diff --git a/ChangeLog b/ChangeLog
index 6c29301b1..230e99739 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@ Version 1.0.18 (unreleased)
New features:
+* Add new role "Project Administrator"
* Add login bruteforce protection with captcha and account lockdown
* Add new api procedures: getDefaultTaskColor(), getDefaultTaskColors() and getColorList()
* Add user api access
diff --git a/app/Api/User.php b/app/Api/User.php
index 7409a41bb..4884c45cd 100644
--- a/app/Api/User.php
+++ b/app/Api/User.php
@@ -27,7 +27,7 @@ class User extends \Core\Base
return $this->user->remove($user_id);
}
- public function createUser($username, $password, $name = '', $email = '', $is_admin = 0)
+ public function createUser($username, $password, $name = '', $email = '', $is_admin = 0, $is_project_admin = 0)
{
$values = array(
'username' => $username,
@@ -36,14 +36,14 @@ class User extends \Core\Base
'name' => $name,
'email' => $email,
'is_admin' => $is_admin,
+ 'is_project_admin' => $is_project_admin,
);
list($valid,) = $this->user->validateCreation($values);
-
return $valid ? $this->user->create($values) : false;
}
- public function createLdapUser($username = '', $email = '', $is_admin = 0)
+ public function createLdapUser($username = '', $email = '', $is_admin = 0, $is_project_admin = 0)
{
$ldap = new Ldap($this->container);
$user = $ldap->lookup($username, $email);
@@ -58,12 +58,13 @@ class User extends \Core\Base
'email' => $user['email'],
'is_ldap_user' => 1,
'is_admin' => $is_admin,
+ 'is_project_admin' => $is_project_admin,
);
return $this->user->create($values);
}
- public function updateUser($id, $username = null, $name = null, $email = null, $is_admin = null)
+ public function updateUser($id, $username = null, $name = null, $email = null, $is_admin = null, $is_project_admin = null)
{
$values = array(
'id' => $id,
@@ -71,6 +72,7 @@ class User extends \Core\Base
'name' => $name,
'email' => $email,
'is_admin' => $is_admin,
+ 'is_project_admin' => $is_project_admin,
);
foreach ($values as $key => $value) {
diff --git a/app/Controller/Project.php b/app/Controller/Project.php
index 45bc2a460..9309cfae2 100644
--- a/app/Controller/Project.php
+++ b/app/Controller/Project.php
@@ -141,8 +141,15 @@ class Project extends Base
$project = $this->getProject();
$values = $this->request->getValues();
- if ($project['is_private'] == 1 && $this->userSession->isAdmin() && ! isset($values['is_private'])) {
- $values += array('is_private' => 0);
+ if (isset($values['is_private'])) {
+ if (! $this->helper->user->isProjectAdministrationAllowed($project['id'])) {
+ unset($values['is_private']);
+ }
+ }
+ else if ($project['is_private'] == 1 && ! isset($values['is_private'])) {
+ if ($this->helper->user->isProjectAdministrationAllowed($project['id'])) {
+ $values += array('is_private' => 0);
+ }
}
list($valid, $errors) = $this->project->validateModification($values);
@@ -402,7 +409,7 @@ class Project extends Base
*/
public function create(array $values = array(), array $errors = array())
{
- $is_private = $this->request->getIntegerParam('private', $this->userSession->isAdmin() ? 0 : 1);
+ $is_private = $this->request->getIntegerParam('private', $this->userSession->isAdmin() || $this->userSession->isProjectAdmin() ? 0 : 1);
$this->response->html($this->template->layout('project/new', array(
'board_selector' => $this->projectPermission->getAllowedProjects($this->userSession->getId()),
diff --git a/app/Controller/User.php b/app/Controller/User.php
index 10a3a931d..04e574178 100644
--- a/app/Controller/User.php
+++ b/app/Controller/User.php
@@ -303,12 +303,16 @@ class User extends Base
$values = $this->request->getValues();
if ($this->userSession->isAdmin()) {
- $values += array('is_admin' => 0);
+ $values += array('is_admin' => 0, 'is_project_admin' => 0);
}
else {
-
+ // Regular users can't be admin
if (isset($values['is_admin'])) {
- unset($values['is_admin']); // Regular users can't be admin
+ unset($values['is_admin']);
+ }
+
+ if (isset($values['is_project_admin'])) {
+ unset($values['is_project_admin']);
}
}
diff --git a/app/Helper/User.php b/app/Helper/User.php
index c1fff8c63..cb596fb03 100644
--- a/app/Helper/User.php
+++ b/app/Helper/User.php
@@ -77,19 +77,44 @@ class User extends \Core\Base
}
/**
- * Proxy cache helper for acl::isManagerActionAllowed()
+ * Return if the logged user is project admin
*
* @access public
- * @param integer $project_id
* @return boolean
*/
- public function isManager($project_id)
+ public function isProjectAdmin()
+ {
+ return $this->userSession->isProjectAdmin();
+ }
+
+ /**
+ * Check for project administration actions access (Project Admin group)
+ *
+ * @access public
+ * @return boolean
+ */
+ public function isProjectAdministrationAllowed($project_id)
{
if ($this->userSession->isAdmin()) {
return true;
}
- return $this->memoryCache->proxy('acl', 'isManagerActionAllowed', $project_id);
+ return $this->memoryCache->proxy('acl', 'handleProjectAdminPermissions', $project_id);
+ }
+
+ /**
+ * Check for project management actions access (Regular users who are Project Managers)
+ *
+ * @access public
+ * @return boolean
+ */
+ public function isProjectManagementAllowed($project_id)
+ {
+ if ($this->userSession->isAdmin()) {
+ return true;
+ }
+
+ return $this->memoryCache->proxy('acl', 'handleProjectManagerPermissions', $project_id);
}
/**
diff --git a/app/Locale/cs_CZ/translations.php b/app/Locale/cs_CZ/translations.php
index c83fe21ba..d968c0b33 100644
--- a/app/Locale/cs_CZ/translations.php
+++ b/app/Locale/cs_CZ/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/da_DK/translations.php b/app/Locale/da_DK/translations.php
index cd7a6f0dc..c48a3339b 100644
--- a/app/Locale/da_DK/translations.php
+++ b/app/Locale/da_DK/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/de_DE/translations.php b/app/Locale/de_DE/translations.php
index 891ed651d..ca5a3fa4c 100644
--- a/app/Locale/de_DE/translations.php
+++ b/app/Locale/de_DE/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/es_ES/translations.php b/app/Locale/es_ES/translations.php
index a1ba90297..feda7b043 100644
--- a/app/Locale/es_ES/translations.php
+++ b/app/Locale/es_ES/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/fi_FI/translations.php b/app/Locale/fi_FI/translations.php
index 4acd409ce..e65f6a348 100644
--- a/app/Locale/fi_FI/translations.php
+++ b/app/Locale/fi_FI/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/fr_FR/translations.php b/app/Locale/fr_FR/translations.php
index 11a429ee2..3f26afe66 100644
--- a/app/Locale/fr_FR/translations.php
+++ b/app/Locale/fr_FR/translations.php
@@ -1017,4 +1017,6 @@ return array(
'contributors' => 'contributeurs',
'License:' => 'Licence :',
'License' => 'Licence',
+ 'Project Administrator' => 'Administrateur de projet',
+ 'Enter the text below' => 'Entrez le texte ci-dessous',
);
diff --git a/app/Locale/hu_HU/translations.php b/app/Locale/hu_HU/translations.php
index 18737dc12..d697e9de4 100644
--- a/app/Locale/hu_HU/translations.php
+++ b/app/Locale/hu_HU/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/it_IT/translations.php b/app/Locale/it_IT/translations.php
index 93800be6a..665ecfaae 100644
--- a/app/Locale/it_IT/translations.php
+++ b/app/Locale/it_IT/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/ja_JP/translations.php b/app/Locale/ja_JP/translations.php
index 77ebd6504..7b424f863 100644
--- a/app/Locale/ja_JP/translations.php
+++ b/app/Locale/ja_JP/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/nl_NL/translations.php b/app/Locale/nl_NL/translations.php
index fedf0c65f..42c10941d 100644
--- a/app/Locale/nl_NL/translations.php
+++ b/app/Locale/nl_NL/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/pl_PL/translations.php b/app/Locale/pl_PL/translations.php
index e55e2dcd7..0b4a8b7ab 100644
--- a/app/Locale/pl_PL/translations.php
+++ b/app/Locale/pl_PL/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/pt_BR/translations.php b/app/Locale/pt_BR/translations.php
index 8965c5aff..009cd01fd 100644
--- a/app/Locale/pt_BR/translations.php
+++ b/app/Locale/pt_BR/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/pt_PT/translations.php b/app/Locale/pt_PT/translations.php
index 2f294cfd3..0a95b1664 100644
--- a/app/Locale/pt_PT/translations.php
+++ b/app/Locale/pt_PT/translations.php
@@ -1015,4 +1015,6 @@ return array(
'contributors' => 'contribuidores',
'License:' => 'Licença:',
'License' => 'Licença',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/ru_RU/translations.php b/app/Locale/ru_RU/translations.php
index bc02e35aa..d81c5ea06 100644
--- a/app/Locale/ru_RU/translations.php
+++ b/app/Locale/ru_RU/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/sr_Latn_RS/translations.php b/app/Locale/sr_Latn_RS/translations.php
index b6b4ca144..e053eddfb 100644
--- a/app/Locale/sr_Latn_RS/translations.php
+++ b/app/Locale/sr_Latn_RS/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/sv_SE/translations.php b/app/Locale/sv_SE/translations.php
index fd29872a6..97cfe42ff 100644
--- a/app/Locale/sv_SE/translations.php
+++ b/app/Locale/sv_SE/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/th_TH/translations.php b/app/Locale/th_TH/translations.php
index 28e403768..8b2ec5517 100644
--- a/app/Locale/th_TH/translations.php
+++ b/app/Locale/th_TH/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/tr_TR/translations.php b/app/Locale/tr_TR/translations.php
index a014dfc16..c16789f4c 100644
--- a/app/Locale/tr_TR/translations.php
+++ b/app/Locale/tr_TR/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Locale/zh_CN/translations.php b/app/Locale/zh_CN/translations.php
index 71c89d91f..f5fb4d37c 100644
--- a/app/Locale/zh_CN/translations.php
+++ b/app/Locale/zh_CN/translations.php
@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
+ // 'Project Administrator' => '',
+ // 'Enter the text below' => '',
);
diff --git a/app/Model/Acl.php b/app/Model/Acl.php
index a47886bb7..0840f44c2 100644
--- a/app/Model/Acl.php
+++ b/app/Model/Acl.php
@@ -32,7 +32,7 @@ class Acl extends Base
* @access private
* @var array
*/
- private $member_acl = array(
+ private $project_member_acl = array(
'board' => '*',
'comment' => '*',
'file' => '*',
@@ -56,17 +56,27 @@ class Acl extends Base
* @access private
* @var array
*/
- private $manager_acl = array(
+ private $project_manager_acl = array(
'action' => '*',
'analytic' => '*',
'category' => '*',
'column' => '*',
- 'export' => array('tasks', 'subtasks', 'summary'),
+ 'export' => '*',
'project' => array('edit', 'update', 'share', 'integration', 'users', 'alloweverybody', 'allow', 'setowner', 'revoke', 'duplicate', 'disable', 'enable'),
'swimlane' => '*',
'budget' => '*',
);
+ /**
+ * Controllers and actions for project admins
+ *
+ * @access private
+ * @var array
+ */
+ private $project_admin_acl = array(
+ 'project' => array('remove'),
+ );
+
/**
* Controllers and actions for admins
*
@@ -77,8 +87,6 @@ class Acl extends Base
'user' => array('index', 'create', 'save', 'remove', 'authentication'),
'config' => '*',
'link' => '*',
- 'project' => array('remove'),
- 'hourlyrate' => '*',
'currency' => '*',
'twofactor' => array('disable'),
);
@@ -149,9 +157,22 @@ class Acl extends Base
* @param string $action Action name
* @return bool
*/
- public function isManagerAction($controller, $action)
+ public function isProjectManagerAction($controller, $action)
{
- return $this->matchAcl($this->manager_acl, $controller, $action);
+ return $this->matchAcl($this->project_manager_acl, $controller, $action);
+ }
+
+ /**
+ * Return true if the given action is for application managers
+ *
+ * @access public
+ * @param string $controller Controller name
+ * @param string $action Action name
+ * @return bool
+ */
+ public function isProjectAdminAction($controller, $action)
+ {
+ return $this->matchAcl($this->project_admin_acl, $controller, $action);
}
/**
@@ -162,9 +183,9 @@ class Acl extends Base
* @param string $action Action name
* @return bool
*/
- public function isMemberAction($controller, $action)
+ public function isProjectMemberAction($controller, $action)
{
- return $this->matchAcl($this->member_acl, $controller, $action);
+ return $this->matchAcl($this->project_member_acl, $controller, $action);
}
/**
@@ -189,13 +210,18 @@ class Acl extends Base
return false;
}
+ // Check project admin permissions
+ if ($this->isProjectAdminAction($controller, $action)) {
+ return $this->handleProjectAdminPermissions($project_id);
+ }
+
// Check project manager permissions
- if ($this->isManagerAction($controller, $action)) {
- return $this->isManagerActionAllowed($project_id);
+ if ($this->isProjectManagerAction($controller, $action)) {
+ return $this->handleProjectManagerPermissions($project_id);
}
// Check project member permissions
- if ($this->isMemberAction($controller, $action)) {
+ if ($this->isProjectMemberAction($controller, $action)) {
return $project_id > 0 && $this->projectPermission->isMember($project_id, $this->userSession->getId());
}
@@ -203,12 +229,43 @@ class Acl extends Base
return true;
}
- public function isManagerActionAllowed($project_id)
+ /**
+ * Handle permission for project manager
+ *
+ * @access public
+ * @param integer $project_id
+ * @return boolean
+ */
+ public function handleProjectManagerPermissions($project_id)
{
- if ($this->userSession->isAdmin()) {
- return true;
+ if ($project_id > 0) {
+ if ($this->userSession->isProjectAdmin()) {
+ return $this->projectPermission->isMember($project_id, $this->userSession->getId());
+ }
+
+ return $this->projectPermission->isManager($project_id, $this->userSession->getId());
}
- return $project_id > 0 && $this->projectPermission->isManager($project_id, $this->userSession->getId());
+ return false;
+ }
+
+ /**
+ * Handle permission for project admins
+ *
+ * @access public
+ * @param integer $project_id
+ * @return boolean
+ */
+ public function handleProjectAdminPermissions($project_id)
+ {
+ if (! $this->userSession->isProjectAdmin()) {
+ return false;
+ }
+
+ if ($project_id > 0) {
+ return $this->projectPermission->isMember($project_id, $this->userSession->getId());
+ }
+
+ return true;
}
}
diff --git a/app/Model/User.php b/app/Model/User.php
index 8daef3f2c..76af342d3 100644
--- a/app/Model/User.php
+++ b/app/Model/User.php
@@ -57,6 +57,7 @@ class User extends Base
'name',
'email',
'is_admin',
+ 'is_project_admin',
'is_ldap_user',
'notifications_enabled',
'google_id',
@@ -254,7 +255,7 @@ class User extends Base
}
$this->removeFields($values, array('confirmation', 'current_password'));
- $this->resetFields($values, array('is_admin', 'is_ldap_user'));
+ $this->resetFields($values, array('is_admin', 'is_ldap_user', 'is_project_admin'));
}
/**
@@ -442,6 +443,7 @@ class User extends Base
new Validators\Unique('username', t('The username must be unique'), $this->db->getConnection(), self::TABLE, 'id'),
new Validators\Email('email', t('Email address invalid')),
new Validators\Integer('is_admin', t('This value must be an integer')),
+ new Validators\Integer('is_project_admin', t('This value must be an integer')),
new Validators\Integer('is_ldap_user', t('This value must be an integer')),
);
}
diff --git a/app/Model/UserSession.php b/app/Model/UserSession.php
index 44a9c2a2e..1ae3fdf4d 100644
--- a/app/Model/UserSession.php
+++ b/app/Model/UserSession.php
@@ -34,6 +34,7 @@ class UserSession extends Base
$user['id'] = (int) $user['id'];
$user['is_admin'] = (bool) $user['is_admin'];
+ $user['is_project_admin'] = (bool) $user['is_project_admin'];
$user['is_ldap_user'] = (bool) $user['is_ldap_user'];
$user['twofactor_activated'] = (bool) $user['twofactor_activated'];
@@ -73,6 +74,17 @@ class UserSession extends Base
return isset($this->session['user']['is_admin']) && $this->session['user']['is_admin'] === true;
}
+ /**
+ * Return true if the logged user is project admin
+ *
+ * @access public
+ * @return bool
+ */
+ public function isProjectAdmin()
+ {
+ return isset($this->session['user']['is_project_admin']) && $this->session['user']['is_project_admin'] === true;
+ }
+
/**
* Get the connected user id
*
diff --git a/app/Schema/Mysql.php b/app/Schema/Mysql.php
index 31ffaa32d..9bd610bb6 100644
--- a/app/Schema/Mysql.php
+++ b/app/Schema/Mysql.php
@@ -6,7 +6,12 @@ use PDO;
use Core\Security;
use Model\Link;
-const VERSION = 82;
+const VERSION = 83;
+
+function version_83($pdo)
+{
+ $pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INT DEFAULT 0");
+}
function version_82($pdo)
{
diff --git a/app/Schema/Postgres.php b/app/Schema/Postgres.php
index 876df981d..e1ba07e3f 100644
--- a/app/Schema/Postgres.php
+++ b/app/Schema/Postgres.php
@@ -6,7 +6,12 @@ use PDO;
use Core\Security;
use Model\Link;
-const VERSION = 62;
+const VERSION = 63;
+
+function version_63($pdo)
+{
+ $pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INTEGER DEFAULT 0");
+}
function version_62($pdo)
{
diff --git a/app/Schema/Sqlite.php b/app/Schema/Sqlite.php
index 4b8f5ac62..15268d9ab 100644
--- a/app/Schema/Sqlite.php
+++ b/app/Schema/Sqlite.php
@@ -6,7 +6,12 @@ use Core\Security;
use PDO;
use Model\Link;
-const VERSION = 78;
+const VERSION = 79;
+
+function version_79($pdo)
+{
+ $pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INTEGER DEFAULT 0");
+}
function version_78($pdo)
{
diff --git a/app/Template/activity/project.php b/app/Template/activity/project.php
index 480bbadd6..bc5852129 100644
--- a/app/Template/activity/project.php
+++ b/app/Template/activity/project.php
@@ -19,7 +19,7 @@
url->link(t('Back to the calendar'), 'calendar', 'show', array('project_id' => $project['id'])) ?>
- user->isManager($project['id'])): ?>
+ user->isProjectManagementAllowed($project['id'])): ?>
url->link(t('Project settings'), 'project', 'show', array('project_id' => $project['id'])) ?>
diff --git a/app/Template/analytic/layout.php b/app/Template/analytic/layout.php
index 9d6bf77c4..fd2090ae3 100644
--- a/app/Template/analytic/layout.php
+++ b/app/Template/analytic/layout.php
@@ -19,7 +19,7 @@
url->link(t('Back to the calendar'), 'calendar', 'show', array('project_id' => $project['id'])) ?>
- user->isManager($project['id'])): ?>
+ user->isProjectManagementAllowed($project['id'])): ?>
url->link(t('Project settings'), 'project', 'show', array('project_id' => $project['id'])) ?>
diff --git a/app/Template/app/layout.php b/app/Template/app/layout.php
index 4a307a198..de561dede 100644
--- a/app/Template/app/layout.php
+++ b/app/Template/app/layout.php
@@ -1,7 +1,7 @@
diff --git a/docs/api-json-rpc.markdown b/docs/api-json-rpc.markdown
index 7c211081c..618529332 100644
--- a/docs/api-json-rpc.markdown
+++ b/docs/api-json-rpc.markdown
@@ -2632,6 +2632,7 @@ Response example:
- **name** (string, optional)
- **email** (string, optional)
- **is_admin** Set the value 1 for admins or 0 for regular users (integer, optional)
+ - **is_project_admin** Set the value 1 for project admins or 0 for regular users (integer, optional)
- Result on success: **user_id**
- Result on failure: **false**
@@ -2666,6 +2667,7 @@ Response example:
- **username** (string, optional if email is set)
- **email** (string, optional if username is set)
- **is_admin** Set the value 1 for admins or 0 for regular users (integer, optional)
+ - **is_project_admin** Set the value 1 for project admins or 0 for regular users (integer, optional)
- Result on success: **user_id**
- Result on failure: **false**
@@ -2787,6 +2789,7 @@ Response example:
- **name** (string, optional)
- **email** (string, optional)
- **is_admin** (integer, optional)
+ - **is_project_admin** Set the value 1 for project admins or 0 for regular users (integer, optional)
- Result on success: **true**
- Result on failure: **false**
diff --git a/docs/project-permissions.markdown b/docs/project-permissions.markdown
index af3adcd60..d4aa88e38 100644
--- a/docs/project-permissions.markdown
+++ b/docs/project-permissions.markdown
@@ -4,7 +4,7 @@ Project permissions
A project can have two kinds of people: **project managers** and **project members**.
- Project managers can manage the configuration of the project and access to the reports.
-- Project members are standard users, they have less privileges.
+- Project members can only do basic operations (create or move tasks).
When you create a new project, you are automatically assigned as a project manager.
diff --git a/docs/user-management.markdown b/docs/user-management.markdown
index 98691dddd..25cc8539a 100644
--- a/docs/user-management.markdown
+++ b/docs/user-management.markdown
@@ -1,22 +1,45 @@
User management
===============
-Group of users
---------------
+Roles at the application level
+------------------------------
-Kanboard use a basic permission system, there is two kind of users:
+Kanboard use a basic permission system, there are 3 type of users:
-- Administrators
-- Standard users
+### Administrators
-Administrator have access to everything. By example, they can add or remove projects.
+- Access to everything
-There is also permissions defined at the project level, users can be seen as:
+### Project Administrators
-- Project member
-- Project manager
+- Can create multi-users and private projects
+- Can convert multi-users and private projects
+- Can see only their own projects
+- Cannot change application settings
+- Cannot manage users
-Project managers have more privileges than a simple user member.
+### Standard Users
+
+- Can create only private projects
+- Can see only their own projects
+- Cannot remove projects
+
+Roles at the project level
+--------------------------
+
+These role are related to the project permission.
+
+### Project Managers
+
+- Can manage only their own projects
+- Can access to reports and budget section
+
+### Project Members
+
+- Can do any daily operations in their projects (create and move tasks...)
+- Cannot configure projects
+
+Note: Any "Standard User" can be promotted "Project Manager" for a given project, they don't necessary need to be "Project Administrator".
Local and remote users
----------------------
diff --git a/tests/units/AclTest.php b/tests/units/AclTest.php
index 05e8561ec..4d735dfbf 100644
--- a/tests/units/AclTest.php
+++ b/tests/units/AclTest.php
@@ -35,12 +35,18 @@ class AclTest extends Base
public function testPublicActions()
{
$acl = new Acl($this->container);
+ $this->assertTrue($acl->isPublicAction('task', 'readonly'));
$this->assertTrue($acl->isPublicAction('board', 'readonly'));
$this->assertFalse($acl->isPublicAction('board', 'show'));
$this->assertTrue($acl->isPublicAction('feed', 'project'));
$this->assertTrue($acl->isPublicAction('feed', 'user'));
+ $this->assertTrue($acl->isPublicAction('ical', 'project'));
+ $this->assertTrue($acl->isPublicAction('ical', 'user'));
$this->assertTrue($acl->isPublicAction('oauth', 'github'));
$this->assertTrue($acl->isPublicAction('oauth', 'google'));
+ $this->assertTrue($acl->isPublicAction('auth', 'login'));
+ $this->assertTrue($acl->isPublicAction('auth', 'check'));
+ $this->assertTrue($acl->isPublicAction('auth', 'captcha'));
}
public function testAdminActions()
@@ -54,21 +60,32 @@ class AclTest extends Base
$this->assertTrue($acl->isAdminAction('user', 'save'));
}
- public function testManagerActions()
+ public function testProjectAdminActions()
{
$acl = new Acl($this->container);
- $this->assertFalse($acl->isManagerAction('board', 'readonly'));
- $this->assertFalse($acl->isManagerAction('project', 'remove'));
- $this->assertFalse($acl->isManagerAction('project', 'show'));
- $this->assertTrue($acl->isManagerAction('project', 'disable'));
- $this->assertTrue($acl->isManagerAction('category', 'index'));
- $this->assertTrue($acl->isManagerAction('project', 'users'));
- $this->assertFalse($acl->isManagerAction('app', 'index'));
+ $this->assertFalse($acl->isProjectAdminAction('config', 'save'));
+ $this->assertFalse($acl->isProjectAdminAction('user', 'index'));
+ $this->assertTrue($acl->isProjectAdminAction('project', 'remove'));
+ }
+
+ public function testProjectManagerActions()
+ {
+ $acl = new Acl($this->container);
+ $this->assertFalse($acl->isProjectManagerAction('board', 'readonly'));
+ $this->assertFalse($acl->isProjectManagerAction('project', 'remove'));
+ $this->assertFalse($acl->isProjectManagerAction('project', 'show'));
+ $this->assertTrue($acl->isProjectManagerAction('project', 'disable'));
+ $this->assertTrue($acl->isProjectManagerAction('category', 'index'));
+ $this->assertTrue($acl->isProjectManagerAction('project', 'users'));
+ $this->assertFalse($acl->isProjectManagerAction('app', 'index'));
}
public function testPageAccessNoSession()
{
$acl = new Acl($this->container);
+ $session = new Session;
+ $session = array();
+
$this->assertFalse($acl->isAllowed('board', 'readonly'));
$this->assertFalse($acl->isAllowed('task', 'show'));
$this->assertFalse($acl->isAllowed('config', 'application'));
@@ -81,7 +98,6 @@ class AclTest extends Base
{
$acl = new Acl($this->container);
$session = new Session;
-
$session['user'] = array();
$this->assertFalse($acl->isAllowed('board', 'readonly'));
@@ -106,15 +122,60 @@ class AclTest extends Base
$this->assertTrue($acl->isAllowed('webhook', 'github'));
$this->assertTrue($acl->isAllowed('task', 'show'));
$this->assertTrue($acl->isAllowed('task', 'update'));
- $this->assertTrue($acl->isAllowed('project', 'show'));
$this->assertTrue($acl->isAllowed('config', 'application'));
+ $this->assertTrue($acl->isAllowed('project', 'show'));
$this->assertTrue($acl->isAllowed('project', 'users'));
+ $this->assertTrue($acl->isAllowed('project', 'remove'));
$this->assertTrue($acl->isAllowed('category', 'edit'));
$this->assertTrue($acl->isAllowed('task', 'remove'));
$this->assertTrue($acl->isAllowed('app', 'index'));
}
- public function testPageAccessManager()
+ public function testPageAccessProjectAdmin()
+ {
+ $acl = new Acl($this->container);
+ $p = new Project($this->container);
+ $pp = new ProjectPermission($this->container);
+ $u = new User($this->container);
+ $session = new Session;
+
+ // We create our user
+ $this->assertEquals(2, $u->create(array('username' => 'unittest', 'password' => 'unittest')));
+
+ // We create a project and set our user as project manager
+ $this->assertEquals(1, $p->create(array('name' => 'UnitTest')));
+ $this->assertTrue($pp->addMember(1, 2));
+ $this->assertTrue($pp->isMember(1, 2));
+ $this->assertFalse($pp->isManager(1, 2));
+
+ // We fake a session for him
+ $session['user'] = array(
+ 'id' => 2,
+ 'is_admin' => false,
+ 'is_project_admin' => true,
+ );
+
+ $this->assertTrue($acl->isAllowed('board', 'readonly', 1));
+ $this->assertTrue($acl->isAllowed('task', 'readonly', 1));
+ $this->assertTrue($acl->isAllowed('webhook', 'github', 1));
+ $this->assertTrue($acl->isAllowed('task', 'show', 1));
+ $this->assertFalse($acl->isAllowed('task', 'show', 2));
+ $this->assertTrue($acl->isAllowed('task', 'update', 1));
+ $this->assertTrue($acl->isAllowed('project', 'show', 1));
+ $this->assertFalse($acl->isAllowed('config', 'application', 1));
+
+ $this->assertTrue($acl->isAllowed('project', 'users', 1));
+ $this->assertFalse($acl->isAllowed('project', 'users', 2));
+
+ $this->assertTrue($acl->isAllowed('project', 'remove', 1));
+ $this->assertFalse($acl->isAllowed('project', 'remove', 2));
+
+ $this->assertTrue($acl->isAllowed('category', 'edit', 1));
+ $this->assertTrue($acl->isAllowed('task', 'remove', 1));
+ $this->assertTrue($acl->isAllowed('app', 'index', 1));
+ }
+
+ public function testPageAccessProjectManager()
{
$acl = new Acl($this->container);
$p = new Project($this->container);
@@ -144,8 +205,13 @@ class AclTest extends Base
$this->assertTrue($acl->isAllowed('task', 'update', 1));
$this->assertTrue($acl->isAllowed('project', 'show', 1));
$this->assertFalse($acl->isAllowed('config', 'application', 1));
+
$this->assertTrue($acl->isAllowed('project', 'users', 1));
$this->assertFalse($acl->isAllowed('project', 'users', 2));
+
+ $this->assertFalse($acl->isAllowed('project', 'remove', 1));
+ $this->assertFalse($acl->isAllowed('project', 'remove', 2));
+
$this->assertTrue($acl->isAllowed('category', 'edit', 1));
$this->assertTrue($acl->isAllowed('task', 'remove', 1));
$this->assertTrue($acl->isAllowed('app', 'index', 1));
diff --git a/tests/units/UserTest.php b/tests/units/UserTest.php
index 6c68dfd22..e3fa5f764 100644
--- a/tests/units/UserTest.php
+++ b/tests/units/UserTest.php
@@ -112,6 +112,7 @@ class UserTest extends Base
$u = new User($this->container);
$this->assertNotFalse($u->create(array('username' => 'toto', 'password' => '123456', 'name' => 'Toto')));
$this->assertNotFalse($u->create(array('username' => 'titi', 'is_ldap_user' => 1)));
+ $this->assertNotFalse($u->create(array('username' => 'papa', 'is_project_admin' => 1)));
$this->assertFalse($u->create(array('username' => 'toto')));
$user = $u->getById(1);
@@ -137,6 +138,13 @@ class UserTest extends Base
$this->assertEquals('', $user['name']);
$this->assertEquals(0, $user['is_admin']);
$this->assertEquals(1, $user['is_ldap_user']);
+
+ $user = $u->getById(4);
+ $this->assertNotFalse($user);
+ $this->assertTrue(is_array($user));
+ $this->assertEquals('papa', $user['username']);
+ $this->assertEquals(0, $user['is_admin']);
+ $this->assertEquals(1, $user['is_project_admin']);
}
public function testUpdate()