Merge branch 'Copy-For-View-Only' of git://github.com/mark-james/BookStack into mark...

diff --git a/app/Auth/Permissions/PermissionService.php b/app/Auth/Permissions/PermissionService.php
index af2a5e1fd8c694ee36d2e5e25134e0b3f5ec991d..b28f59cc5018b127eaf15365b20148761de791de 100644 (file)
--- a/app/Auth/Permissions/PermissionService.php
+++ b/app/Auth/Permissions/PermissionService.php
@@ -556,6 +556,33 @@ class PermissionService
         return $q;
     }
 
+    /**
+     * Checks if a user has a book or chapter available to create a page
+     * @param Ownable $ownable
+     * @param $permission
+     * @return bool
+     */
+    public function checkAvailableCreatePageAccess()
+    {
+        $userRoleIds = $this->currentUser()->roles()->pluck('id')->toArray();
+        $userId = $this->currentUser()->id;
+
+
+        $canCreatePage = $this->db->table('joint_permissions')
+            ->where('action', '=', 'page-create')
+            ->whereIn('role_id', $userRoleIds)
+            ->where(function ($query) use ($userId) {
+                $query->where('has_permission', '=', 1)
+                ->orWhere(function ($query2) use ($userId) {
+                    $query2->where('has_permission_own', '=', 1)
+                    ->where('created_by', '=', $userId);
+                });       
+            })
+            ->get()->count() > 0;
+
+        return $canCreatePage;
+    }
+
     /**
      * Check if an entity has restrictions set on itself or its
      * parent tree.

diff --git a/app/Http/Controllers/PageController.php b/app/Http/Controllers/PageController.php
index b68655241485c572a0ea277f400ffd98e880f461..d95e02470bee10c63d436421ac7a53cdcff6577c 100644 (file)
--- a/app/Http/Controllers/PageController.php
+++ b/app/Http/Controllers/PageController.php
@@ -643,7 +643,7 @@ class PageController extends Controller
     public function showCopy($bookSlug, $pageSlug)
     {
         $page = $this->pageRepo->getPageBySlug($pageSlug, $bookSlug);
-        $this->checkOwnablePermission('page-update', $page);
+        $this->checkOwnablePermission('page-view', $page);
         session()->flashInput(['name' => $page->name]);
         return view('pages/copy', [
             'book' => $page->book,
@@ -662,7 +662,7 @@ class PageController extends Controller
     public function copy($bookSlug, $pageSlug, Request $request)
     {
         $page = $this->pageRepo->getPageBySlug($pageSlug, $bookSlug);
-        $this->checkOwnablePermission('page-update', $page);
+        $this->checkOwnablePermission('page-view', $page);
 
         $entitySelection = $request->get('entity_selection', null);
         if ($entitySelection === null || $entitySelection === '') {

diff --git a/app/helpers.php b/app/helpers.php
index b0886d02b9762c27383e37f5b7989014607ed03c..383e25c1594e8eac7e5b1b3f6cb2f8d3c3fa8c6e 100644 (file)
--- a/app/helpers.php
+++ b/app/helpers.php
@@ -65,6 +65,17 @@ function userCan($permission, Ownable $ownable = null)
     return $permissionService->checkOwnableUserAccess($ownable, $permission);
 }
 
+/**
+ * Check if the current user has the ability to create a page for an existing object
+ * @return bool
+ */
+function userCanCreatePage()
+{
+    // Check for create page permissions
+    $permissionService = app(\BookStack\Auth\Permissions\PermissionService::class);
+    return $permissionService->checkAvailableCreatePageAccess();
+}
+
 /**
  * Helper to access system settings.
  * @param $key

diff --git a/resources/views/pages/show.blade.php b/resources/views/pages/show.blade.php
index afe007d45fe057df7dc24f58065d40a1985b41a0..6f221edee92b37be1fa361dd582cac883cfb148c 100644 (file)
--- a/resources/views/pages/show.blade.php
+++ b/resources/views/pages/show.blade.php
@@ -17,15 +17,17 @@
             @if(userCan('page-update', $page))
                 <a href="{{ $page->getUrl('/edit') }}" class="text-primary text-button" >@icon('edit'){{ trans('common.edit') }}</a>
             @endif
-            @if(userCan('page-update', $page) || userCan('restrictions-manage', $page) || userCan('page-delete', $page))
+            @if((userCan('page-view', $page) && userCanCreatePage()) || userCan('page-update', $page) || userCan('restrictions-manage', $page) || userCan('page-delete', $page))
                 <div dropdown class="dropdown-container">
                     <a dropdown-toggle class="text-primary text-button">@icon('more') {{ trans('common.more') }}</a>
                     <ul>
-                        @if(userCan('page-update', $page))
+                        @if(userCanCreatePage())
                             <li><a href="{{ $page->getUrl('/copy') }}" class="text-primary" >@icon('copy'){{ trans('common.copy') }}</a></li>
-                            @if(userCan('page-delete', $page))
-                                <li><a href="{{ $page->getUrl('/move') }}" class="text-primary" >@icon('folder'){{ trans('common.move') }}</a></li>
-                            @endif
+                        @endif
+                        @if(userCan('page-delete', $page) && userCan('page-update, $page))
+                            <li><a href="{{ $page->getUrl('/move') }}" class="text-primary" >@icon('folder'){{ trans('common.move') }}</a></li>
+                        @endif
+                        @if(userCan('page-update', $page))
                             <li><a href="{{ $page->getUrl('/revisions') }}" class="text-primary">@icon('history'){{ trans('entities.revisions') }}</a></li>
                         @endif
                         @if(userCan('restrictions-manage', $page))