xibosignage / xibo

Xibo Digital Signage
https://xibosignage.com
GNU Affero General Public License v3.0
575 stars 165 forks source link

Permissions - playlist permissions can't be set without cascade #1443

Closed PeterMis closed 6 years ago

PeterMis commented 6 years ago

When we assign permission to a layout without using Cascade permissions, we can assign them to a layout itself, region and existing widgets manually, it would seem however that playlists permissions are not assigned this way.

When user that has view/edit permissions manually assigned to layout, region and widgets, will try to just edit and save the order it will show access denied, similarly if user will try to add a new widget or edit existing widget.

It seems to fail in the code we have in all mentioned places ie

if (!$this->getUser()->checkEditable($playlist))
            throw new AccessDeniedException();

As the permissions to playlist does not seem to be assigned that throws an error.

If we do use Cascade permissions on the layout, then the above issue do not exist as in this case permissions are correctly assigned to layout, regions, playlists and widgets.

We should either have the 'regionIncludePlaylists' checkbox or have cascade on the region (with one level down compared to cascade in layout) or have permissions to region also assign the same permission to the playlists on that region.

OP - https://community.xibo.org.uk/t/user-permission-problem-cms-1-8-7-custom/13547

dasgarner commented 6 years ago

This is a complicated one - I think your idea here:

have permissions to region also assign the same permission to the playlists on that region. is the most sensible way forward.

This would fit the 2.0 model as well, where Playlists can exist independently from a Region. Region permissions would only apply downward for the Region specific Playlist.