sipwise
/
ngcp-panel
mirror of https://github.com/sipwise/ngcp-panel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

MT#4565 Fix read-only permissions.

Browse Source 
Properly deny write ops for read-only admins and resellers.
gjungwirth/fix_tests
Andreas Granig 12 years ago
parent dd39baee6e
commit 272caf532e
4 changed files with 116 additions and 1 deletions
Show Stats Download Patch File Download Diff File

68
lib/NGCP/Panel/Controller/Subscriber.pm
Unescape View File

@ -409,6 +409,9 @@ sub preferences_base :Chained('base') :PathPart('preferences') :CaptureArgs(1) {
sub preferences_edit :Chained('preferences_base') :PathPart('edit') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
$c->stash(edit_preference => 1);
my @enums = $c->stash->{preference_meta}
@ -433,6 +436,9 @@ sub preferences_edit :Chained('preferences_base') :PathPart('edit') :Args(0) {
sub preferences_callforward :Chained('base') :PathPart('preferences/callforward') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $cf_desc;
given($cf_type) {
when("cfu") { $cf_desc = "Call Forward Unconditional" }
@ -694,6 +700,9 @@ sub preferences_callforward :Chained('base') :PathPart('preferences/callforward'
sub preferences_callforward_advanced :Chained('base') :PathPart('preferences/callforward') :Args(2) {
my ($self, $c, $cf_type, $advanced) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
# TODO bail out of $advanced ne "advanced"
if(defined $advanced && $advanced eq 'advanced') {
$advanced = 1;
@ -847,6 +856,9 @@ sub preferences_callforward_advanced :Chained('base') :PathPart('preferences/cal
sub preferences_callforward_destinationset :Chained('base') :PathPart('preferences/destinationset') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
my @sets;
@ -879,6 +891,9 @@ sub preferences_callforward_destinationset :Chained('base') :PathPart('preferenc
sub preferences_callforward_destinationset_create :Chained('base') :PathPart('preferences/destinationset/create') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
if($c->config->{features}->{cloudpbx}) {
@ -987,6 +1002,9 @@ sub preferences_callforward_destinationset_create :Chained('base') :PathPart('pr
sub preferences_callforward_destinationset_base :Chained('base') :PathPart('preferences/destinationset') :CaptureArgs(1) {
my ($self, $c, $set_id) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
$c->stash(destination_set => $c->stash->{subscriber}
->provisioning_voip_subscriber
->voip_cf_destination_sets
@ -1203,6 +1221,9 @@ sub preferences_callforward_destinationset_delete :Chained('preferences_callforw
sub preferences_callforward_timeset :Chained('base') :PathPart('preferences/timeset') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
my @sets;
@ -1234,6 +1255,9 @@ sub preferences_callforward_timeset :Chained('base') :PathPart('preferences/time
sub preferences_callforward_timeset_create :Chained('base') :PathPart('preferences/timeset/create') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
my $form = NGCP::Panel::Form::TimeSet->new;
@ -1303,6 +1327,9 @@ sub preferences_callforward_timeset_create :Chained('base') :PathPart('preferenc
sub preferences_callforward_timeset_base :Chained('base') :PathPart('preferences/timeset') :CaptureArgs(1) {
my ($self, $c, $set_id) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
$c->stash(time_set => $c->stash->{subscriber}
->provisioning_voip_subscriber
->voip_cf_time_sets
@ -1438,6 +1465,9 @@ sub preferences_callforward_timeset_delete :Chained('preferences_callforward_tim
sub preferences_callforward_delete :Chained('base') :PathPart('preferences/callforward/delete') :Args(1) {
my ($self, $c, $cf_type) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
try {
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
$prov_subscriber->voip_cf_mappings->search({ type => $cf_type })
@ -1592,6 +1622,10 @@ sub reglist :Chained('master') :PathPart('regdevices') :Args(0) {
sub edit_master :Chained('master') :PathPart('edit') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $subscriber = $c->stash->{subscriber};
my $prov_subscriber = $subscriber->provisioning_voip_subscriber;
@ -1796,6 +1830,9 @@ sub edit_master :Chained('master') :PathPart('edit') :Args(0) {
sub edit_voicebox :Chained('base') :PathPart('preferences/voicebox/edit') :Args(1) {
my ($self, $c, $attribute) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $form;
my $posted = ($c->request->method eq 'POST');
my $vm_user = $c->stash->{subscriber}->provisioning_voip_subscriber->voicemail_user;
@ -1898,6 +1935,9 @@ sub edit_voicebox :Chained('base') :PathPart('preferences/voicebox/edit') :Args(
sub edit_fax :Chained('base') :PathPart('preferences/fax/edit') :Args(1) {
my ($self, $c, $attribute) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $form;
my $posted = ($c->request->method eq 'POST');
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
@ -2041,6 +2081,9 @@ sub edit_fax :Chained('base') :PathPart('preferences/fax/edit') :Args(1) {
sub edit_reminder :Chained('base') :PathPart('preferences/reminder/edit') {
my ($self, $c, $attribute) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $posted = ($c->request->method eq 'POST');
my $reminder = $c->stash->{subscriber}->provisioning_voip_subscriber->voip_reminder;
my $params = {};
@ -2218,6 +2261,9 @@ sub play_voicemail :Chained('voicemail') :PathPart('play') :Args(0) {
sub delete_voicemail :Chained('voicemail') :PathPart('delete') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
try {
$c->stash->{voicemail}->delete;
$c->flash(messages => [{type => 'success', text => 'Successfully deleted voicemail'}]);
@ -2259,6 +2305,10 @@ sub registered :Chained('master') :PathPart('registered') :CaptureArgs(1) {
sub delete_registered :Chained('registered') :PathPart('delete') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $ret;
try {
@ -2425,6 +2475,9 @@ sub trusted_base :Chained('base') :PathPart('preferences/trusted') :CaptureArgs(
sub edit_trusted :Chained('trusted_base') :PathPart('edit') {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $posted = ($c->request->method eq 'POST');
my $trusted = $c->stash->{trusted};
my $params = {};
@ -2479,6 +2532,9 @@ sub edit_trusted :Chained('trusted_base') :PathPart('edit') {
sub delete_trusted :Chained('trusted_base') :PathPart('delete') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
try {
$c->stash->{trusted}->delete;
$c->flash(messages => [{type => 'success', text => 'Successfully deleted trusted source'}]);
@ -2580,6 +2636,9 @@ sub speeddial :Chained('base') :PathPart('preferences/speeddial') :CaptureArgs(1
sub delete_speeddial :Chained('speeddial') :PathPart('delete') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
try {
$c->stash->{speeddial}->delete;
$c->flash(messages => [{type => 'success', text => 'Successfully deleted speed dial slot'}]);
@ -2597,6 +2656,9 @@ sub delete_speeddial :Chained('speeddial') :PathPart('delete') :Args(0) {
sub edit_speeddial :Chained('speeddial') :PathPart('edit') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $posted = ($c->request->method eq 'POST');
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
my $slots = $prov_subscriber->voip_speed_dials;
@ -2680,6 +2742,9 @@ sub autoattendant :Chained('base') :PathPart('preferences/autoattendant') :Captu
sub delete_autoattendant :Chained('autoattendant') :PathPart('delete') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
try {
$c->stash->{autoattendant}->delete;
$c->flash(messages => [{type => 'success', text => 'Successfully deleted auto attendant slot'}]);
@ -2697,6 +2762,9 @@ sub delete_autoattendant :Chained('autoattendant') :PathPart('delete') :Args(0)
sub edit_autoattendant :Chained('base') :PathPart('preferences/speeddial/edit') :Args(0) {
my ($self, $c) = @_;
$c->detach('/denied_page')
if(($c->user->roles eq "admin" || $c->user->roles eq "reseller") && $c->user->read_only);
my $posted = ($c->request->method eq 'POST');
my $prov_subscriber = $c->stash->{subscriber}->provisioning_voip_subscriber;
my $slots = $prov_subscriber->voip_pbx_autoattendants;

2
share/templates/helpers/pref_table.tt
Unescape View File

@ -133,7 +133,9 @@
</td>
<td>
<div class="sw_actions pull-right">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-small btn-primary" href="[% helper.base_uri _ "/" _ r.id _ "/edit" %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
</tr>

15
share/templates/subscriber/master.tt
Unescape View File

@ -33,7 +33,9 @@
<div class="accordion-body collapse" id="collapse_master">
<div class="accordion-inner">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-tertiary btn-large" href="[% c.uri_for_action('/subscriber/edit_master', [ subscriber.id ]) %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
<div class="ngcp-separator"></div>
<table class="table table-bordered table-striped table-highlight table-hover" id="subscribers_table">
@ -135,10 +137,17 @@
helper.form_object = form;
helper.ajax_uri = c.uri_for_action('/subscriber/ajax_voicemails', [c.req.captures.0]);
IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1;
helper.dt_buttons = [
{ name = 'Play', uri = "details/voicemail/'+full.id+'/play", class = 'btn-small btn-tertiary', icon = 'icon-play' },
];
ELSE;
helper.dt_buttons = [
{ name = 'Play', uri = "details/voicemail/'+full.id+'/play", class = 'btn-small btn-tertiary', icon = 'icon-play' },
{ name = 'Delete', uri = "details/voicemail/'+full.id+'/delete", class = 'btn-small btn-secondary', icon = 'icon-trash' },
];
END;
PROCESS 'helpers/datatables.tt';
@ -155,7 +164,9 @@
<div class="accordion-body collapse" id="collapse_regdev">
<div class="accordion-inner">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-tertiary btn-large" href="[% c.uri_for_action('/subscriber/create_registered', [c.req.captures.0]) %]"><i class="icon-star"></i> Create Permanent Registration</a>
[% END -%]
[%
helper.name = 'Registered Devices';
#helper.column_sort = 'origtime';
@ -167,9 +178,11 @@
helper.form_object = form;
helper.ajax_uri = c.uri_for_action('/subscriber/ajax_registered', [c.req.captures.0]);
IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1;
helper.dt_buttons = [
{ name = 'Delete', uri = "details/registered/'+full.id+'/delete", class = 'btn-small btn-secondary', icon = 'icon-trash' },
];
END;
PROCESS 'helpers/datatables.tt';
@ -178,7 +191,7 @@
</div>
</div>
[% IF c.config.features.callflow -%]
[% IF c.config.features.callflow && c.user.call_data -%]
<div class="accordion-group">
<div class="accordion-heading">
<a class="accordion-toggle" data-toggle="collapse" data-parent="#subscriber_data" href="#collapse_cap">Captured Dialogs</a>

32
share/templates/subscriber/preferences.tt
Unescape View File

@ -118,10 +118,12 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/preferences_callforward", [c.req.captures.0], cf.type) %]"><i class="icon-edit"></i> Edit</a>
[% IF cf_destinations.${cf.type}.size -%]
<a class="btn btn-secondary btn-small" data-confirm="Delete" href="[% c.uri_for_action("/subscriber/preferences_callforward_delete", [c.req.captures.0], cf.type) %]"><i class="icon-trash"></i> Delete</a>
[% END -%]
[% END -%]
</div>
</td>
@ -158,7 +160,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_voicebox", [c.req.captures.0], 'pin') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -170,7 +174,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_voicebox", [c.req.captures.0], 'email') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -182,7 +188,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_voicebox", [c.req.captures.0], 'delete') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -194,7 +202,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_voicebox", [c.req.captures.0], 'attach') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -235,7 +245,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'name') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -247,7 +259,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'password') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -259,7 +273,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'active') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -271,7 +287,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'send_status') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -283,7 +301,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'send_copy') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -297,7 +317,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_fax", [c.req.captures.0], 'destinations') %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -318,7 +340,9 @@
<div class="accordion-body collapse" id="collapse_aa">
<div class="accordion-inner">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-tertiary btn-large" href="[% c.uri_for_action('/subscriber/edit_autoattendant', [c.req.captures.0]) %]"><i class="icon-star"></i> Edit Slots</a>
[% END -%]
[%
helper.messages = '';
helper.name = 'Autoattendant';
@ -345,7 +369,9 @@
<div class="accordion-body collapse" id="collapse_speed">
<div class="accordion-inner">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-tertiary btn-large" href="[% c.uri_for_action('/subscriber/create_speeddial', [c.req.captures.0]) %]"><i class="icon-star"></i> Create Slot</a>
[% END -%]
[%
helper.messages = '';
helper.name = 'Speeddial';
@ -390,7 +416,9 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_reminder", [c.req.captures.0]) %]"><i class="icon-edit"></i> Edit</a>
[% END -%]
</div>
</td>
@ -410,7 +438,9 @@
<div class="accordion-body collapse" id="collapse_ts">
<div class="accordion-inner">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-tertiary btn-large" href="[% c.uri_for_action("/subscriber/create_trusted", [c.req.captures.0]) %]"><i class="icon-star"></i> Create</a>
[% END -%]
<div class="ngcp-separator"></div>
<table class="table table-bordered table-striped table-highlight table-hover" id="preferences_table_ts">
@ -437,8 +467,10 @@
</td>
<td class="ngcp-actions-column">
<div class="sw_actions">
[% IF (c.user.roles == "admin" || c.user.roles == "reseller") && c.user.read_only != 1 -%]
<a class="btn btn-primary btn-small" href="[% c.uri_for_action("/subscriber/edit_trusted", [c.req.captures.0, trusted.id]) %]"><i class="icon-edit"></i> Edit</a>
<a class="btn btn-secondary btn-small" href="[% c.uri_for_action("/subscriber/delete_trusted", [c.req.captures.0, trusted.id]) %]" data-confirm="Delete"><i class="icon-trash"></i> Delete</a>
[% END -%]
</div>
</td>

Write Preview
Loading…
Cancel
Save