mirror of
https://github.com/BookStackApp/BookStack.git
synced 2024-08-26 12:16:07 +00:00
Allowed child entity permissions to override parent permissions
Updated elements of a page display and sidebar render to allow child permissions to work even when parent entitites have permission set. This allows a page with a 'view' permission to be viewable even when the parent book or chapter is not viewable. Fixes #366
This commit is contained in:
parent
4c985aac7e
commit
a323b0d49c
@ -348,6 +348,10 @@ class EntityRepo
|
|||||||
foreach ($entities as $entity) {
|
foreach ($entities as $entity) {
|
||||||
if ($entity->chapter_id === 0 || $entity->chapter_id === '0') continue;
|
if ($entity->chapter_id === 0 || $entity->chapter_id === '0') continue;
|
||||||
$parentKey = 'BookStack\\Chapter:' . $entity->chapter_id;
|
$parentKey = 'BookStack\\Chapter:' . $entity->chapter_id;
|
||||||
|
if (!isset($parents[$parentKey])) {
|
||||||
|
$tree[] = $entity;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
$chapter = $parents[$parentKey];
|
$chapter = $parents[$parentKey];
|
||||||
$chapter->pages->push($entity);
|
$chapter->pages->push($entity);
|
||||||
}
|
}
|
||||||
|
@ -1,5 +1,7 @@
|
|||||||
<div class="breadcrumbs">
|
<div class="breadcrumbs">
|
||||||
|
@if (userCan('view', $book))
|
||||||
<a href="{{ $chapter->book->getUrl() }}" class="text-book text-button"><i class="zmdi zmdi-book"></i>{{ $chapter->book->getShortName() }}</a>
|
<a href="{{ $chapter->book->getUrl() }}" class="text-book text-button"><i class="zmdi zmdi-book"></i>{{ $chapter->book->getShortName() }}</a>
|
||||||
<span class="sep">»</span>
|
<span class="sep">»</span>
|
||||||
|
@endif
|
||||||
<a href="{{ $chapter->getUrl() }}" class="text-chapter text-button"><i class="zmdi zmdi-collection-bookmark"></i>{{$chapter->getShortName()}}</a>
|
<a href="{{ $chapter->getUrl() }}" class="text-chapter text-button"><i class="zmdi zmdi-collection-bookmark"></i>{{$chapter->getShortName()}}</a>
|
||||||
</div>
|
</div>
|
@ -1,12 +1,14 @@
|
|||||||
<div class="breadcrumbs">
|
<div class="breadcrumbs">
|
||||||
<a href="{{ $page->book->getUrl() }}" class="text-book text-button"><i class="zmdi zmdi-book"></i>{{ $page->book->getShortName() }}</a>
|
@if (userCan('view', $page->book))
|
||||||
@if($page->hasChapter())
|
<a href="{{ $page->book->getUrl() }}" class="text-book text-button"><i class="zmdi zmdi-book"></i>{{ $page->book->getShortName() }}</a>
|
||||||
<span class="sep">»</span>
|
<span class="sep">»</span>
|
||||||
|
@endif
|
||||||
|
@if($page->hasChapter() && userCan('view', $page->chapter))
|
||||||
<a href="{{ $page->chapter->getUrl() }}" class="text-chapter text-button">
|
<a href="{{ $page->chapter->getUrl() }}" class="text-chapter text-button">
|
||||||
<i class="zmdi zmdi-collection-bookmark"></i>
|
<i class="zmdi zmdi-collection-bookmark"></i>
|
||||||
{{ $page->chapter->getShortName() }}
|
{{ $page->chapter->getShortName() }}
|
||||||
</a>
|
</a>
|
||||||
|
<span class="sep">»</span>
|
||||||
@endif
|
@endif
|
||||||
<span class="sep">»</span>
|
|
||||||
<a href="{{ $page->getUrl() }}" class="text-page text-button"><i class="zmdi zmdi-file"></i>{{ $page->getShortName() }}</a>
|
<a href="{{ $page->getUrl() }}" class="text-page text-button"><i class="zmdi zmdi-file"></i>{{ $page->getShortName() }}</a>
|
||||||
</div>
|
</div>
|
@ -39,8 +39,10 @@
|
|||||||
|
|
||||||
<h6 class="text-muted">{{ trans('entities.books_navigation') }}</h6>
|
<h6 class="text-muted">{{ trans('entities.books_navigation') }}</h6>
|
||||||
<ul class="sidebar-page-list menu">
|
<ul class="sidebar-page-list menu">
|
||||||
<li class="book-header"><a href="{{ $book->getUrl() }}" class="book {{ $current->matches($book)? 'selected' : '' }}"><i class="zmdi zmdi-book"></i>{{$book->name}}</a></li>
|
|
||||||
|
|
||||||
|
@if (userCan('view', $book))
|
||||||
|
<li class="book-header"><a href="{{ $book->getUrl() }}" class="book {{ $current->matches($book)? 'selected' : '' }}"><i class="zmdi zmdi-book"></i>{{$book->name}}</a></li>
|
||||||
|
@endif
|
||||||
|
|
||||||
@foreach($sidebarTree as $bookChild)
|
@foreach($sidebarTree as $bookChild)
|
||||||
<li class="list-item-{{ $bookChild->getClassName() }} {{ $bookChild->getClassName() }} {{ $bookChild->isA('page') && $bookChild->draft ? 'draft' : '' }}">
|
<li class="list-item-{{ $bookChild->getClassName() }} {{ $bookChild->getClassName() }} {{ $bookChild->isA('page') && $bookChild->draft ? 'draft' : '' }}">
|
||||||
|
@ -522,4 +522,21 @@ class RestrictionsTest extends BrowserKitTest
|
|||||||
->see('Delete Chapter');
|
->see('Delete Chapter');
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public function test_page_visible_if_has_permissions_when_book_not_visible()
|
||||||
|
{
|
||||||
|
$book = \BookStack\Book::first();
|
||||||
|
$bookChapter = $book->chapters->first();
|
||||||
|
$bookPage = $bookChapter->pages->first();
|
||||||
|
|
||||||
|
$this->setEntityRestrictions($book, []);
|
||||||
|
$this->setEntityRestrictions($bookPage, ['view']);
|
||||||
|
|
||||||
|
$this->actingAs($this->viewer);
|
||||||
|
$this->get($bookPage->getUrl());
|
||||||
|
$this->assertResponseOk();
|
||||||
|
$this->see($bookPage->name);
|
||||||
|
$this->dontSee(substr($book->name, 0, 15));
|
||||||
|
$this->dontSee(substr($bookChapter->name, 0, 15));
|
||||||
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user