Index: branches/RC/core/kernel/db/db_event_handler.php =================================================================== diff -u -N -r11759 -r11821 --- branches/RC/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 11759) +++ branches/RC/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 11821) @@ -256,7 +256,7 @@ if (isset($direct_ids) || ($ids !== false)) { // save ids directly if they given $this->Application->StoreVar($session_name, implode(',', $direct_ids ? $direct_ids : $ids)); - return $ids; + return $direct_ids ? $direct_ids : $ids; } $ret = Array(); Index: branches/RC/core/units/general/cat_event_handler.php =================================================================== diff -u -N -r11751 -r11821 --- branches/RC/core/units/general/cat_event_handler.php (.../cat_event_handler.php) (revision 11751) +++ branches/RC/core/units/general/cat_event_handler.php (.../cat_event_handler.php) (revision 11821) @@ -17,6 +17,7 @@ 'OnResetSettings' => Array ('self' => 'add|edit|advanced:import'), 'OnBeforeDeleteOriginal' => Array ('self' => 'edit|advanced:approve'), + 'OnCopy' => Array ('self' => true), 'OnDownloadFile' => Array ('self' => 'view'), 'OnCancelAction' => Array ('self' => true), 'OnItemBuild' => Array ('self' => true), @@ -81,7 +82,7 @@ else { // leave only items, that can be edited $ids = Array (); - $check_method = ($event->Name == 'OnMassDelete') ? 'DeleteCheckPermission' : 'ModifyCheckPermission'; + $check_method = in_array($event->Name, Array ('OnMassDelete', 'OnCut')) ? 'DeleteCheckPermission' : 'ModifyCheckPermission'; foreach ($items as $item_id => $item_data) { if ($perm_helper->$check_method($item_data['CreatedById'], $item_data['CategoryId'], $event->Prefix) > 0) { $ids[] = $item_id; @@ -125,7 +126,8 @@ { return Array ( 'OnEdit', 'OnSave', 'OnMassDelete', 'OnMassApprove', - 'OnMassDecline', 'OnMassMoveUp', 'OnMassMoveDown' + 'OnMassDecline', 'OnMassMoveUp', 'OnMassMoveDown', + 'OnCut', ); } @@ -197,6 +199,7 @@ $this->Application->RemoveVar('clipboard'); $clipboard_helper =& $this->Application->recallObject('ClipboardHelper'); $clipboard_helper->setClipboard($event, 'copy', $this->StoreSelectedIDs($event)); + $this->clearSelectedIDs($event); } /** @@ -209,16 +212,37 @@ $this->Application->RemoveVar('clipboard'); $clipboard_helper =& $this->Application->recallObject('ClipboardHelper'); $clipboard_helper->setClipboard($event, 'cut', $this->StoreSelectedIDs($event)); + $this->clearSelectedIDs($event); } /** + * Checks permission for OnPaste event + * + * @param kEvent $event + * @return bool + */ + function _checkPastePermission(&$event) + { + $perm_helper =& $this->Application->recallObject('PermissionsHelper'); + /* @var $perm_helper kPermissionsHelper */ + + $category_id = $this->Application->GetVar('m_cat_id'); + if ($perm_helper->AddCheckPermission($category_id, $event->Prefix) == 0) { + // no items left for editing -> no permission + return $perm_helper->finalizePermissionCheck($event, false); + } + + return true; + } + + /** * Performs category item paste * * @param kEvent $event */ function OnPaste(&$event) { - if ($this->Application->CheckPermission('SYSTEM_ACCESS.READONLY', 1)) { + if ($this->Application->CheckPermission('SYSTEM_ACCESS.READONLY', 1) || !$this->_checkPastePermission($event)) { return; } @@ -230,7 +254,9 @@ if ($clipboard_data['copy']) { $temp =& $this->Application->recallObject($event->getPrefixSpecial().'_TempHandler', 'kTempTablesHandler'); - $this->Application->SetVar('ResetCatBeforeClone', 1); + /* @var $temp kTempTablesHandler */ + + $this->Application->SetVar('ResetCatBeforeClone', 1); // used in "kCatDBEventHandler::OnBeforeClone" $temp->CloneItems($event->Prefix, $event->Special, $clipboard_data['copy']); } Index: branches/RC/core/units/categories/categories_event_handler.php =================================================================== diff -u -N -r11760 -r11821 --- branches/RC/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 11760) +++ branches/RC/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 11821) @@ -12,9 +12,9 @@ $permissions = Array ( 'OnRebuildCache' => Array ('self' => 'add|edit'), - 'OnCopy' => Array ('self' => 'add|edit'), + 'OnCopy' => Array ('self' => true), 'OnCut' => Array ('self' => 'edit'), - 'OnPasteClipboard' => Array ('self' => 'add|edit'), + 'OnPasteClipboard' => Array ('self' => true), 'OnPaste' => Array ('self' => 'add|edit', 'subitem' => 'edit'), 'OnRecalculatePriorities' => Array ('self' => 'add|edit'), // category ordering @@ -62,11 +62,7 @@ } } - $check_events = Array ( - 'OnEdit', 'OnSave', 'OnMassDelete', 'OnMassApprove', - 'OnMassDecline', 'OnMassMoveUp', 'OnMassMoveDown' - ); - if (in_array($event->Name, $check_events)) { + if (in_array($event->Name, $this->_getMassPermissionEvents())) { $items = $this->_getPermissionCheckInfo($event); $perm_helper =& $this->Application->recallObject('PermissionsHelper'); @@ -79,7 +75,7 @@ else { // leave only items, that can be edited $ids = Array (); - $check_method = ($event->Name == 'OnMassDelete') ? 'DeleteCheckPermission' : 'ModifyCheckPermission'; + $check_method = in_array($event->Name, Array ('OnMassDelete', 'OnCut')) ? 'DeleteCheckPermission' : 'ModifyCheckPermission'; foreach ($items as $item_id => $item_data) { if ($perm_helper->$check_method($item_data['CreatedById'], $item_data['ParentId'], $event->Prefix) > 0) { $ids[] = $item_id; @@ -108,6 +104,20 @@ } /** + * Returns events, that require item-based (not just event-name based) permission check + * + * @return Array + */ + function _getMassPermissionEvents() + { + return Array ( + 'OnEdit', 'OnSave', 'OnMassDelete', 'OnMassApprove', + 'OnMassDecline', 'OnMassMoveUp', 'OnMassMoveDown', + 'OnCut', + ); + } + + /** * Returns category item IDs, that require permission checking * * @param kEvent $event @@ -932,14 +942,34 @@ } /** + * Checks permission for OnPaste event + * + * @param kEvent $event + * @return bool + */ + function _checkPastePermission(&$event) + { + $perm_helper =& $this->Application->recallObject('PermissionsHelper'); + /* @var $perm_helper kPermissionsHelper */ + + $category_id = $this->Application->GetVar('m_cat_id'); + if ($perm_helper->AddCheckPermission($category_id, $event->Prefix) == 0) { + // no items left for editing -> no permission + return $perm_helper->finalizePermissionCheck($event, false); + } + + return true; + } + + /** * Paste categories with subitems from clipboard * * @param kEvent $event */ function OnPaste(&$event) { - if ($this->Application->CheckPermission('SYSTEM_ACCESS.READONLY', 1)) { - return; + if ($this->Application->CheckPermission('SYSTEM_ACCESS.READONLY', 1) || !$this->_checkPastePermission($event)) { + return ; } $clipboard_data = $event->getEventParam('clipboard_data'); @@ -948,7 +978,6 @@ return false; } - // 1. get ParentId of moved category(-es) before it gets updated!!!) $id_field = $this->Application->getUnitOption($event->Prefix, 'IDField'); @@ -1208,7 +1237,7 @@ if ($this->Application->GetVar('propagate_category_status')) { $sql = 'UPDATE '.$object->TableName.' - SET '.$status_field.' = '.$object->GetDBField('Status').' + SET '.$status_field.' = '.$object->GetDBField($status_field).' WHERE TreeLeft BETWEEN '.$object->GetDBField('TreeLeft').' AND '.$object->GetDBField('TreeRight'); $this->Conn->Query($sql); }