dev/core#61 Split Edit Message Templates Permission (#11974)

* dev/core#61 split edit message templates permission

diff --git a/CRM/Admin/Form/MessageTemplates.php b/CRM/Admin/Form/MessageTemplates.php
index b980e17e721bc8a364d0eee7a8c0644f01be0e9b..d316d559e26873e28c897d02afb3655863b759ca 100644 (file)
--- a/CRM/Admin/Form/MessageTemplates.php
+++ b/CRM/Admin/Form/MessageTemplates.php
@@ -106,6 +106,7 @@ class CRM_Admin_Form_MessageTemplates extends CRM_Admin_Form {
     }
     else {
       $this->_workflow_id = CRM_Utils_Array::value('workflow_id', $this->_values);
+      $this->checkUserPermission($this->_workflow_id);
       $this->assign('workflow_id', $this->_workflow_id);
 
       if ($this->_workflow_id) {
@@ -214,6 +215,26 @@ class CRM_Admin_Form_MessageTemplates extends CRM_Admin_Form {
     }
   }
 
+  /**
+   * Restrict users access based on permission
+   *
+   * @param int $workflowId
+   */
+  private function checkUserPermission($workflowId) {
+    if (isset($workflowId)) {
+      $canView = CRM_Core_Permission::check('edit system workflow message templates');
+    }
+    else {
+      $canView = CRM_Core_Permission::check('edit user-driven message templates');
+    }
+
+    if (!$canView && !CRM_Core_Permission::check('edit message templates')) {
+      CRM_Core_Session::setStatus(ts('You do not have permission to view requested page.'), ts('Access Denied'));
+      $url = CRM_Utils_System::url('civicrm/admin/messageTemplates', "reset=1");
+      CRM_Utils_System::redirect($url);
+    }
+  }
+
   /**
    * Global form rule.
    *

diff --git a/CRM/Admin/Page/MessageTemplates.php b/CRM/Admin/Page/MessageTemplates.php
index 8eefe4846bf2d1996b2255569a756c243d17cec0..1fdc8dc65a50dc8b746c244e64ac509fe565e71c 100644 (file)
--- a/CRM/Admin/Page/MessageTemplates.php
+++ b/CRM/Admin/Page/MessageTemplates.php
@@ -289,6 +289,9 @@ class CRM_Admin_Page_MessageTemplates extends CRM_Core_Page_Basic {
     );
 
     $this->assign('rows', $rows);
+    $this->assign('canEditSystemTemplates', CRM_Core_Permission::check('edit system workflow message templates'));
+    $this->assign('canEditMessageTemplates', CRM_Core_Permission::check('edit message templates'));
+    $this->assign('canEditUserDrivenMessageTemplates', CRM_Core_Permission::check('edit user-driven message templates'));
   }
 
 }

diff --git a/CRM/Core/Permission.php b/CRM/Core/Permission.php
index ce7d2b2bd6e47eb43d605f15d6fa9d83955252f2..ee7b49f69d6fe2cc11fc7b84806da5d39c136da7 100644 (file)
--- a/CRM/Core/Permission.php
+++ b/CRM/Core/Permission.php
@@ -879,6 +879,12 @@ class CRM_Core_Permission {
       'edit message templates' => array(
         $prefix . ts('edit message templates'),
       ),
+      'edit system workflow message templates' => array(
+        $prefix . ts('edit system workflow message templates'),
+      ),
+      'edit user-driven message templates' => array(
+        $prefix . ts('edit user-driven message templates'),
+      ),
       'view my invoices' => array(
         $prefix . ts('view my invoices'),
         ts('Allow users to view/ download their own invoices'),
@@ -1461,8 +1467,8 @@ class CRM_Core_Permission {
 
     $permissions['message_template'] = array(
       'get' => array('access CiviCRM'),
-      'create' => array('edit message templates'),
-      'update' => array('edit message templates'),
+      'create' => array('edit message templates', 'edit user-driven message templates', 'edit system workflow message templates'),
+      'update' => array('edit message templates', 'edit user-driven message templates', 'edit system workflow message templates'),
     );
     return $permissions;
   }

diff --git a/CRM/Core/xml/Menu/Admin.xml b/CRM/Core/xml/Menu/Admin.xml
index 23f09219a19654f889373ea8205c2a6229cb3c83..38377d0850c24df6a550cfc3ea3642402657bbd3 100644 (file)
--- a/CRM/Core/xml/Menu/Admin.xml
+++ b/CRM/Core/xml/Menu/Admin.xml
@@ -262,7 +262,7 @@
      <page_callback>CRM_Admin_Page_MessageTemplates</page_callback>
      <adminGroup>Communications</adminGroup>
      <icon>admin/small/template.png</icon>
-     <access_arguments>edit message templates</access_arguments>
+     <access_arguments>edit message templates;edit user-driven message templates;edit system workflow message templates</access_arguments>
      <weight>30</weight>
   </item>
   <item>
@@ -270,7 +270,7 @@
      <title>Message Templates</title>
      <desc>Add/Edit Message Templates</desc>
      <page_callback>CRM_Admin_Form_MessageTemplates</page_callback>
-     <access_arguments>edit message templates</access_arguments>
+     <access_arguments>edit message templates;edit user-driven message templates;edit system workflow message templates</access_arguments>
      <weight>262</weight>
   </item>
   <item>

diff --git a/CRM/Upgrade/Incremental/php/FiveTwo.php b/CRM/Upgrade/Incremental/php/FiveTwo.php
index 9d74ea2b2c9655ed70d6ee776f943bbb23f1fbeb..f8f2c8bd9aa5e7660a4db01c46aad710471f6cea 100644 (file)
--- a/CRM/Upgrade/Incremental/php/FiveTwo.php
+++ b/CRM/Upgrade/Incremental/php/FiveTwo.php
@@ -40,10 +40,14 @@ class CRM_Upgrade_Incremental_php_FiveTwo extends CRM_Upgrade_Incremental_Base {
    * @param null $currentVer
    */
   public function setPreUpgradeMessage(&$preUpgradeMessage, $rev, $currentVer = NULL) {
-    // Example: Generate a pre-upgrade message.
-    // if ($rev == '5.12.34') {
-    //   $preUpgradeMessage .= '<p>' . ts('A new permission has been added called %1 This Permission is now used to control access to the Manage Tags screen', array(1 => 'manage tags')) . '</p>';
-    // }
+    if ($rev == '5.3.0') {
+      $params = array(
+        1 => 'edit user-driven message templates',
+        2 => 'edit system workflow message templates',
+        3 => 'edit message templates',
+      );
+      $preUpgradeMessage .= '<p>' . ts('New granular permissions called %1 and %2 have been added for %3 permission. These permissions help to limit user access per template', $params) . '</p>';
+    }
   }
 
   /**

diff --git a/templates/CRM/Admin/Page/MessageTemplates.tpl b/templates/CRM/Admin/Page/MessageTemplates.tpl
index e1b86a7ac5aceb69902621d62381547d24b0702b..c8e41a24e4dd862c7480730d7dbc143e4f1c720d 100644 (file)
--- a/templates/CRM/Admin/Page/MessageTemplates.tpl
+++ b/templates/CRM/Admin/Page/MessageTemplates.tpl
@@ -89,14 +89,23 @@
 <div class="crm-content-block crm-block">
   <div id='mainTabContainer'>
     <ul>
-      <li id='tab_user'>    <a href='#user'     title='{ts}User-driven Messages{/ts}'>    {ts}User-driven Messages{/ts}    </a></li>
-      <li id='tab_workflow'><a href='#workflow' title='{ts}System Workflow Messages{/ts}'>{ts}System Workflow Messages{/ts}</a></li>
+      {if $canEditUserDrivenMessageTemplates or $canEditMessageTemplates}
+        <li id='tab_user'><a href='#user' title='{ts}User-driven Messages{/ts}'>{ts}User-driven Messages{/ts}</a></li>
+      {/if}
+      {if $canEditSystemTemplates or $canEditMessageTemplates}
+        <li id='tab_workflow'><a href='#workflow' title='{ts}System Workflow Messages{/ts}'>{ts}System Workflow Messages{/ts}</a></li>
+      {/if}
     </ul>
 
     {* create two selector tabs, first being the ‘user’ one, the second being the ‘workflow’ one *}
     {include file="CRM/common/enableDisableApi.tpl"}
     {include file="CRM/common/jsortable.tpl"}
     {foreach from=$rows item=template_row key=type}
+      {if (
+        $type ne 'userTemplates' and ($canEditSystemTemplates or $canEditMessageTemplates)
+      ) or (
+        $type eq 'userTemplates'and ($canEditUserDrivenMessageTemplates or $canEditMessageTemplates)
+      )}
       <div id="{if $type eq 'userTemplates'}user{else}workflow{/if}" class='ui-tabs-panel ui-widget-content ui-corner-bottom'>
           <div class="help">
           {if $type eq 'userTemplates'}
@@ -160,6 +169,7 @@
             {/if}
          </div>
       </div>
+      {/if}
     {/foreach}
   </div>
 </div>