ENH: refs #445. Private user should be allowed to view their own userpage

Added a test to make sure this is true. Also made it so that a private user
will now see himself in the user index list.

Author: zachmullen

core/controllers/UserController.php

@@ -44,6 +44,7 @@ function indexAction()
 
     $order = $this->_getParam('order');
     $offset = $this->_getParam('offset');
+
     if(!isset($order))
       {
       $order = 'view';
@@ -59,7 +60,7 @@ function indexAction()
       }
     else
       {
-      $users = $this->User->getAll(true, 100, $order, $offset);
+      $users = $this->User->getAll(true, 100, $order, $offset, $this->userSession->Dao);
       }
 
     $this->view->order = $order;
@@ -668,7 +669,9 @@ public function userpageAction()
     else
       {
       $userDao = $this->User->load($user_id);
-      if($userDao->getPrivacy() == MIDAS_USER_PRIVATE && (!isset($this->userSession->Dao) || !$this->userSession->Dao->isAdmin()))
+      if($userDao->getPrivacy() == MIDAS_USER_PRIVATE &&
+        (!$this->logged || $this->userSession->Dao->getKey() != $userDao->getKey()) &&
+        (!isset($this->userSession->Dao) || !$this->userSession->Dao->isAdmin()))
         {
         throw new Zend_Exception("Permission error");
         }

core/models/base/UserModelBase.php

@@ -67,7 +67,7 @@ abstract function getByUuid($uuid);
   /** Returns a user given its folder (either public,private or base folder) */
   abstract function getByFolder($folder);
   /** Returns all the users */
-  abstract function getAll($onlyPublic = false, $limit = 20, $order = 'lastname', $offset = null);
+  abstract function getAll($onlyPublic = false, $limit = 20, $order = 'lastname', $offset = null, $currentUser = null);
 
   /** save */
   public function save($dao)
@@ -226,4 +226,4 @@ public function getGravatarUrl($email, $s = 32, $d = '404', $r = 'g', $img = fal
       }
     return $url;
     }
-} // end class UserModelBase
+} // end class UserModelBase

core/models/pdo/UserModel.php

@@ -83,26 +83,31 @@ public function getUserCommunities($userDao)
     } // end getUserCommunities
 
   /** Get all */
-  function getAll($onlyPublic = false, $limit = 20, $order = 'lastname', $offset = null)
+  function getAll($onlyPublic = false, $limit = 20, $order = 'lastname', $offset = null, $currentUser = null)
     {
     $sql = $this->database->select();
     if($onlyPublic)
       {
-      $sql ->where('privacy = ?', MIDAS_USER_PUBLIC);
+      $orClause = '';
+      if($currentUser !== null && $currentUser->getPrivacy() == MIDAS_USER_PRIVATE)
+        {
+        $orClause = ' OR '.$this->database->getDB()->quoteInto('user_id = ? ', $currentUser->getUserId());
+        }
+      $sql->where('privacy = ?'.$orClause, MIDAS_USER_PUBLIC);
       }
 
     if($offset == null)
       {
-      $sql  ->limit($limit);
+      $sql->limit($limit);
       }
     elseif(!is_numeric($offset))
       {
-      $sql ->where('lastname LIKE ?', $offset.'%');
-      $sql  ->limit($limit);
+      $sql->where('lastname LIKE ?', $offset.'%');
+      $sql->limit($limit);
       }
     else
       {
-      $sql  ->limit($limit, $offset);
+      $sql->limit($limit, $offset);
       }
     switch($order)
       {
@@ -127,6 +132,7 @@ function getAll($onlyPublic = false, $limit = 20, $order = 'lastname', $offset =
       }
     return $return;
     } // end getAll()
+
   /** Get admins */
   function getAdmins()
     {

core/tests/controllers/UserControllerTest.php

@@ -237,21 +237,29 @@ public function testUserpageAction()
     $this->resetAll();
     $usersFile = $this->loadData('User', 'default');
     $userDao = $this->User->load($usersFile[0]->getKey());
-    $this->dispatchUrI("/user/userpage", $userDao);
+    $this->dispatchUrI('/user/userpage', $userDao);
 
     $this->assertQuery('div.genericInfo');
 
     $folder = $userDao->getPublicFolder();
     $this->assertQuery("tr[element='".$folder->getKey()."']");
 
-    $this->params = array();
-    $this->params['user_id'] = $userDao->getKey();
-    $this->dispatchUrI("/user/userpage", null, false);
+    // Should be able to see this user page since user is public
+    $this->resetAll();
+    $this->dispatchUrI('/user/'.$userDao->getKey(), null);
 
     $userDao->setPrivacy(MIDAS_USER_PRIVATE);
     $this->User->save($userDao);
 
-    $this->dispatchUrI("/user/userpage", null, true);
+    // Should throw an exception since the user is now private
+    $this->resetAll();
+    $this->dispatchUrI('/user/'.$userDao->getKey(), null, true);
+
+    // Private user should be able to view his own user page
+    $this->resetAll();
+    $this->dispatchUrI('/user/'.$userDao->getKey(), $userDao);
+    $this->assertController('user');
+    $this->assertAction('userpage');
     }
 
   /** test validentry */