[Tiki-devel] Permission inheritance

Hi all, almost certainly something for Victor but others may know and/or benefit from sharing :)

A couple of Tikis ago you added a "layer" to the Permissions system so that child objects could inherit the permission on their parents, like files in file galleries, and blog posts in blogs etc.

We are deploying a tiki for a client that needs category permissions to work on forums, which we assumed they would but it seems not. A user can see how many "topics" (a.k.a. threads) there are in a forum, on tiki-forums.php, but not see the actual posts in tiki-view_forum.php or tiki-view_forum_thread.php.

So i worked out the patch below, which gets the relevant parent forumId into the Perms::get function and hoped the Victor Magic would take over and all would be well... but it seems not. And stepping through the code i get lost, as usual, in \Perms_ResolverFactory_ObjectFactory::bulk and so on.

What did i miss?

Thanks in advance

jonny
----

Index: lib/comments/commentslib.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/lib/comments/commentslib.php b/lib/comments/commentslib.php
--- a/lib/comments/commentslib.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
+++ b/lib/comments/commentslib.php	(date 1611684287040)
@@ -921,7 +921,7 @@
 		$query .= $info['query'];
 
 		$ret = $this->fetchAll($query, $info['bindvars'], $max, $offset);
-		$ret = $this->filter_topic_perms($ret);
+		$ret = $this->filter_topic_perms($ret, $forumId);
 
 		foreach ($ret as &$res) {
 			$tid = $res['threadId'];
@@ -960,7 +960,7 @@
 		return $this->getOne($query, $info['bindvars']);
 	}
 
-	private function filter_topic_perms($topics) {
+	private function filter_topic_perms($topics, $forumId = null) {
 		$topic_ids = array_map(function($row){
 			return $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
 		}, $topics);
@@ -970,7 +970,7 @@
 		$ret = [];
 		foreach ($topics as $row) {
 			$topic_id = $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
-			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id]);
+			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id, 'parentId' => $forumId]);
 			if ($perms->forum_read) {
 				$ret[] = $row;
 			}
Index: lib/tikilib.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/lib/tikilib.php b/lib/tikilib.php
--- a/lib/tikilib.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
+++ b/lib/tikilib.php	(date 1611676561491)
@@ -4051,13 +4051,13 @@
 	 * @param bool $global
 	 * @return array|bool
 	 */
-	function get_perm_object($objectId, $objectType, $info = '', $global = true)
+	function get_perm_object($objectId, $objectType, $info = '', $global = true, $parentId = null)
 	{
 		global $user;
 		$smarty = TikiLib::lib('smarty');
 		$userlib = TikiLib::lib('user');
 
-		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId ]);
+		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId, 'parentId' => $parentId ]);
 		if (empty($perms->getGroups())) {
 			$perms->setGroups($this->get_user_groups($user));
 		}
Index: tiki-view_forum_thread.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/tiki-view_forum_thread.php b/tiki-view_forum_thread.php
--- a/tiki-view_forum_thread.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
+++ b/tiki-view_forum_thread.php	(date 1611682683787)
@@ -145,7 +145,7 @@
 $commentslib->comment_add_hit($_REQUEST["comments_parentId"]);
 $commentslib->mark_comment($user, $forumId, $_REQUEST["comments_parentId"]);
 
-$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread');
+$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread', '', true, $forumId);
 
 if ($user) {
 	if ($forum_info["moderator"] == $user) {