autonomic-cooperative/opencase
Archived
0
0
Fork 0
Code Issues 43 Pull Requests Releases Wiki Activity

Added access control for viewing activity

Browse Source 
Can only view activity if involved in the case.
This commit is contained in:
naomi
2018-07-19 15:10:02 +02:00
parent d2bd27c960
commit ec99009f16
3 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/opencase_entities/src/OCCaseAccessControlHandler.php
View File

@ -29,10 +29,10 @@ class OCCaseAccessControlHandler extends EntityAccessControlHandler {
$account->hasPermission('view published case entities')
|| CaseInvolvement::userIsInvolved($account, $entity)
);
case 'update':
case 'update': // you can edit the case only if a) you can see it and b) you have the permission to edit cases.
return AccessResult::allowedIf(
$account->hasPermission('edit published case entities')
|| CaseInvolvement::userIsInvolved($account, $entity)
$account->hasPermission('edit case entities')
&& ($account->hasPermission('view published case entities') || CaseInvolvement::userIsInvolved($account, $entity))
);
case 'delete':
return AccessResult::allowedIfHasPermission($account, 'delete case entities');