From 492e3f782b9dd5fb731a33312d8fb57986934822 Mon Sep 17 00:00:00 2001
From: coderkun <coderkun@users.noreply.github.com>
Date: Tue, 3 Jun 2014 14:37:33 +0200
Subject: [PATCH] restrict CRUD for Questgroupshierarchy to Seminary admins

---
 controllers/QuestgroupshierarchyController.inc | 8 ++++++--
 views/html/questgroups/questgroup.tpl          | 4 +++-
 views/html/seminaries/seminary.tpl             | 4 +++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/controllers/QuestgroupshierarchyController.inc b/controllers/QuestgroupshierarchyController.inc
index 5f6c3601..58fa3e0c 100644
--- a/controllers/QuestgroupshierarchyController.inc
+++ b/controllers/QuestgroupshierarchyController.inc
@@ -39,6 +39,8 @@
 		public $permissions = array(
 			'create'	=> array('admin', 'moderator', 'user'),
 			'edit'		=> array('admin', 'moderator', 'user'),
+			'moveup'	=> array('admin', 'moderator', 'user'),
+			'movedown'	=> array('admin', 'moderator', 'user'),
 			'delete'	=> array('admin', 'moderator', 'user')
 		);
 		/**
@@ -47,8 +49,10 @@
 		 * @var array
 		 */
 		public $seminaryPermissions = array(
-			'create'	=> array('admin', 'moderator'),
-			'edit'		=> array('admin', 'moderator'),
+			'create'	=> array('admin'),
+			'edit'		=> array('admin'),
+			'moveup'	=> array('admin'),
+			'movedown'	=> array('admin'),
 			'delete'	=> array('admin')
 		);
 		
diff --git a/views/html/questgroups/questgroup.tpl b/views/html/questgroups/questgroup.tpl
index b5e7008c..3d359611 100644
--- a/views/html/questgroups/questgroup.tpl
+++ b/views/html/questgroups/questgroup.tpl
@@ -22,7 +22,7 @@
 <?php foreach($childquestgroupshierarchy as $hierarchyIndex => &$hierarchy) : ?>
 <?php if(count($hierarchy['questgroups']) > 0 || count(array_intersect(array('admin', 'moderator'), \hhu\z\controllers\SeminaryController::$character['characterroles'])) > 0) : ?>
 <h3><?=$hierarchy['title_plural']?></h3>
-<?php if(count(array_intersect(array('admin', 'moderator'), \hhu\z\controllers\SeminaryController::$character['characterroles'])) > 0) : ?>
+<?php if(in_array('admin', \hhu\z\controllers\SeminaryController::$character['characterroles'])) : ?>
 <nav class="admin">
 	<li><a href="<?=$linker->link(array('questgroupshierarchy','edit',$seminary['url'],$hierarchy['url']))?>"><?=_('Edit Questgroupshierarchy')?></a></li>
 	<li><a href="<?=$linker->link(array('questgroupshierarchy','delete',$seminary['url'],$hierarchy['url']))?>"><?=_('Delete Questgroupshierarchy')?></a></li>
@@ -59,6 +59,7 @@
 </ul>
 <?php endif ?>
 <?php endforeach ?>
+<?php if(in_array('admin', \hhu\z\controllers\SeminaryController::$character['characterroles'])) : ?>
 <form method="post" action="<?=$linker->link(array('questgroupshierarchy','create',$seminary['url']))?>">
 	<h2><?=_('New Questgroupshierarchy')?></h2>
 	<?=_('Title (singular)')?>: <input type="text" name="title_singular" placeholder="<?=_('Title (singular)')?>" />
@@ -67,6 +68,7 @@
 	<input type="submit" name="create" value="<?=_('Add new Questgroupshierarchy')?>" />
 </form>
 <?php endif ?>
+<?php endif ?>
 
 <?php if(isset($quests) && !is_null($quests) && count($quests) > 0) : ?>
 <h3><?=_('Quests')?></h3>
diff --git a/views/html/seminaries/seminary.tpl b/views/html/seminaries/seminary.tpl
index f7bc4fdd..bc9ede9c 100644
--- a/views/html/seminaries/seminary.tpl
+++ b/views/html/seminaries/seminary.tpl
@@ -22,7 +22,7 @@
 <p><?=\hhu\z\Utils::t($seminary['description'])?></p>
 <?php foreach($questgroupshierarchy as $hierarchyIndex => &$hierarchy) : ?>
 <h2 id="<?=$hierarchy['url']?>"><?=$hierarchy['title_plural']?></h2>
-<?php if(count(array_intersect(array('admin', 'moderator'), \hhu\z\controllers\SeminaryController::$character['characterroles'])) > 0) : ?>
+<?php if(in_array('admin', \hhu\z\controllers\SeminaryController::$character['characterroles'])) : ?>
 <nav class="admin">
 	<li><a href="<?=$linker->link(array('questgroupshierarchy','edit',$seminary['url'],$hierarchy['url']))?>"><?=_('Edit Questgrouphierarchy')?></a></li>
 	<li><a href="<?=$linker->link(array('questgroupshierarchy','delete',$seminary['url'],$hierarchy['url']))?>"><?=_('Delete Questgrouphierarchy')?></a></li>
@@ -56,9 +56,11 @@
 </ul>
 <?php endforeach ?>
 
+<?php if(in_array('admin', \hhu\z\controllers\SeminaryController::$character['characterroles'])) : ?>
 <form method="post" action="<?=$linker->link(array('questgroupshierarchy','create',$seminary['url']))?>">
 	<h2><?=_('New Questgroupshierarchy')?></h2>
 	<?=_('Title (singular)')?>: <input type="text" name="title_singular" placeholder="<?=_('Title (singular)')?>" /></h2>
 	<?=_('Title (plural)')?>: <input type="text" name="title_plural" placeholder="<?=_('Title (plural)')?>" /></h2>
 	<input type="submit" name="create" value="<?=_('Add new Questgroupshierarchy')?>" />
 </form>
+<?php endif ?>