Skip to content

Commit 6b68696

Browse files
ferishiliferishili
authored
improving permission checks for scheduling, (#1297)
fixes #1205
1 parent 39f6c07 commit 6b68696

12 files changed

+88
-38
lines changed

‎OpencastV3.class.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ public function getTabNavigation($course_id)
201201
PluginEngine::getURL($this, ['target_view' => 'videos'], 'course#/course/videos')
202202
));
203203

204-
if ($GLOBALS['perm']->have_studip_perm('tutor', $course_id) &&
204+
if (Perm::schedulingAllowed($course_id) &&
205205
Config::get()->OPENCAST_ALLOW_SCHEDULER &&
206206
Helpers::checkCourseDefaultPlaylist($course_id)) {
207207
$main->addSubNavigation('schedule', new Navigation(

‎lib/Providers/Perm.php

+24
Original file line numberDiff line numberDiff line change
@@ -184,4 +184,28 @@ public static function courseBelongsToInstitute($course_id, $inst_id)
184184

185185
return false;
186186
}
187+
188+
/**
189+
* Checks, whether the current user is able to perform the scheduling in a course
190+
*
191+
* @param string $context_id course or institute id
192+
* @param string $user_id user id
193+
*
194+
* @return boolean true if allowed, false otherwise
195+
*/
196+
public static function schedulingAllowed($context_id = null, $user_id = null)
197+
{
198+
if (is_null($user_id)) {
199+
$user_id = $GLOBALS['user']->id;
200+
}
201+
202+
if (is_null($context_id)) {
203+
$context_id = \Context::getId();
204+
}
205+
206+
// Reuse the config to make sure that the tutor gets the lecture permission when configured!
207+
$required_perm = \Config::get()->OPENCAST_TUTOR_EPISODE_PERM ? 'tutor' : 'dozent';
208+
209+
return $GLOBALS['perm']->have_studip_perm($required_perm, $context_id, $user_id);
210+
}
187211
}

‎lib/Routes/Course/CourseConfig.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,12 @@ public function __invoke(Request $request, Response $response, $args)
5757
'series' => [
5858
'series_id' => $series->series_id,
5959
],
60-
'workflow' => SeminarWorkflowConfiguration::getWorkflowForCourse($course_id),
61-
'edit_allowed' => Perm::editAllowed($course_id),
62-
'upload_allowed' => Perm::uploadAllowed($course_id),
63-
'upload_enabled' => \CourseConfig::get($course_id)->OPENCAST_ALLOW_STUDENT_UPLOAD ? 1 : 0,
64-
'has_default_playlist' => Helpers::checkCourseDefaultPlaylist($course_id)
60+
'workflow' => SeminarWorkflowConfiguration::getWorkflowForCourse($course_id),
61+
'edit_allowed' => Perm::editAllowed($course_id),
62+
'upload_allowed' => Perm::uploadAllowed($course_id),
63+
'upload_enabled' => \CourseConfig::get($course_id)->OPENCAST_ALLOW_STUDENT_UPLOAD ? 1 : 0,
64+
'has_default_playlist' => Helpers::checkCourseDefaultPlaylist($course_id),
65+
'scheduling_allowed' => Perm::schedulingAllowed($course_id)
6566
];
6667

6768
return $this->createResponse($results, $response);

‎lib/Routes/Course/CourseListSchedule.php

+12-1
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,27 @@
77
use Opencast\OpencastTrait;
88
use Opencast\OpencastController;
99
use Opencast\Models\ScheduleHelper;
10+
use Opencast\Providers\Perm;
1011

1112
class CourseListSchedule extends OpencastController
1213
{
1314
use OpencastTrait;
1415

1516
public function __invoke(Request $request, Response $response, $args)
1617
{
18+
global $user;
19+
1720
$course_id = $args['course_id'];
1821
$semester_filter = $args['semester_filter'];
1922

23+
if (empty($course_id)) {
24+
throw new Error('Es fehlen Parameter!', 422);
25+
}
26+
27+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
28+
throw new \AccessDeniedException();
29+
}
30+
2031
$semester_list = ScheduleHelper::getSemesterList($course_id);
2132
$allow_schedule_alternate = \Config::get()->OPENCAST_ALLOW_ALTERNATE_SCHEDULE;
2233

@@ -31,4 +42,4 @@ public function __invoke(Request $request, Response $response, $args)
3142

3243
return $this->createResponse($response_data, $response);
3344
}
34-
}
45+
}

‎lib/Routes/Playlist/PlaylistScheduleUpdate.php

+6-6
Original file line numberDiff line numberDiff line change
@@ -9,28 +9,28 @@
99
use Opencast\OpencastController;
1010
use Opencast\Models\ScheduleHelper;
1111
use Opencast\Models\Playlists;
12+
use Opencast\Providers\Perm;
1213

1314
class PlaylistScheduleUpdate extends OpencastController
1415
{
1516
use OpencastTrait;
1617

1718
public function __invoke(Request $request, Response $response, $args)
1819
{
19-
global $perm;
20-
21-
if (!$perm->have_perm('tutor')) {
22-
throw new \AccessDeniedException();
23-
}
20+
global $user;
2421

2522
$course_id = $args['course_id'];
2623
$token = $args['token'];
2724
$type = $args['type'];
2825

29-
3026
if (empty($token) || empty($course_id) || empty($type) || !in_array($type, ['livestreams', 'scheduled'])) {
3127
throw new Error('Es fehlen Parameter!', 422);
3228
}
3329

30+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
31+
throw new \AccessDeniedException();
32+
}
33+
3434
$playlist = Playlists::findOneByToken($token);
3535

3636
if (empty($playlist)) {

‎lib/Routes/Schedule/ScheduleAdd.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,15 @@
88
use Opencast\OpencastTrait;
99
use Opencast\OpencastController;
1010
use Opencast\Models\ScheduleHelper;
11+
use Opencast\Providers\Perm;
1112

1213
class ScheduleAdd extends OpencastController
1314
{
1415
use OpencastTrait;
1516

1617
public function __invoke(Request $request, Response $response, $args)
1718
{
18-
global $perm;
19-
20-
if (!$perm->have_perm('tutor')) {
21-
throw new \AccessDeniedException();
22-
}
19+
global $user;
2320

2421
$termin_id = $args['termin_id'];
2522
$course_id = $args['course_id'];
@@ -28,6 +25,10 @@ public function __invoke(Request $request, Response $response, $args)
2825
throw new Error('Es fehlen Parameter!', 422);
2926
}
3027

28+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
29+
throw new \AccessDeniedException();
30+
}
31+
3132
$json = $this->getRequestData($request);
3233

3334
$livestream = !empty($json['livestream']) ? true : false;

‎lib/Routes/Schedule/ScheduleBulk.php

+7-5
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,18 @@
88
use Opencast\OpencastTrait;
99
use Opencast\OpencastController;
1010
use Opencast\Models\ScheduleHelper;
11+
use Opencast\Providers\Perm;
1112

1213
class ScheduleBulk extends OpencastController
1314
{
1415
use OpencastTrait;
1516

1617
public function __invoke(Request $request, Response $response, $args)
1718
{
18-
global $perm;
19-
20-
if (!$perm->have_perm('tutor')) {
21-
throw new \AccessDeniedException();
22-
}
19+
global $user;
2320

2421
$course_id = $args['course_id'];
22+
2523
$json = $this->getRequestData($request);
2624
$termin_ids = isset($json['termin_ids']) ? $json['termin_ids'] : [];
2725
$action = isset($json['action']) ? $json['action'] : null;
@@ -30,6 +28,10 @@ public function __invoke(Request $request, Response $response, $args)
3028
throw new Error('Es fehlen Parameter!', 422);
3129
}
3230

31+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
32+
throw new \AccessDeniedException();
33+
}
34+
3335
$message_type = 'success';
3436
$message_text = _('Die angeforderte Massenaktion wurde ausgeführt.');
3537
$errors = [];

‎lib/Routes/Schedule/ScheduleDelete.php

+7-6
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,15 @@
88
use Opencast\OpencastTrait;
99
use Opencast\OpencastController;
1010
use Opencast\Models\ScheduleHelper;
11+
use Opencast\Providers\Perm;
1112

1213
class ScheduleDelete extends OpencastController
1314
{
1415
use OpencastTrait;
1516

1617
public function __invoke(Request $request, Response $response, $args)
1718
{
18-
global $perm;
19-
20-
if (!$perm->have_perm('tutor')) {
21-
throw new \AccessDeniedException();
22-
}
19+
global $user;
2320

2421
$termin_id = $args['termin_id'];
2522
$course_id = $args['course_id'];
@@ -28,10 +25,14 @@ public function __invoke(Request $request, Response $response, $args)
2825
throw new Error('Es fehlen Parameter!', 422);
2926
}
3027

28+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
29+
throw new \AccessDeniedException();
30+
}
31+
3132
if (ScheduleHelper::deleteEventForSeminar($course_id, $termin_id)) {
3233
return $response->withStatus(204);
3334
}
34-
35+
3536
throw new Error(_('Die geplante Aufzeichnung konnte nicht entfernt werden.'), 409);
3637
}
3738
}

‎lib/Routes/Schedule/ScheduleShow.php

+5
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,18 @@
88
use Opencast\Errors\Error;
99
use Opencast\OpencastTrait;
1010
use Opencast\OpencastController;
11+
use Opencast\Providers\Perm;
1112

1213
class ScheduleShow extends OpencastController
1314
{
1415
use OpencastTrait;
1516

1617
public function __invoke(Request $request, Response $response, $args)
1718
{
19+
// TODO: This needs to be filled up with course id and user id!
20+
if (!Perm::schedulingAllowed()) {
21+
throw new \AccessDeniedException();
22+
}
1823
// TODO: Fill this up when necessary!
1924
return $response->withStatus(200);
2025
}

‎lib/Routes/Schedule/ScheduleUpdate.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,15 @@
88
use Opencast\OpencastTrait;
99
use Opencast\OpencastController;
1010
use Opencast\Models\ScheduleHelper;
11+
use Opencast\Providers\Perm;
1112

1213
class ScheduleUpdate extends OpencastController
1314
{
1415
use OpencastTrait;
1516

1617
public function __invoke(Request $request, Response $response, $args)
1718
{
18-
global $perm;
19-
20-
if (!$perm->have_perm('tutor')) {
21-
throw new \AccessDeniedException();
22-
}
19+
global $user;
2320

2421
$termin_id = $args['termin_id'];
2522
$course_id = $args['course_id'];
@@ -28,6 +25,10 @@ public function __invoke(Request $request, Response $response, $args)
2825
throw new Error('Es fehlen Parameter!', 422);
2926
}
3027

28+
if (!Perm::schedulingAllowed($course_id, $user->id)) {
29+
throw new \AccessDeniedException();
30+
}
31+
3132
$json = $this->getRequestData($request);
3233
$start = isset($json['start']) ? $json['start'] : null;
3334
$end = isset($json['end']) ? $json['end'] : null;

‎vueapp/components/Courses/CoursesSidebar.vue

+7-3
Original file line numberDiff line numberDiff line change
@@ -283,9 +283,10 @@ export default {
283283
284284
canSchedule() {
285285
try {
286-
return this.cid !== undefined &&
287-
this.currentUser.can_edit &&
288-
this.simple_config_list['settings']['OPENCAST_ALLOW_SCHEDULER'];
286+
return this.cid !== undefined && // Make sure this is happening in a course!
287+
this.currentUser.can_edit && // Make sure the user has sufficient "global" rights.
288+
this.simple_config_list['settings']['OPENCAST_ALLOW_SCHEDULER'] && // Make sure it is configured!
289+
this.course_config.scheduling_allowed; // Make sure the user is allowed to schedule recordings in the course!
289290
} catch (error) {
290291
return false;
291292
}
@@ -411,6 +412,9 @@ export default {
411412
},
412413
413414
updateScheduledRecordingsPlaylists(type) {
415+
if (!this.canSchedule) {
416+
return;
417+
}
414418
this.$store.dispatch('clearMessages');
415419
if (type == 'scheduled') {
416420
this.$store.dispatch('setSchedulePlaylist', this.schedulePlaylistToken)

‎vueapp/components/Schedule/ScheduleList.vue

+1-1
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@
100100
<MessageBox v-else-if="!schedule_loading" type="info">
101101
{{ $gettext('Es gibt bisher keine Termine.') }}
102102
</MessageBox>
103-
<ScheduleLoading v-else :allow_schedule_alternate="allow_schedule_alternate"/>
103+
<ScheduleLoading v-else :allow_schedule_alternate="allow_schedule_alternate"/>
104104
</div>
105105
</template>
106106

0 commit comments

Comments
 (0)