From 1df09242a0faa24d812b4c50c6024532ebde0846 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Wed, 9 Nov 2016 19:54:00 +0100
Subject: [PATCH] don't show preview if ViewOnline isn't allowed, more access
 checks

---
 views/bootstrap/class.ViewDocument.php | 80 +++++++++++++++-----------
 1 file changed, 46 insertions(+), 34 deletions(-)

diff --git a/views/bootstrap/class.ViewDocument.php b/views/bootstrap/class.ViewDocument.php
index 18da0550f..25eb94581 100644
--- a/views/bootstrap/class.ViewDocument.php
+++ b/views/bootstrap/class.ViewDocument.php
@@ -439,7 +439,9 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 		if(is_string($txt))
 			echo $txt;
 		$this->contentContainerEnd();
-		$this->preview();
+		if($accessop->check_controller_access('ViewOnline', array('action'=>'run'))) {
+			$this->preview();
+		}
 ?>
 </div>
 <div class="span8">
@@ -580,51 +582,61 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
 		}
 		print "</ul>";
 		print "<ul class=\"unstyled actions\">";
-		if($accessop->mayEditVersion($document)) {
-			print "<li>".$this->html_link('EditOnline', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("edit_version"), false, true)."</li>";
-		}
+		if($this->check_access('EditOnline'))
+			if($accessop->mayEditVersion($document)) {
+				print "<li>".$this->html_link('EditOnline', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("edit_version"), false, true)."</li>";
+			}
 		/* Only admin has the right to remove version in any case or a regular
 		 * user if enableVersionDeletion is on
 		 */
-		if($accessop->mayRemoveVersion($document)) {
-			print "<li>".$this->html_link('RemoveVersion', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-remove\"></i>".getMLText("rm_version"), false, true)."</li>";
-		}
-		if($accessop->mayOverrideStatus($document)) {
-			print "<li>".$this->html_link('OverrideContentStatus', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-align-justify\"></i>".getMLText("change_status"), false, true)."</li>";
-		}
-		if($accessop->maySetRecipients($document)) {
-			print "<li>".$this->html_link('SetRecipients', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-check\"></i>".getMLText("change_recipients"), false, true)."</li>";
-		}
-		if($accessop->maySetRevisors($document)) {
-			print "<li>".$this->html_link('SetRevisors', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-refresh\"></i>".getMLText("change_revisors"), false, true)."</li>";
-		}
+		if($this->check_access('RemoveVersion'))
+			if($accessop->mayRemoveVersion($document)) {
+				print "<li>".$this->html_link('RemoveVersion', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-remove\"></i>".getMLText("rm_version"), false, true)."</li>";
+			}
+		if($this->check_access('OverrideContentStatus'))
+			if($accessop->mayOverrideStatus($document)) {
+				print "<li>".$this->html_link('OverrideContentStatus', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-align-justify\"></i>".getMLText("change_status"), false, true)."</li>";
+			}
+		if($this->check_access('SetRecipients'))
+			if($accessop->maySetRecipients($document)) {
+				print "<li>".$this->html_link('SetRecipients', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-check\"></i>".getMLText("change_recipients"), false, true)."</li>";
+			}
+		if($this->check_access('SetRevisors'))
+			if($accessop->maySetRevisors($document)) {
+				print "<li>".$this->html_link('SetRevisors', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-refresh\"></i>".getMLText("change_revisors"), false, true)."</li>";
+			}
 		if($workflowmode == 'traditional' || $workflowmode == 'traditional_only_approval') {
 			// Allow changing reviewers/approvals only if not reviewed
-			if($accessop->maySetReviewersApprovers($document)) {
-				print "<li>".$this->html_link('SetReviewersApprovers', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("change_assignments"), false, true)."</li>";
-			}
-		} else {
-			if($accessop->maySetWorkflow($document)) {
-				if(!$workflow) {
-					print "<li>".$this->html_link('SetWorkflow', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-random\"></i>".getMLText("set_workflow"), false, true)."</li>";
+			if($this->check_access('SetReviewersApprovers'))
+				if($accessop->maySetReviewersApprovers($document)) {
+					print "<li>".$this->html_link('SetReviewersApprovers', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("change_assignments"), false, true)."</li>";
+				}
+		} else {
+			if($this->check_access('SetWorkflow'))
+				if($accessop->maySetWorkflow($document)) {
+					if(!$workflow) {
+						print "<li>".$this->html_link('SetWorkflow', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-random\"></i>".getMLText("set_workflow"), false, true)."</li>";
+					}
 				}
-			}
 		}
 		/*
 		if($accessop->maySetExpires($document)) {
 			print "<li>".$this->html_link('SetExpires', array('documentid'=>$documentid), array(), "<i class=\"icon-time\"></i>".getMLText("set_expiry"), false, true)."</li>";
 		}
 		 */
-		if($dms->getAllTransmittals($user)) {
-			if($this->check_access('AddToTransmittal'))
-				print "<li>".$this->html_link('AddToTransmittal', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-list\"></i>".getMLText("add_to_transmittal"), false, true)."</li>";
-		}
-		if($accessop->mayEditComment($document)) {
-			print "<li>".$this->html_link('EditComment', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-comment\"></i>".getMLText("edit_comment"), false, true)."</li>";
-		}
-		if($accessop->mayEditAttributes($document)) {
-			print "<li>".$this->html_link('EditAttributes', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("edit_attributes"), false, true)."</li>";
-		}
+		if($this->check_access('AddToTransmittal'))
+			if($dms->getAllTransmittals($user)) {
+				if($this->check_access('AddToTransmittal'))
+					print "<li>".$this->html_link('AddToTransmittal', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-list\"></i>".getMLText("add_to_transmittal"), false, true)."</li>";
+			}
+		if($this->check_access('EditComment'))
+			if($accessop->mayEditComment($document)) {
+				print "<li>".$this->html_link('EditComment', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-comment\"></i>".getMLText("edit_comment"), false, true)."</li>";
+			}
+		if($this->check_access('EditAttributes'))
+			if($accessop->mayEditAttributes($document)) {
+				print "<li>".$this->html_link('EditAttributes', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-edit\"></i>".getMLText("edit_attributes"), false, true)."</li>";
+			}
 
 		//print "<li>".$this->html_link('Download', array('documentid'=>$documentid, 'vfile'=>1), array(), "<i class=\"icon-info-sign\"></i>".getMLText("versioning_info"), false, true)."</li>";