Tickets :: Comment on [#1272] Permission check on editing the ticket

* Your Email Address
* Spam protection	Enter the letters below: .__ . . .. ..___ \| \\| \ /\ /[__ \|__/\|___ \/ \/ [___
Comment	> Only allow the the user who has the PERMS_EDIT on the queue to edit > and update the ticket. (Comment not included) > > in /lib/Whups.php function &getTicketTabs(&$vars, $qid=null): > > > > Old: > > function &getTicketTabs(&$vars) > > { > > $tabs = &new Horde_UI_Tabs('action', $vars); > > $tabs->addTab(_("History"), Horde::applicationUrl('ticket/'), ''); > > if (Auth::getAuth()) { > > $tabs->addTab(_("Update"), > Horde::applicationUrl('ticket/update.php')); > > } > > $tabs->addTab(_("Comment"), > Horde::applicationUrl('ticket/comment.php')); > > if (Auth::getAuth()) { > > $tabs->addTab(_("People"), > Horde::applicationUrl('ticket/people.php')); > > $tabs->addTab(_("Set Queue"), > Horde::applicationUrl('ticket/queue.php')); > > } > > if (Auth::isAdmin('whups:admin')) { > > $tabs->addTab(_("Set Type"), > Horde::applicationUrl('ticket/type.php')); > > $tabs->addTab(_("Delete"), > Horde::applicationUrl('ticket/delete.php')); > > } > > > > return $tabs; > > } > > > > New: > > function &getTicketTabs(&$vars, $qid=null) > > { > > global $perms; > > $tabs = &new Horde_UI_Tabs('action', $vars); > > $tabs->addTab(_("History"), Horde::applicationUrl('ticket/'), ''); > > if ( $perms->hasPermission('whups:queues:'.$qid, > Auth::getAuth() , PERMS_EDIT) ) { > > $tabs->addTab(_("Update"), > Horde::applicationUrl('ticket/update.php')); > > } > > $tabs->addTab(_("Comment"), > Horde::applicationUrl('ticket/comment.php')); > > if ( $perms->hasPermission('whups:queues:'.$qid, > Auth::getAuth() , PERMS_EDIT) ) { > > $tabs->addTab(_("People"), > Horde::applicationUrl('ticket/people.php')); > > $tabs->addTab(_("Set Queue"), > Horde::applicationUrl('ticket/queue.php')); > > } > > if (Auth::isAdmin('whups:admin')) { > > $tabs->addTab(_("Set Type"), > Horde::applicationUrl('ticket/type.php')); > > $tabs->addTab(_("Delete"), > Horde::applicationUrl('ticket/delete.php')); > > } > > return $tabs; > > } > > > > And add the correct permission check in > > ticket/update.php > > ticket/people.php > > ticket/queue.php > > like: > > if ( ! $perms->hasPermission('whups:queues:'.$qid, Auth::getAuth() , > PERMS_EDIT) ) { > > // deny > > } > > > > Note: if the user set queue of a ticket to the one he/she has no > permission, he/she will lose the controle of the ticket. > >
Attachment
Watch this ticket

Saved Queries