diff --git a/app/Controller/Base.php b/app/Controller/Base.php index e9957bbd6..e07aabf73 100644 --- a/app/Controller/Base.php +++ b/app/Controller/Base.php @@ -31,6 +31,7 @@ use Model\LastLogin; * @property \Model\Task $task * @property \Model\TaskHistory $taskHistory * @property \Model\TaskExport $taskExport + * @property \Model\TaskPermission $taskPermission * @property \Model\TaskValidator $taskValidator * @property \Model\CommentHistory $commentHistory * @property \Model\SubtaskHistory $subtaskHistory @@ -242,6 +243,10 @@ abstract class Base */ protected function taskLayout($template, array $params) { + if (isset($params['task']) && $this->taskPermission->canRemoveTask($params['task']) === false) { + $params['hide_remove_menu'] = true; + } + $content = $this->template->load($template, $params); $params['task_content_for_layout'] = $content; diff --git a/app/Controller/Task.php b/app/Controller/Task.php index 7bb989c6a..28db5c288 100644 --- a/app/Controller/Task.php +++ b/app/Controller/Task.php @@ -289,6 +289,10 @@ class Task extends Base { $task = $this->getTask(); + if (! $this->taskPermission->canRemoveTask($task)) { + $this->forbidden(); + } + if ($this->request->getStringParam('confirmation') === 'yes') { $this->checkCSRFParam(); diff --git a/app/Model/TaskPermission.php b/app/Model/TaskPermission.php new file mode 100644 index 000000000..2ab154f45 --- /dev/null +++ b/app/Model/TaskPermission.php @@ -0,0 +1,32 @@ +acl->isAdminUser()) { + return true; + } + else if (isset($task['creator_id']) && $task['creator_id'] == $this->acl->getUserId()) { + return true; + } + + return false; + } +} diff --git a/app/Templates/task_layout.php b/app/Templates/task_layout.php index 96c456082..ca0a413f3 100644 --- a/app/Templates/task_layout.php +++ b/app/Templates/task_layout.php @@ -7,7 +7,7 @@
- $task)) ?> + $task, 'hide_remove_menu' => isset($hide_remove_menu))) ?>
diff --git a/app/Templates/task_sidebar.php b/app/Templates/task_sidebar.php index 4d363fecf..4cffd5fa7 100644 --- a/app/Templates/task_sidebar.php +++ b/app/Templates/task_sidebar.php @@ -18,7 +18,9 @@ -
  • + +
  • +
    \ No newline at end of file diff --git a/tests/units/TaskPermissionTest.php b/tests/units/TaskPermissionTest.php new file mode 100644 index 000000000..660369906 --- /dev/null +++ b/tests/units/TaskPermissionTest.php @@ -0,0 +1,100 @@ +registry); + $tp = new TaskPermission($this->registry); + $p = new Project($this->registry); + $u = new User($this->registry); + + $this->assertTrue($u->create(array('username' => 'toto', 'password' => '123456'))); + $this->assertTrue($u->create(array('username' => 'toto2', 'password' => '123456'))); + $this->assertEquals(1, $p->create(array('name' => 'Project #1'))); + $this->assertEquals(1, $t->create(array('title' => 'Task #1', 'project_id' => 1, 'creator_id' => 1))); + $this->assertEquals(2, $t->create(array('title' => 'Task #2', 'project_id' => 1, 'creator_id' => 2))); + $this->assertEquals(3, $t->create(array('title' => 'Task #3', 'project_id' => 1, 'creator_id' => 3))); + $this->assertEquals(4, $t->create(array('title' => 'Task #4', 'project_id' => 1))); + + // User #1 can remove everything + $user = $u->getbyId(1); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(1); + $this->assertNotEmpty($task); + $this->assertTrue($tp->canRemoveTask($task)); + + // User #2 can't remove the task #1 + $user = $u->getbyId(2); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(1); + $this->assertNotEmpty($task); + $this->assertFalse($tp->canRemoveTask($task)); + + // User #1 can remove everything + $user = $u->getbyId(1); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(2); + $this->assertNotEmpty($task); + $this->assertTrue($tp->canRemoveTask($task)); + + // User #2 can remove his own task + $user = $u->getbyId(2); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(2); + $this->assertNotEmpty($task); + $this->assertTrue($tp->canRemoveTask($task)); + + // User #1 can remove everything + $user = $u->getbyId(1); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(3); + $this->assertNotEmpty($task); + $this->assertTrue($tp->canRemoveTask($task)); + + // User #2 can't remove the task #3 + $user = $u->getbyId(2); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(3); + $this->assertNotEmpty($task); + $this->assertFalse($tp->canRemoveTask($task)); + + // User #1 can remove everything + $user = $u->getbyId(1); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(4); + $this->assertNotEmpty($task); + $this->assertTrue($tp->canRemoveTask($task)); + + // User #2 can't remove the task #4 + $user = $u->getbyId(2); + $this->assertNotEmpty($user); + $u->updateSession($user); + + $task = $t->getbyId(4); + $this->assertNotEmpty($task); + $this->assertFalse($tp->canRemoveTask($task)); + } +}