Peter M. Groen / knowledgetree

Commit 4212e9cd5c419bdc97efa66f87ac50ac4024aebf

Authored by megan_w
1 parent 0b936ff5

KTS-2655 

"Error Message On Removing Permissions but action goes ahead anyway"
Fixed. Added a check to ensure the user doesn't removed his/her own permission to manage security.

Committed by: Megan Watson
Reviewed by: Jonathan Byrne



git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@8162 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 2 changed files with 51 additions and 13 deletions
lib/groups/GroupUtil.php
  View file @4212e9c
... ... @@ -7,32 +7,32 @@
7 7 * KnowledgeTree Open Source Edition
8 8 * Document Management Made Simple
9 9 * Copyright (C) 2004 - 2008 The Jam Warehouse Software (Pty) Limited
10   - *
  10 + *
11 11 * This program is free software; you can redistribute it and/or modify it under
12 12 * the terms of the GNU General Public License version 3 as published by the
13 13 * Free Software Foundation.
14   - *
  14 + *
15 15 * This program is distributed in the hope that it will be useful, but WITHOUT
16 16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17 17 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18 18 * details.
19   - *
  19 + *
20 20 * You should have received a copy of the GNU General Public License
21 21 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22   - *
  22 + *
23 23 * You can contact The Jam Warehouse Software (Pty) Limited, Unit 1, Tramber Place,
24 24 * Blake Street, Observatory, 7925 South Africa. or email info@knowledgetree.com.
25   - *
  25 + *
26 26 * The interactive user interfaces in modified source and object code versions
27 27 * of this program must display Appropriate Legal Notices, as required under
28 28 * Section 5 of the GNU General Public License version 3.
29   - *
  29 + *
30 30 * In accordance with Section 7(b) of the GNU General Public License version 3,
31 31 * these Appropriate Legal Notices must retain the display of the "Powered by
32   - * KnowledgeTree" logo and retain the original copyright notice. If the display of the
  32 + * KnowledgeTree" logo and retain the original copyright notice. If the display of the
33 33 * logo is not reasonably feasible for technical reasons, the Appropriate Legal Notices
34   - * must display the words "Powered by KnowledgeTree" and retain the original
35   - * copyright notice.
  34 + * must display the words "Powered by KnowledgeTree" and retain the original
  35 + * copyright notice.
36 36 * Contributor( s): ______________________________________
37 37 */
38 38  
... ... @@ -304,6 +304,26 @@ class GroupUtil {
304 304 }
305 305 // }}}
306 306  
  307 + function checkUserInGroups($iUserId, $aGroupIds) {
  308 + $sGroupIds = implode(', ', $aGroupIds);
  309 +
  310 + global $default;
  311 + $sTable = $default->users_groups_table;
  312 + $sQuery = "SELECT count(*) AS cnt FROM $sTable WHERE user_id = ? AND group_id IN (?)";
  313 + $aParams = array($iUserId, $sGroupIds);
  314 +
  315 + $res = DBUtil::getOneResult(array($sQuery, $aParams));
  316 +
  317 + if(PEAR::isError($res) || empty($res)){
  318 + return false;
  319 + }
  320 +
  321 + if($res['cnt'] > 0){
  322 + return true;
  323 + }
  324 + return false;
  325 + }
  326 +
307 327 // {{{
308 328 function buildGroupArray() {
309 329 global $default;
... ...
plugins/ktcore/folder/Permissions.php
  View file @4212e9c
... ... @@ -453,11 +453,29 @@ class KTFolderPermissionsAction extends KTFolderAction {
453 453 if (!KTBrowseUtil::inAdminMode($this->oUser, $this->oFolder)) {
454 454 $this->oValidator->userHasPermissionOnItem($this->oUser, $this->_sEditShowPermission, $this->oFolder, $aOptions);
455 455 }
  456 +
  457 + $aFoo = $_REQUEST['foo'];
  458 + $aPermissions = KTPermission::getList();
  459 +
  460 + // Check which groups have permission to manage security
  461 + $aNewGroups = $aFoo[4]['group'];
  462 + $aNewRoles = (isset($aFoo[4]['role']) ? $aFoo[4]['role'] : array());
  463 +
  464 + // Ensure the user is not removing his/her own permission to update the folder permissions (manage security)
  465 + if(!in_array(-3, $aNewRoles)){
  466 + $iUserId = $this->oUser->getId();
  467 + if(!GroupUtil::checkUserInGroups($iUserId, $aNewGroups)){
  468 + // If user no longer has permission, return an error.
  469 + $this->addErrorMessage(_kt('The selected permissions cannot be updated. You will no longer have permission to manage security on this folder.'));
  470 + $this->redirectTo('edit', 'fFolderId=' . $this->oFolder->getId());
  471 + exit(0);
  472 + }
  473 + }
  474 +
  475 +
456 476 require_once(KT_LIB_DIR . '/documentmanagement/observers.inc.php');
457 477 $oPO = KTPermissionObject::get($this->oFolder->getPermissionObjectId());
458   - $aFoo = $_REQUEST['foo'];
459 478  
460   - $aPermissions = KTPermission::getList();
461 479 foreach ($aPermissions as $oPermission) {
462 480 $iPermId = $oPermission->getId();
463 481  
... ... @@ -471,11 +489,11 @@ class KTFolderPermissionsAction extends KTFolderAction {
471 489 'transactionNS' => 'ktcore.transactions.permissions_change',
472 490 'userid' => $_SESSION['userID'],
473 491 'ip' => Session::getClientIP(),
474   - ));
  492 + ));
475 493 $aOptions = array(
476 494 'defaultmessage' => _kt('Error updating permissions'),
477 495 'redirect_to' => array('edit', sprintf('fFolderId=%d', $this->oFolder->getId())),
478   - );
  496 + );
479 497 $this->oValidator->notErrorFalse($oTransaction, $aOptions);
480 498  
481 499 $po =& new JavascriptObserver($this);
... ...