Re: [Tiki-devel] Permission inheritance

Hi Jonny,

Does this comment in Perms_ResolverFactory_CategoryFactory help?

  * Parent parameter can be passed during initialization to configure
  * Factory to return parent object permissions. Currently only supports
  * TrackerItem parents (i.e. Trackers) category permissions. Parent
  * perissions are retrieved by loading categories for the parent and then
  * checking their permissions.

If you use category permissions, maybe that's why parent->child 
inheritance does not work in forum context. For now parent->child 
permission check on category basis is done only for tracker->trackeritem 
relation. We could extend to forum->thread level but I am not use both 
of these can be categorized. Can you share a bit more about your 
use-case - where do you set categories and which categories get permissions?

Regards,
Victor

On 1/27/21 11:11 AM, Jonny Bradley via TikiWiki-devel wrote:
> Hi all, almost certainly something for Victor but others may know and/or benefit from sharing :)
>
> A couple of Tikis ago you added a "layer" to the Permissions system so that child objects could inherit the permission on their parents, like files in file galleries, and blog posts in blogs etc.
>
> We are deploying a tiki for a client that needs category permissions to work on forums, which we assumed they would but it seems not. A user can see how many "topics" (a.k.a. threads) there are in a forum, on tiki-forums.php, but not see the actual posts in tiki-view_forum.php or tiki-view_forum_thread.php.
>
> So i worked out the patch below, which gets the relevant parent forumId into the Perms::get function and hoped the Victor Magic would take over and all would be well... but it seems not. And stepping through the code i get lost, as usual, in \Perms_ResolverFactory_ObjectFactory::bulk and so on.
>
> What did i miss?
>
> Thanks in advance
>
> jonny
> ----
>
> Index: lib/comments/commentslib.php
> IDEA additional info:
> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> <+>UTF-8
> ===================================================================
> diff --git a/lib/comments/commentslib.php b/lib/comments/commentslib.php
> --- a/lib/comments/commentslib.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
> +++ b/lib/comments/commentslib.php	(date 1611684287040)
> @@ -921,7 +921,7 @@
>   		$query .= $info['query'];
>   
>   		$ret = $this->fetchAll($query, $info['bindvars'], $max, $offset);
> -		$ret = $this->filter_topic_perms($ret);
> +		$ret = $this->filter_topic_perms($ret, $forumId);
>   
>   		foreach ($ret as &$res) {
>   			$tid = $res['threadId'];
> @@ -960,7 +960,7 @@
>   		return $this->getOne($query, $info['bindvars']);
>   	}
>   
> -	private function filter_topic_perms($topics) {
> +	private function filter_topic_perms($topics, $forumId = null) {
>   		$topic_ids = array_map(function($row){
>   			return $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
>   		}, $topics);
> @@ -970,7 +970,7 @@
>   		$ret = [];
>   		foreach ($topics as $row) {
>   			$topic_id = $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
> -			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id]);
> +			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id, 'parentId' => $forumId]);
>   			if ($perms->forum_read) {
>   				$ret[] = $row;
>   			}
> Index: lib/tikilib.php
> IDEA additional info:
> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> <+>UTF-8
> ===================================================================
> diff --git a/lib/tikilib.php b/lib/tikilib.php
> --- a/lib/tikilib.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
> +++ b/lib/tikilib.php	(date 1611676561491)
> @@ -4051,13 +4051,13 @@
>   	 * @param bool $global
>   	 * @return array|bool
>   	 */
> -	function get_perm_object($objectId, $objectType, $info = '', $global = true)
> +	function get_perm_object($objectId, $objectType, $info = '', $global = true, $parentId = null)
>   	{
>   		global $user;
>   		$smarty = TikiLib::lib('smarty');
>   		$userlib = TikiLib::lib('user');
>   
> -		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId ]);
> +		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId, 'parentId' => $parentId ]);
>   		if (empty($perms->getGroups())) {
>   			$perms->setGroups($this->get_user_groups($user));
>   		}
> Index: tiki-view_forum_thread.php
> IDEA additional info:
> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> <+>UTF-8
> ===================================================================
> diff --git a/tiki-view_forum_thread.php b/tiki-view_forum_thread.php
> --- a/tiki-view_forum_thread.php	(revision bc819256788b13decea7e53e9cb4a5920646b95b)
> +++ b/tiki-view_forum_thread.php	(date 1611682683787)
> @@ -145,7 +145,7 @@
>   $commentslib->comment_add_hit($_REQUEST["comments_parentId"]);
>   $commentslib->mark_comment($user, $forumId, $_REQUEST["comments_parentId"]);
>   
> -$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread');
> +$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread', '', true, $forumId);
>   
>   if ($user) {
>   	if ($forum_info["moderator"] == $user) {
>
>
>
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel


_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel