Skip to content

Commit

Permalink
Add concept of permissions for users, orgs, search
Browse files Browse the repository at this point in the history
  • Loading branch information
Jared Hancock committed Mar 5, 2015
1 parent 1c59006 commit 79888ba
Show file tree
Hide file tree
Showing 23 changed files with 255 additions and 46 deletions.
1 change: 0 additions & 1 deletion bootstrap.php
View file
Expand Up @@ -198,7 +198,6 @@ function loadCode() {
require(INCLUDE_DIR.'class.crypto.php');
require(INCLUDE_DIR.'class.timezone.php');
require_once(INCLUDE_DIR.'class.signal.php');
require(INCLUDE_DIR.'class.nav.php');
require(INCLUDE_DIR.'class.page.php');
require_once(INCLUDE_DIR.'class.format.php'); //format helpers
require_once(INCLUDE_DIR.'class.validator.php'); //Class to help with basic form input validation...please help improve it.
Expand Down
1 change: 1 addition & 0 deletions client.inc.php
View file
Expand Up @@ -76,6 +76,7 @@
/* Client specific defaults */
define('PAGE_LIMIT', DEFAULT_PAGE_LIMIT);

require(INCLUDE_DIR.'class.nav.php');
$nav = new UserNav($thisclient, 'home');

$exempt = in_array(basename($_SERVER['SCRIPT_NAME']), array('logout.php', 'ajax.php', 'logs.php', 'upgrade.php'));
Expand Down
19 changes: 18 additions & 1 deletion include/ajax.orgs.php
View file
Expand Up @@ -54,6 +54,8 @@ function editOrg($id) {

if(!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(Organization::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif(!($org = Organization::lookup($id)))
Http::response(404, 'Unknown organization');

Expand All @@ -72,6 +74,8 @@ function updateOrg($id, $profile=false) {

if(!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(Organization::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif(!($org = Organization::lookup($id)))
Http::response(404, 'Unknown organization');

Expand All @@ -97,6 +101,8 @@ function delete($id) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(Organization::PERM_DELETE))
Http::response(403, 'Permission Denied');
elseif (!($org = Organization::lookup($id)))
Http::response(404, 'Unknown organization');

Expand All @@ -116,6 +122,8 @@ function addUser($id, $userId=0, $remote=false) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif (!($org = Organization::lookup($id)))
Http::response(404, 'Unknown organization');

Expand All @@ -137,7 +145,8 @@ function addUser($id, $userId=0, $remote=false) {
Format::htmlchars($user->getName()));
} else { //Creating new user
$form = UserForm::getUserForm()->getForm($_POST);
if (!($user = User::fromForm($form)))
$can_create = $thisstaff->getRole()->hasPerm(User::PERM_CREATE);
if (!($user = User::fromForm($form, $can_create)))
$info['error'] = __('Error adding user - try again!');
}

Expand Down Expand Up @@ -175,6 +184,8 @@ function importUsers($org_id) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(Organization::PERM_CREATE))
Http::response(403, 'Permission Denied');
elseif (!($org = Organization::lookup($org_id)))
Http::response(404, 'No such organization');

Expand All @@ -198,6 +209,10 @@ function importUsers($org_id) {
}

function addOrg() {
global $thisstaff;

if (!$thisstaff->getRole()->hasPerm(Organization::PERM_CREATE))
Http::response(403, 'Permission Denied');

$info = array();

Expand Down Expand Up @@ -266,6 +281,8 @@ function updateForms($org_id) {

if (!$thisstaff)
Http::response(403, "Login required");
elseif (!$thisstaff->getRole()->hasPerm(Organization::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif (!($org = Organization::lookup($org_id)))
Http::response(404, "No such ticket");
elseif (!isset($_POST['forms']))
Expand Down
30 changes: 28 additions & 2 deletions include/ajax.users.php
View file
Expand Up @@ -109,6 +109,8 @@ function editUser($id) {

if(!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif(!($user = User::lookup($id)))
Http::response(404, 'Unknown user');

Expand All @@ -125,6 +127,8 @@ function updateUser($id) {

if(!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif(!($user = User::lookup($id)))
Http::response(404, 'Unknown user');

Expand All @@ -141,6 +145,8 @@ function register($id) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_MANAGE))
Http::response(403, 'Permission Denied');
elseif (!($user = User::lookup($id)))
Http::response(404, 'Unknown user');

Expand Down Expand Up @@ -168,6 +174,8 @@ function manage($id, $target=null) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_MANAGE))
Http::response(403, 'Permission Denied');
elseif (!($user = User::lookup($id)))
Http::response(404, 'Unknown user');

Expand Down Expand Up @@ -200,6 +208,8 @@ function delete($id) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_DELETE))
Http::response(403, 'Permission Denied');
elseif (!($user = User::lookup($id)))
Http::response(404, 'Unknown user');

Expand Down Expand Up @@ -240,9 +250,13 @@ function lookup() {
}

function addUser() {
global $thisstaff;

$info = array();

if (!$thisstaff->getRole()->hasPerm(User::PERM_CREATE))
Http::response(403, 'Permission Denied');

if (!AuthenticationBackend::getSearchDirectories())
$info['lookup'] = 'local';

Expand All @@ -263,6 +277,8 @@ function addRemoteUser($bk, $id) {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_CREATE))
Http::response(403, 'Permission Denied');
elseif (!$bk || !$id)
Http::response(422, 'Backend and user id required');
elseif (!($backend = AuthenticationBackend::getSearchDirectoryBackend($bk))
Expand All @@ -284,6 +300,8 @@ function importUsers() {

if (!$thisstaff)
Http::response(403, 'Login Required');
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_CREATE))
Http::response(403, 'Permission Denied');

$info = array(
'title' => __('Import Users'),
Expand All @@ -304,6 +322,7 @@ function importUsers() {
}

function selectUser($id) {
global $thisstaff;

if ($id)
$user = User::lookup($id);
Expand All @@ -319,9 +338,14 @@ function selectUser($id) {
}

static function _lookupform($form=null, $info=array()) {
global $thisstaff;

if (!$info or !$info['title'])
$info += array('title' => __('Lookup or create a user'));
if (!$info or !$info['title']) {
if ($thisstaff->getRole()->hasPerm(User::PERM_CREATE))
$info += array('title' => __('Lookup or create a user'));
else
$info += array('title' => __('Lookup a user'));
}

ob_start();
include(STAFFINC_DIR . 'templates/user-lookup.tmpl.php');
Expand Down Expand Up @@ -422,6 +446,8 @@ function updateForms($user_id) {

if (!$thisstaff)
Http::response(403, "Login required");
elseif (!$thisstaff->getRole()->hasPerm(User::PERM_EDIT))
Http::response(403, 'Permission Denied');
elseif (!($user = User::lookup($user_id)))
Http::response(404, "No such user");
elseif (!isset($_POST['forms']))
Expand Down
14 changes: 11 additions & 3 deletions include/class.nav.php
View file
Expand Up @@ -111,10 +111,18 @@ function addSubMenu($item,$active=false){


function getTabs(){
global $thisstaff;

if(!$this->tabs) {
$this->tabs=array();
$this->tabs['dashboard'] = array('desc'=>__('Dashboard'),'href'=>'dashboard.php','title'=>__('Agent Dashboard'));
$this->tabs['users'] = array('desc' => __('Users'), 'href' => 'users.php', 'title' => __('User Directory'));
$this->tabs = array();
$this->tabs['dashboard'] = array(
'desc'=>__('Dashboard'),'href'=>'dashboard.php','title'=>__('Agent Dashboard')
);
if ($thisstaff->getRole()->hasPerm(User::PERM_DIRECTORY)) {
$this->tabs['users'] = array(
'desc' => __('Users'), 'href' => 'users.php', 'title' => __('User Directory')
);
}
$this->tabs['tickets'] = array('desc'=>__('Tickets'),'href'=>'tickets.php','title'=>__('Ticket Queue'));
$this->tabs['kbase'] = array('desc'=>__('Knowledgebase'),'href'=>'kb.php','title'=>__('Knowledgebase'));
if (count($this->getRegisteredApps()))
Expand Down
26 changes: 26 additions & 0 deletions include/class.organization.php
View file
Expand Up @@ -35,6 +35,25 @@ class OrganizationModel extends VerySimpleModel {
const COLLAB_PRIMARY_CONTACT = 0x0002;
const ASSIGN_AGENT_MANAGER = 0x0004;

const PERM_CREATE = 'org.create';
const PERM_EDIT = 'org.edit';
const PERM_DELETE = 'org.delete';

static protected $perms = array(
self::PERM_CREATE => array(
'title' => /* @trans */ 'Create',
'desc' => /* @trans */ 'Ability to create new organizations',
),
self::PERM_EDIT => array(
'title' => /* @trans */ 'Edit',
'desc' => /* @trans */ 'Ability to manage organizations',
),
self::PERM_DELETE => array(
'title' => /* @trans */ 'Delete',
'desc' => /* @trans */ 'Ability to delete organizations',
),
);

var $_manager;

function getId() {
Expand Down Expand Up @@ -101,7 +120,14 @@ protected function setStatus($flag) {
function allMembers() {
return $this->users;
}

static function getPermissions() {
return self::$perms;
}
}
include_once INCLUDE_DIR.'class.role.php';
RolePermission::register(/* @trans */ 'Organizations',
OrganizationModel::getPermissions());

class OrganizationCdata extends VerySimpleModel {
static $meta = array(
Expand Down
2 changes: 2 additions & 0 deletions include/class.role.php
View file
Expand Up @@ -266,6 +266,8 @@ class RolePermission {
static protected $_permissions = array(
/* @trans */ 'Tickets' => array(),
/* @trans */ 'Tasks' => array(),
/* @trans */ 'Users' => array(),
/* @trans */ 'Organizations' => array(),
/* @trans */ 'Knowledgebase' => array(),
/* @trans */ 'Miscellaneous' => array(),
);
Expand Down
14 changes: 14 additions & 0 deletions include/class.search.php
View file
Expand Up @@ -30,6 +30,15 @@ abstract class SearchBackend {
const SORT_RECENT = 2;
const SORT_OLDEST = 3;

const PERM_AGENTS = 'search.all';

static protected $perms = array(
self::PERM_AGENTS => array(
'title' => /* @trans */ 'Search',
'desc' => /* @trans */ 'See all tickets in search results, regardless of access'
),
);

abstract function update($model, $id, $content, $new=false, $attrs=array());
abstract function find($query, QuerySet $criteria);

Expand All @@ -48,7 +57,12 @@ function getInstance($id) {

return new self::$registry[$id]();
}

static function getPermissions() {
return self::$perms;
}
}
RolePermission::register(/* @trans */ 'Miscellaneous', SearchBackend::getPermissions());

// Register signals to intercept saving of various content throughout the
// system
Expand Down
5 changes: 3 additions & 2 deletions include/class.staff.php
View file
Expand Up @@ -320,7 +320,7 @@ function getRole($dept=null) {
if (isset($this->_roles[$deptId]))
return $this->_roles[$deptId];

if (($role=$this->group->getRole($deptId)))
if (($role = $this->group->getRole($deptId)))
return $this->_roles[$deptId] = $role;
}
// For the primary department, use the primary role
Expand All @@ -329,6 +329,7 @@ function getRole($dept=null) {

function hasPerm($perm) {
if (!isset($this->_perms)) {
$this->_perms = array();
foreach ($this->getDepartments() as $deptId) {
if (($role = $this->getRole($deptId))) {
foreach ($role->getPermission()->getInfo() as $perm=>$v) {
Expand All @@ -337,7 +338,7 @@ function hasPerm($perm) {
}
}
}
return @$this->_perms[$perm];
return @$this->_perms[$perm] ?: false;
}

function canManageTickets() {
Expand Down
11 changes: 8 additions & 3 deletions include/class.ticket.php
View file
Expand Up @@ -2790,7 +2790,7 @@ protected function filterTicketData($origin, $vars, $forms, $user=false) {
*/
static function create($vars, &$errors, $origin, $autorespond=true,
$alertstaff=true) {
global $ost, $cfg, $thisclient, $_FILES;
global $ost, $cfg, $thisclient, $thisstaff;

// Don't enforce form validation for email
$field_filter = function($type) use ($origin) {
Expand Down Expand Up @@ -2958,9 +2958,14 @@ static function create($vars, &$errors, $origin, $autorespond=true,
}

$user_form = UserForm::getUserForm()->getForm($vars);
$can_create = $thisstaff->getRole()->hasPerm(User::PERM_CREATE);
if (!$user_form->isValid($field_filter('user'))
|| !($user=User::fromVars($user_form->getClean())))
$errors['user'] = __('Incomplete client information');
|| !($user=User::fromVars($user_form->getClean(), $can_create))
) {
$errors['user'] = $can_create
? __('Incomplete client information')
: __('You do not have permission to create users.');
}
}
}

Expand Down

0 comments on commit 79888ba

Please sign in to comment.