diff --git a/app/Auth/Permissions/PermissionService.php b/app/Auth/Permissions/PermissionService.php index af2a5e1fd..33d214963 100644 --- a/app/Auth/Permissions/PermissionService.php +++ b/app/Auth/Permissions/PermissionService.php @@ -556,6 +556,32 @@ class PermissionService return $q; } + /** + * Checks if a user has the given permission for any items in the system. + * @param string $permission + * @return bool + */ + public function checkUserHasPermissionOnAnything(string $permission) + { + $userRoleIds = $this->currentUser()->roles()->select('id')->pluck('id')->toArray(); + $userId = $this->currentUser()->id; + + $canCreatePage = $this->db->table('joint_permissions') + ->where('action', '=', $permission) + ->whereIn('role_id', $userRoleIds) + ->where(function ($query) use ($userId) { + $query->where('has_permission', '=', 1) + ->orWhere(function ($query2) use ($userId) { + $query2->where('has_permission_own', '=', 1) + ->where('created_by', '=', $userId); + }); + }) + ->get()->count() > 0; + + $this->clean(); + return $canCreatePage; + } + /** * Check if an entity has restrictions set on itself or its * parent tree. diff --git a/app/Http/Controllers/PageController.php b/app/Http/Controllers/PageController.php index b68655241..d95e02470 100644 --- a/app/Http/Controllers/PageController.php +++ b/app/Http/Controllers/PageController.php @@ -643,7 +643,7 @@ class PageController extends Controller public function showCopy($bookSlug, $pageSlug) { $page = $this->pageRepo->getPageBySlug($pageSlug, $bookSlug); - $this->checkOwnablePermission('page-update', $page); + $this->checkOwnablePermission('page-view', $page); session()->flashInput(['name' => $page->name]); return view('pages/copy', [ 'book' => $page->book, @@ -662,7 +662,7 @@ class PageController extends Controller public function copy($bookSlug, $pageSlug, Request $request) { $page = $this->pageRepo->getPageBySlug($pageSlug, $bookSlug); - $this->checkOwnablePermission('page-update', $page); + $this->checkOwnablePermission('page-view', $page); $entitySelection = $request->get('entity_selection', null); if ($entitySelection === null || $entitySelection === '') { diff --git a/app/helpers.php b/app/helpers.php index b0886d02b..0825a2e4a 100644 --- a/app/helpers.php +++ b/app/helpers.php @@ -1,5 +1,6 @@ can($permission); } // Check permission on ownable item - $permissionService = app(\BookStack\Auth\Permissions\PermissionService::class); + $permissionService = app(PermissionService::class); return $permissionService->checkOwnableUserAccess($ownable, $permission); } +/** + * Check if the current user has the given permission + * on any item in the system. + * @param string $permission + * @return bool + */ +function userCanOnAny(string $permission) +{ + $permissionService = app(PermissionService::class); + return $permissionService->checkUserHasPermissionOnAnything($permission); +} + /** * Helper to access system settings. * @param $key diff --git a/resources/views/pages/show.blade.php b/resources/views/pages/show.blade.php index afe007d45..db2f1462e 100644 --- a/resources/views/pages/show.blade.php +++ b/resources/views/pages/show.blade.php @@ -17,15 +17,17 @@ @if(userCan('page-update', $page)) @icon('edit'){{ trans('common.edit') }} @endif - @if(userCan('page-update', $page) || userCan('restrictions-manage', $page) || userCan('page-delete', $page)) + @if((userCan('page-view', $page) && userCanOnAny('page-create')) || userCan('page-update', $page) || userCan('restrictions-manage', $page) || userCan('page-delete', $page))