Skip to content
Snippets Groups Projects
Commit ec396041 authored by Diego Sampaio's avatar Diego Sampaio
Browse files

improved permission check on permissions manager pages

parent 6fd70f9a
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 91 additions and 71 deletions
packages/rocketchat-authorization/client/views/permissions.coffee
+ 3
− 0
View file @ ec396041
......@@ -10,6 +10,9 @@ Template.permissions.helpers
if roles?
return 'checked' if roles.indexOf(@name) isnt -1
hasPermission: ->
return RocketChat.authz.hasAllPermission 'access-rocket-permissions'
Template.permissions.events
'click .role-permission': (e, instance) ->
permission = e.currentTarget.getAttribute('data-permission')
......
packages/rocketchat-authorization/client/views/permissions.html
+ 20
− 16
View file @ ec396041
<template name="permissions">
<h1>{{_ "Permissions"}}</h1>
{{#if hasPermission}}
<h1>{{_ "Permissions"}}</h1>
<a href="{{pathFor "rocket-permissions-new"}}" class="button primary new-role">{{_ "New_role"}}</a>
<a href="{{pathFor "rocket-permissions-new"}}" class="button primary new-role">{{_ "New_role"}}</a>
<table border="1">
<tr>
<td>&nbsp;</td>
{{#each role}}
<td title="{{description}}"><a href="{{pathFor "rocket-permissions-edit" name=name}}">{{name}}</a></td>
{{/each}}
</tr>
{{#each permission}}
<table border="1">
<tr>
<td>{{_id}}</td>
<td>&nbsp;</td>
{{#each role}}
<td>
<input type="checkbox" name="perm[{{_id}}][{{../_id}}]" class="role-permission" value="1" checked="{{granted ../roles ../_id}}" data-role="{{name}}" data-permission="{{../_id}}">
</td>
<td title="{{description}}"><a href="{{pathFor "rocket-permissions-edit" name=name}}">{{name}}</a></td>
{{/each}}
</tr>
{{/each}}
</table>
{{#each permission}}
<tr>
<td>{{_id}}</td>
{{#each role}}
<td>
<input type="checkbox" name="perm[{{_id}}][{{../_id}}]" class="role-permission" value="1" checked="{{granted ../roles ../_id}}" data-role="{{name}}" data-permission="{{../_id}}">
</td>
{{/each}}
</tr>
{{/each}}
</table>
{{else}}
{{_ "Not_authorized"}}
{{/if}}
</template>
packages/rocketchat-authorization/client/views/permissionsRole.coffee
+ 3
− 0
View file @ ec396041
......@@ -14,6 +14,9 @@ Template.permissionsRole.helpers
if @emails?.length > 0
return @emails[0].address
hasPermission: ->
return RocketChat.authz.hasAllPermission 'access-rocket-permissions'
Template.permissionsRole.events
'click .remove-user': (e, instance) ->
......
packages/rocketchat-authorization/client/views/permissionsRole.html
+ 57
− 53
View file @ ec396041
<template name="permissionsRole">
<a href="{{pathFor "rocket-permissions"}}">{{_ "Back_to_permissions"}}</a><br><br>
{{#if hasPermission}}
<a href="{{pathFor "rocket-permissions"}}">{{_ "Back_to_permissions"}}</a><br><br>
{{#with role}}
<form id="form-role" class="inline">
<label>{{_ "Role"}}</label>:
{{#if editing}}
<span>{{name}}</span>
{{else}}
<input type="text" name="name" value="">
{{/if}}
<br>
<label>{{_ "Description"}}</label>:
<input type="text" name="description" value="{{description}}">
<br>
{{#with role}}
<form id="form-role" class="inline">
<label>{{_ "Role"}}</label>:
{{#if editing}}
<span>{{name}}</span>
{{else}}
<input type="text" name="name" value="">
{{/if}}
<br>
<label>{{_ "Description"}}</label>:
<input type="text" name="description" value="{{description}}">
<br>
<button name="save" class="button primary">{{_ "Save"}}</button>
<button name="save" class="button primary">{{_ "Save"}}</button>
{{#unless protected}}
<button name="delete" class="button red delete-role">{{_ "Delete"}}</button>
{{/unless}}
</form>
{{/with}}
{{#unless protected}}
<button name="delete" class="button red delete-role">{{_ "Delete"}}</button>
{{/unless}}
</form>
{{/with}}
{{#if editing}}
<h2>{{_ "Users_in_role"}}</h2>
<form id="form-users" class="inline">
<label>{{_ "Add_user"}}</label>
<input type="text" name="username" placeholder="{{_ "Enter_a_username"}}">
<button name="add" class="button primary">{{_ "Add"}}</button>
</form>
<div class="list">
<table>
<thead>
<tr>
<th>&nbsp;</th>
<th width="34%">{{_ "Name"}}</th>
<th width="33%">{{_ "Username"}}</th>
<th width="33%">{{_ "E-mail"}}</th>
<th>&nbsp;</th>
</tr>
</thead>
<tbody>
{{#each userInRole}}
<tr class="user-info" data-id="{{_id}}">
<td>
<div class="user-image status-{{status}}">
{{> avatar username=username}}
</div>
</td>
<td>{{name}}</td>
<td>{{username}}</td>
<td>{{emailAddress}}</td>
<td><a href="#remove" class="remove-user"><i class="icon-block"></i></a></td>
{{#if editing}}
<h2>{{_ "Users_in_role"}}</h2>
<form id="form-users" class="inline">
<label>{{_ "Add_user"}}</label>
<input type="text" name="username" placeholder="{{_ "Enter_a_username"}}">
<button name="add" class="button primary">{{_ "Add"}}</button>
</form>
<div class="list">
<table>
<thead>
<tr>
<th>&nbsp;</th>
<th width="34%">{{_ "Name"}}</th>
<th width="33%">{{_ "Username"}}</th>
<th width="33%">{{_ "E-mail"}}</th>
<th>&nbsp;</th>
</tr>
{{/each}}
</tbody>
</table>
</div>
</thead>
<tbody>
{{#each userInRole}}
<tr class="user-info" data-id="{{_id}}">
<td>
<div class="user-image status-{{status}}">
{{> avatar username=username}}
</div>
</td>
<td>{{name}}</td>
<td>{{username}}</td>
<td>{{emailAddress}}</td>
<td><a href="#remove" class="remove-user"><i class="icon-block"></i></a></td>
</tr>
{{/each}}
</tbody>
</table>
</div>
{{/if}}
{{else}}
{{_ "Not_authorized"}}
{{/if}}
</template>
packages/rocketchat-authorization/server/methods/addPermissionToRole.coffee
+ 4
− 1
View file @ ec396041
Meteor.methods
'authorization:addPermissionToRole': (permission, role) ->
# @TODO permission check
if not Meteor.userId() or not RocketChat.authz.hasPermission Meteor.userId(), 'access-rocket-permissions'
throw new Meteor.Error "not-authorized"
console.log '[methods] authorization:addPermissionToRole -> '.green, 'arguments:', arguments
RocketChat.models.Permissions.addRole permission, role
packages/rocketchat-authorization/server/methods/removeRoleFromPermission.coffee
+ 4
− 1
View file @ ec396041
Meteor.methods
'authorization:removeRoleFromPermission': (permission, role) ->
# @TODO permission check
if not Meteor.userId() or not RocketChat.authz.hasPermission Meteor.userId(), 'access-rocket-permissions'
throw new Meteor.Error "not-authorized"
console.log '[methods] authorization:removeRoleFromPermission -> '.green, 'arguments:', arguments
RocketChat.models.Permissions.removeRole permission, role
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment