Index: branches/unlabeled/unlabeled-1.14.2/kernel/units/admin/admin_config.php =================================================================== diff -u -r5770 -r6026 --- branches/unlabeled/unlabeled-1.14.2/kernel/units/admin/admin_config.php (.../admin_config.php) (revision 5770) +++ branches/unlabeled/unlabeled-1.14.2/kernel/units/admin/admin_config.php (.../admin_config.php) (revision 6026) @@ -126,11 +126,11 @@ 'in-portal:service' => Array( 'parent' => 'in-portal:tools', - 'icon' => 'tool_service', + 'icon' => 'conf_general', 'label' => 'la_tab_Service', 'url' => Array('t' => 'tools/system_tools', 'pass' => 'm'), 'permissions' => Array('view'), - 'priority' => 1, + 'priority' => 10, 'type' => stTREE, ), Index: branches/unlabeled/unlabeled-1.22.2/core/units/categories/categories_event_handler.php =================================================================== diff -u -r6015 -r6026 --- branches/unlabeled/unlabeled-1.22.2/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 6015) +++ branches/unlabeled/unlabeled-1.22.2/core/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 6026) @@ -11,11 +11,62 @@ parent::mapPermissions(); $permissions = Array( 'OnRebuildCache' => Array('self' => 'add|edit'), +// 'OnSave' => Array('self' => 'add|edit') ); $this->permMapping = array_merge($this->permMapping, $permissions); } /** + * Checks permissions of user + * + * @param kEvent $event + */ + function CheckPermission(&$event) + { + if (!$this->Application->IsAdmin()) { + if ($event->Name == 'OnSetSortingDirect') { + // allow sorting on front event without view permission + return true; + } + } + + if ($event->Name == 'OnEdit' || $event->Name == 'OnSave') { + // check each id from selected individually and only if all are allowed proceed next + if ($event->Name == 'OnEdit') { + $selected_ids = implode(',', $this->StoreSelectedIDs($event)); + } + else { + $selected_ids = $this->Application->RecallVar($event->getPrefixSpecial().'_selected_ids'); + } + + $id_field = $this->Application->getUnitOption($event->Prefix, 'IDField'); + $table_name = $this->Application->getUnitOption($event->Prefix, 'TableName'); + $sql = 'SELECT '.$id_field.', CreatedById + FROM '.$table_name.' item_table + WHERE '.$id_field.' IN ('.$selected_ids.')'; + $items = $this->Conn->Query($sql, $id_field); + + $perm_value = true; + $perm_helper =& $this->Application->recallObject('PermissionsHelper'); + foreach ($items as $item_id => $item_data) { + if ($perm_helper->ModifyCheckPermission($item_data['CreatedById'], $item_data[$id_field], $event->Prefix) == 0) { + // one of items selected has no permission + $perm_value = false; + break; + } + } + + if (!$perm_value) { + $event->status = erPERM_FAIL; + } + + return $perm_value; + } + + return parent::CheckPermission($event); + } + + /** * Apply system filter to categories list * * @param kEvent $event Index: branches/unlabeled/unlabeled-1.1.2/kernel/admin_templates/item_selector/item_selector_toolbar.tpl =================================================================== diff -u -r5820 -r6026 --- branches/unlabeled/unlabeled-1.1.2/kernel/admin_templates/item_selector/item_selector_toolbar.tpl (.../item_selector_toolbar.tpl) (revision 5820) +++ branches/unlabeled/unlabeled-1.1.2/kernel/admin_templates/item_selector/item_selector_toolbar.tpl (.../item_selector_toolbar.tpl) (revision 6026) @@ -4,55 +4,59 @@ \ No newline at end of file Index: branches/unlabeled/unlabeled-1.155.2/core/kernel/application.php =================================================================== diff -u -r5970 -r6026 --- branches/unlabeled/unlabeled-1.155.2/core/kernel/application.php (.../application.php) (revision 5970) +++ branches/unlabeled/unlabeled-1.155.2/core/kernel/application.php (.../application.php) (revision 6026) @@ -512,13 +512,13 @@ } // this allows to save 2 sql queries for each category - $sql = 'SELECT NamedParentPath, CachedCategoryTemplate, CachedItemTemplate + $sql = 'SELECT NamedParentPath, CachedCategoryTemplate FROM '.$table.' WHERE '.$id_field.' = '.$this->Conn->qstr($id); $category_data = $this->Conn->GetRow($sql); $filename = $category_data['NamedParentPath']; $this->setCache('category_templates', $id, $category_data['CachedCategoryTemplate']); - $this->setCache('item_templates', $id, $category_data['CachedItemTemplate']); +// $this->setCache('item_templates', $id, $category_data['CachedItemTemplate']); } else { $resource_id = $this->Conn->GetOne('SELECT ResourceId FROM '.$table.' WHERE '.$id_field.' = '.$this->Conn->qstr($id)); @@ -1229,7 +1229,7 @@ unset($params['category_processed']); } - if (!$m_only || !$cat_processed) { + if (!$m_only || !$cat_processed || !defined('EXP_DIR_URLS')) { $ret = trim($ret, '/').'.html'; } else { @@ -1435,6 +1435,10 @@ if( isset($params['js_redirect']) ) unset($params['js_redirect']); if (!isset($params['pass'])) $params['pass'] = 'all'; + if ($this->GetVar('ajax') == 'yes' && $t == $this->GetVar('t')) { + // redirects to the same template as current + $params['ajax'] = 'yes'; + } $params['__URLENCODE__'] = 1; $location = $this->HREF($t, $prefix, $params, $index_file); //echo " location : $location
"; Index: branches/unlabeled/unlabeled-1.7.2/kernel/units/general/helpers/multilanguage.php =================================================================== diff -u -r5521 -r6026 --- branches/unlabeled/unlabeled-1.7.2/kernel/units/general/helpers/multilanguage.php (.../multilanguage.php) (revision 5521) +++ branches/unlabeled/unlabeled-1.7.2/kernel/units/general/helpers/multilanguage.php (.../multilanguage.php) (revision 6026) @@ -5,7 +5,7 @@ * */ class kMultiLanguageHelper extends kHelper { - + var $languageCount = 0; /** @@ -14,34 +14,34 @@ * @var Array */ var $curStructure = Array(); - + /** * Field, to get structure information from * * @var string */ var $curSourceField = false; - + /** * Indexes used in table of 32 * * @var int */ var $curIndexCount = 0; - + /** * Fields from config, that are currently used * * @var Array */ var $curFields = Array(); - + function kMultiLanguageHelper() { parent::kHelper(); $this->languageCount = $this->getLanguageCount(); } - + /** * Returns language count in system (always is divisible by 5) * @@ -56,33 +56,33 @@ } return $languages_count + 5 - ( $languages_count % 5 ? ($languages_count % 5) : 5 ); } - - + + function scanTable($mask) { $i = 0; $fields_found = 0; $fields = array_keys($this->curStructure); - + foreach ($fields as $field_name) { if (preg_match($mask, $field_name)) { $fields_found++; } } return $fields_found; } - - function readTableStructure($table_name) + + function readTableStructure($table_name, $refresh=false) { static $structure_status = Array(); - - if (!getArrayValue($structure_status, $table_name)) { + + if ($refresh || !getArrayValue($structure_status, $table_name)) { $this->curStructure = $this->Conn->Query('DESCRIBE '.$table_name, 'Field'); $this->curIndexCount = count($this->Conn->Query('SHOW INDEXES FROM '.$table_name)); $structure_status[$table_name] = true; } } - + /** * Creates missing multilanguage fields in table by specified prefix * @@ -94,29 +94,34 @@ if ($refresh) { $this->Application->HandleEvent( new kEvent($prefix.':OnCreateCustomFields') ); } - + $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $this->curFields = $this->Application->getUnitOption($prefix, 'Fields'); - + if (!($table_name && $this->curFields) ) { // invalid config found or prefix not found return true; } $sqls = Array(); + $this->readTableStructure($table_name, $refresh); + foreach($this->curFields as $field_name => $field_options) { if (getArrayValue($field_options, 'formatter') == 'kMultiLanguage') { - $this->readTableStructure($table_name); - + if (isset($field_options['master_field'])) { + unset($this->curFields[$field_name]); + continue; + } + $created_count = $this->getCreatedCount($field_name); $create_count = $this->languageCount - $created_count; if ($create_count > 0) { // `l77_Name` VARCHAR( 255 ) NULL DEFAULT '0'; $field_mask = Array(); $field_mask['name'] = 'l%s_'.$field_name; $field_mask['null'] = getArrayValue($field_options, 'not_null') ? 'NOT NULL' : 'NULL'; - + if ($this->curSourceField) { $default_value = $this->getFieldParam('Default') != 'NULL' ? $this->Conn->qstr($this->getFieldParam('Default')) : $this->getFieldParam('Default'); $field_mask['type'] = $this->getFieldParam('Type'); @@ -127,23 +132,23 @@ } $field_mask['default'] = 'DEFAULT '.$default_value; $field_mask = $field_mask['name'].' '.$field_mask['type'].' '.$field_mask['null'].' '.$field_mask['default']; - + $sqls[] = 'ALTER TABLE '.$table_name.( $this->generateAlterSQL($field_mask, $created_count + 1, $create_count) ); } } } - + foreach ($sqls as $sql_query) { $this->Conn->Query($sql_query); } } - + function deleteField($prefix, $custom_id) { $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $sql = 'DESCRIBE '.$table_name.' "l%_cust_'.$custom_id.'"'; $fields = $this->Conn->GetCol($sql); - + $sql = 'ALTER TABLE '.$table_name.' '; $sql_template = 'DROP COLUMN %s, '; foreach ($fields as $field_name) { @@ -152,7 +157,7 @@ $sql = preg_replace('/(.*), $/', '\\1', $sql); $this->Conn->Query($sql); } - + /** * Returns parameter requested of current source field * @@ -163,7 +168,7 @@ { return $this->curStructure[$this->curSourceField][$param_name]; } - + function getCreatedCount($field_name) { $ret = $this->scanTable('/^l[\d]+_'.preg_quote($field_name, '/').'/'); @@ -197,7 +202,7 @@ // if language count = 0, then assume it's multi language mode $single_lang = $this->Conn->GetOne($sql) == 1; } - + $ret = ' '; $i_count = $start_index + $create_count; while ($start_index < $i_count) { @@ -207,23 +212,24 @@ if (!$this->curSourceField) { // get field name before this one $fields = array_keys($this->curFields); +// $prev_field = key(end($this->curStructure)); $prev_field = $fields[array_search($prev_field, $fields) - 1]; if (getArrayValue($this->curFields[$prev_field], 'formatter') == 'kMultiLanguage') { $prev_field = 'l'.$this->languageCount.'_'.$prev_field; } } } - + $field_expression = sprintf($field_mask, $start_index); $ret .= 'ADD COLUMN '.$field_expression.' AFTER `'.$prev_field.'`, '; - + if ($this->curIndexCount < 32 && ($start_index == $this->Application->GetDefaultLanguageId() || !$single_lang)) { // create index for primary language column + for all others (if multiple languages installed) - list($field_name, $field_params) = explode(' ', $field_expression, 2); + list($field_name, $field_params) = explode(' ', $field_expression, 2); $ret .= 'ADD INDEX (`'.$field_name.'` (5) ), '; $this->curIndexCount++; } - + $start_index++; } return preg_replace('/, $/',';',$ret); Index: branches/unlabeled/unlabeled-1.73.2/core/kernel/db/db_event_handler.php =================================================================== diff -u -r5962 -r6026 --- branches/unlabeled/unlabeled-1.73.2/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 5962) +++ branches/unlabeled/unlabeled-1.73.2/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 6026) @@ -120,8 +120,8 @@ // theese event do not harm, but just in case check them too :) - 'OnCancelEdit' => Array('self' => true), - 'OnCancel' => Array('self' => true), + 'OnCancelEdit' => Array('self' => true, 'subitem' => true), + 'OnCancel' => Array('self' => true, 'subitem' => true), 'OnSetSorting' => Array('self' => true, 'subitem' => true), 'OnSetSortingDirect' => Array('self' => true, 'subitem' => true), @@ -1756,6 +1756,7 @@ $fields = $this->Application->getUnitOption($event->Prefix, 'Fields', Array()); $field_options = Array('type' => 'string', 'formatter' => 'kMultiLanguage', 'not_null' => 1, 'db_type' => 'text', 'default' => ''); foreach ($custom_fields as $custom_id => $custom_params) { + if (isset($fields['cust_'.$custom_id])) continue; $fields['cust_'.$custom_id] = $field_options; } $this->Application->setUnitOption($event->Prefix, 'Fields', $fields); Index: branches/unlabeled/unlabeled-1.7.2/core/units/general/helpers/multilanguage.php =================================================================== diff -u -r5521 -r6026 --- branches/unlabeled/unlabeled-1.7.2/core/units/general/helpers/multilanguage.php (.../multilanguage.php) (revision 5521) +++ branches/unlabeled/unlabeled-1.7.2/core/units/general/helpers/multilanguage.php (.../multilanguage.php) (revision 6026) @@ -5,7 +5,7 @@ * */ class kMultiLanguageHelper extends kHelper { - + var $languageCount = 0; /** @@ -14,34 +14,34 @@ * @var Array */ var $curStructure = Array(); - + /** * Field, to get structure information from * * @var string */ var $curSourceField = false; - + /** * Indexes used in table of 32 * * @var int */ var $curIndexCount = 0; - + /** * Fields from config, that are currently used * * @var Array */ var $curFields = Array(); - + function kMultiLanguageHelper() { parent::kHelper(); $this->languageCount = $this->getLanguageCount(); } - + /** * Returns language count in system (always is divisible by 5) * @@ -56,33 +56,33 @@ } return $languages_count + 5 - ( $languages_count % 5 ? ($languages_count % 5) : 5 ); } - - + + function scanTable($mask) { $i = 0; $fields_found = 0; $fields = array_keys($this->curStructure); - + foreach ($fields as $field_name) { if (preg_match($mask, $field_name)) { $fields_found++; } } return $fields_found; } - - function readTableStructure($table_name) + + function readTableStructure($table_name, $refresh=false) { static $structure_status = Array(); - - if (!getArrayValue($structure_status, $table_name)) { + + if ($refresh || !getArrayValue($structure_status, $table_name)) { $this->curStructure = $this->Conn->Query('DESCRIBE '.$table_name, 'Field'); $this->curIndexCount = count($this->Conn->Query('SHOW INDEXES FROM '.$table_name)); $structure_status[$table_name] = true; } } - + /** * Creates missing multilanguage fields in table by specified prefix * @@ -94,29 +94,34 @@ if ($refresh) { $this->Application->HandleEvent( new kEvent($prefix.':OnCreateCustomFields') ); } - + $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $this->curFields = $this->Application->getUnitOption($prefix, 'Fields'); - + if (!($table_name && $this->curFields) ) { // invalid config found or prefix not found return true; } $sqls = Array(); + $this->readTableStructure($table_name, $refresh); + foreach($this->curFields as $field_name => $field_options) { if (getArrayValue($field_options, 'formatter') == 'kMultiLanguage') { - $this->readTableStructure($table_name); - + if (isset($field_options['master_field'])) { + unset($this->curFields[$field_name]); + continue; + } + $created_count = $this->getCreatedCount($field_name); $create_count = $this->languageCount - $created_count; if ($create_count > 0) { // `l77_Name` VARCHAR( 255 ) NULL DEFAULT '0'; $field_mask = Array(); $field_mask['name'] = 'l%s_'.$field_name; $field_mask['null'] = getArrayValue($field_options, 'not_null') ? 'NOT NULL' : 'NULL'; - + if ($this->curSourceField) { $default_value = $this->getFieldParam('Default') != 'NULL' ? $this->Conn->qstr($this->getFieldParam('Default')) : $this->getFieldParam('Default'); $field_mask['type'] = $this->getFieldParam('Type'); @@ -127,23 +132,23 @@ } $field_mask['default'] = 'DEFAULT '.$default_value; $field_mask = $field_mask['name'].' '.$field_mask['type'].' '.$field_mask['null'].' '.$field_mask['default']; - + $sqls[] = 'ALTER TABLE '.$table_name.( $this->generateAlterSQL($field_mask, $created_count + 1, $create_count) ); } } } - + foreach ($sqls as $sql_query) { $this->Conn->Query($sql_query); } } - + function deleteField($prefix, $custom_id) { $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $sql = 'DESCRIBE '.$table_name.' "l%_cust_'.$custom_id.'"'; $fields = $this->Conn->GetCol($sql); - + $sql = 'ALTER TABLE '.$table_name.' '; $sql_template = 'DROP COLUMN %s, '; foreach ($fields as $field_name) { @@ -152,7 +157,7 @@ $sql = preg_replace('/(.*), $/', '\\1', $sql); $this->Conn->Query($sql); } - + /** * Returns parameter requested of current source field * @@ -163,7 +168,7 @@ { return $this->curStructure[$this->curSourceField][$param_name]; } - + function getCreatedCount($field_name) { $ret = $this->scanTable('/^l[\d]+_'.preg_quote($field_name, '/').'/'); @@ -197,7 +202,7 @@ // if language count = 0, then assume it's multi language mode $single_lang = $this->Conn->GetOne($sql) == 1; } - + $ret = ' '; $i_count = $start_index + $create_count; while ($start_index < $i_count) { @@ -207,23 +212,24 @@ if (!$this->curSourceField) { // get field name before this one $fields = array_keys($this->curFields); +// $prev_field = key(end($this->curStructure)); $prev_field = $fields[array_search($prev_field, $fields) - 1]; if (getArrayValue($this->curFields[$prev_field], 'formatter') == 'kMultiLanguage') { $prev_field = 'l'.$this->languageCount.'_'.$prev_field; } } } - + $field_expression = sprintf($field_mask, $start_index); $ret .= 'ADD COLUMN '.$field_expression.' AFTER `'.$prev_field.'`, '; - + if ($this->curIndexCount < 32 && ($start_index == $this->Application->GetDefaultLanguageId() || !$single_lang)) { // create index for primary language column + for all others (if multiple languages installed) - list($field_name, $field_params) = explode(' ', $field_expression, 2); + list($field_name, $field_params) = explode(' ', $field_expression, 2); $ret .= 'ADD INDEX (`'.$field_name.'` (5) ), '; $this->curIndexCount++; } - + $start_index++; } return preg_replace('/, $/',';',$ret); Index: branches/unlabeled/unlabeled-1.17.2/core/units/general/helpers/permissions_helper.php =================================================================== diff -u -r5874 -r6026 --- branches/unlabeled/unlabeled-1.17.2/core/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 5874) +++ branches/unlabeled/unlabeled-1.17.2/core/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 6026) @@ -151,6 +151,9 @@ // item being created -> check by current (before editing started, saved in OnPreCreate event) category permissions $category_id = $this->Application->RecallVar('m_cat_id'); } + elseif ($top_prefix == 'c') { + $category_id = $id; + } else { // item being edited -> check by it's primary category permissions $sql = 'SELECT ci.CategoryId, main_table.CreatedById @@ -163,15 +166,15 @@ } $item_prefix = $this->Application->getUnitOption($top_prefix, 'PermItemPrefix'); - + if (substr($event->Name, 0, 9) == 'OnPreSave') { if ($event_handler->isNewItemCreate($event)) { - return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || + return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id); } else { - return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || - $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id) || + return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || + $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id) || $this->ModifyCheckPermission($owner_id, $category_id, $top_prefix); } } @@ -231,14 +234,14 @@ $this->showDebug('Tag '.$tag_name.' permission(-s): '.$permission_groups.'', $params); $permission_groups = explode('|', $permission_groups); $group_has_permission = false; - + $perm_category = $this->Application->GetVar('m_cat_id'); - + if ($perm_prefix) { // use primary category of item with id from {perm_prefix}_id as base for permission checking $perm_category = $this->getPrimaryCategory($perm_prefix); } - + foreach ($permission_groups as $permission_group) { $permissions = explode(',', $permission_group); $has_permission = true; @@ -275,18 +278,20 @@ $id_field = $this->Application->getUnitOption($prefix, 'IDField'); $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $id = $this->Application->GetVar($prefix.'_id'); - + + if (!$id) return $this->Application->GetVar('m_cat_id'); + $sql = 'SELECT ResourceId FROM '.$table_name.' WHERE '.$id_field.' = '.$id; $resource_id = $this->Conn->GetOne($sql); - + $sql = 'SELECT CategoryId FROM '.$this->Application->getUnitOption('ci', 'TableName').' WHERE ItemResourceId = '.$resource_id.' AND PrimaryCat = 1'; return $this->Conn->GetOne($sql); } - + /** * Returns no permission template to redirect to * @@ -362,7 +367,7 @@ FROM '.TABLE_PREFIX.'PermissionConfig WHERE PermissionName = '.$this->Conn->qstr($name); $perm_id = $this->Conn->GetOne($sql); - + $sql = 'SELECT PermId FROM '.TABLE_PREFIX.'PermCache WHERE (PermId = '.$perm_id.') AND (CategoryId = '.$cat_id.')'; @@ -409,7 +414,7 @@ $this->Application->setCache('permissions', $cache_key, $perm_value); return $perm_value; } - + /** * Allows to check MODIFY & OWNER.MODFY +/- PENDING permission combinations on item * @@ -421,15 +426,15 @@ function ModifyCheckPermission($owner_id, $category_id, $prefix) { $perm_prefix = $this->Application->getUnitOption($prefix, 'PermItemPrefix'); - + $live_modify = $this->CheckPermission($perm_prefix.'.MODIFY', ptCATEGORY, $category_id); if ($live_modify) { return 1; } else if ($this->CheckPermission($perm_prefix.'.MODIFY.PENDING', ptCATEGORY, $category_id)) { return 2; } - + if ($owner_id == $this->Application->GetVar('u_id')) { // user is item's OWNER -> check this permissions first $live_modify = $this->CheckPermission($perm_prefix.'.OWNER.MODIFY', ptCATEGORY, $category_id); @@ -440,7 +445,7 @@ return 2; } } - + return 0; } } Index: branches/unlabeled/unlabeled-1.38.2/kernel/include/item.php =================================================================== diff -u -r5962 -r6026 --- branches/unlabeled/unlabeled-1.38.2/kernel/include/item.php (.../item.php) (revision 5962) +++ branches/unlabeled/unlabeled-1.38.2/kernel/include/item.php (.../item.php) (revision 6026) @@ -1172,7 +1172,7 @@ { parent::Update($UpdatedBy); - $this->GenerateFilename(); + $this->GenerateFilename(); parent::Update($UpdatedBy); } @@ -1182,7 +1182,6 @@ parent::Create(); $this->GenerateFilename(); - parent::Update(); } Index: branches/unlabeled/unlabeled-1.17.2/kernel/units/general/helpers/permissions_helper.php =================================================================== diff -u -r5874 -r6026 --- branches/unlabeled/unlabeled-1.17.2/kernel/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 5874) +++ branches/unlabeled/unlabeled-1.17.2/kernel/units/general/helpers/permissions_helper.php (.../permissions_helper.php) (revision 6026) @@ -151,6 +151,9 @@ // item being created -> check by current (before editing started, saved in OnPreCreate event) category permissions $category_id = $this->Application->RecallVar('m_cat_id'); } + elseif ($top_prefix == 'c') { + $category_id = $id; + } else { // item being edited -> check by it's primary category permissions $sql = 'SELECT ci.CategoryId, main_table.CreatedById @@ -163,15 +166,15 @@ } $item_prefix = $this->Application->getUnitOption($top_prefix, 'PermItemPrefix'); - + if (substr($event->Name, 0, 9) == 'OnPreSave') { if ($event_handler->isNewItemCreate($event)) { - return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || + return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id); } else { - return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || - $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id) || + return $this->CheckPermission($item_prefix.'.ADD', 0, $category_id) || + $this->CheckPermission($item_prefix.'.ADD.PENDING', 0, $category_id) || $this->ModifyCheckPermission($owner_id, $category_id, $top_prefix); } } @@ -231,14 +234,14 @@ $this->showDebug('Tag '.$tag_name.' permission(-s): '.$permission_groups.'', $params); $permission_groups = explode('|', $permission_groups); $group_has_permission = false; - + $perm_category = $this->Application->GetVar('m_cat_id'); - + if ($perm_prefix) { // use primary category of item with id from {perm_prefix}_id as base for permission checking $perm_category = $this->getPrimaryCategory($perm_prefix); } - + foreach ($permission_groups as $permission_group) { $permissions = explode(',', $permission_group); $has_permission = true; @@ -275,18 +278,20 @@ $id_field = $this->Application->getUnitOption($prefix, 'IDField'); $table_name = $this->Application->getUnitOption($prefix, 'TableName'); $id = $this->Application->GetVar($prefix.'_id'); - + + if (!$id) return $this->Application->GetVar('m_cat_id'); + $sql = 'SELECT ResourceId FROM '.$table_name.' WHERE '.$id_field.' = '.$id; $resource_id = $this->Conn->GetOne($sql); - + $sql = 'SELECT CategoryId FROM '.$this->Application->getUnitOption('ci', 'TableName').' WHERE ItemResourceId = '.$resource_id.' AND PrimaryCat = 1'; return $this->Conn->GetOne($sql); } - + /** * Returns no permission template to redirect to * @@ -362,7 +367,7 @@ FROM '.TABLE_PREFIX.'PermissionConfig WHERE PermissionName = '.$this->Conn->qstr($name); $perm_id = $this->Conn->GetOne($sql); - + $sql = 'SELECT PermId FROM '.TABLE_PREFIX.'PermCache WHERE (PermId = '.$perm_id.') AND (CategoryId = '.$cat_id.')'; @@ -409,7 +414,7 @@ $this->Application->setCache('permissions', $cache_key, $perm_value); return $perm_value; } - + /** * Allows to check MODIFY & OWNER.MODFY +/- PENDING permission combinations on item * @@ -421,15 +426,15 @@ function ModifyCheckPermission($owner_id, $category_id, $prefix) { $perm_prefix = $this->Application->getUnitOption($prefix, 'PermItemPrefix'); - + $live_modify = $this->CheckPermission($perm_prefix.'.MODIFY', ptCATEGORY, $category_id); if ($live_modify) { return 1; } else if ($this->CheckPermission($perm_prefix.'.MODIFY.PENDING', ptCATEGORY, $category_id)) { return 2; } - + if ($owner_id == $this->Application->GetVar('u_id')) { // user is item's OWNER -> check this permissions first $live_modify = $this->CheckPermission($perm_prefix.'.OWNER.MODIFY', ptCATEGORY, $category_id); @@ -440,7 +445,7 @@ return 2; } } - + return 0; } } Index: branches/unlabeled/unlabeled-1.1.2/core/admin_templates/catalog/item_selector/item_selector_toolbar.tpl =================================================================== diff -u -r5820 -r6026 --- branches/unlabeled/unlabeled-1.1.2/core/admin_templates/catalog/item_selector/item_selector_toolbar.tpl (.../item_selector_toolbar.tpl) (revision 5820) +++ branches/unlabeled/unlabeled-1.1.2/core/admin_templates/catalog/item_selector/item_selector_toolbar.tpl (.../item_selector_toolbar.tpl) (revision 6026) @@ -4,55 +4,59 @@ \ No newline at end of file Index: branches/unlabeled/unlabeled-1.56.2/kernel/include/category.php =================================================================== diff -u -r5656 -r6026 --- branches/unlabeled/unlabeled-1.56.2/kernel/include/category.php (.../category.php) (revision 5656) +++ branches/unlabeled/unlabeled-1.56.2/kernel/include/category.php (.../category.php) (revision 6026) @@ -9,18 +9,18 @@ class clsCategory extends clsItem { var $Permissions; - + var $DescriptionField = ''; - + function clsCategory($CategoryId=NULL) { global $objSession; $this->clsItem(TRUE); - + $ml_formatter =& $this->Application->recallObject('kMultiLanguage'); $this->TitleField = $ml_formatter->LangFieldName('Name'); $this->DescriptionField = $ml_formatter->LangFieldName('Description'); - + $this->tablename = GetTablePrefix()."Category"; $this->type=1; $this->BasePermission ="CATEGORY"; @@ -314,28 +314,28 @@ } return $dataValid; } - + function UpdateCachedPath() { if( $this->UsingTempTable() == true) return ; $Id = $this->Get('CategoryId'); $Id2 = $Id; - + $path_parts = Array(); - $nav_parts = Array(); + $nav_parts = Array(); $named_parts = Array(); $cateogry_template = ''; $item_template = ''; - + $ml_helper =& $this->Application->recallObject('kMultiLanguageHelper'); $language_count = $ml_helper->getLanguageCount(); $primary_lang_id = $this->Application->GetDefaultLanguageId(); - - do { + + do { $rs = $this->adodbConnection->Execute('SELECT * FROM '.$this->tablename.' WHERE CategoryId = '.$Id2); $path_parts[] = $Id2; $named_parts[] = $rs->fields['Filename']; - + $i = 1; while ($i <= $language_count) { $nav_parts[$i][] = $rs->fields['l'.$i.'_Name'] ? $rs->fields['l'.$i.'_Name'] : $rs->fields['l'.$primary_lang_id.'_Name']; @@ -345,30 +345,25 @@ if (!$cateogry_template && $rs->fields['CachedCategoryTemplate']) { $cateogry_template = $rs->fields['CachedCategoryTemplate']; } - - if (!$item_template && $rs->fields['CachedItemTemplate']) { - $item_template = $rs->fields['CachedItemTemplate']; - } - + $Id2 = ($rs && !$rs->EOF) ? $rs->fields['ParentId'] : '0'; - + } while ($Id2 != '0'); - + $parent_path = '|'.implode('|', array_reverse($path_parts) ).'|'; $named_path = implode('/', array_reverse($named_parts) ); - + $i = 1; while ($i <= $language_count) { $this->Set('l'.$i.'_CachedNavbar', implode('&|&', array_reverse($nav_parts[$i]) )); $i++; } - + $this->Set('ParentPath', $parent_path); $this->Set('NamedParentPath', $named_path); $this->Set('CachedCategoryTemplate', $cateogry_template); - $this->Set('CachedItemTemplate', $item_template); $this->Update(); - + } function GetCachedNavBar() @@ -847,7 +842,7 @@ $ml_formatter =& $this->Application->recallObject('kMultiLanguage'); return str_replace('&|&', ' > ', $this->Get($ml_formatter->LangFieldName('CachedNavbar'))); } - + function ParseObject($element) { global $objConfig, $objCatList, $rootURL, $var_list, $var_list_update, $m_var_list_update, $objItemTypes,$objCountCache, $objUsers; @@ -910,9 +905,9 @@ @field:cat.cachednavbar @description: Category cached navbar */ - + $this->Set('CachedNavbar', $this->GetNavbar()); - + $ret = $this->HighlightField("CachedNavbar"); if(!strlen($ret)) { @@ -1385,7 +1380,7 @@ case "cat_fullpath": return $this->GetNavbar(); break; - + case "cat_name": return $this->Get($this->TitleField); break; @@ -1570,15 +1565,15 @@ var $TitleField = ''; var $DescriptionField = ''; - + function clsCatList() { global $m_var_list; $this->clsItemCollection(); $ml_formatter =& $this->Application->recallObject('kMultiLanguage'); $this->TitleField = $ml_formatter->LangFieldName('Name'); $this->DescriptionField = $ml_formatter->LangFieldName('Description'); - + $this->Prefix = 'c'; $this->classname="clsCategory"; $this->AdminSearchFields = array($this->TitleField, $this->DescriptionField); @@ -2121,24 +2116,24 @@ function &Add_NEW($fields_hash, $from_import = false) { global $objSession; - + $fields_hash['CreatedById'] = $objSession->Get('PortalUserId'); - + $d = new clsCategory(NULL); $fields_hash['Filename'] = $d->StripDisallowed($fields_hash['Filename']); $d->tablename = $this->SourceTable; - + if ( $d->UsingTempTable() ) { $d->Set('CategoryId', -1); } $d->idfield = 'CategoryId'; - + foreach ($fields_hash as $field_name => $field_value) { $d->Set($field_name, $field_value); } - + $d->Create(); - + if (!$from_import) { if ($d->Get('Status') == STATUS_ACTIVE) { $d->SendUserEventMail("CATEGORY.ADD", $objSession->Get("PortalUserId")); @@ -2153,7 +2148,7 @@ } return $d; } - + function &Add( $ParentId, $Name, $Description, $CreatedOn, $EditorsPick, $Status, $Hot, $New, $Pop, $Priority, $MetaKeywords,$MetaDesc, $auto_filename = 1, $filename = '') { @@ -2190,16 +2185,16 @@ return $d; } - function &Edit_Category($category_id, $fields_hash) + function &Edit_Category($category_id, $fields_hash) { $d =& $this->GetCategory($category_id); - + $fields_hash['Filename'] = $d->StripDisallowed($fields_hash['Filename']); - + foreach ($fields_hash as $field_name => $field_value) { $d->Set($field_name, $field_value); } - + $d->Update(); $d->UpdateCachedPath(); return $d; @@ -2373,7 +2368,7 @@ } $perm_status = $objSession->HasCatPermission('CATEGORY.DELETE', $check_cat); } - + if (($d->Get("CategoryId") == $Id) && $perm_status) { $d->SendUserEventMail("CATEGORY.DELETE",$objSession->Get("PortalUserId")); $d->SendAdminEventMail("CATEGORY.DELETE"); Index: branches/unlabeled/unlabeled-1.50.2/core/units/categories/categories_config.php =================================================================== diff -u -r6015 -r6026 --- branches/unlabeled/unlabeled-1.50.2/core/units/categories/categories_config.php (.../categories_config.php) (revision 6015) +++ branches/unlabeled/unlabeled-1.50.2/core/units/categories/categories_config.php (.../categories_config.php) (revision 6026) @@ -104,7 +104,7 @@ 'type' => stTREE, ), - 'in-portal:browse_new' => Array( + 'in-portal:browse' => Array( 'parent' => 'in-portal:site', 'icon' => 'catalog', 'label' => 'la_tab_Browse', @@ -115,7 +115,7 @@ 'priority' => 0.1, 'type' => stTREE, ), - 'in-portal:advanced_view_new' => Array( + 'in-portal:advanced_view' => Array( 'parent' => 'in-portal:site', 'icon' => 'advanced_view', 'label' => 'la_tab_AdvancedView', Index: branches/unlabeled/unlabeled-1.50.2/kernel/units/categories/categories_config.php =================================================================== diff -u -r6015 -r6026 --- branches/unlabeled/unlabeled-1.50.2/kernel/units/categories/categories_config.php (.../categories_config.php) (revision 6015) +++ branches/unlabeled/unlabeled-1.50.2/kernel/units/categories/categories_config.php (.../categories_config.php) (revision 6026) @@ -104,7 +104,7 @@ 'type' => stTREE, ), - 'in-portal:browse_new' => Array( + 'in-portal:browse' => Array( 'parent' => 'in-portal:site', 'icon' => 'catalog', 'label' => 'la_tab_Browse', @@ -115,7 +115,7 @@ 'priority' => 0.1, 'type' => stTREE, ), - 'in-portal:advanced_view_new' => Array( + 'in-portal:advanced_view' => Array( 'parent' => 'in-portal:site', 'icon' => 'advanced_view', 'label' => 'la_tab_AdvancedView', Index: branches/unlabeled/unlabeled-1.6.2/kernel/units/relationship/relationship_event_handler.php =================================================================== diff -u -r5795 -r6026 --- branches/unlabeled/unlabeled-1.6.2/kernel/units/relationship/relationship_event_handler.php (.../relationship_event_handler.php) (revision 5795) +++ branches/unlabeled/unlabeled-1.6.2/kernel/units/relationship/relationship_event_handler.php (.../relationship_event_handler.php) (revision 6026) @@ -23,20 +23,20 @@ function OnNew(&$event) { parent::OnNew(&$event); - + $object =& $event->getObject(); $table_info = $object->getLinkedInfo(); - + $object->SetDBField('SourceId', $table_info['ParentId']); $source_itemtype = $this->Application->getUnitOption($table_info['ParentPrefix'], 'ItemType'); $object->SetDBField('SourceType', $source_itemtype); - + $object->SetDBField('TargetId', $this->Application->GetVar('target_id')); $object->SetDBField('TargetType', $this->Application->GetVar('target_type')); - + $this->OnAfterItemLoad($event); } - + /** * Add new relation * @@ -48,7 +48,7 @@ if ($dst_field == 'TargetId') { // prepare target_id & target_type $object =& $event->getObject( Array('skip_autoload' => true) ); - + $selected_ids = $this->Application->GetVar('selected_ids'); $target_prefix = false; foreach ($selected_ids as $selected_prefix => $target_id) { @@ -57,22 +57,27 @@ break; } } - + + if (!$target_prefix) { + $this->finalizePopup($event); + return; + } + $sql = 'SELECT ResourceId FROM '.$this->Application->getUnitOption($target_prefix, 'TableName').' WHERE '.$this->Application->getUnitOption($target_prefix, 'IDField').' = '.$target_id; $target_id = $this->Conn->GetOne($sql); $target_type = $this->Application->getUnitOption($target_prefix, 'ItemType'); - + // don't add same relation twice $table_info = $object->getLinkedInfo(); $sql = 'SELECT TargetId FROM '.$object->TableName.' WHERE (SourceId = '.$table_info['ParentId'].') AND (TargetId = '.$target_id.')'; $duplicate_relation = $this->Conn->GetOne($sql) == $target_id; - + $this->finalizePopup($event); - + if (!$duplicate_relation) { // place correct template in opener stack $source_prefix = $this->Application->getUnitOption($event->Prefix, 'ParentPrefix'); @@ -94,23 +99,23 @@ function OnAfterItemLoad(&$event) { $object =& $event->getObject(); - + $sql = 'SELECT Prefix FROM '.TABLE_PREFIX.'ItemTypes WHERE ItemType = '.$object->GetDBField('TargetType'); $target_prefix = $this->Conn->GetOne($sql); - + $title_field = $this->getTitleField($target_prefix); $title_phrase = $this->Application->getUnitOption($target_prefix, 'TitlePhrase'); - + $sql = 'SELECT '.$title_field.' FROM '.$this->Application->getUnitOption($target_prefix, 'TableName').' WHERE ResourceId = '.$object->GetDBField('TargetId'); - + $object->SetDBField('ItemName', $this->Conn->GetOne($sql)); $object->SetDBField('ItemType', $this->Application->Phrase($title_phrase)); } - + /** * Creates needed sql query to load list, * if no query is defined in config for @@ -200,17 +205,17 @@ function getTitleField($prefix) { $lang_prefix = 'l'.$this->Application->GetVar('m_lang').'_'; - + $title_field = $this->Application->getUnitOption($prefix, 'TitleField'); $field_options = $this->Application->getUnitOption($prefix.'.'.$title_field, 'Fields'); - + $formatter_class = isset($field_options['formatter']) ? $field_options['formatter'] : ''; if ($formatter_class == 'kMultiLanguage' && !isset($field_options['master_field'])) { $title_field = $lang_prefix.$title_field; } return $title_field; } - + /** * Get configs from modules installed * Index: branches/unlabeled/unlabeled-1.6.2/core/units/relationship/relationship_event_handler.php =================================================================== diff -u -r5795 -r6026 --- branches/unlabeled/unlabeled-1.6.2/core/units/relationship/relationship_event_handler.php (.../relationship_event_handler.php) (revision 5795) +++ branches/unlabeled/unlabeled-1.6.2/core/units/relationship/relationship_event_handler.php (.../relationship_event_handler.php) (revision 6026) @@ -23,20 +23,20 @@ function OnNew(&$event) { parent::OnNew(&$event); - + $object =& $event->getObject(); $table_info = $object->getLinkedInfo(); - + $object->SetDBField('SourceId', $table_info['ParentId']); $source_itemtype = $this->Application->getUnitOption($table_info['ParentPrefix'], 'ItemType'); $object->SetDBField('SourceType', $source_itemtype); - + $object->SetDBField('TargetId', $this->Application->GetVar('target_id')); $object->SetDBField('TargetType', $this->Application->GetVar('target_type')); - + $this->OnAfterItemLoad($event); } - + /** * Add new relation * @@ -48,7 +48,7 @@ if ($dst_field == 'TargetId') { // prepare target_id & target_type $object =& $event->getObject( Array('skip_autoload' => true) ); - + $selected_ids = $this->Application->GetVar('selected_ids'); $target_prefix = false; foreach ($selected_ids as $selected_prefix => $target_id) { @@ -57,22 +57,27 @@ break; } } - + + if (!$target_prefix) { + $this->finalizePopup($event); + return; + } + $sql = 'SELECT ResourceId FROM '.$this->Application->getUnitOption($target_prefix, 'TableName').' WHERE '.$this->Application->getUnitOption($target_prefix, 'IDField').' = '.$target_id; $target_id = $this->Conn->GetOne($sql); $target_type = $this->Application->getUnitOption($target_prefix, 'ItemType'); - + // don't add same relation twice $table_info = $object->getLinkedInfo(); $sql = 'SELECT TargetId FROM '.$object->TableName.' WHERE (SourceId = '.$table_info['ParentId'].') AND (TargetId = '.$target_id.')'; $duplicate_relation = $this->Conn->GetOne($sql) == $target_id; - + $this->finalizePopup($event); - + if (!$duplicate_relation) { // place correct template in opener stack $source_prefix = $this->Application->getUnitOption($event->Prefix, 'ParentPrefix'); @@ -94,23 +99,23 @@ function OnAfterItemLoad(&$event) { $object =& $event->getObject(); - + $sql = 'SELECT Prefix FROM '.TABLE_PREFIX.'ItemTypes WHERE ItemType = '.$object->GetDBField('TargetType'); $target_prefix = $this->Conn->GetOne($sql); - + $title_field = $this->getTitleField($target_prefix); $title_phrase = $this->Application->getUnitOption($target_prefix, 'TitlePhrase'); - + $sql = 'SELECT '.$title_field.' FROM '.$this->Application->getUnitOption($target_prefix, 'TableName').' WHERE ResourceId = '.$object->GetDBField('TargetId'); - + $object->SetDBField('ItemName', $this->Conn->GetOne($sql)); $object->SetDBField('ItemType', $this->Application->Phrase($title_phrase)); } - + /** * Creates needed sql query to load list, * if no query is defined in config for @@ -200,17 +205,17 @@ function getTitleField($prefix) { $lang_prefix = 'l'.$this->Application->GetVar('m_lang').'_'; - + $title_field = $this->Application->getUnitOption($prefix, 'TitleField'); $field_options = $this->Application->getUnitOption($prefix.'.'.$title_field, 'Fields'); - + $formatter_class = isset($field_options['formatter']) ? $field_options['formatter'] : ''; if ($formatter_class == 'kMultiLanguage' && !isset($field_options['master_field'])) { $title_field = $lang_prefix.$title_field; } return $title_field; } - + /** * Get configs from modules installed * Index: branches/unlabeled/unlabeled-1.22.2/kernel/units/categories/categories_event_handler.php =================================================================== diff -u -r6015 -r6026 --- branches/unlabeled/unlabeled-1.22.2/kernel/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 6015) +++ branches/unlabeled/unlabeled-1.22.2/kernel/units/categories/categories_event_handler.php (.../categories_event_handler.php) (revision 6026) @@ -11,11 +11,62 @@ parent::mapPermissions(); $permissions = Array( 'OnRebuildCache' => Array('self' => 'add|edit'), +// 'OnSave' => Array('self' => 'add|edit') ); $this->permMapping = array_merge($this->permMapping, $permissions); } /** + * Checks permissions of user + * + * @param kEvent $event + */ + function CheckPermission(&$event) + { + if (!$this->Application->IsAdmin()) { + if ($event->Name == 'OnSetSortingDirect') { + // allow sorting on front event without view permission + return true; + } + } + + if ($event->Name == 'OnEdit' || $event->Name == 'OnSave') { + // check each id from selected individually and only if all are allowed proceed next + if ($event->Name == 'OnEdit') { + $selected_ids = implode(',', $this->StoreSelectedIDs($event)); + } + else { + $selected_ids = $this->Application->RecallVar($event->getPrefixSpecial().'_selected_ids'); + } + + $id_field = $this->Application->getUnitOption($event->Prefix, 'IDField'); + $table_name = $this->Application->getUnitOption($event->Prefix, 'TableName'); + $sql = 'SELECT '.$id_field.', CreatedById + FROM '.$table_name.' item_table + WHERE '.$id_field.' IN ('.$selected_ids.')'; + $items = $this->Conn->Query($sql, $id_field); + + $perm_value = true; + $perm_helper =& $this->Application->recallObject('PermissionsHelper'); + foreach ($items as $item_id => $item_data) { + if ($perm_helper->ModifyCheckPermission($item_data['CreatedById'], $item_data[$id_field], $event->Prefix) == 0) { + // one of items selected has no permission + $perm_value = false; + break; + } + } + + if (!$perm_value) { + $event->status = erPERM_FAIL; + } + + return $perm_value; + } + + return parent::CheckPermission($event); + } + + /** * Apply system filter to categories list * * @param kEvent $event Index: branches/unlabeled/unlabeled-1.14.2/core/units/admin/admin_config.php =================================================================== diff -u -r5770 -r6026 --- branches/unlabeled/unlabeled-1.14.2/core/units/admin/admin_config.php (.../admin_config.php) (revision 5770) +++ branches/unlabeled/unlabeled-1.14.2/core/units/admin/admin_config.php (.../admin_config.php) (revision 6026) @@ -126,11 +126,11 @@ 'in-portal:service' => Array( 'parent' => 'in-portal:tools', - 'icon' => 'tool_service', + 'icon' => 'conf_general', 'label' => 'la_tab_Service', 'url' => Array('t' => 'tools/system_tools', 'pass' => 'm'), 'permissions' => Array('view'), - 'priority' => 1, + 'priority' => 10, 'type' => stTREE, ),