Changeset 3726

Timestamp:

09/19/09 15:02:26 (2 years ago)

Author:

ringmaster

Message:

Add permission check to core dash modules so that users without access to moderate comments can't view the comment module on the dashboard. Likewise with the log module.

Prevent users who only have permission to edit their own user account from editing others' user accounts by twiddling the URL.

Add a permission token to grant/deny access for users to add dashboard modules.

Added "My Profile" to main menu under "M" accesskey. Links to user page for the current user. There should possibly be a way to omit this item from the menu if you also have access to the full user management page.

Bumped DB version to get new permission token.

Location:

trunk/htdocs/system

Files:

• classes/adminhandler.php (modified) (3 diffs)
• classes/installhandler.php (modified) (1 diff)
• classes/version.php (modified) (1 diff)
• plugins/coredashmodules/coredashmodules.plugin.php (modified) (1 diff)

trunk/htdocs/system/classes/adminhandler.php

@@ -433 +433 @@
                 $modules = Modules::get_active();
 
-                // append the 'Add Item' module
-                $modules['nosort'] = 'Add Item';
-
-                // register the 'Add Item' filter
-                Plugins::register( array( $this, 'filter_dash_module_add_item' ), 'filter', 'dash_module_add_item');
+                if(User::identify()->can('manage_dash_modules')) {
+                        // append the 'Add Item' module
+                        $modules['nosort'] = 'Add Item';
+        
+                        // register the 'Add Item' filter
+                        Plugins::register( array( $this, 'filter_dash_module_add_item' ), 'filter', 'dash_module_add_item');
+                }
 
                 foreach ( $modules as $id => $module_name ) {
@@ -620 +622 @@
 
                 $edit_user = User::identify();
+                $permission = false;
 
                 if ( ($this->handler_vars['user'] == '') || (User::get_by_name($this->handler_vars['user']) == $edit_user) ) {
+                        if($edit_user->can('manage_self') || $edit_user->can('manage_users')) {
+                                $permission = true;
+                        }
                         $who = _t("You");
                         $possessive = _t("Your User Information");
                 }
                 else {
+                        if($edit_user->can('manage_users')) {
+                                $permission = true;
+                        }
                         $edit_user = User::get_by_name($this->handler_vars['user']);
                         $who = $edit_user->username;
                         $possessive = sprintf( _t("%s's User Information"), $who );
+                }
+
+                if(!$permission) {
+                        Session::error(_t('Access to that page has been denied by the administrator.'));
+                        $this->get_blank();
+                        return;
                 }
 
@@ -3086 +3101 @@
                         'import' => array( 'url' => URL::get( 'admin', 'page=import' ), 'title' => _t( 'Import content from another blog' ), 'text' => _t( 'Import' ), 'hotkey' => 'I', 'access'=>array('manage_import'=>true) ),
                         'users' => array( 'url' => URL::get( 'admin', 'page=users' ), 'title' => _t( 'View and manage users' ), 'text' => _t( 'Users' ), 'hotkey' => 'U', 'access'=>array('manage_users'=>true) ),
+                        'profile' => array( 'url' => URL::get( 'admin', 'page=user' ), 'title' => _t( 'Manage your user profile' ), 'text' => _t( 'My Profile' ), 'hotkey' => 'M', 'access'=>array('manage_self'=>true, 'manage_users'=>true) ),
                         'groups' => array( 'url' => URL::get( 'admin', 'page=groups' ), 'title' => _t( 'View and manage groups' ), 'text' => _t( 'Groups' ), 'hotkey' => 'G', 'access'=>array('manage_groups'=>true) ),
                         'logs' => array( 'url' => URL::get( 'admin', 'page=logs'), 'title' => _t( 'View system log messages' ), 'text' => _t( 'Logs' ), 'hotkey' => 'L', 'access'=>array('manage_logs'=>true) ) ,

trunk/htdocs/system/classes/installhandler.php

@@ -1449 +1449 @@
                 ACL::create_token( 'manage_self', _t('Edit own profile'), 'Administration' );
         }
+        
+        private function upgrade_db_post_3701()
+        {
+                ACL::create_token( 'manage_dash_modules', _t('Manage dashboard modules'), 'Administration' );
+        }
 
         /**

trunk/htdocs/system/classes/version.php

@@ -15 +15 @@
         // DB and API versions are aligned with the SVN revision
         // number in which they last changed.
-        const DB_VERSION = 3699;
+        const DB_VERSION = 3702;
         const API_VERSION = 3124;
 

trunk/htdocs/system/plugins/coredashmodules/coredashmodules.plugin.php

@@ -44 +44 @@
         function filter_dash_modules( $modules )
         {
-                array_push( $modules, 'Latest Entries', 'Latest Comments', 'Latest Log Activity' );
+                $modules[] = 'Latest Entries';
+                if(User::identify()->can('manage_all_comments')) {
+                        $modules[] = 'Latest Comments';
+                }
+                if(User::identify()->can('manage_logs')) {
+                        $modules[] = 'Latest Log Activity';
+                }
                 
                 $this->add_template( 'dash_logs', dirname( __FILE__ ) . '/dash_logs.php' );