From: Dan Brown <redacted>
Date: Mon, 5 Sep 2022 14:52:12 +0000 (+0100)
Subject: Added permission visiblity control to image-delete button
X-Git-Tag: v22.09~1^2~9
X-Git-Url: http://source.bookstackapp.com/bookstack/commitdiff_plain/fbef0d06f2d61030183d5b85a49620f4d23717b1

Added permission visiblity control to image-delete button

Includes test to cover.
For #3697
---

diff --git a/app/Http/Controllers/Images/ImageController.php b/app/Http/Controllers/Images/ImageController.php
index b5bc840a1..4b0ba8b45 100644
--- a/app/Http/Controllers/Images/ImageController.php
+++ b/app/Http/Controllers/Images/ImageController.php
@@ -14,12 +14,9 @@ use Illuminate\Validation\ValidationException;
 
 class ImageController extends Controller
 {
-    protected $imageRepo;
-    protected $imageService;
-
-    /**
-     * ImageController constructor.
-     */
+    protected ImageRepo $imageRepo;
+    protected ImageService $imageService;
+    
     public function __construct(ImageRepo $imageRepo, ImageService $imageService)
     {
         $this->imageRepo = $imageRepo;
diff --git a/resources/views/pages/parts/image-manager-form.blade.php b/resources/views/pages/parts/image-manager-form.blade.php
index 81041fcac..aa21e31bb 100644
--- a/resources/views/pages/parts/image-manager-form.blade.php
+++ b/resources/views/pages/parts/image-manager-form.blade.php
@@ -20,10 +20,12 @@
         </div>
         <div class="grid half">
             <div>
-                <button type="button"
+                @if(userCan('image-delete', $image))
+                    <button type="button"
                         id="image-manager-delete"
                         title="{{ trans('common.delete') }}"
                         class="button icon outline">@icon('delete')</button>
+                @endif
             </div>
             <div class="text-right">
                 <button type="submit"
diff --git a/tests/Uploads/ImageTest.php b/tests/Uploads/ImageTest.php
index 2a3023a9e..84f9e47f4 100644
--- a/tests/Uploads/ImageTest.php
+++ b/tests/Uploads/ImageTest.php
@@ -457,6 +457,32 @@ class ImageTest extends TestCase
         $this->assertFalse(file_exists(public_path($relPath)), 'Uploaded image has not been deleted as expected');
     }
 
+    public function test_image_manager_delete_button_only_shows_with_permission()
+    {
+        $page = Page::query()->first();
+        $this->asAdmin();
+        $imageName = 'first-image.png';
+        $relPath = $this->getTestImagePath('gallery', $imageName);
+        $this->deleteImage($relPath);
+        $viewer = $this->getViewer();
+
+        $this->uploadImage($imageName, $page->id);
+        $image = Image::first();
+
+        $resp = $this->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementExists('button#image-manager-delete[title="Delete"]');
+
+        $resp = $this->actingAs($viewer)->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementNotExists('button#image-manager-delete[title="Delete"]');
+
+        $this->giveUserPermissions($viewer, ['image-delete-all']);
+
+        $resp = $this->actingAs($viewer)->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementExists('button#image-manager-delete[title="Delete"]');
+
+        $this->deleteImage($relPath);
+    }
+
     protected function getTestProfileImage()
     {
         $imageName = 'profile.png';