diff --git a/lib/Db/ShareMapper.php b/lib/Db/ShareMapper.php index a76c8f5c1..a5aa08ef9 100644 --- a/lib/Db/ShareMapper.php +++ b/lib/Db/ShareMapper.php @@ -104,7 +104,6 @@ public function findAllSharesForNode(string $nodeType, int $nodeId, string $send $qb = $this->db->getQueryBuilder(); $qb->select('*') ->from($this->table) - ->where($qb->expr()->eq('sender', $qb->createNamedParameter($sender, IQueryBuilder::PARAM_STR))) ->andWhere($qb->expr()->eq('node_type', $qb->createNamedParameter($nodeType, IQueryBuilder::PARAM_STR))) ->andWhere($qb->expr()->eq('node_id', $qb->createNamedParameter($nodeId, IQueryBuilder::PARAM_INT))); return $this->findEntities($qb); diff --git a/lib/Service/PermissionsService.php b/lib/Service/PermissionsService.php index ece2f86d3..ef205800b 100644 --- a/lib/Service/PermissionsService.php +++ b/lib/Service/PermissionsService.php @@ -84,6 +84,19 @@ public function canAccessView($view, ?string $userId = null): bool { return false; } + /** + * @param int $elementId + * @param string $nodeType + * @param string|null $userId + * @return bool + * @throws InternalError + */ + public function canManageElementById(int $elementId, string $nodeType = 'table', ?string $userId = null): bool { + if ($nodeType === 'table') return $this->canManageTableById($elementId, $userId); + else if ($nodeType === 'view') return $this->canManageViewById($elementId, $userId); + else throw new InternalError('Cannot read permission for node type '.$nodeType); + } + /** * @param View $view * @param string|null $userId @@ -113,6 +126,22 @@ public function canManageTableById(int $tableId, ?string $userId = null): bool { return $this->canManageTable($table, $userId); } + public function canManageViewById(int $viewId, ?string $userId = null): bool { + try { + $view = $this->viewMapper->find($viewId); + } catch (MultipleObjectsReturnedException $e) { + $this->logger->warning('Multiple tables were found for this id'); + return false; + } catch (DoesNotExistException $e) { + $this->logger->warning('No table was found for this id'); + return false; + } catch (InternalError | Exception $e) { + $this->logger->warning('Error occurred: '.$e->getMessage()); + return false; + } + return $this->canManageView($view, $userId); + } + // ***** COLUMNS permissions ***** @@ -237,6 +266,15 @@ public function canReadShare(Share $share, ?string $userId = null): bool { if ($userId === '') { return true; } + try { + if ($this->canManageElementById($share->getNodeId(), $share->getNodeType())){ + return true; + } + } catch (InternalError $e) { + $this->logger->warning('Cannot check manage permissions, permission denied'); + return false; + } + if ($share->getSender() === $userId) { return true; @@ -263,36 +301,6 @@ public function canReadShare(Share $share, ?string $userId = null): bool { return false; } - public function canUpdateShare(Share $item, ?string $userId = null): bool { - try { - $userId = $this->preCheckUserId($userId); - } catch (InternalError $e) { - $this->logger->warning('Cannot pre check the user id, permission denied'); - return false; - } - - if ($userId === '') { - return true; - } - - return $item->getSender() === $userId; - } - - public function canDeleteShare(Share $item, ?string $userId = null): bool { - try { - $userId = $this->preCheckUserId($userId); - } catch (InternalError $e) { - $this->logger->warning('Cannot pre check the user id, permission denied'); - return false; - } - - if ($userId === '') { - return true; - } - - return $item->getSender() === $userId; - } - /** * @param int $elementId * @param string|null $elementType diff --git a/lib/Service/ShareService.php b/lib/Service/ShareService.php index 2c76fe971..2f4834acb 100644 --- a/lib/Service/ShareService.php +++ b/lib/Service/ShareService.php @@ -226,7 +226,7 @@ public function updatePermission(int $id, string $permission, bool $value): Shar $item = $this->mapper->find($id); // security - if (!$this->permissionsService->canUpdateShare($item)) { + if (!$this->permissionsService->canManageElementById($item->getNodeId(), $item->getNodeType())) { throw new PermissionError('PermissionError: can not update share with id '.$id); } @@ -272,7 +272,7 @@ public function delete(int $id): Share { $item = $this->mapper->find($id); // security - if (!$this->permissionsService->canDeleteShare($item)) { + if (!$this->permissionsService->canManageElementById($item->getNodeId(), $item->getNodeType())) { throw new PermissionError('PermissionError: can not delete share with id '.$id); } diff --git a/src/modules/main/modals/ViewSettings.vue b/src/modules/main/modals/ViewSettings.vue index 4e28fe1bc..26f4a9f7a 100644 --- a/src/modules/main/modals/ViewSettings.vue +++ b/src/modules/main/modals/ViewSettings.vue @@ -1,5 +1,5 @@