X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Flib%2FRT%2FSharedSetting.pm;h=43df379b12b0a8d2d5d85b79b0e8f3c8b12258a9;hb=73a6a80a9ca5edbd43d139b7cb25bfee4abfd35e;hp=6d1dbfeb44bc539526811132140d6e7219cb38ca;hpb=75162bb14b3e38d66617077843f4dfdcaf09d5c4;p=freeside.git

diff --git a/rt/lib/RT/SharedSetting.pm b/rt/lib/RT/SharedSetting.pm
index 6d1dbfeb4..43df379b1 100644
--- a/rt/lib/RT/SharedSetting.pm
+++ b/rt/lib/RT/SharedSetting.pm
@@ -2,7 +2,7 @@
 #
 # COPYRIGHT:
 #
-# This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
+# This software is Copyright (c) 1996-2015 Best Practical Solutions, LLC
 #                                          <sales@bestpractical.com>
 #
 # (Except where explicitly superseded by other copyright notices)
@@ -64,7 +64,9 @@ It consists of an ID, a name, and some arbitrary data.
 package RT::SharedSetting;
 use strict;
 use warnings;
+
 use RT::Attribute;
+use Scalar::Util 'blessed';
 use base qw/RT::Base/;
 
 =head1 METHODS
@@ -110,6 +112,9 @@ sub Load {
             return (0, $self->loc("Permission denied"))
                 unless $self->CurrentUserCanSee;
 
+            my ($ok, $msg) = $self->PostLoadValidate;
+            return ($ok, $msg) if !$ok;
+
             return (1, $self->loc("Loaded [_1] [_2]", $self->ObjectName, $self->Name));
         } else {
             $RT::Logger->error("Could not load attribute " . $id
@@ -150,12 +155,24 @@ sub LoadById {
 
 =head2 PostLoad
 
-Called after after successful L</Load>.
+Called after a successful L</Load>.
 
 =cut
 
 sub PostLoad { }
 
+=head2 PostLoadValidate
+
+Called just before returning success from L</Load>; may be used to validate
+that the record is correct. This method is expected to return a (ok, msg)
+pair.
+
+=cut
+
+sub PostLoadValidate {
+    return 1;
+}
+
 =head2 Save
 
 Creates a new shared setting. Takes a privacy, a name, and any other arguments.
@@ -193,11 +210,11 @@ sub Save {
         $self->{'Attribute'} = $object->Attributes->WithId($att_id);
         $self->{'Id'}        = $att_id;
         $self->{'Privacy'}   = $privacy;
-        return ( 1, $self->loc( "Saved [_1] [_2]", $self->ObjectName, $name ) );
+        return ( 1, $self->loc( "Saved [_1] [_2]", $self->loc( $self->ObjectName ), $name ) );
     }
     else {
         $RT::Logger->error($self->ObjectName . " save failure: $att_msg");
-        return ( 0, $self->loc("Failed to create [_1] attribute", $self->ObjectName) );
+        return ( 0, $self->loc("Failed to create [_1] attribute", $self->loc( $self->ObjectName ) ) );
     }
 }
 
@@ -257,11 +274,11 @@ where status is true upon success.
 
 sub Delete {
     my $self = shift;
-
     return (0, $self->loc("Permission denied"))
         unless $self->CurrentUserCanDelete;
 
     my ($status, $msg) = $self->{'Attribute'}->Delete;
+    $self->CurrentUser->ClearAttributes; # force the current user's attribute cache to be cleaned up
     if ($status) {
         return (1, $self->loc("Deleted [_1]", $self->ObjectName));
     } else {
@@ -294,6 +311,9 @@ sub Id {
     return $self->{'Id'};
 }
 
+*id = \&Id;
+
+
 =head2 Privacy
 
 Returns the principal object to whom this shared setting belongs, in a string
@@ -329,7 +349,7 @@ This does not deal with ACLs, this only looks at membership.
 sub IsVisibleTo {
     my $self    = shift;
     my $to      = shift;
-    my $privacy = $self->Privacy;
+    my $privacy = $self->Privacy || '';
 
     # if the privacies are the same, then they can be seen. this handles
     # a personal setting being visible to that user.
@@ -372,6 +392,11 @@ sub _GetObject {
     my $self = shift;
     my $privacy = shift;
 
+    # short circuit: if they pass the object we want anyway, just return it
+    if (blessed($privacy) && $privacy->isa('RT::Record')) {
+        return $privacy;
+    }
+
     my ($obj_type, $obj_id) = split(/\-/, ($privacy || ''));
 
     unless ($obj_type && $obj_id) {
@@ -395,7 +420,9 @@ sub _GetObject {
         return undef;
     }
 
-    if ($obj_type eq 'RT::Group' && !$object->HasMemberRecursively($self->CurrentUser->PrincipalObj)) {
+    if (   $obj_type eq 'RT::Group'
+        && !$object->HasMemberRecursively($self->CurrentUser->PrincipalObj)
+        && !$self->CurrentUser->HasRight( Object => $RT::System, Right => 'SuperUser' ) ) {
         $RT::Logger->debug("Permission denied, ".$self->CurrentUser->Name.
                            " is not a member of group");
         return undef;
@@ -450,6 +477,42 @@ sub _build_privacy {
          : undef;
 }
 
+=head2 ObjectsForLoading
+
+Returns a list of objects that can be used to load this shared setting. It
+is ACL checked.
+
+=cut
+
+sub ObjectsForLoading {
+    my $self = shift;
+    return grep { $self->CurrentUserCanSee($_) } $self->_PrivacyObjects;
+}
+
+=head2 ObjectsForCreating
+
+Returns a list of objects that can be used to create this shared setting. It
+is ACL checked.
+
+=cut
+
+sub ObjectsForCreating {
+    my $self = shift;
+    return grep { $self->CurrentUserCanCreate($_) } $self->_PrivacyObjects;
+}
+
+=head2 ObjectsForModifying
+
+Returns a list of objects that can be used to modify this shared setting. It
+is ACL checked.
+
+=cut
+
+sub ObjectsForModifying {
+    my $self = shift;
+    return grep { $self->CurrentUserCanModify($_) } $self->_PrivacyObjects;
+}
+
 RT::Base->_ImportOverlays();
 
 1;