From c0a2d6a7ee8a9162dc1de0a213173764190bd52f Mon Sep 17 00:00:00 2001
From: Florian Schlichting <fsfs@debian.org>
Date: Fri, 30 Dec 2016 17:48:27 +0100
Subject: [PATCH] do not show edit buttons on admin pages when not allowed to
 edit

---
 inc/ui/collection-edit.php | 49 +++++++++++++++++++++++++-------------
 inc/ui/principal-edit.php  | 39 ++++++++++++++++++++----------
 2 files changed, 59 insertions(+), 29 deletions(-)

diff --git a/inc/ui/collection-edit.php b/inc/ui/collection-edit.php
index 9e62356b..9ac41b49 100644
--- a/inc/ui/collection-edit.php
+++ b/inc/ui/collection-edit.php
@@ -90,7 +90,7 @@ if ( $can_write_collection && $editor->IsSubmit() ) {
     $c->messages[] = i18n("Creating new Collection.");
   }
   else {
-    $c->messages[] = i18n("Updating Collection record.");
+    $c->messages[] = i18n("Updating Collection.");
   }
   if ( !$editor->Write() ) {
     $c->messages[] = i18n("Failed to write collection.");
@@ -128,7 +128,7 @@ if ( $can_write_collection && $editor->IsSubmit() ) {
 else {
   if ( $id > 0 ) $editor->GetRecord();
   if ( $editor->IsSubmit() ) {
-    $c->messages[] = i18n('You do not have permission to modify this record.');
+    $c->messages[] = i18n('You do not have permission to modify this collection.');
   }
 }
 if ( $editor->Available() ) {
@@ -233,6 +233,25 @@ $btn_fb = htmlspecialchars(translate('Free/Busy'));        $btn_fb_title = htmls
 $btn_sd = htmlspecialchars(translate('Schedule Deliver')); $btn_sd_title = htmlspecialchars(translate('Privileges to allow delivery of scheduling messages'));
 $btn_ss = htmlspecialchars(translate('Schedule Send'));    $btn_ss_title = htmlspecialchars(translate('Privileges to delegate scheduling decisions'));
 
+if ($can_write_collection || ! $id > 0) {
+  $privileges_row = <<<EOPRIV
+<input type="button" value="$btn_all" class="submit" title="$btn_all_title" onclick="toggle_privileges('default_privileges', 'all', 'form_editor_1');">
+<input type="button" value="$btn_rw" class="submit" title="$btn_rw_title"
+ onclick="toggle_privileges('default_privileges', 'read', 'write-properties', 'write-content', 'bind', 'unbind', 'read-free-busy',
+                            'read-current-user-privilege-set', 'schedule-deliver-invite', 'schedule-deliver-reply', 'schedule-query-freebusy',
+                            'schedule-send-invite', 'schedule-send-reply', 'schedule-send-freebusy' );">
+<input type="button" value="$btn_read" class="submit" title="$btn_read_title"
+ onclick="toggle_privileges('default_privileges', 'read', 'read-free-busy', 'schedule-query-freebusy', 'read-current-user-privilege-set' );">
+<input type="button" value="$btn_fb" class="submit" title="$btn_fb_title"
+ onclick="toggle_privileges('default_privileges', 'read-free-busy', 'schedule-query-freebusy' );">
+<br>$privileges_set
+EOPRIV;
+  $submit_row = '<tr> <th class="right"></th>                   <td class="left" colspan="2">##submit##</td> </tr>';
+} else {
+  $privileges_row = collection_privilege_format_function( $editor->Value('default_privileges') );
+  $privileges_row = '<div id="privileges">' . $privileges_row . '</div>';
+  $submit_row = '';
+}
 
 $id = $editor->Value('collection_id');
 $template = <<<EOTEMPLATE
@@ -338,20 +357,12 @@ label.privilege {
  <tr> <th class="right">$prompt_addressbook:</th>      <td class="left">##is_addressbook.checkbox##</td> </tr>
  <tr> <th class="right">$prompt_privileges:</th><td class="left">##use_default_privs.checkbox## &nbsp; &nbsp; &nbsp;
  <div id="privileges_settings">
-<input type="button" value="$btn_all" class="submit" title="$btn_all_title" onclick="toggle_privileges('default_privileges', 'all', 'form_editor_1');">
-<input type="button" value="$btn_rw" class="submit" title="$btn_rw_title"
- onclick="toggle_privileges('default_privileges', 'read', 'write-properties', 'write-content', 'bind', 'unbind', 'read-free-busy',
-                            'read-current-user-privilege-set', 'schedule-deliver-invite', 'schedule-deliver-reply', 'schedule-query-freebusy',
-                            'schedule-send-invite', 'schedule-send-reply', 'schedule-send-freebusy' );">
-<input type="button" value="$btn_read" class="submit" title="$btn_read_title"
- onclick="toggle_privileges('default_privileges', 'read', 'read-free-busy', 'schedule-query-freebusy', 'read-current-user-privilege-set' );">
-<input type="button" value="$btn_fb" class="submit" title="$btn_fb_title"
- onclick="toggle_privileges('default_privileges', 'read-free-busy', 'schedule-query-freebusy' );">
-<br>$privileges_set</div></td> </tr>
+  $privileges_row
+ </div></td> </tr>
  <tr> <th class="right">$prompt_timezone:</th>         <td class="left">##timezone.select##</td> </tr>
  <tr> <th class="right">$prompt_schedule_transp:</th>  <td class="left">##schedule_transp.select##</td> </tr>
  <tr> <th class="right">$prompt_description:</th>      <td class="left">##description.textarea.78x6##</td> </tr>
- <tr> <th class="right"></th>                   <td class="left" colspan="2">##submit##</td> </tr>
+ $submit_row
 </table>
 </form>
 <script language="javascript">
@@ -497,8 +508,10 @@ EOTEMPLATE;
   $browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "'".$c->base_url.'/caldav.php'."' ||COALESCE(d.dav_name,c.dav_name)" );
   $browser->AddColumn( 'expiry', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYYMMDD"T"HH:MI:SS\')');
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&ticket_id=##URL:ticket_id##&subaction=delete_ticket';
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_collection) {
+    $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&ticket_id=##URL:ticket_id##&subaction=delete_ticket';
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'target', 'A' );
 
@@ -527,8 +540,10 @@ EOTEMPLATE;
   $browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
   $browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&bind_id=##URL:bind_id##&subaction=delete_binding';
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_collection) {
+    $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##dav_owner_id##&bind_id=##URL:bind_id##&subaction=delete_binding';
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'target', 'A' );
 
diff --git a/inc/ui/principal-edit.php b/inc/ui/principal-edit.php
index 95d5a880..bb33e6db 100644
--- a/inc/ui/principal-edit.php
+++ b/inc/ui/principal-edit.php
@@ -300,7 +300,13 @@ function principal_editor() {
   $prompt_type = translate('Principal Type');
   $prompt_privileges = translate('Privileges granted to All Users');
 
-  $privs_html = build_privileges_html( $editor, 'default_privileges');
+  if ($can_write_principal) {
+    $privs_html = build_privileges_html( $editor, 'default_privileges');
+    $submit_row = '<tr> <th class="right"></th>                   <td class="left" colspan="2">##submit##</td> </tr>';
+  } else {
+    $privs_html = principal_privilege_format_function( $editor->Value('default_privileges') );
+    $submit_row = '';
+  }
 
   $admin_row_entry = '';
   $delete_principal_button = '';
@@ -386,7 +392,7 @@ label.privilege {
  <tr> <th class="right">$prompt_type:</th>        <td class="left">##type_id.select##</td> </tr>
  $admin_row_entry
  <tr> <th class="right" style="white-space:normal;">$prompt_privileges:</th><td class="left">$privs_html</td> </tr>
- <tr> <th class="right"></th>                   <td class="left" colspan="2">##submit##</td> </tr>
+ $submit_row
 </table>
 </form>
 EOTEMPLATE;
@@ -808,8 +814,10 @@ function access_ticket_browser() {
   $browser->AddColumn( 'target', translate('Target'), '', '<td style="white-space:nowrap;">%s</td>', "COALESCE(d.dav_name,c.dav_name)" );
   $browser->AddColumn( 'expires', translate('Expires'), '', '', 'TO_CHAR(expires,\'YYYY-MM-DD HH:MI:SS\')');
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', 'privileges', '', '', 'principal_privilege_format_function' );
-  $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id='.$id.'&ticket_id=##URL:ticket_id##&subaction=delete_ticket';
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_principal) {
+    $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id='.$id.'&ticket_id=##URL:ticket_id##&subaction=delete_ticket';
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'target', 'A' );
 
@@ -846,7 +854,7 @@ function confirm_delete_ticket($confirmation_hash) {
 
 
 function principal_collection_browser() {
-  global $c, $page_elements, $id, $editor;
+  global $c, $page_elements, $id, $editor, $can_write_principal;
 
   $browser = new Browser(translate('Principal Collections'));
 
@@ -858,15 +866,18 @@ function principal_collection_browser() {
   $browser->AddColumn( 'publicly_readable', translate('Public'), 'centre', '', 'CASE WHEN publicly_readable THEN \''.translate('Yes').'\' ELSE \''.translate('No').'\' END' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '',
           "COALESCE( privileges_list(default_privileges), '[".translate('from principal')."]')" );
-  $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id='.$id.'&dav_name=##URL:dav_name##&subaction=delete_collection';
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_principal) {
+    $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id='.$id.'&dav_name=##URL:dav_name##&subaction=delete_collection';
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'dav_name', 'A' );
 
   $browser->SetJoins( "collection " );
   $browser->SetWhere( 'user_no = '.intval($editor->Value('user_no')) );
 
-  $browser->AddRow( array( 'dav_name' => '<a href="'.$rowurl.'&user_no='.intval($editor->Value('user_no')).'" class="submit">'.translate('Create Collection').'</a>' ));
+  if ($can_write_principal)
+    $browser->AddRow( array( 'dav_name' => '<a href="'.$rowurl.'&user_no='.intval($editor->Value('user_no')).'" class="submit">'.translate('Create Collection').'</a>' ));
 
   if ( $c->enable_row_linking ) {
     $browser->RowFormat( '<tr onMouseover="LinkHref(this,1);" title="'.translate('Click to edit principal details').'" class="r%d">', '</tr>', '#even' );
@@ -899,8 +910,10 @@ function bindings_to_other_browser() {
   $browser->AddColumn( 'dav_name', translate('To Collection'), '', '<td style="white-space:nowrap;">%s</td>', 'c.dav_name' );
   $browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  $delurl = $c->base_url . sprintf('/admin.php?action=edit&t=principal&id=%s&bind_id=##bind_id##&subaction=delete_bind_in', $editor->Value('principal_id'));
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_principal) {
+    $delurl = $c->base_url . sprintf('/admin.php?action=edit&t=principal&id=%s&bind_id=##bind_id##&subaction=delete_bind_in', $editor->Value('principal_id'));
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'target', 'A' );
 
@@ -935,8 +948,10 @@ function bindings_to_us_browser() {
   $browser->AddColumn( 'bound_as', translate('Bound As'), '', '<td style="white-space:nowrap;">%s</td>', 'b.dav_name' );
   $browser->AddColumn( 'access_ticket_id', translate('Ticket ID'), '', '' );
   $browser->AddColumn( 'privs', translate('Privileges'), '', '', "privileges_list(privileges)" );
-  $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##principal_id##&bind_id=##bind_id##&subaction=delete_binding';
-  $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  if ($can_write_principal) {
+    $delurl = $c->base_url . '/admin.php?action=edit&t=principal&id=##principal_id##&bind_id=##bind_id##&subaction=delete_binding';
+    $browser->AddColumn( 'delete', translate('Action'), 'center', '', "'<a class=\"submit\" href=\"$delurl\">".translate('Delete')."</a>'" );
+  }
 
   $browser->SetOrdering( 'target', 'A' );