions.json
@@ -0,0 +1,7 @@
+{
+    "locations.view": "See locations with assigned roles.",
+    "roles.edit": "Edit roles.",
+    "roles.view": "Show roles.",
+    "users.edit-roles": "Assign or remove roles from users.",
+    "users.view": "See users with assigned roles."
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/en/template-tags.json b/modules-available/permissionmanager/lang/en/template-tags.json
index cef23422..b7a1d77a 100644
--- a/modules-available/permissionmanager/lang/en/template-tags.json
+++ b/modules-available/permissionmanager/lang/en/template-tags.json
@@ -1,18 +1,20 @@
 {
     "lang_addRole": "Grant Roles",
     "lang_addRoleHeading": "Add new role",
-    "lang_deleteCheck": "Are you sure you want to delete this role?",
     "lang_editRoleHeading": "Edit role",
     "lang_locationAwareDesc": "Permissions with this symbol can be restricted to certain locations. All other permissions are independent of the locations selected for this role.",
     "lang_locations": "Locations",
     "lang_moduleName": "Permission Manager",
     "lang_name": "Name",
     "lang_newRole": "New Role",
+    "lang_numAssignedUsers": "Users with this role",
     "lang_permissions": "Permissions",
     "lang_removeRole": "Revoke Roles",
+    "lang_roleDeleteConfirm": "Are you sure you want to delete this role? Users currently assigned to this role will lose the according permissions.",
     "lang_roles": "Roles",
     "lang_searchPlaceholder": "Search for roles...",
     "lang_selected": "selected",
     "lang_selectizePlaceholder": "Filter for roles...",
-    "lang_users": "Users"
+    "lang_users": "Users",
+    "lang_view": "View"
 }
\ No newline at end of file
diff --git a/modules-available/permissionmanager/page.inc.php b/modules-available/permissionmanager/page.inc.php
index 1c2d56bf..a78f935f 100644
--- a/modules-available/permissionmanager/page.inc.php
+++ b/modules-available/permissionmanager/page.inc.php
@@ -17,17 +17,21 @@ class Page_PermissionManager extends Page
 
 		$action = Request::any('action', 'show', 'string');
 		if ($action === 'addRoleToUser') {
+			User::assertPermission('users.edit-roles');
 			$users = Request::post('users', '');
 			$roles = Request::post('roles', '');
 			PermissionDbUpdate::addRoleToUser($users, $roles);
 		} elseif ($action === 'removeRoleFromUser') {
+			User::assertPermission('users.edit-roles');
 			$users = Request::post('users', '');
 			$roles = Request::post('roles', '');
 			PermissionDbUpdate::removeRoleFromUser($users, $roles);
 		} elseif ($action === 'deleteRole') {
+			User::assertPermission('roles.edit');
 			$id = Request::post('deleteId', false, 'string');
 			PermissionDbUpdate::deleteRole($id);
 		} elseif ($action === 'saveRole') {
+			User::assertPermission('roles.edit');
 			$roleID = Request::post("roleid", false);
 			$rolename = Request::post("rolename");
 			$locations = self::processLocations(Request::post("locations"));
@@ -44,33 +48,51 @@ class Page_PermissionManager extends Page
 	 */
 	protected function doRender()
 	{
-		$show = Request::get("show", "roles");
+		$show = Request::get("show", false, 'string');
+
+		if ($show === false) {
+			foreach (['roles', 'users', 'locations'] as $show) {
+				if (User::hasPermission($show . '.*'))
+					break;
+			}
+		}
 
 		// switch between tables, but always show menu to switch tables
 		// get menu button colors
-		$buttonColors = array();
+		$data = array();
 		if ($show === "roleEditor") {
-			$buttonColors['groupClass'] = 'slx-fade';
-			$buttonColors['rolesButtonClass'] = 'active';
+			$data['groupClass'] = 'btn-group-muted';
+			$data['rolesButtonClass'] = 'active';
 		} else {
-			$buttonColors[$show . 'ButtonClass'] = 'active';
+			$data[$show . 'ButtonClass'] = 'active';
 		}
+		Permission::addGlobalTags($data['perms'], null, ['roles.*', 'users.*', 'locations.*']);
 
-		Render::addtemplate('header-menu', $buttonColors);
+		Render::addtemplate('header-menu', $data);
 
 		if ($show === "roles") {
-			$data = array("roles" => GetPermissionData::getRoles());
+			User::assertPermission('roles.*');
+			$data = array("roles" => GetPermissionData::getRoles(GetPermissionData::WITH_USER_COUNT));
+			Permission::addGlobalTags($data['perms'], null, ['roles.edit']);
 			Render::addTemplate('rolestable', $data);
 		} elseif ($show === "users") {
-			$data = array("user" => GetPermissionData::getUserData(), "allroles" => GetPermissionData::getRoles());
+			User::assertPermission('users.*');
+			$data = array("user" => GetPermissionData::getUserData());
+			if (User::hasPermission('users.edit-roles')) {
+				$data['allroles'] = GetPermissionData::getRoles();
+			}
+			Permission::addGlobalTags($data['perms'], null, ['users.edit-roles']);
 			Render::addTemplate('role-filter-selectize', $data);
 			Render::addTemplate('userstable', $data);
 		} elseif ($show === "locations") {
+			User::assertPermission('locations.*');
 			$data = array("location" => GetPermissionData::getLocationData(), "allroles" => GetPermissionData::getRoles());
 			Render::addTemplate('role-filter-selectize', $data);
 			Render::addTemplate('locationstable', $data);
 		} elseif ($show === "roleEditor") {
+			User::assertPermission('roles.*');
 			$data = array("cancelShow" => Request::get("cancel", "roles"));
+			Permission::addGlobalTags($data['perms'], null, ['roles.edit']);
 
 			$selectedPermissions = array();
 			$selectedLocations = array();
@@ -83,8 +105,10 @@ class Page_PermissionManager extends Page
 				$selectedLocations = $roleData["locations"];
 			}
 
-			$data["permissionHTML"] = self::generatePermissionHTML(PermissionUtil::getPermissions(), $selectedPermissions);
-			$data["locationHTML"] = self::generateLocationHTML(Location::getTree(), $selectedLocations);
+			$data["permissionHTML"] = self::generatePermissionHTML(PermissionUtil::getPermissions(), $selectedPermissions,
+				false, '', ['perms' => $data['perms']]);
+			$data["locationHTML"] = self::generateLocationHTML(Location::getTree(), $selectedLocations,
+				false, '', ['perms' => $data['perms']]);
 
 			Render::addTemplate('roleeditor', $data);
 		}
@@ -99,7 +123,7 @@ class Page_PermissionManager extends Page
 	 * @param string $permString the prefix permission string with which all permissions in the permission tree should start
 	 * @return string generated html code
 	 */
-	private static function generatePermissionHTML($permissions, $selectedPermissions = array(), $selectAll = false, $permString = "")
+	private static function generatePermissionHTML($permissions, $selectedPermissions = array(), $selectAll = false, $permString = "", $tags = [])
 	{
 		$res = "";
 		$toplevel = $permString == "";
@@ -132,12 +156,12 @@ class Page_PermissionManager extends Page
 				"toplevel" => $toplevel,
 				"checkboxname" => "permissions",
 				"selected" => $selected,
-				"HTML" => $leaf ? "" : self::generatePermissionHTML($v, $selectedPermissions, $selected, $nextPermString),
+				"HTML" => $leaf ? "" : self::generatePermissionHTML($v, $selectedPermissions, $selected, $nextPermString, $tags),
 			);
 			if ($leaf) {
 				$data += $v;
 			}
-			$res .= Render::parse("treenode", $data);
+			$res .= Render::parse("treenode", $data + $tags);
 		}
 		if ($toplevel) {
 			$res = Render::parse("treepanel",
@@ -145,7 +169,7 @@ class Page_PermissionManager extends Page
 					"name" => Dictionary::translateFile("template-tags", "lang_permissions"),
 					"checkboxname" => "permissions",
 					"selected" => $selectAll,
-					"HTML" => $res));
+					"HTML" => $res) + $tags);
 		}
 		return $res;
 	}
@@ -159,7 +183,7 @@ class Page_PermissionManager extends Page
 	 * @param array $toplevel true if the location tree are the children of the root location, false if not
 	 * @return string generated html code
 	 */
-	private static function generateLocationHTML($locations, $selectedLocations = array(), $selectAll = false, $toplevel = true)
+	private static function generateLocationHTML($locations, $selectedLocations = array(), $selectAll = false, $toplevel = true, $tags = [])
 	{
 		$res = "";
 		if ($toplevel && in_array(0, $selectedLocations)) {
@@ -174,7 +198,8 @@ class Page_PermissionManager extends Page
 					"checkboxname" => "locations",
 					"selected" => $selected,
 					"HTML" => array_key_exists("children", $location) ?
-						self::generateLocationHTML($location["children"], $selectedLocations, $selected, false) : ""));
+						self::generateLocationHTML($location["children"], $selectedLocations, $selected, false, $tags) : "")
+				+ $tags);
 		}
 		if ($toplevel) {
 			$res = Render::parse("treepanel",
@@ -182,7 +207,7 @@ class Page_PermissionManager extends Page
 					"name" => Dictionary::translateFile("template-tags", "lang_locations"),
 					"checkboxname" => "locations",
 					"selected" => $selectAll,
-					"HTML" => $res));
+					"HTML" => $res) + $tags);
 		}
 		return $res;
 	}
diff --git a/modules-available/permissionmanager/permissions/permissions.json b/modules-available/permissionmanager/permissions/permissions.json
new file mode 100644
index 00000000..3981a2c3
--- /dev/null
+++ b/modules-available/permissionmanager/permissions/permissions.json
@@ -0,0 +1,17 @@
+{
+	"roles.view": {
+		"location-aware": false
+	},
+	"roles.edit": {
+		"location-aware": false
+	},
+	"users.view": {
+		"location-aware": false
+	},
+	"users.edit-roles": {
+		"location-aware": false
+	},
+	"locations.view": {
+		"location-aware": false
+	}
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/style.css b/modules-available/permissionmanager/style.css
index 8285fdd2..6169b26f 100644
--- a/modules-available/permissionmanager/style.css
+++ b/modules-available/permissionmanager/style.css
@@ -55,3 +55,7 @@ td > .label {
         column-count: 3;
     }
 }
+
+.btn-group-muted > button {
+    color: #aaa;
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/templates/header-menu.html b/modules-available/permissionmanager/templates/header-menu.html
index ce31d237..91bfa3af 100644
--- a/modules-available/permissionmanager/templates/header-menu.html
+++ b/modules-available/permissionmanager/templates/header-menu.html
@@ -4,17 +4,17 @@
 			<input type="hidden" name="do" value="permissionmanager">
 
 			<div class="btn-group {{groupClass}}">
-				<button class="btn btn-default {{rolesButtonClass}}" type="submit" name="show" value="roles">
+				<button class="btn btn-default {{rolesButtonClass}}" type="submit" name="show" value="roles" {{perms.roles.disabled}}>
 					<span class="glyphicon glyphicon-education"></span>
 					{{lang_roles}}
 				</button>
 
-				<button class="btn btn-default {{usersButtonClass}}" type="submit" name="show" value="users">
+				<button class="btn btn-default {{usersButtonClass}}" type="submit" name="show" value="users" {{perms.users.disabled}}>
 					<span class="glyphicon glyphicon-user"></span>
 					{{lang_users}}
 				</button>
 
-				<button class="btn btn-default {{locationsButtonClass}}" type="submit" name="show" value="locations">
+				<button class="btn btn-default {{locationsButtonClass}}" type="submit" name="show" value="locations" {{perms.locations.disabled}}>
 					<span class="glyphicon glyphicon-home"></span>
 					{{lang_locations}}
 				</button>
diff --git a/modules-available/permissionmanager/templates/roleeditor.html b/modules-available/permissionmanager/templates/roleeditor.html
index d50f2145..8524427b 100644
--- a/modules-available/permissionmanager/templates/roleeditor.html
+++ b/modules-available/permissionmanager/templates/roleeditor.html
@@ -22,7 +22,10 @@
 
 	<div class="pull-right">
 		<a href="?do=permissionmanager&amp;show={{cancelShow}}" class="btn btn-default">{{lang_cancel}}</a>
-		<button type="submit" class="btn btn-primary"><span class="glyphicon glyphicon-floppy-disk"></span> {{lang_save}}</button>
+		<button type="submit" class="btn btn-primary" {{perms.roles.edit.disabled}}>
+			<span class="glyphicon glyphicon-floppy-disk"></span>
+			{{lang_save}}
+		</button>
 	</div>
 	<ul class="nav nav-tabs text-center" role="tablist">
 		<li role="presentation" class="active"><a href="#permissions" role="tab" data-toggle="tab">{{lang_permissions}}</a></li>
diff --git a/modules-available/permissionmanager/templates/rolestable.html b/modules-available/permissionmanager/templates/rolestable.html
index 944ab3ae..9ba8d85c 100644
--- a/modules-available/permissionmanager/templates/rolestable.html
+++ b/modules-available/permissionmanager/templates/rolestable.html
@@ -11,7 +11,14 @@
 				<thead>
 					<tr>
 						<th data-sort="string">{{lang_roles}}</th>
-						<th class="text-center slx-smallcol">{{lang_edit}}</th>
+						<th class="text-center slx-smallcol">
+							{{#perms.roles.edit.disabled}}
+							{{lang_view}}
+							{{/perms.roles.edit.disabled}}
+							{{^perms.roles.edit.disabled}}
+							{{lang_edit}}
+							{{/perms.roles.edit.disabled}}
+						</th>
 						<th class="text-center slx-smallcol">{{lang_delete}}</th>
 					</tr>
 				</thead>
@@ -24,7 +31,9 @@
 							<a class="btn btn-xs btn-primary" href="?do=permissionmanager&show=roleEditor&roleid={{roleid}}"><span class="glyphicon glyphicon-edit"></span></a>
 						</td>
 						<td class="text-center">
-							<a class="btn btn-xs btn-danger" href="#deleteModal" data-toggle="modal" data-target="#deleteModal" onclick="deleteRole('{{roleid}}')"><span class="glyphicon glyphicon-trash"></span></a>
+							<button type="button" class="btn btn-xs btn-danger" data-toggle="modal" data-target="#deleteModal" onclick="deleteRole('{{roleid}}', '{{users}}')" {{perms.roles.edit.disabled}}>
+								<span class="glyphicon glyphicon-trash"></span>
+							</button>
 						</td>
 					</tr>
 				{{/roles}}
@@ -42,10 +51,11 @@
 					<h4 class="modal-title" id="myModalLabel">{{lang_delete}}</h4>
 				</div>
 				<div class="modal-body">
-					{{lang_deleteCheck}}
+					<p>{{lang_roleDeleteConfirm}}</p>
+					{{lang_numAssignedUsers}}: <span id="delete-role-users"></span>
 				</div>
 				<div class="modal-footer">
-					<input type="hidden" id="deleteId" name="deleteId" value=""/>
+					<input type="hidden" id="delete-role-id" name="deleteId" value="">
 					<button type="button" class="btn btn-default" data-dismiss="modal">{{lang_cancel}}</button>
 					<button type="submit" name="action" value="deleteRole" class="btn btn-danger"><span class="glyphicon glyphicon-trash"></span> {{lang_delete}}</button>
 				</div>
@@ -56,12 +66,13 @@
 </form>
 
 <div class="text-right">
-	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
+	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success {{perms.roles.edit.disabled}}"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
 </div>
 
 <script>
-	function deleteRole($roleid) {
-		$(".modal-footer #deleteId").val($roleid);
+	function deleteRole(roleid, users) {
+		$("#delete-role-id").val(roleid);
+		$("#delete-role-users").text(users);
 	}
 
 	function searchFieldFunction() {
diff --git a/modules-available/permissionmanager/templates/treenode.html b/modules-available/permissionmanager/templates/treenode.html
index a4a3d7b5..f8ee3df5 100644
--- a/modules-available/permissionmanager/templates/treenode.html
+++ b/modules-available/permissionmanager/templates/treenode.html
@@ -1,7 +1,7 @@
 {{#toplevel}}<ul>{{/toplevel}}
 <li {{#description}}title="{{description}}" data-toggle="tooltip" data-placement="left"{{/description}}>
 	<div class='checkbox'>
-		<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" {{#selected}}checked{{/selected}}>
+		<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" {{#selected}}checked{{/selected}} {{edit_disabled}} {{perms.roles.edit.disabled}}>
 		<label for="{{id}}">
 			{{name}}
 			{{#location-aware}}<span class="glyphicon glyphicon-home text-muted"></span>{{/location-aware}}
diff --git a/modules-available/permissionmanager/templates/treepanel.html b/modules-available/permissionmanager/templates/treepanel.html
index cda848a0..eccecb58 100644
--- a/modules-available/permissionmanager/templates/treepanel.html
+++ b/modules-available/permissionmanager/templates/treepanel.html
@@ -1,7 +1,7 @@
 <div class="panel panel-primary tree-panel">
 	<div class="panel-heading">
 		<div class="checkbox">
-			<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" class="master-checkbox" {{#selected}}checked{{/selected}}>
+			<input id="{{id}}" name="{{checkboxname}}[]" value="{{id}}" type="checkbox" class="master-checkbox" {{#selected}}checked{{/selected}} {{perms.roles.edit.disabled}}>
 			<label for="{{id}}">{{name}}</label>
 		</div>
 	</div>
diff --git a/modules-available/roomplanner/permissions/permissions.json b/modules-available/roomplanner/permissions/permissions.json
new file mode 100644
index 00000000..f7bc3479
--- /dev/null
+++ b/modules-available/roomplanner/permissions/permissions.json
@@ -0,0 +1,10 @@
+{
+	"compilerOptions": {
+		"module": "commonjs",
+		"target": "es5",
+		"sourceMap": true
+	},
+	"exclude": [
+		"node_modules"
+	]
+}
\ No newline at end of file
-- 
cgit v1.2.3-55-g7522


From 5014f09a5aa30b1c3aa1e35e67a183086a212052 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Fri, 13 Apr 2018 12:30:43 +0200
Subject: [permissionmanager] Add role description field; install some default
 rules

Closes #3356
---
 .../inc/getpermissiondata.inc.php                  |   4 +-
 .../inc/permissiondbupdate.inc.php                 |  31 ++++---
 .../permissionmanager/install.inc.php              | 103 +++++++++++++++++++++
 .../permissionmanager/lang/de/template-tags.json   |   5 +-
 .../permissionmanager/lang/en/template-tags.json   |   5 +-
 modules-available/permissionmanager/page.inc.php   |  29 +++---
 .../permissionmanager/templates/roleeditor.html    |   8 +-
 .../permissionmanager/templates/rolestable.html    |   6 +-
 8 files changed, 156 insertions(+), 35 deletions(-)

(limited to 'modules-available/permissionmanager/templates/rolestable.html')

diff --git a/modules-available/permissionmanager/inc/getpermissiondata.inc.php b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
index fc18de99..660c94ae 100644
--- a/modules-available/permissionmanager/inc/getpermissiondata.inc.php
+++ b/modules-available/permissionmanager/inc/getpermissiondata.inc.php
@@ -84,7 +84,7 @@ class GetPermissionData
 		if (!empty($joins)) {
 			$joins .= ' GROUP BY r.roleid';
 		}
-		return Database::queryAll("SELECT r.roleid, r.rolename $cols FROM role r
+		return Database::queryAll("SELECT r.roleid, r.rolename, r.roledescription $cols FROM role r
 			$joins
 			ORDER BY rolename ASC");
 	}
@@ -97,7 +97,7 @@ class GetPermissionData
 	 */
 	public static function getRoleData($roleid)
 	{
-		$query = "SELECT roleid, rolename FROM role WHERE roleid = :roleid";
+		$query = "SELECT roleid, rolename, roledescription FROM role WHERE roleid = :roleid";
 		$data = Database::queryFirst($query, array("roleid" => $roleid));
 		$query = "SELECT roleid, locationid FROM role_x_location WHERE roleid = :roleid";
 		$res = Database::simpleQuery($query, array("roleid" => $roleid));
diff --git a/modules-available/permissionmanager/inc/permissiondbupdate.inc.php b/modules-available/permissionmanager/inc/permissiondbupdate.inc.php
index 1d6367af..0cd89b3a 100644
--- a/modules-available/permissionmanager/inc/permissiondbupdate.inc.php
+++ b/modules-available/permissionmanager/inc/permissiondbupdate.inc.php
@@ -54,7 +54,7 @@ class PermissionDbUpdate
 	/**
 	 * Delete role from the role table.
 	 *
-	 * @param string $roleid roleid
+	 * @param int $roleid roleid
 	 */
 	public static function deleteRole($roleid)
 	{
@@ -64,41 +64,42 @@ class PermissionDbUpdate
 	/**
 	 * Save changes to a role or create a new one.
 	 *
-	 * @param string $rolename rolename
+	 * @param string $roleName rolename
 	 * @param int[] $locations array of locations
 	 * @param string[] $permissions array of permissions
-	 * @param string|null $roleid roleid or null if the role does not exist yet
+	 * @param int|null $roleId roleid or null if the role does not exist yet
 	 */
-	public static function saveRole($rolename, $locations, $permissions, $roleid = null)
+	public static function saveRole($roleName, $roleDescription, $locations, $permissions, $roleId = null)
 	{
 		foreach ($permissions as &$permission) {
 			$permission = strtolower($permission);
 		}
 		unset($permission);
-		if ($roleid) {
-			Database::exec("UPDATE role SET rolename = :rolename WHERE roleid = :roleid",
-				array("rolename" => $rolename, "roleid" => $roleid));
+		if ($roleId) {
+			Database::exec("UPDATE role SET rolename = :rolename, roledescription = :roledescription WHERE roleid = :roleid",
+				array("rolename" => $roleName, "roledescription" => $roleDescription, "roleid" => $roleId));
 			Database::exec("DELETE FROM role_x_location
 					WHERE roleid = :roleid AND (locationid NOT IN (:locations) OR locationid IS NULL)",
-				array("roleid" => $roleid, 'locations' => $locations));
+				array("roleid" => $roleId, 'locations' => $locations));
 			Database::exec("DELETE FROM role_x_permission
 					WHERE roleid = :roleid AND permissionid NOT IN (:permissions)",
-				array("roleid" => $roleid, 'permissions' => $permissions));
+				array("roleid" => $roleId, 'permissions' => $permissions));
 		} else {
-			Database::exec("INSERT INTO role (rolename) VALUES (:rolename)", array("rolename" => $rolename));
-			$roleid = Database::lastInsertId();
+			Database::exec("INSERT INTO role (rolename, roledescription) VALUES (:rolename, :roledescription)",
+				array("rolename" => $roleName, "roledescription" => $roleDescription));
+			$roleId = Database::lastInsertId();
 		}
 
 		if (!empty($locations)) {
-			$arg = array_map(function ($loc) use ($roleid) {
-				return compact('roleid', 'loc');
+			$arg = array_map(function ($loc) use ($roleId) {
+				return compact('roleId', 'loc');
 			}, $locations);
 			Database::exec("INSERT IGNORE INTO role_x_location (roleid, locationid) VALUES :arg", ['arg' => $arg]);
 		}
 
 		if (!empty($permissions)) {
-			$arg = array_map(function ($perm) use ($roleid) {
-				return compact('roleid', 'perm');
+			$arg = array_map(function ($perm) use ($roleId) {
+				return compact('roleId', 'perm');
 			}, $permissions);
 			Database::exec("INSERT IGNORE INTO role_x_permission (roleid, permissionid) VALUES :arg", ['arg' => $arg]);
 		}
diff --git a/modules-available/permissionmanager/install.inc.php b/modules-available/permissionmanager/install.inc.php
index afa5dd7e..480460db 100644
--- a/modules-available/permissionmanager/install.inc.php
+++ b/modules-available/permissionmanager/install.inc.php
@@ -5,6 +5,7 @@ $res = array();
 $res[] = tableCreate('role', "
 	roleid int(10) unsigned NOT NULL AUTO_INCREMENT,
 	rolename varchar(200) NOT NULL,
+	roledescription TEXT,
 	PRIMARY KEY (roleid)
 ");
 
@@ -100,6 +101,108 @@ if (!tableExists('user') || !tableExists('location')) {
 		$res[] = UPDATE_DONE;
 	}
 }
+
+// 2018-04-13 role description field; add a couple default roles
+if (!tableHasColumn('role', 'roledescription')) {
+	$alter = Database::exec("ALTER TABLE role ADD roledescription TEXT");
+	if ($alter === false)
+		finalResponse(UPDATE_FAILED, 'Cannot add roledescription field to table role: ' . Database::lastError());
+	$res[] = UPDATE_DONE;
+}
+
+if (!tableHasColumn('role', 'roledescription')) {
+	finalResponse(UPDATE_RETRY, 'Try again later');
+}
+
+if (Database::exec("INSERT INTO `role` VALUES
+			(1,'Super-Admin', 'Hat keinerlei Zugriffsbeschränkungen'),
+			(2,'Admin', 'Alles bis auf Rechte-/Nutzerverwaltung'),
+			(3,'Prüfungsadmin', 'Kann E-Prüfungen verwalten, Prüfungsmodus einschalten, etc.'),
+			(4,'Lesezugriff', 'Kann auf die meisten Seiten zugreifen, jedoch keine Änderungen vornehmen')") !== false) {
+	// Success, there probably were no roles before, keep going
+	// Assign roles to location (all)
+	Database::exec("INSERT INTO `role_x_location` VALUES (1,NULL),(2,NULL),(3,NULL),(4,NULL)");
+	// Assign permissions to roles
+	Database::exec("INSERT INTO `role_x_permission` VALUES
+			(3,'exams.exams.*'),
+			(3,'rebootcontrol.action.*'),
+			(3,'statistics.hardware.projectors.view'),
+			(3,'statistics.machine.note.*'),
+			(3,'statistics.machine.view-details'),
+			(3,'statistics.view.*'),
+			(3,'syslog.view'),
+			
+			(1,'*'),
+			
+			(4,'adduser.user.view-list'),
+			(4,'backup.create'),
+			(4,'baseconfig.view'),
+			(4,'dnbd3.access-page'),
+			(4,'dnbd3.refresh'),
+			(4,'dnbd3.view.details'),
+			(4,'dozmod.actionlog.view'),
+			(4,'dozmod.users.view'),
+			(4,'eventlog.view'),
+			(4,'exams.exams.view'),
+			(4,'locationinfo.backend.check'),
+			(4,'locationinfo.panel.list'),
+			(4,'locations.location.view'),
+			(4,'minilinux.view'),
+			(4,'news.*'),
+			(4,'permissionmanager.locations.view'),
+			(4,'permissionmanager.roles.view'),
+			(4,'permissionmanager.users.view'),
+			(4,'runmode.list-all'),
+			(4,'serversetup.access-page'),
+			(4,'serversetup.download'),
+			(4,'statistics.hardware.projectors.view'),
+			(4,'statistics.machine.note.view'),
+			(4,'statistics.machine.view-details'),
+			(4,'statistics.view.*'),
+			(4,'statistics_reporting.reporting.download'),
+			(4,'statistics_reporting.table.export'),
+			(4,'statistics_reporting.table.view.*'),
+			(4,'sysconfig.config.view-list'),
+			(4,'sysconfig.module.download'),
+			(4,'sysconfig.module.view-list'),
+			(4,'syslog.view'),
+			(4,'systemstatus.show.overview.*'),
+			(4,'systemstatus.tab.*'),
+			(4,'webinterface.access-page'),
+			
+			(2,'adduser.user.view-list'),
+			(2,'backup.*'),
+			(2,'baseconfig.*'),
+			(2,'dnbd3.*'),
+			(2,'dozmod.*'),
+			(2,'eventlog.view'),
+			(2,'exams.exams.*'),
+			(2,'locationinfo.*'),
+			(2,'locations.*'),
+			(2,'minilinux.*'),
+			(2,'news.*'),
+			(2,'permissionmanager.locations.view'),
+			(2,'permissionmanager.roles.view'),
+			(2,'permissionmanager.users.view'),
+			(2,'rebootcontrol.*'),
+			(2,'roomplanner.edit'),
+			(2,'runmode.list-all'),
+			(2,'serversetup.*'),
+			(2,'statistics.*'),
+			(2,'statistics_reporting.*'),
+			(2,'sysconfig.*'),
+			(2,'syslog.*'),
+			(2,'systemstatus.*'),
+			(2,'vmstore.edit'),
+			(2,'webinterface.*')");
+	// Asign the first user to the superadmin role
+	Database::exec("INSERT INTO `role_x_user` VALUES (1,1)");
+	$res[] = UPDATE_DONE;
+}
+
+//
+//
+
 if (in_array(UPDATE_DONE, $res)) {
 	finalResponse(UPDATE_DONE, 'Tables created successfully');
 }
diff --git a/modules-available/permissionmanager/lang/de/template-tags.json b/modules-available/permissionmanager/lang/de/template-tags.json
index a4fc990b..504ef6d2 100644
--- a/modules-available/permissionmanager/lang/de/template-tags.json
+++ b/modules-available/permissionmanager/lang/de/template-tags.json
@@ -1,6 +1,7 @@
 {
     "lang_addRole": "Rollen erteilen",
     "lang_addRoleHeading": "Neue Rolle hinzuf\u00fcgen",
+    "lang_description": "Beschreibung",
     "lang_editRoleHeading": "Rolle bearbeiten",
     "lang_locationAwareDesc": "Berechtigungen mit diesem Symbol k\u00f6nnen auf bestimmte R\u00e4ume\/Orte beschr\u00e4nkt werden. Alle anderen Berechtigungen sind unabh\u00e4ngig von den f\u00fcr diese Rolle ausgew\u00e4hlten Orten.",
     "lang_locations": "R\u00e4ume",
@@ -8,9 +9,9 @@
     "lang_name": "Name",
     "lang_newRole": "Rolle anlegen",
     "lang_numAssignedUsers": "Benutzer mit dieser Rolle",
+    "lang_permission": "Berechtigung",
     "lang_permissionDeniedBody": "Ihnen fehlt eine oder mehrere Berechtigungen, um auf diese Seite oder Funktion zuzugreifen.",
     "lang_permissionDeniedHeader": "Zugriff verweigert",
-    "lang_permission": "Berechtigung",
     "lang_permissions": "Rechte",
     "lang_removeRole": "Rollen entziehen",
     "lang_roleDeleteConfirm": "Sind Sie sich sicher, dass Sie diese Rolle l\u00f6schen m\u00f6chten? Benutzer, denen diese Rolle zugewiesen ist, werden die entsprechenden Berechtigungen verlieren.",
@@ -20,4 +21,4 @@
     "lang_selectizePlaceholder": "Nach Rollen filtern...",
     "lang_users": "Nutzer",
     "lang_view": "Anzeigen"
-}
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/lang/en/template-tags.json b/modules-available/permissionmanager/lang/en/template-tags.json
index 92c3ac26..6f1fa614 100644
--- a/modules-available/permissionmanager/lang/en/template-tags.json
+++ b/modules-available/permissionmanager/lang/en/template-tags.json
@@ -1,6 +1,7 @@
 {
     "lang_addRole": "Grant Roles",
     "lang_addRoleHeading": "Add new role",
+    "lang_description": "Description",
     "lang_editRoleHeading": "Edit role",
     "lang_locationAwareDesc": "Permissions with this symbol can be restricted to certain locations. All other permissions are independent of the locations selected for this role.",
     "lang_locations": "Locations",
@@ -8,9 +9,9 @@
     "lang_name": "Name",
     "lang_newRole": "New Role",
     "lang_numAssignedUsers": "Users with this role",
+    "lang_permission": "Permission",
     "lang_permissionDeniedBody": "You are missing one or more permissions to access this page or functionality.",
     "lang_permissionDeniedHeader": "Access denied",
-    "lang_permission": "Permission",
     "lang_permissions": "Permissions",
     "lang_removeRole": "Revoke Roles",
     "lang_roleDeleteConfirm": "Are you sure you want to delete this role? Users currently assigned to this role will lose the according permissions.",
@@ -20,4 +21,4 @@
     "lang_selectizePlaceholder": "Filter for roles...",
     "lang_users": "Users",
     "lang_view": "View"
-}
+}
\ No newline at end of file
diff --git a/modules-available/permissionmanager/page.inc.php b/modules-available/permissionmanager/page.inc.php
index 11b5b028..462d3163 100644
--- a/modules-available/permissionmanager/page.inc.php
+++ b/modules-available/permissionmanager/page.inc.php
@@ -28,15 +28,24 @@ class Page_PermissionManager extends Page
 			PermissionDbUpdate::removeRoleFromUser($users, $roles);
 		} elseif ($action === 'deleteRole') {
 			User::assertPermission('roles.edit');
-			$id = Request::post('deleteId', false, 'string');
+			$id = Request::post('deleteId', false, 'int');
 			PermissionDbUpdate::deleteRole($id);
 		} elseif ($action === 'saveRole') {
 			User::assertPermission('roles.edit');
-			$roleID = Request::post("roleid", false);
-			$rolename = Request::post("rolename");
-			$locations = self::processLocations(Request::post("locations"));
+			$roleID = Request::post("roleid", false, 'int');
+			if ($roleID === false) {
+				Message::addError('main.parameter-missing', 'roleid');
+				Util::redirect('?do=permissionmanager');
+			}
+			$roleName = Request::post("rolename", '', 'string');
+			if (empty($roleName)) {
+				Message::addError('main.parameter-empty', 'rolename');
+				Util::redirect('?do=permissionmanager');
+			}
+			$roleDescription = Request::post('roledescription', '', 'string');
+			$locations = self::processLocations(Request::post("locations", [], 'array'));
 			$permissions = self::processPermissions(Request::post("permissions"));
-			PermissionDbUpdate::saveRole($rolename, $locations, $permissions, $roleID);
+			PermissionDbUpdate::saveRole($roleName, $roleDescription, $locations, $permissions, $roleID);
 		}
 		if (Request::isPost()) {
 			Util::redirect('?do=permissionmanager&show=' . Request::get("show", "roles"));
@@ -100,18 +109,16 @@ class Page_PermissionManager extends Page
 			Render::addTemplate('locationstable', $data);
 		} elseif ($show === "roleEditor") {
 			User::assertPermission('roles.*');
-			$data = array("cancelShow" => Request::get("cancel", "roles"));
+			$data = array("cancelShow" => Request::get("cancel", "roles", 'string'));
 			Permission::addGlobalTags($data['perms'], null, ['roles.edit']);
 
 			$selectedPermissions = array();
 			$selectedLocations = array();
 			$roleid = Request::get("roleid", false, 'int');
 			if ($roleid !== false) {
-				$roleData = GetPermissionData::getRoleData($roleid);
-				$data["roleid"] = $roleid;
-				$data["rolename"] = $roleData["rolename"];
-				$selectedPermissions = $roleData["permissions"];
-				$selectedLocations = $roleData["locations"];
+				$data += GetPermissionData::getRoleData($roleid);
+				$selectedPermissions = $data["permissions"];
+				$selectedLocations = $data["locations"];
 			}
 
 			$data["permissionHTML"] = self::generatePermissionHTML(PermissionUtil::getPermissions(), $selectedPermissions,
diff --git a/modules-available/permissionmanager/templates/roleeditor.html b/modules-available/permissionmanager/templates/roleeditor.html
index 38493d5d..c464c1fc 100644
--- a/modules-available/permissionmanager/templates/roleeditor.html
+++ b/modules-available/permissionmanager/templates/roleeditor.html
@@ -13,11 +13,17 @@
 	<input type="hidden" name="roleid" value="{{roleid}}">
 
 	<div class="input-group">
-	<span class="input-group-addon">
+	<span class="input-group-addon slx-ga">
 		<label for="rolename">{{lang_name}}</label>
 	</span>
 		<input id="rolename" name="rolename" value="{{rolename}}" type="text" class="form-control" required>
 	</div>
+	<div class="input-group">
+		<span class="input-group-addon slx-ga">
+			<label for="roledescription">{{lang_description}}</label>
+		</span>
+		<input id="roledescription" name="roledescription" value="{{roledescription}}" type="text" class="form-control">
+	</div>
 	<br>
 
 	<div class="pull-right">
diff --git a/modules-available/permissionmanager/templates/rolestable.html b/modules-available/permissionmanager/templates/rolestable.html
index 9ba8d85c..d520db33 100644
--- a/modules-available/permissionmanager/templates/rolestable.html
+++ b/modules-available/permissionmanager/templates/rolestable.html
@@ -11,6 +11,7 @@
 				<thead>
 					<tr>
 						<th data-sort="string">{{lang_roles}}</th>
+						<th data-sort="string">{{lang_description}}</th>
 						<th class="text-center slx-smallcol">
 							{{#perms.roles.edit.disabled}}
 							{{lang_view}}
@@ -27,8 +28,9 @@
 				{{#roles}}
 					<tr>
 						<td class="rolename">{{rolename}}</td>
+						<td class="text-muted"><table class="slx-ellipsis"><tr><td>{{roledescription}}</td></tr></table></td>
 						<td class="text-center">
-							<a class="btn btn-xs btn-primary" href="?do=permissionmanager&show=roleEditor&roleid={{roleid}}"><span class="glyphicon glyphicon-edit"></span></a>
+							<a class="btn btn-xs btn-primary" href="?do=permissionmanager&amp;show=roleEditor&amp;roleid={{roleid}}"><span class="glyphicon glyphicon-edit"></span></a>
 						</td>
 						<td class="text-center">
 							<button type="button" class="btn btn-xs btn-danger" data-toggle="modal" data-target="#deleteModal" onclick="deleteRole('{{roleid}}', '{{users}}')" {{perms.roles.edit.disabled}}>
@@ -66,7 +68,7 @@
 </form>
 
 <div class="text-right">
-	<a href="?do=permissionmanager&show=roleEditor" class="btn btn-success {{perms.roles.edit.disabled}}"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
+	<a href="?do=permissionmanager&amp;show=roleEditor" class="btn btn-success {{perms.roles.edit.disabled}}"><span class="glyphicon glyphicon-plus"></span> {{lang_newRole}}</a>
 </div>
 
 <script>
-- 
cgit v1.2.3-55-g7522