Skip to content

Commit 85c8d04

Browse files
atelomycterusatelomycterus
committed
Issues-373: added custom upload permissions
1 parent 02564e5 commit 85c8d04

File tree

6 files changed

+3324
-11
lines changed

6 files changed

+3324
-11
lines changed

‎config/vanilla/bootstrap.late.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,4 +55,16 @@
5555
$CategoryModel->recalculateTree();
5656
unset($CategoryModel);
5757
}
58+
59+
60+
// Define some permissions for the Vanilla categories.
61+
// FIX: https://github.com/topcoder-platform/forums/issues/373
62+
$PermissionModel->define(
63+
[
64+
'Vanilla.Discussions.Uploads' => 0,
65+
'Vanilla.Comments.Uploads' => 0],
66+
'tinyint',
67+
'Category',
68+
'PermissionCategoryID'
69+
);
5870
}

‎vanilla/applications/dashboard/controllers/api/MediaApiController.php‎

Lines changed: 61 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -364,12 +364,6 @@ public function patch_attachment(int $id, array $body): array {
364364
* @return array
365365
*/
366366
public function post(array $body) {
367-
if(!Gdn::session()->checkPermission('Garden.Uploads.Add')) {
368-
throw new ClientException('You don\'t have permission to upload files', 403);
369-
}
370-
371-
//$this->permission('Garden.Uploads.Add');
372-
373367
$allowedExtensions = $this->config->get('Garden.Upload.AllowedFileExtensions', []);
374368
$uploadSchema = new UploadedFileSchema([
375369
UploadedFileSchema::OPTION_ALLOWED_EXTENSIONS => $allowedExtensions,
@@ -380,10 +374,69 @@ public function post(array $body) {
380374

381375
$in = $this->schema([
382376
'file' => $uploadSchema,
377+
'categoryID:i?' => "CategoryID",
378+
'discussionID:i?' => "DiscussionID",
379+
'commentID:i?' => "CommentID",
380+
'actionType:s?' => "ActionType"
383381
], 'in')->setDescription('Add a media item.');
384-
$out = $this->schema($this->fullSchema(), 'out');
385-
386382
$body = $in->validate($body);
383+
$categoryID = $body['categoryID'];
384+
$discussionID = $body['discussionID'];
385+
$commentID = $body['commentID'];
386+
$actionType = $body['actionType'];
387+
388+
if(!$categoryID && !$discussionID && !Gdn::session()->checkPermission('Garden.Uploads.Add')) {
389+
throw new ClientException("You don't have permission to upload files", 403);
390+
}
391+
392+
if(!Gdn::session()->checkPermission('Garden.Uploads.Add')) {
393+
switch ($actionType) {
394+
case 'NewDiscussion':
395+
if(!$categoryID) {
396+
throw new ClientException("You don't have permission to upload files", 403);
397+
}
398+
$permissionCategory = CategoryModel::permissionCategory($categoryID);
399+
$discussionsUploads = CategoryModel::checkPermission($permissionCategory, 'Vanilla.Discussions.Uploads');
400+
if(!$discussionsUploads) {
401+
throw new ClientException("You don't have permission to upload files", 403);
402+
}
403+
break;
404+
case 'EditDiscussion':
405+
$discussionModel = new DiscussionModel();
406+
$discussion = $discussionModel->getID($discussionID);
407+
if (!$discussion) {
408+
throw new NotFoundException('Discussion');
409+
}
410+
$categoryID = val('CategoryID', $discussion, false);
411+
$permissionCategory = CategoryModel::permissionCategory($categoryID);
412+
$discussionsUploads = CategoryModel::checkPermission($permissionCategory, 'Vanilla.Discussions.Uploads');
413+
if(!$discussionsUploads) {
414+
throw new ClientException("You don't have permission to upload files", 403);
415+
}
416+
break;
417+
case 'NewComment':
418+
case 'EditComment':
419+
$discussionModel = new DiscussionModel();
420+
$discussion = $discussionModel->getID($discussionID);
421+
if (!$discussion) {
422+
throw new NotFoundException('Discussion');
423+
}
424+
425+
$categoryID = val('CategoryID', $discussion, false);
426+
$permissionCategory = CategoryModel::permissionCategory($categoryID);
427+
$commentsUploads = CategoryModel::checkPermission($permissionCategory, 'Vanilla.Comments.Uploads');
428+
// No permissions
429+
if(!$commentsUploads) {
430+
throw new ClientException("You don't have permission to upload files", 403);
431+
}
432+
break;
433+
default:
434+
throw new ClientException("You don't have permission to upload files", 403);
435+
}
436+
437+
}
438+
439+
$out = $this->schema($this->fullSchema(), 'out');
387440

388441
$imageExtensions = array_keys(ImageResizer::getExtType());
389442
/** @var UploadedFile $file */

‎vanilla/applications/vanilla/controllers/class.discussioncontroller.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,8 @@ public function index($DiscussionID = '', $DiscussionStub = '', $Page = '') {
257257
$this->DiscussionID = $this->Discussion->DiscussionID;
258258
$this->Form->addHidden('DiscussionID', $this->DiscussionID);
259259
$this->Form->addHidden('CommentID', '');
260+
$this->setData('ActionType', 'NewComment');
261+
$this->Form->addHidden('ActionType', 'NewComment');
260262

261263
// Look in the session stash for a comment
262264
$StashComment = $Session->getPublicStash('CommentForDiscussionID_'.$this->Discussion->DiscussionID);

‎vanilla/applications/vanilla/controllers/class.postcontroller.php‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ public function discussion($categoryUrlCode = '') {
173173
$this->Form->setFormValue('DiscussionID', $this->Discussion->DiscussionID);
174174

175175
$this->title(t('Edit Discussion'));
176-
176+
$this->setData('ActionType', 'EditDiscussion');
177177
if ($this->Discussion->Type) {
178178
$this->setData('Type', $this->Discussion->Type);
179179
} else {
@@ -197,8 +197,10 @@ public function discussion($categoryUrlCode = '') {
197197
$this->permission('Vanilla.Discussions.Add');
198198
}
199199
$this->title(t('New Discussion'));
200+
$this->setData('ActionType', 'NewDiscussion');
200201
}
201202

203+
$this->Form->addHidden('ActionType', $this->data('ActionType'));
202204
touchValue('Type', $this->Data, 'Discussion');
203205

204206
// Remove Announce parameter if it was injected into the form.
@@ -443,7 +445,7 @@ public function editDiscussion($discussionID = '', $draftID = '') {
443445
$record = $this->Draft = $this->DraftModel->getID($draftID);
444446
$this->CategoryID = $this->Draft->CategoryID;
445447
$this->setData('ShowPreviewButton', $record->Format != 'Rich');
446-
448+
$this->setData('ActionType', 'NewDiscussion');
447449
// FIX: https://github.com/topcoder-platform/forums/issues/347
448450
$this->setData('_CancelUrl', '/drafts');
449451
// Verify this is their draft
@@ -452,6 +454,7 @@ public function editDiscussion($discussionID = '', $draftID = '') {
452454
}
453455
} else {
454456
$record = $this->DiscussionModel->getID($discussionID);
457+
$this->setData('ActionType', 'EditDiscussion');
455458
$this->setData('ShowPreviewButton', $this->Discussion->Format != 'Rich');
456459
// FIX: Issues-308: Editor - supporting old and new formats
457460
$this->EventArguments['Discussion'] = &$record;
@@ -693,7 +696,7 @@ public function comment($DiscussionID = '') {
693696
$this->Form->addHidden('DiscussionID', $DiscussionID);
694697
$this->Form->addHidden('CommentID', $CommentID);
695698
$this->Form->addHidden('DraftID', $DraftID, true);
696-
699+
$this->Form->addHidden('ActionType', $this->data('ActionType'));
697700
// Check permissions
698701
if ($Discussion && $Editing) {
699702
// Make sure that content can (still) be edited.
@@ -987,9 +990,11 @@ public function comment2($commentID, $inserted = false) {
987990
*/
988991
public function editComment($commentID = '', $draftID = '') {
989992
if (is_numeric($commentID) && $commentID > 0) {
993+
$this->setData('ActionType', 'EditComment');
990994
$this->Form->setModel($this->CommentModel);
991995
$this->Comment = $this->CommentModel->getID($commentID);
992996
} else {
997+
$this->setData('ActionType', 'NewComment');
993998
$this->Form->setModel($this->DraftModel);
994999
$this->Comment = $this->DraftModel->getID($draftID);
9951000
}

‎vanilla/applications/vanilla/models/class.categorymodel.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,8 @@ private function calculateUser(array &$category, $addUserCategory = null) {
211211
$category['PermsDiscussionsAdd'] = self::checkPermission($category, 'Vanilla.Discussions.Add');
212212
$category['PermsDiscussionsEdit'] = self::checkPermission($category, 'Vanilla.Discussions.Edit');
213213
$category['PermsCommentsAdd'] = self::checkPermission($category, 'Vanilla.Comments.Add');
214+
$category['PermsDiscussionsUploads'] = self::checkPermission($category, 'Vanilla.Discussions.Uploads');
215+
$category['PermsCommentsUploads'] = self::checkPermission($category, 'Vanilla.Comments.Uploads');
214216

215217
$code = $category['UrlCode'];
216218
$category['Name'] = Gdn::translate("Categories.".$code.".Name", $category['Name']);

0 commit comments

Comments
 (0)