diff --git a/browse.php b/browse.php index 51abbf5..2d4d68f 100755 --- a/browse.php +++ b/browse.php @@ -43,6 +43,8 @@ require_once(KT_LIB_DIR . "/widgets/portlet.inc.php"); require_once(KT_LIB_DIR . '/actions/folderaction.inc.php'); require_once(KT_DIR . '/plugins/ktcore/KTFolderActions.php'); +require_once(KT_LIB_DIR . "/permissions/permissionutil.inc.php"); +require_once(KT_LIB_DIR . "/permissions/permission.inc.php"); /******* NBM's FAMOUS MOVECOLUMN HACK * @@ -683,6 +685,7 @@ class BrowseDispatcher extends KTStandardDispatcher { $aFolderSelection = KTUtil::arrayGet($_REQUEST, 'selection_f' , array()); $aDocumentSelection = KTUtil::arrayGet($_REQUEST, 'selection_d' , array()); + $oPerm = KTPermission::getByName('ktcore.permissions.delete'); // now show the items... $delItems = array(); @@ -696,6 +699,9 @@ class BrowseDispatcher extends KTStandardDispatcher { $folderStr = '' . _('Folders: ') . ''; foreach ($aFolderSelection as $iFolderId) { $oF = Folder::get($iFolderId); + if (!KTPermissionUtil::userHasPermissionOnItem($this->oUser, $oPerm, $oF)) { + $this->errorRedirectToMain(_('You do not have permission to delete the folder: ') . $oF->getName()); + } $delItems['folders'][] = $oF->getName(); } $folderStr .= implode(', ', $delItems['folders']); @@ -705,7 +711,12 @@ class BrowseDispatcher extends KTStandardDispatcher { $documentStr = '' . _('Documents: ') . ''; foreach ($aDocumentSelection as $iDocId) { $oD = Document::get($iDocId); - $delItems['documents'][] = $oD->getName(); + if (!KTPermissionUtil::userHasPermissionOnItem($this->oUser, $oPerm, $oD)) { + $this->errorRedirectToMain(_('You do not have permission to delete the document: ') . $oD->getName()); + } + if (!PEAR::isError($oD)) { + $delItems['documents'][] = $oD->getName(); + } } $documentStr .= implode(', ', $delItems['documents']); } @@ -734,7 +745,7 @@ class BrowseDispatcher extends KTStandardDispatcher { $fFolderId = KTUtil::arrayGet($_REQUEST, 'fFolderId', 1); - + $oPerm = KTPermission::getByName('ktcore.permissions.delete'); $res = KTUtil::arrayGet($_REQUEST,'sReason'); $sReason = $res; if (empty($res)) { @@ -751,17 +762,19 @@ class BrowseDispatcher extends KTStandardDispatcher { $oF = Folder::get($id); if (PEAR::isError($oF) || ($oF == false)) { return $this->errorRedirectToMain(_('Invalid Folder selected.')); - } else { + } else if (!KTPermissionUtil::userHasPermissionOnItem($this->oUser, $oPerm, $oF)) { + return $this->errorRedirectToMain(sprintf(_('You do not have permissions to delete the folder: %s'), $oF->getName())); + } else{ $aFolders[] = $oF; } } foreach ($aDocumentSelection as $id) { $oD = Document::get($id); - if (!Permission::userHasDocumentWritePermission($oD)) { - return $this->errorRedirectToMain(sprintf(_('You do not have permissions to delete the documen: %s'), $oD->getName())); - } + if (PEAR::isError($oD) || ($oD == false)) { return $this->errorRedirectToMain(_('Invalid Document selected.')); + } else if (!KTPermissionUtil::userHasPermissionOnItem($this->oUser, $oPerm, $oD)) { + return $this->errorRedirectToMain(sprintf(_('You do not have permissions to delete the document: %s'), $oD->getName())); } else { $aDocuments[] = $oD; } diff --git a/lib/foldermanagement/folderutil.inc.php b/lib/foldermanagement/folderutil.inc.php index 6129274..8ac0f10 100644 --- a/lib/foldermanagement/folderutil.inc.php +++ b/lib/foldermanagement/folderutil.inc.php @@ -203,8 +203,7 @@ class KTFolderUtil { function delete($oStartFolder, $oUser, $sReason, $aOptions = null) { require_once(KT_LIB_DIR . '/unitmanagement/Unit.inc'); - // FIXME: we need to work out if "write" is the right perm. - $oPerm = KTPermission::getByName('ktcore.permissions.write'); + $oPerm = KTPermission::getByName('ktcore.permissions.delete'); $bIgnorePermissions = KTUtil::arrayGet($aOptions, 'ignore_permissions'); @@ -270,7 +269,7 @@ class KTFolderUtil { // now we can go ahead. foreach ($aDocuments as $oDocument) { - $res = KTDocumentUtil::delete($oDocument, $sReason, 1); // id of destination folder = ROOT + $res = KTDocumentUtil::delete($oDocument, $sReason); if (PEAR::isError($res)) { DBUtil::rollback(); return PEAR::raiseError(_('Delete Aborted. Unexpected failure to delete document: ') . $oDocument->getName() . $res->getMessage()); diff --git a/plugins/ktcore/KTDocumentActions.php b/plugins/ktcore/KTDocumentActions.php index 25b9cbf..c5e5f03 100644 --- a/plugins/ktcore/KTDocumentActions.php +++ b/plugins/ktcore/KTDocumentActions.php @@ -359,7 +359,7 @@ class KTDocumentEditAction extends KTDocumentAction { class KTDocumentDeleteAction extends KTDocumentAction { var $sName = 'ktcore.actions.document.delete'; - var $_sShowPermission = "ktcore.permissions.write"; + var $_sShowPermission = "ktcore.permissions.delete"; function getDisplayName() { return _('Delete');