email acl fix

2016-08-11 15:30:47 +03:00
parent a5ae33ab81
commit fecbb26cbf
3 changed files with 67 additions and 1 deletions
@@ -76,5 +76,46 @@ class Email extends \Espo\Core\Acl\Base

        return false;
    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($data === false) {
+            return false;
+        }
+
+        if ($data->delete === 'own') {
+            if ($user->id === $entity->get('assignedUserId')) {
+                return true;
+            }
+
+            if ($user->id === $entity->get('createdById')) {
+                return true;
+            }
+
+            $assignedUserIdList = $entity->getLinkMultipleIdList('assignedUsers');
+            if (count($assignedUserIdList) === 1 && $entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+                return true;
+            }
+            return false;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+            return true;
+        }
+
+        if ($data->edit !== 'no' || $data->create !== 'no') {
+            if ($entity->get('createdById') === $user->id) {
+                if ($entity->get('status') !== 'Sent' && $entity->get('status') !== 'Archived') {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
 }

@@ -72,6 +72,31 @@ Espo.define('acl/email', 'acl', function (Dep) {
                return true;
            }

+            return false;
+        },
+
+        checkModelDelete: function (model, data, precise) {
+            var result = this.checkModel(model, data, 'delete', precise);
+
+            if (result) {
+                return true;
+            }
+
+            if (data === false) {
+                return false;
+            }
+
+            var d = data || {};
+            if (d.read === 'no') {
+                return false;
+            }
+
+            if (model.get('createdById') === this.getUser().id) {
+                if (model.get('status') !== 'Sent' && model.get('status') !== 'Archived') {
+                    return true;
+                }
+            }
+
            return false;
        }

@@ -1100,7 +1100,7 @@ Espo.define('views/record/list', 'view', function (Dep) {
            if (!id) return;

            var model = this.collection.get(id);
-            if (!this.getAcl().checkScope(this.scope, 'delete')) {
+            if (!this.getAcl().checkModel(model, 'delete')) {
                this.notify('Access denied', 'error');
                return false;
            }