From 0ca04aaa68c6e35b9d0dec066ac2171e5e4ba551 Mon Sep 17 00:00:00 2001
From: Florian Schlichting <fsfs@debian.org>
Date: Tue, 10 Jan 2017 20:42:26 +0100
Subject: [PATCH] UI: do not show tickets unless user has write access; they
 are like passwords

Same with external URLs

Also restrict Delete buttons on incoming binds to Admins: these binds
will usually live in other people's namespace, which we should not
alter, and may be restricted to default privileges (e.g. freebusy)
anyway
---
 inc/ui/collection-edit.php | 21 ++++++++++++---------
 inc/ui/principal-edit.php  |  8 +++++---
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/inc/ui/collection-edit.php b/inc/ui/collection-edit.php
index 44980ffb..3af9edd3 100644
--- a/inc/ui/collection-edit.php
+++ b/inc/ui/collection-edit.php
@@ -137,13 +137,14 @@ if ( $editor->Available() ) {
   $entryqry->Exec('admin-collection-edit');
   $entries = $entryqry->Fetch();  $entries = $entries->count;
 
-  $externalqry = new AwlQuery( 'SELECT external_url from dav_binding where bound_source_id=:id  limit 1', array(':id' => $editor->Value('collection_id') ) );
-  $externalqry->Exec('external-bind-url');
-  $external = $externalqry->Fetch();  $external_url = $external->external_url;
-  if ( $external_url ) {
-    $external_bind = "\n<tr> <th class='right'>" . translate('External Url') . "</th>         <td class='left'>$external_url</td> </tr>";
-  } else {
-    $external_bind = "";
+  $external_bind = "";
+  if ($can_write_collection) {
+    $externalqry = new AwlQuery( 'SELECT external_url from dav_binding where bound_source_id=:id  limit 1', array(':id' => $editor->Value('collection_id') ) );
+    $externalqry->Exec('external-bind-url');
+    $external = $externalqry->Fetch();  $external_url = $external->external_url;
+    if ( $external_url ) {
+        $external_bind = "\n<tr> <th class='right'>" . translate('External Url') . "</th>         <td class='left'>$external_url</td> </tr>";
+    }
   }
 }
 else {
@@ -510,7 +511,9 @@ EOTEMPLATE;
 
   $browser = new Browser(translate('Access Tickets'));
   $browser->AddHidden( 'dav_owner_id' );
-  $browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
+  if ($can_write_collection) {
+    $browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
+  }
   $browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "'".$c->base_url.'/caldav.php'."' ||COALESCE(d.dav_name,c.dav_name)" );
   $browser->AddColumn( 'expiry', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYYMMDD"T"HH:MI:SS\')');
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
@@ -546,7 +549,7 @@ EOTEMPLATE;
   $browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
   $browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  if ($can_write_collection) {
+  if ( $session->AllowedTo('Admin') ) {
     $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&bind_id=##URL:bind_id##&subaction=delete_binding';
     $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
   }
diff --git a/inc/ui/principal-edit.php b/inc/ui/principal-edit.php
index 2696101e..efe8650e 100644
--- a/inc/ui/principal-edit.php
+++ b/inc/ui/principal-edit.php
@@ -809,7 +809,9 @@ function access_ticket_browser() {
 
   $browser = new Browser(translate('Access Tickets'));
 
-  $browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
+  if ( $can_write_principal ) {
+    $browser->AddColumn( 'ticket_id', translate('Ticket ID'), '', '' );
+  }
   $browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "COALESCE(d.dav_name,c.dav_name)" );
   $browser->AddColumn( 'expires', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYY-MM-DD HH:MI:SS\')');
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', 'privileges', '', '', 'principal_privilege_format_function' );
@@ -940,7 +942,7 @@ function confirm_delete_bind_in($confirmation_hash) {
 
 
 function bindings_to_us_browser() {
-  global $c, $page_elements, $id, $editor, $can_write_principal;
+  global $c, $page_elements, $id, $editor, $session;
   $browser = new Browser(translate('Bindings to this Principal\'s Collections'));
   $browser->AddColumn( 'bind_id', translate('ID'), '', '' );
   $browser->AddHidden( 'b.dav_owner_id' );
@@ -949,7 +951,7 @@ function bindings_to_us_browser() {
   $browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
   $browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  if ($can_write_principal) {
+  if ( $session->AllowedTo('Admin') ) {
     $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##principal_id##&bind_id=##bind_id##&subaction=delete_binding';
     $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
   }