Update maintenance.php

[bookstack] / app / Auth / Permissions / PermissionService.php

diff --git a/app/Auth/Permissions/PermissionService.php b/app/Auth/Permissions/PermissionService.php
index b28f59cc5018b127eaf15365b20148761de791de..a5ab4ea9a8e51109c7225bc82ccca1799470205d 100644 (file)
--- a/app/Auth/Permissions/PermissionService.php
+++ b/app/Auth/Permissions/PermissionService.php
@@ -557,30 +557,36 @@ class PermissionService
     }
 
     /**
     }
 
     /**

-     * Checks if a user has a book or chapter available to create a page
-     * @param Ownable $ownable
-     * @param $permission
+     * Checks if a user has the given permission for any items in the system.
+     * Can be passed an entity instance to filter on a specific type.
+     * @param string $permission
+     * @param string $entityClass

      * @return bool
      */
      * @return bool
      */

-    public function checkAvailableCreatePageAccess()
+    public function checkUserHasPermissionOnAnything(string $permission, string $entityClass = null)

     {
     {

-        $userRoleIds = $this->currentUser()->roles()->pluck('id')->toArray();
+        $userRoleIds = $this->currentUser()->roles()->select('id')->pluck('id')->toArray();

         $userId = $this->currentUser()->id;
 
         $userId = $this->currentUser()->id;
 

-
-        $canCreatePage = $this->db->table('joint_permissions')
-            ->where('action', '=', 'page-create')
+        $permissionQuery = $this->db->table('joint_permissions')
+            ->where('action', '=', $permission)

             ->whereIn('role_id', $userRoleIds)
             ->where(function ($query) use ($userId) {
                 $query->where('has_permission', '=', 1)
             ->whereIn('role_id', $userRoleIds)
             ->where(function ($query) use ($userId) {
                 $query->where('has_permission', '=', 1)

-                ->orWhere(function ($query2) use ($userId) {
-                    $query2->where('has_permission_own', '=', 1)
-                    ->where('created_by', '=', $userId);
-                });       
-            })
-            ->get()->count() > 0;
+                    ->orWhere(function ($query2) use ($userId) {
+                        $query2->where('has_permission_own', '=', 1)
+                            ->where('created_by', '=', $userId);
+                    });
+            });
+
+        if (!is_null($entityClass)) {
+            $entityInstance = app()->make($entityClass);
+            $permissionQuery = $permissionQuery->where('entity_type', '=', $entityInstance->getMorphClass());
+        }

 
 

-        return $canCreatePage;
+        $hasPermission = $permissionQuery->count() > 0;
+        $this->clean();
+        return $hasPermission;

     }
 
     /**
     }
 
     /**


@@ -698,7 +704,7 @@ class PermissionService
      * @param string $entityIdColumn
      * @param string $entityTypeColumn
      * @param string $action
      * @param string $entityIdColumn
      * @param string $entityTypeColumn
      * @param string $action

-     * @return mixed
+     * @return QueryBuilder

      */
     public function filterRestrictedEntityRelations($query, $tableName, $entityIdColumn, $entityTypeColumn, $action = 'view')
     {
      */
     public function filterRestrictedEntityRelations($query, $tableName, $entityIdColumn, $entityTypeColumn, $action = 'view')
     {


@@ -726,18 +732,21 @@ class PermissionService
     }
 
     /**
     }
 
     /**

-     * Filters pages that are a direct relation to another item.
+     * Add conditions to a query to filter the selection to related entities
+     * where permissions are granted.
+     * @param $entityType

      * @param $query
      * @param $tableName
      * @param $entityIdColumn
      * @return mixed
      */
      * @param $query
      * @param $tableName
      * @param $entityIdColumn
      * @return mixed
      */

-    public function filterRelatedPages($query, $tableName, $entityIdColumn)
+    public function filterRelatedEntity($entityType, $query, $tableName, $entityIdColumn)

     {
         $this->currentAction = 'view';
         $tableDetails = ['tableName' => $tableName, 'entityIdColumn' => $entityIdColumn];
 
     {
         $this->currentAction = 'view';
         $tableDetails = ['tableName' => $tableName, 'entityIdColumn' => $entityIdColumn];
 

-        $pageMorphClass = $this->entityProvider->page->getMorphClass();
+        $pageMorphClass = $this->entityProvider->get($entityType)->getMorphClass();
+

         $q = $query->where(function ($query) use ($tableDetails, $pageMorphClass) {
             $query->where(function ($query) use (&$tableDetails, $pageMorphClass) {
                 $query->whereExists(function ($permissionQuery) use (&$tableDetails, $pageMorphClass) {
         $q = $query->where(function ($query) use ($tableDetails, $pageMorphClass) {
             $query->where(function ($query) use (&$tableDetails, $pageMorphClass) {
                 $query->whereExists(function ($permissionQuery) use (&$tableDetails, $pageMorphClass) {


@@ -755,7 +764,9 @@ class PermissionService
                 });
             })->orWhere($tableDetails['entityIdColumn'], '=', 0);
         });
                 });
             })->orWhere($tableDetails['entityIdColumn'], '=', 0);
         });

+

         $this->clean();
         $this->clean();

+

         return $q;
     }
 
         return $q;
     }