From 25d6ca3fea42b01192ef3dd99a996c26bf1653be Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 12 Feb 2019 14:12:05 +0200
Subject: [PATCH] forbid mass remove by where if no mass update permission

---
 application/Espo/Core/Controllers/Record.php | 10 +++++++-
 application/Espo/Services/Record.php         | 24 ++++++++++----------
 client/src/views/record/list.js              |  4 ++++
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/application/Espo/Core/Controllers/Record.php b/application/Espo/Core/Controllers/Record.php
index 7c04e65693..d802606149 100644
--- a/application/Espo/Core/Controllers/Record.php
+++ b/application/Espo/Core/Controllers/Record.php
@@ -321,7 +321,15 @@ class Record extends Base
             throw new Forbidden();
         }
 
-        return $this->getRecordService()->massDelete($this->getMassActionParamsFromData($data));
+        $actionParams = $this->getMassActionParamsFromData($data);
+
+        if (array_key_exists('where', $actionParams)) {
+            if ($this->getAcl()->get('massUpdatePermission') !== 'yes') {
+                throw new Forbidden();
+            }
+        }
+
+        return $this->getRecordService()->massDelete($actionParams);
     }
 
     public function actionCreateLink($params, $data, $request)
diff --git a/application/Espo/Services/Record.php b/application/Espo/Services/Record.php
index 2b69c22491..64145520db 100644
--- a/application/Espo/Services/Record.php
+++ b/application/Espo/Services/Record.php
@@ -1598,7 +1598,7 @@ class Record extends \Espo\Core\Services\Base
 
     public function massUpdate(array $params, $data)
     {
-        $idsUpdated = [];
+        $updatedIdList = [];
         $repository = $this->getRepository();
 
         $count = 0;
@@ -1619,7 +1619,7 @@ class Record extends \Espo\Core\Services\Base
                     }
                     if ($this->checkAssignment($entity)) {
                         if ($repository->save($entity, ['massUpdate' => true])) {
-                            $idsUpdated[] = $entity->id;
+                            $updatedIdList[] = $entity->id;
                             $count++;
 
                             $this->processActionHistoryRecord('update', $entity);
@@ -1657,7 +1657,7 @@ class Record extends \Espo\Core\Services\Base
                     $entity->set($data);
                     if ($this->checkAssignment($entity)) {
                         if ($repository->save($entity, ['massUpdate' => true, 'skipStreamNotesAcl' => true])) {
-                            $idsUpdated[] = $entity->id;
+                            $updatedIdList[] = $entity->id;
                             $count++;
 
                             $this->processActionHistoryRecord('update', $entity);
@@ -1666,18 +1666,18 @@ class Record extends \Espo\Core\Services\Base
                 }
             }
 
-            $this->afterMassUpdate($idsUpdated, $data);
+            $this->afterMassUpdate($updatedIdList, $data);
 
             return (object) [
                 'count' => $count
             ];
         }
 
-        $this->afterMassUpdate($idsUpdated, $data);
+        $this->afterMassUpdate($updatedIdList, $data);
 
         return (object) [
             'count' => $count,
-            'ids' => $idsUpdated
+            'ids' => $updatedIdList
         ];
     }
 
@@ -1698,7 +1698,7 @@ class Record extends \Espo\Core\Services\Base
 
     public function massDelete(array $params)
     {
-        $idsRemoved = array();
+        $removedIdList = [];
         $repository = $this->getRepository();
 
         $count = 0;
@@ -1709,7 +1709,7 @@ class Record extends \Espo\Core\Services\Base
                 $entity = $this->getEntity($id);
                 if ($entity && $this->getAcl()->check($entity, 'delete') && $this->checkEntityForMassRemove($entity)) {
                     if ($repository->remove($entity)) {
-                        $idsRemoved[] = $entity->id;
+                        $removedIdList[] = $entity->id;
                         $count++;
 
                         $this->processActionHistoryRecord('delete', $entity);
@@ -1745,7 +1745,7 @@ class Record extends \Espo\Core\Services\Base
 
                 if ($this->getAcl()->check($entity, 'delete') && $this->checkEntityForMassRemove($entity)) {
                     if ($repository->remove($entity)) {
-                        $idsRemoved[] = $entity->id;
+                        $removedIdList[] = $entity->id;
                         $count++;
 
                         $this->processActionHistoryRecord('delete', $entity);
@@ -1753,18 +1753,18 @@ class Record extends \Espo\Core\Services\Base
                 }
             }
 
-            $this->afterMassDelete($idsRemoved);
+            $this->afterMassDelete($removedIdList);
 
             return [
                 'count' => $count
             ];
         }
 
-        $this->afterMassDelete($idsRemoved);
+        $this->afterMassDelete($removedIdList);
 
         return [
             'count' => $count,
-            'ids' => $idsRemoved
+            'ids' => $removedIdList
         ];
     }
 
diff --git a/client/src/views/record/list.js b/client/src/views/record/list.js
index 310ad57894..de95040834 100644
--- a/client/src/views/record/list.js
+++ b/client/src/views/record/list.js
@@ -976,6 +976,10 @@ Espo.define('views/record/list', 'view', function (Dep) {
                 }, this);
             }
 
+            if (this.getAcl().get('massUpdatePermission') !== 'yes') {
+                this.removeAllResultMassAction('remove');
+            }
+
             Espo.Utils.clone(this.massActionList).forEach(function (item) {
                 var propName = 'massAction' + Espo.Utils.upperCaseFirst(item) + 'Disabled';
                 if (this[propName] || this.options[propName]) {