From e4138b894c8580f6bdd80c31f4b03971f8c4bb83 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Mon, 29 Jun 2020 17:23:07 +0300
Subject: [PATCH] acl changes

---
 application/Espo/Core/Acl.php                 | 14 ++++++++--
 application/Espo/Core/AclManager.php          | 27 ++++++++++++++-----
 application/Espo/Hooks/Note/Mentions.php      |  2 +-
 .../Espo/Modules/Crm/Services/Activities.php  |  2 +-
 application/Espo/Services/Stream.php          |  2 +-
 5 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/application/Espo/Core/Acl.php b/application/Espo/Core/Acl.php
index 99f9892cff..46c95cb648 100644
--- a/application/Espo/Core/Acl.php
+++ b/application/Espo/Core/Acl.php
@@ -127,7 +127,7 @@ class Acl
     }
 
     /**
-     * Whether a user has an access to another user taking into account a specific permission.
+     * @deprecated
      */
     public function checkUser(string $permission, User $entity) : bool
     {
@@ -174,11 +174,21 @@ class Acl
         return $this->getAclManager()->getScopeForbiddenLinkList($this->getUser(), $scope, $action, $thresholdLevel);
     }
 
-    public function checkUserPermission($target, string $permissionType = 'userPermission') : bool
+    /**
+     * Whether a user has an access to another user over a specific permission.
+     *
+     * @param $target User|string User entity or user ID.
+     */
+    public function checkUserPermission($target, string $permissionType = 'user') : bool
     {
         return $this->getAclManager()->checkUserPermission($this->getUser(), $target, $permissionType);
     }
 
+    /**
+     * Whether a user can assign to another user.
+     *
+     * @param $target User|string User entity or user ID.
+     */
     public function checkAssignmentPermission($target) : bool
     {
         return $this->getAclManager()->checkAssignmentPermission($this->getUser(), $target);
diff --git a/application/Espo/Core/AclManager.php b/application/Espo/Core/AclManager.php
index 2fb3b8fde4..c4916906d7 100644
--- a/application/Espo/Core/AclManager.php
+++ b/application/Espo/Core/AclManager.php
@@ -141,6 +141,9 @@ class AclManager
      */
     public function get(User $user, string $permission) : ?string
     {
+        if (substr($permission, -10) !== 'Permission') {
+            $permission .= 'Permission';
+        }
         return $this->getTable($user)->get($permission);
     }
 
@@ -248,21 +251,21 @@ class AclManager
     }
 
     /**
-     * Whether a user has an access to another user taking into account a specific permission.
+     * @deprecated
      */
-    public function checkUser(User $user, string $permission, User $entity) : bool
+    public function checkUser(User $user, string $permission, User $target) : bool
     {
         if ($user->isAdmin()) {
             return true;
         }
         if ($this->get($user, $permission) === 'no') {
-            if ($entity->id !== $user->id) {
+            if ($target->id !== $user->id) {
                 return false;
             }
         } else if ($this->get($user, $permission) === 'team') {
-            if ($entity->id != $user->id) {
+            if ($target->id != $user->id) {
                 $teamIdList1 = $user->getTeamIdList();
-                $teamIdList2 = $entity->getTeamIdList();
+                $teamIdList2 = $target->getTeamIdList();
 
                 $inTeam = false;
                 foreach ($teamIdList1 as $id) {
@@ -366,7 +369,12 @@ class AclManager
         return $list;
     }
 
-    public function checkUserPermission(User $user, $target, string $permissionType = 'userPermission') : bool
+    /**
+     * Whether a user has an access to another user over a specific permission.
+     *
+     * @param $target User|string User entity or user ID.
+     */
+    public function checkUserPermission(User $user, $target, string $permissionType = 'user') : bool
     {
         $permission = $this->get($user, $permissionType);
 
@@ -396,9 +404,14 @@ class AclManager
         return true;
     }
 
+    /**
+     * Whether a user can assign to another user.
+     *
+     * @param $target User|string User entity or user ID.
+     */
     public function checkAssignmentPermission(User $user, $target) : bool
     {
-        return $this->checkUserPermission($user, $target, 'assignmentPermission');
+        return $this->checkUserPermission($user, $target, 'assignment');
     }
 
     /**
diff --git a/application/Espo/Hooks/Note/Mentions.php b/application/Espo/Hooks/Note/Mentions.php
index 8b7c06d3f4..1f046f0595 100644
--- a/application/Espo/Hooks/Note/Mentions.php
+++ b/application/Espo/Hooks/Note/Mentions.php
@@ -89,7 +89,7 @@ class Mentions
                 $userName = substr($item, 1);
                 $user = $this->entityManager->getRepository('User')->where(['userName' => $userName])->findOne();
                 if ($user) {
-                    if (!$this->acl->checkUser('assignmentPermission', $user)) {
+                    if (!$this->acl->checkUserPermission($user, 'assignment')) {
                         continue;
                     }
                     $m = [
diff --git a/application/Espo/Modules/Crm/Services/Activities.php b/application/Espo/Modules/Crm/Services/Activities.php
index 5c872489ad..ce44c7ffa3 100644
--- a/application/Espo/Modules/Crm/Services/Activities.php
+++ b/application/Espo/Modules/Crm/Services/Activities.php
@@ -737,7 +737,7 @@ class Activities implements
     protected function accessCheck($entity)
     {
         if ($entity->getEntityType() == 'User') {
-            if (!$this->getAcl()->checkUser('userPermission', $entity)) {
+            if (!$this->getAcl()->checkUserPermission($entity, 'user')) {
                 throw new Forbidden();
             }
 
diff --git a/application/Espo/Services/Stream.php b/application/Espo/Services/Stream.php
index e341e49e47..ab022f08b2 100644
--- a/application/Espo/Services/Stream.php
+++ b/application/Espo/Services/Stream.php
@@ -352,7 +352,7 @@ class Stream
             if (!$user) {
                 throw new NotFound();
             }
-            if (!$this->acl->checkUser('userPermission', $user)) {
+            if (!$this->acl->checkUserPermission($user, 'user')) {
                 throw new Forbidden();
             }
         }