nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-09 15:06:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

UI: do not show tickets unless user has write access; they are like passwords

Browse Source 
Same with external URLs

Also restrict Delete buttons on incoming binds to Admins: these binds
will usually live in other people's namespace, which we should not
alter, and may be restricted to default privileges (e.g. freebusy)
anyway
This commit is contained in:
Florian Schlichting 2017-01-10 20:42:26 +01:00
parent ab7dad057d
commit 0ca04aaa68
2 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
inc/ui/collection-edit.php
View File

@ -137,13 +137,14 @@ if ( $editor->Available() ) {
$entryqry->Exec('admin-collection-edit');
$entries = $entryqry->Fetch(); $entries = $entries->count;
$externalqry = new AwlQuery( 'SELECT external_url from dav_binding where bound_source_id=:id limit 1', array(':id' => $editor->Value('collection_id') ) );
$externalqry->Exec('external-bind-url');
$external = $externalqry->Fetch(); $external_url = $external->external_url;
if ( $external_url ) {
$external_bind = "\n<tr> <th class='right'>" . translate('External Url') . "</th> <td class='left'>$external_url</td> </tr>";
} else {
$external_bind = "";
$external_bind = "";
if ($can_write_collection) {
$externalqry = new AwlQuery( 'SELECT external_url from dav_binding where bound_source_id=:id limit 1', array(':id' => $editor->Value('collection_id') ) );
$externalqry->Exec('external-bind-url');
$external = $externalqry->Fetch(); $external_url = $external->external_url;
if ( $external_url ) {
$external_bind = "\n<tr> <th class='right'>" . translate('External Url') . "</th> <td class='left'>$external_url</td> </tr>";
}
}
}
else {
@ -510,7 +511,9 @@ EOTEMPLATE;
$browser = new Browser(translate('Access Tickets'));
$browser->AddHidden( 'dav_owner_id' );
$browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
if ($can_write_collection) {
$browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
}
$browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "'".$c->base_url.'/caldav.php'."' ||COALESCE(d.dav_name,c.dav_name)" );
$browser->AddColumn( 'expiry', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYYMMDD"T"HH:MI:SS\')');
$browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
@ -546,7 +549,7 @@ EOTEMPLATE;
$browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
$browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
$browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
if ($can_write_collection) {
if ( $session->AllowedTo('Admin') ) {
$delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&bind_id=##URL:bind_id##&subaction=delete_binding';
$browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
}

8
inc/ui/principal-edit.php
View File

@ -809,7 +809,9 @@ function access_ticket_browser() {
$browser = new Browser(translate('Access Tickets'));
$browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
if ( $can_write_principal ) {
$browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
}
$browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "COALESCE(d.dav_name,c.dav_name)" );
$browser->AddColumn( 'expires', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYY-MM-DD HH:MI:SS\')');
$browser->AddColumn( 'privs', translate('Privileges'), '', '', 'privileges', '', '', 'principal_privilege_format_function' );
@ -940,7 +942,7 @@ function confirm_delete_bind_in($confirmation_hash) {
function bindings_to_us_browser() {
global $c, $page_elements, $id, $editor, $can_write_principal;
global $c, $page_elements, $id, $editor, $session;
$browser = new Browser(translate('Bindings to this Principal\'s Collections'));
$browser->AddColumn( 'bind_id', translate('ID'), '', '' );
$browser->AddHidden( 'b.dav_owner_id' );
@ -949,7 +951,7 @@ function bindings_to_us_browser() {
$browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
$browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
$browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
if ($can_write_principal) {
if ( $session->AllowedTo('Admin') ) {
$delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##principal_id##&bind_id=##bind_id##&subaction=delete_binding';
$browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
}