*5540* Implement validation (authorization) - fixed a few authorizati…

…on bugs in FilterGridHandler and CitationGridHandler

classes/controllers/grid/filter/FilterGridHandler.inc.php

@@ -39,8 +39,7 @@ function FilterGridHandler() {
 	function authorize(&$request, &$args, $roleAssignments) {
 		// Make sure the user can change the journal setup.
 		import('classes.security.authorization.OjsJournalSetupPolicy');
-		$this->addPolicy(new OjsJournalSetupPolicy($request));
-
+		$this->addPolicy(new OjsJournalSetupPolicy($request, $roleAssignments));
 		return parent::authorize($request, $args, $roleAssignments);
 	}
 }

classes/security/authorization/OjsJournalSetupPolicy.inc.php

@@ -11,19 +11,20 @@
  * @brief Class to control access to OJS' journal setup components
  */
 
-import('lib.pkp.classes.security.authorization.OjsJournalPolicy');
+import('classes.security.authorization.OjsJournalPolicy');
 
 class OjsJournalSetupPolicy extends OjsJournalPolicy {
 	/**
 	 * Constructor
 	 * @param $request PKPRequest
+	 * @param $roleAssignments array
 	 */
-	function OjsJournalSetupPolicy(&$request) {
+	function OjsJournalSetupPolicy(&$request, $roleAssignments) {
 		parent::OjsJournalPolicy($request);
 
 		// Only journal managers may access setup pages.
 		import('lib.pkp.classes.security.authorization.RoleBasedHandlerOperationPolicy');
-		$this->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_JOURNAL_MANAGER, 'You are not a journal manager!'));
+		$this->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_JOURNAL_MANAGER, $roleAssignments[ROLE_ID_JOURNAL_MANAGER], 'You are not a journal manager!'));
 	}
 }
 

classes/security/authorization/OjsSubmissionEditingPolicy.inc.php

@@ -18,8 +18,11 @@ class OjsSubmissionEditingPolicy extends OjsJournalPolicy {
 	/**
 	 * Constructor
 	 * @param $request PKPRequest
+	 * @param $args array
+	 * @param $roleAssignments array
+	 * @param $submissionParameterName string
 	 */
-	function OjsSubmissionEditingPolicy(&$request, &$args, $submissionParameterName = 'articleId') {
+	function OjsSubmissionEditingPolicy(&$request, &$args, $roleAssignments, $submissionParameterName = 'articleId') {
 		parent::OjsJournalPolicy($request);
 
 		// Editorial components can only be called if there's a
@@ -35,16 +38,16 @@ function OjsSubmissionEditingPolicy(&$request, &$args, $submissionParameterName
 		//
 		// Editor role
 		//
-		// Editors can access all operations for all submissions.
-		$editorialRolePolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_EDITOR));
+		// Editors can access all remote operations for all submissions.
+		$editorialRolePolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_EDITOR, $roleAssignments[ROLE_ID_EDITOR]));
 
 
 		//
 		// Section editor role
 		//
-		// 1) Series editors can access all operations ...
+		// 1) Series editors can access all remote operations ...
 		$sectionEditorPolicy = new PolicySet(COMBINING_DENY_OVERRIDES);
-		$sectionEditorPolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_SECTION_EDITOR));
+		$sectionEditorPolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, ROLE_ID_SECTION_EDITOR, $roleAssignments[ROLE_ID_SECTION_EDITOR]));
 
 		// 2) ... but only if the requested submission has been explicitly assigned to them.
 		import('classes.security.authorization.SectionSubmissionAssignmentPolicy');

controllers/grid/citation/CitationGridHandler.inc.php

@@ -39,8 +39,7 @@ function CitationGridHandler() {
 	function authorize(&$request, &$args, $roleAssignments) {
 		// Make sure the user can edit the submission in the request.
 		import('classes.security.authorization.OjsSubmissionEditingPolicy');
-		$this->addPolicy(new OjsSubmissionEditingPolicy($request, $args, 'assocId'));
-
+		$this->addPolicy(new OjsSubmissionEditingPolicy($request, $args, $roleAssignments, 'assocId'));
 		return parent::authorize($request, $args, $roleAssignments);
 	}
 
@@ -51,7 +50,7 @@ function authorize(&$request, &$args, $roleAssignments) {
 	function initialize(&$request) {
 		// Associate the citation editor with the authorized article.
 		$this->setAssocType(ASSOC_TYPE_ARTICLE);
-		$article =& $this->getAuthorizationContextObject(ASSOC_TYPE_ARTICLE);
+		$article =& $this->getAuthorizedContextObject(ASSOC_TYPE_ARTICLE);
 		assert(is_a($article, 'Article'));
 		$this->setAssocObject($article);