Anomalie #1647 » group_permissions.patch
| galette/lib/Galette/Entity/Group.php | ||
|---|---|---|
|
$this->login = $login;
|
||
|
return $this;
|
||
|
}
|
||
|
/**
|
||
|
* Can current logged-in user edit group
|
||
|
*
|
||
|
* @param Login $login Login instance
|
||
|
*
|
||
|
* @return boolean
|
||
|
*/
|
||
|
public function canEdit(Login $login): bool
|
||
|
{
|
||
|
global $preferences;
|
||
|
//admin and staff users can edit
|
||
|
if ($login->isAdmin() || $login->isStaff()) {
|
||
|
return true;
|
||
|
}
|
||
|
//group managers can edit groups they manage when pref is on
|
||
|
if ($preferences->pref_bool_groupsmanagers_edit_member && $this->isManager($login)) {
|
||
|
return true;
|
||
|
}
|
||
|
return false;
|
||
|
}
|
||
|
}
|
||
|
-
|
||
| galette/lib/Galette/Controllers/Crud/GroupsController.php | ||
|---|---|---|
|
{
|
||
|
$post = $request->getParsedBody();
|
||
|
$group = new Group($id);
|
||
|
if (!$group->canEdit($this->login)) {
|
||
|
throw new \RuntimeException('Trying to edit group without appropriate permissions');
|
||
|
}
|
||
|
$group->setName($post['group_name']);
|
||
|
try {
|
||
|
-
|
||
| galette/lib/Galette/Controllers/Crud/GroupsController.php | ||
|---|---|---|
|
$post = $request->getParsedBody();
|
||
|
$id = $post['id_group'];
|
||
|
$group = new Group((int)$id);
|
||
|
if (!$group->canEdit($this->login)) {
|
||
|
throw new \RuntimeException('Trying to edit group without appropriate permissions');
|
||
|
}
|
||
|
$groups = new Groups($this->zdb, $this->login);
|
||
|
-
|
||
| galette/templates/default/elements/group.html.twig | ||
|---|---|---|
|
{% set can_edit = login.isGroupManager() and preferences.pref_bool_groupsmanagers_edit_groups or login.isAdmin() or login.isStaff() %}
|
||
|
{% set can_edit = group.canEdit(login) %}
|
||
|
{% set managers = group.getManagers() %}
|
||
|
{% set members = group.getMembers() %}
|
||