tyler.durden
/
icingaweb2
mirror of https://github.com/Icinga/icingaweb2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

monitoring/security: Hide delete downtime action if user lacks the respective permission

This commit is contained in:
Eric Lippmann 2015-01-22 17:35:34 +01:00
parent a19c155d9f
commit 5967d5fe04
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/monitoring/application/views/scripts/show/components/downtime.phtml
View File

@ -33,9 +33,6 @@ foreach ($object->downtimes as $downtime) {
$this->escape($downtime->comment) $this->escape($downtime->comment)
) : $this->escape($downtime->comment); ) : $this->escape($downtime->comment);
$form = clone $delDowntimeForm;
$form->populate(array('downtime_id' => $downtime->id));
if ((bool) $downtime->is_in_effect) { if ((bool) $downtime->is_in_effect) {
$state = 'in downtime since ' . $this->timeSince($downtime->start); $state = 'in downtime since ' . $this->timeSince($downtime->start);
} else { } else {
@ -54,7 +51,12 @@ foreach ($object->downtimes as $downtime) {
<table> <table>
<tr> <tr>
<td style="vertical-align: top;" data-base-target="_self"> <td style="vertical-align: top;" data-base-target="_self">
<?= $form ?> <?= $state ?> <?php if (isset($delDowntimeForm)) { // Form is unset if the current user lacks the respective permission
$form = clone $delDowntimeForm;
$form->populate(array('downtime_id' => $downtime->id));
echo $form;
} ?>
<?= $state ?>
</td> </td>
<td style="padding-left: .5em;"> <td style="padding-left: .5em;">
<?= str_replace(array('\r\n', '\n'), '<br>', $text) ?> <?= str_replace(array('\r\n', '\n'), '<br>', $text) ?>

2
modules/monitoring/library/Monitoring/Web/Controller/MonitoredObjectController.php
View File

@ -79,7 +79,7 @@ abstract class MonitoredObjectController extends Controller
->handleRequest(); ->handleRequest();
$this->view->delCommentForm = $delCommentForm; $this->view->delCommentForm = $delCommentForm;
} }
if (count($this->object->downtimes > 0)) { if (count($this->object->downtimes > 0) && $auth->hasPermission('monitoring/command/downtime/delete')) {
$delDowntimeForm = new DeleteDowntimeCommandForm(); $delDowntimeForm = new DeleteDowntimeCommandForm();
$delDowntimeForm $delDowntimeForm
->setObjects($this->object) ->setObjects($this->object)