Re: [Tiki-devel] Permission inheritance

Thanks Victor, nice to hear :)

I have a commit coming but added calendars and calendaritems, and blogs and blog posts to the category factory but need to set up test cases here locally to check i got the sql right...

More soon

jonny



> On 1 Feb 2021, at 12:02, Victor Emanouilov via TikiWiki-devel <[email protected]> wrote:
> 
> Hi Jonny,
> 
> I think I'd have done it the same way! Looks good to me.
> 
> File gallery->file relation actually works but only on object level (e.g. permission assigned to the file gallery will apply for all files under it and individual file permissions will apply for the files themselves). However, you are right that category factory needs more updates to make it happen - e.g. permission assigned to a file gallery via a category to be enforced for files underneath.
> 
> Regards,
> Victor
> 
> On 1/27/21 2:58 PM, Jonny Bradley via TikiWiki-devel wrote:
>> Hi Victor
>> 
>> Thanks for the speedy reply 8)
>> 
>> So to test i set all forum perms off globally and made a category (reg can see) that has all forum perms apart from tiki_p_admin_forum set for registered, and categorised a forum as "reg can see", and i can see the forum which should have the topics list, but none show up.
>> 
>> I think i've got it working, but not going to commit it just now (new releases coming this afternoon!) but just in case you have a chance to look over this, here's the new patch (below).
>> 
>> The main "magic" i was missing i think was the database lookup in CategoryFactory.php which i think i got working eventually.
>> 
>> If this is all ok i'll commit it to trunk and test more before backporting, but then also i'd like to add files and file galleries support at least, because this has been a major "feature disappointment" since tiki 1.x :p
>> 
>> Thanks V, catching up gradually! (wow, only 4 yours since https://gitlab.com/tikiwiki/tiki/-/commit/1ed83819 ;)
>> 
>> jonny
>> ---
>> 
>> 
>> Index: lib/core/Perms/ResolverFactory/CategoryFactory.php
>> IDEA additional info:
>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
>> <+>UTF-8
>> ===================================================================
>> diff --git a/lib/core/Perms/ResolverFactory/CategoryFactory.php b/lib/core/Perms/ResolverFactory/CategoryFactory.php
>> --- a/lib/core/Perms/ResolverFactory/CategoryFactory.php	(revision 5459652a28dd0edae95e16c103920985aa2c9d14)
>> +++ b/lib/core/Perms/ResolverFactory/CategoryFactory.php	(date 1611751776236)
>> @@ -88,7 +88,7 @@
>>  		}
>>    		// only trackeritem parents supported for now
>> -		if ($this->parent && $baseContext['type'] !== 'trackeritem') {
>> +		if ($this->parent && ! in_array($baseContext['type'], ['trackeritem', 'thread'])) {
>>  			return $values;
>>  		}
>>  @@ -155,6 +155,15 @@
>>  				INNER JOIN `tiki_category_objects` co ON co.`catObjectId` = o.`objectId` WHERE " .
>>  				$db->in('ti.itemId', array_keys($objects), $bindvars) . " ORDER BY co.`catObjectId`, co.`categId`",
>>  				$bindvars
>> +			);
>> +		} else if ($baseContext['type'] === 'thread' && $this->parent) {
>> +			$bindvars = [];
>> +			$result = $db->fetchAll(
>> +				"SELECT co.`categId`, comm.`threadId` AS itemId FROM `tiki_comments` comm
>> +				INNER JOIN `tiki_objects` o ON comm.`object` = o.`itemId` AND o.`type` = 'forum'
>> +				INNER JOIN `tiki_category_objects` co ON co.`catObjectId` = o.`objectId` WHERE " .
>> +				$db->in('comm.threadId', array_keys($objects), $bindvars) . " ORDER BY co.`catObjectId`, co.`categId`",
>> +				$bindvars
>>  			);
>>  		} else {
>>  			$bindvars = [$baseContext['type']];
>> Index: tiki-view_forum_thread.php
>> IDEA additional info:
>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
>> <+>UTF-8
>> ===================================================================
>> diff --git a/tiki-view_forum_thread.php b/tiki-view_forum_thread.php
>> --- a/tiki-view_forum_thread.php	(revision 5459652a28dd0edae95e16c103920985aa2c9d14)
>> +++ b/tiki-view_forum_thread.php	(date 1611751776287)
>> @@ -145,7 +145,7 @@
>>  $commentslib->comment_add_hit($_REQUEST["comments_parentId"]);
>>  $commentslib->mark_comment($user, $forumId, $_REQUEST["comments_parentId"]);
>>  -$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread');
>> +$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread', '', true, $forumId);
>>    if ($user) {
>>  	if ($forum_info["moderator"] == $user) {
>> Index: lib/tikilib.php
>> IDEA additional info:
>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
>> <+>UTF-8
>> ===================================================================
>> diff --git a/lib/tikilib.php b/lib/tikilib.php
>> --- a/lib/tikilib.php	(revision 5459652a28dd0edae95e16c103920985aa2c9d14)
>> +++ b/lib/tikilib.php	(date 1611751776275)
>> @@ -4054,13 +4054,13 @@
>>  	 * @param bool $global
>>  	 * @return array|bool
>>  	 */
>> -	function get_perm_object($objectId, $objectType, $info = '', $global = true)
>> +	function get_perm_object($objectId, $objectType, $info = '', $global = true, $parentId = null)
>>  	{
>>  		global $user;
>>  		$smarty = TikiLib::lib('smarty');
>>  		$userlib = TikiLib::lib('user');
>>  -		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId ]);
>> +		$perms = Perms::get([ 'type' => $objectType, 'object' => $objectId, 'parentId' => $parentId ]);
>>  		if (empty($perms->getGroups())) {
>>  			$perms->setGroups($this->get_user_groups($user));
>>  		}
>> Index: lib/comments/commentslib.php
>> IDEA additional info:
>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
>> <+>UTF-8
>> ===================================================================
>> diff --git a/lib/comments/commentslib.php b/lib/comments/commentslib.php
>> --- a/lib/comments/commentslib.php	(revision 5459652a28dd0edae95e16c103920985aa2c9d14)
>> +++ b/lib/comments/commentslib.php	(date 1611751776224)
>> @@ -915,7 +915,7 @@
>>  		$query .= $info['query'];
>>    		$ret = $this->fetchAll($query, $info['bindvars'], $max, $offset);
>> -		$ret = $this->filter_topic_perms($ret);
>> +		$ret = $this->filter_topic_perms($ret, $forumId);
>>    		foreach ($ret as &$res) {
>>  			$tid = $res['threadId'];
>> @@ -954,17 +954,17 @@
>>  		return $this->getOne($query, $info['bindvars']);
>>  	}
>>  -	private function filter_topic_perms($topics) {
>> +	private function filter_topic_perms($topics, $forumId = null) {
>>  		$topic_ids = array_map(function($row){
>>  			return $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
>>  		}, $topics);
>>  		$topic_ids = array_unique($topic_ids);
>>  -		Perms::bulk(['type' => 'thread'], 'object', $topic_ids);
>> +		Perms::bulk(['type' => 'thread', 'parentId' => $forumId], 'object', $topic_ids);
>>  		$ret = [];
>>  		foreach ($topics as $row) {
>>  			$topic_id = $row['parentId'] > 0 ? $row['parentId'] : $row['threadId'];
>> -			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id]);
>> +			$perms = Perms::get(['type' => 'thread', 'object' => $topic_id, 'parentId' => $forumId]);
>>  			if ($perms->forum_read) {
>>  				$ret[] = $row;
>>  			}
>> 
>> 
>> 
>>> On 27 Jan 2021, at 09:26, Victor Emanouilov via TikiWiki-devel <[email protected]> wrote:
>>> 
>>> Hi Jonny,
>>> 
>>> Does this comment in Perms_ResolverFactory_CategoryFactory help?
>>> 
>>>  * Parent parameter can be passed during initialization to configure
>>>  * Factory to return parent object permissions. Currently only supports
>>>  * TrackerItem parents (i.e. Trackers) category permissions. Parent
>>>  * perissions are retrieved by loading categories for the parent and then
>>>  * checking their permissions.
>>> 
>>> If you use category permissions, maybe that's why parent->child inheritance does not work in forum context. For now parent->child permission check on category basis is done only for tracker->trackeritem relation. We could extend to forum->thread level but I am not use both of these can be categorized. Can you share a bit more about your use-case - where do you set categories and which categories get permissions?
>>> 
>>> Regards,
>>> Victor
>>> 
>>> On 1/27/21 11:11 AM, Jonny Bradley via TikiWiki-devel wrote:
>>>> Hi all, almost certainly something for Victor but others may know and/or benefit from sharing :)
>>>> 
>>>> A couple of Tikis ago you added a "layer" to the Permissions system so that child objects could inherit the permission on their parents, like files in file galleries, and blog posts in blogs etc.
>>>> 
>>>> We are deploying a tiki for a client that needs category permissions to work on forums, which we assumed they would but it seems not. A user can see how many "topics" (a.k.a. threads) there are in a forum, on tiki-forums.php, but not see the actual posts in tiki-view_forum.php or tiki-view_forum_thread.php.
>>>> 
>>>> So i worked out the patch below, which gets the relevant parent forumId into the Perms::get function and hoped the Victor Magic would take over and all would be well... but it seems not. And stepping through the code i get lost, as usual, in \Perms_ResolverFactory_ObjectFactory::bulk and so on.
>>>> 
>>>> What did i miss?
>>>> 
>>>> Thanks in advance
>>>> 
>>>> jonny
>>>> ----
>> [snip]
>> 
>> _______________________________________________
>> TikiWiki-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> 
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>