Schedule Now - Validation Error Permission

Bug #1341390 reported by Laercio
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Xibo
Fix Released
Low
Dan Garner

Bug Description

Schedule Now - Validation Error Permission

The Schedule Now this functionality not respecting SCHEDULE_WITH_VIEW_PERMISSION configuration.

By setting displays with permission only View as images attached, the user can perform scheduling.

Blocking this only applies to the schedule via the menu / index.php? & P = schedule

The same problem happens for the Campaign Item.

Display

Related branches

Revision history for this message
Laercio (laercionit) wrote :
Revision history for this message
Dan Garner (dangarner) wrote :

Line 1103.

Changed in xibo:
milestone: none → 1.6.3
assignee: nobody → Dan Garner (dangarner)
importance: Undecided → Low
status: New → Triaged
Dan Garner (dangarner)
Changed in xibo:
status: Triaged → Fix Committed
Revision history for this message
Laercio (laercionit) wrote :

In this screen schedule now appearing all displays should only appear that the user has less access to VIEW or EDIT (Respecting SCHEDULE_WITH_VIEW_PERMISSION configuration)

Dan Garner (dangarner)
Changed in xibo:
status: Fix Committed → Fix Released
Revision history for this message
Laercio (laercionit) wrote :

DAN, I found a problem.

Schedule Now screens are listing all displays should display only the user has access to less reading, depending on the parameter configuration SCHEDULE_WITH_VIEW_PERMISSION Set View, or only the user has access to edit the configuration is SCHEDULE_WITH_VIEW_PERMISSION set NO

Revision history for this message
Laercio (laercionit) wrote :

Any news about the comments I made? I'm using an invalid logic?

Revision history for this message
Dan Garner (dangarner) wrote :

In 1.6.3 i changed it to work in the way you requested.

(!$auth->edit && Config::GetSetting('SCHEDULE_WITH_VIEW_PERMISSION') == 'No')

If you dont have edit permission and you dont have schedule with view, then the display is not visible. Are you suggesting that this logic is incorrect?

Revision history for this message
Laercio (laercionit) wrote :

Dan, sorry, my English is not very good ....

Come on ...

What is identified as a problem only when the checked SCHEDULE_WITH_VIEW_PERMISSION = YES setting, all displays are displayed to the user. Should show on the screen only displays the user has VIEW permission. Basically the same view control that is in the programming screen.

The other configuration it using SCHEDULE_WITH_VIEW_PERMISSION = NO, this working PERFECTLY. Only displays with EDIT permission to the user are displayed

Revision history for this message
Laercio (laercionit) wrote :

Was the only problem I encountered related to permissionamento, yet.
With that fixed, I can perform the upgrade to version 1.6.3

Revision history for this message
Dan Garner (dangarner) wrote :

If I understand correctly when scheduled with view permission is ticked all displays are shown?

I'll retarget to 1.6.4

Revision history for this message
Dan Garner (dangarner) wrote :

I see the problem and should be able to issue a patch.

Revision history for this message
Laercio (laercionit) wrote :

Dan, do the following test ...

Enable SCHEDULE_WITH_VIEW_PERMISSION = YES option.

Select the schedule now feature in any of the areas, Display, or Layout Campaign.

You will see a screen that is loaded will present all displays, including the user does not have read permission.

Revision history for this message
Laercio (laercionit) wrote : Re: [Bug 1341390] Re: Schedule Now - Validation Error Permission

Perfect Dan,

I await the Path to perform final testing before migration.

*Laercio Junior*
Cel./Pessoal: (21) 99162-7440
Email Pessoal: <email address hidden>
MSN: <email address hidden>
Skype: laercionit

2014-08-23 14:07 GMT-03:00 Dan Garner <email address hidden>:

> I see the problem and should be able to issue a patch.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1341390
>
> Title:
> Schedule Now - Validation Error Permission
>
> Status in Xibo Open Source Digital Signage:
> Fix Released
>
> Bug description:
> Schedule Now - Validation Error Permission
>
> The Schedule Now this functionality not respecting
> SCHEDULE_WITH_VIEW_PERMISSION configuration.
>
> By setting displays with permission only View as images attached, the
> user can perform scheduling.
>
> Blocking this only applies to the schedule via the menu / index.php? &
> P = schedule
>
> The same problem happens for the Campaign Item.
>
>
> Display
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/xibo/+bug/1341390/+subscriptions
>

Revision history for this message
Dan Garner (dangarner) wrote :

I think the attached file should fix the issue.

Replace in lib/pages/

Changed in xibo:
status: Fix Released → In Progress
milestone: 1.6.3 → 1.7.0-alpha
Revision history for this message
Laercio (laercionit) wrote :

In the programming screen displays not appear (I have two with View
permission for the user and one with Permission Edit)

In grid programming, the displays are listed perfectly.
Ta Screen Schedule Now also worked perfectly.
Using SCHEDULE_WITH_VIEW_PERMISSION = YES

[image: Imagem inline 1]

[image: Imagem inline 2]

*Laercio Junior*
Cel./Pessoal: (21) 99162-7440
Email Pessoal: <email address hidden>
MSN: <email address hidden>
Skype: laercionit

2014-08-26 12:48 GMT-03:00 Dan Garner <email address hidden>:

> I think the attached file should fix the issue.
>
> Replace in lib/pages/
>
> ** Changed in: xibo
> Status: Fix Released => In Progress
>
> ** Changed in: xibo
> Milestone: 1.6.3 => 1.7.0-alpha
>
> ** Attachment added: "schedule.class.php"
>
> https://bugs.launchpad.net/xibo/+bug/1341390/+attachment/4187450/+files/schedule.class.php
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1341390
>
> Title:
> Schedule Now - Validation Error Permission
>
> Status in Xibo Open Source Digital Signage:
> In Progress
>
> Bug description:
> Schedule Now - Validation Error Permission
>
> The Schedule Now this functionality not respecting
> SCHEDULE_WITH_VIEW_PERMISSION configuration.
>
> By setting displays with permission only View as images attached, the
> user can perform scheduling.
>
> Blocking this only applies to the schedule via the menu / index.php? &
> P = schedule
>
> The same problem happens for the Campaign Item.
>
>
> Display
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/xibo/+bug/1341390/+subscriptions
>

Revision history for this message
Dan Garner (dangarner) wrote :

The list of displays on the scheduling grid is not intended to obey the schedule with view setting. Regardless of that setting the user should be able to see the displays in the list.

In other words, that list of displays is based on view permissions only.

I think that is correct?

Revision history for this message
Laercio (laercionit) wrote :
Download full text (3.9 KiB)

Dan, I really want to help evolve the system, I spent a good time to write
the items below, I hope you can understand, my English is not very good.
Under my view of what should happen in each feature related permissions.

*Dan, please carefully read the items, and correct me if my logic in the
specification of some features inconsistent with this concept of the
system.*

Option 1: SCHEDULE_WITH_VIEW_PERMISSION = YES

   - Displays: We present all the displays that the user has View
   permission (Menu Displays - index.php p = display &). Regardless of
   SCHEDULE_WITH_VIEW_PERMISSION option, this feature this perfectly and
   smoothly.

[image: Imagem inline 6]

   - GRID Scheduling: We should always present the displays that the user
   has, regardless of SCHEDULE_WITH_VIEW_PERMISSION option VIEW permission for
   Groups Displays and the Displays. This feature this perfectly and smoothly.

[image: Imagem inline 1][image: Imagem inline 2]

   - View Schedules: We always display the events for displays that the
   user has permission to view the display. Regardless of
   SCHEDULE_WITH_VIEW_PERMISSION option, this feature this perfectly.

[image: Imagem inline 3]

   - Create new schedule: We present the programming screen only displays
   the user has VIEW access, in case SCHEDULE_WITH_VIEW_PERMISSION = YES
   option (This functionality with this ERROR)

[image: Imagem inline 4]

   - Edit Schedule: We must allow edit the events for the displays that the
   user has access to view, in case SCHEDULE_WITH_VIEW_PERMISSION = YES.

[image: Imagem inline 5]

   - *Delete Schedule: Should we allow delete scheduled events for displays
   that the user has access to view, in case SCHEDULE_WITH_VIEW_PERMISSION =
   YES*

[image: Imagem inline 5]

   - Schedule Now: To Campaigns, Layouts, Displays and Displays Group have
   a schedule now option, we show only the displays that the user has at least
   VIEW permission.

[image: Imagem inline 8]

_____________________________________________________________________________________

Option 2: SCHEDULE_WITH_VIEW_PERMISSION = NO

   - Displays: We present all the displays that the user has View
   permission (Menu Displays - index.php p = display &). This part of the
   system has no problem. The options listed under Actions that perform
   editing actions (Default Layout, Version, Assign Files, Edit) shall only be
   displayed to users who have EDIT to display, it's very important.

[image: Imagem inline 6]

   - GRID Scheduling: We should always present the displays that the user
   has VIEW permission, regardless of SCHEDULE_WITH_VIEW_PERMISSION option for
   groups and Displays Displays.

 [image: Imagem inline 1][image: Imagem inline 2]

   - View Schedules: We always display the events for displays that the
   user has permission to view the display. If the display that the user has
   permission only view you have any scheduled item should show no link to the
   edition. If the user has the Edit option, we must put the event with link
   editing.

[image: Imagem inline 3]

   - New Event Schedule :We must present the programming screen, which
   displays only the user has access EDIT, i...

Read more...

Revision history for this message
Dan Garner (dangarner) wrote :

We very much appreciate your effort in this area - this schedule with view permission work has become a nightmare for us, consuming massive amounts of time for such a small user edge case.

What I really need to know is a clear list of things that are not working as expected. I think I have extracted the below from your list:

Option 1: SCHEDULE_WITH_VIEW_PERMISSION = YES

   - Create new schedule: We present the programming screen only displays
   the user has VIEW access, in case SCHEDULE_WITH_VIEW_PERMISSION = YES
   option (This functionality with this ERROR)

I think I have seen this error and resolved it in the new attachment.

   - *Delete Schedule: Should we allow delete scheduled events for displays
   that the user has access to view, in case SCHEDULE_WITH_VIEW_PERMISSION =
   YES*

If they can get into the form (i.e. the event is editable) then they can action the delete item.

Option 2: SCHEDULE_WITH_VIEW_PERMISSION = NO
   - Displays:

Schedule with view permissions should not effect the display management page in any way at all (or anything else outside the schedule).

Dan Garner (dangarner)
Changed in xibo:
milestone: 1.7.0-alpha → 1.6.4
Revision history for this message
Laercio (laercionit) wrote :

Dan, Last resume TESTS...

SCHEDULE_WITH_VIEW_PERMISSION = YES:

Single error in the function of this Schedule Now ....
Displays or groups of displays are not listed
All other senarios are perfect!

SCHEDULE_WITH_VIEW_PERMISSION = NO

Edit the error event, there is no link, even with the Display EDIT permission.
Obviously, not having the edit link at the event, also we can not delete.

Error in function Schedule Now, same problem with the item above ......
Displays or groups of displays are not listed
All other senarios are perfect!

All other senarios are perfect! Greate!

Revision history for this message
Dan Garner (dangarner) wrote :

I've found the issue with the schedule now form.

I can't find the issue with the edit link - can you please retest that making sure that ALL DISPLAYS the event is for has the edit permissions required.

Changed in xibo:
status: In Progress → Fix Committed
Revision history for this message
Laercio (laercionit) wrote :

The problem of Schedule Now this resolved.
Just to SCHEDULE_WITH_VIEW_PERMISSION = NO, the link found trouble editing
event
Test case:
3 displays for the user Artivinco
Artivinco Itatiba-and-Artivinco SantaRosa permisson VIEW
Display Artivinco-Claudia - Permission - EDIT

[image: Imagem inline 2]

[image: Imagem inline 1]

ERROR: Can I create event for displays with permission EDIT just this
perfect, but after creating can not edit, the event is no link.

In schedule.class.php file
1776 Line IsEventEditable private function ($ eventDGIDs)
1778 line scheduleWithView = $ (Config :: GetSetting
('SCHEDULE_WITH_VIEW_PERMISSION') == 'Yes');
We should have one for $ scheduleWithView = IF (Config :: GetSetting
('SCHEDULE_WITH_VIEW_PERMISSION') == 'NO');

*Am I right or wrong in my analysis of the code?*

*Laercio Junior*
Cel./Pessoal: (21) 99162-7440
Email Pessoal: <email address hidden>
MSN: <email address hidden>
Skype: laercionit

2014-09-06 10:48 GMT-03:00 Dan Garner <email address hidden>:

> I've found the issue with the schedule now form.
>
> I can't find the issue with the edit link - can you please retest that
> making sure that ALL DISPLAYS the event is for has the edit permissions
> required.
>
> ** Attachment added: "lib/pages/schedule.class.php"
>
> https://bugs.launchpad.net/xibo/+bug/1341390/+attachment/4197037/+files/schedule.class.php
>
> ** Changed in: xibo
> Status: In Progress => Fix Committed
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1341390
>
> Title:
> Schedule Now - Validation Error Permission
>
> Status in Xibo Open Source Digital Signage:
> Fix Committed
>
> Bug description:
> Schedule Now - Validation Error Permission
>
> The Schedule Now this functionality not respecting
> SCHEDULE_WITH_VIEW_PERMISSION configuration.
>
> By setting displays with permission only View as images attached, the
> user can perform scheduling.
>
> Blocking this only applies to the schedule via the menu / index.php? &
> P = schedule
>
> The same problem happens for the Campaign Item.
>
>
> Display
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/xibo/+bug/1341390/+subscriptions
>

Revision history for this message
Laercio (laercionit) wrote :

Dan, this item could be related in this version 1.6.4:

https://bugs.launchpad.net/xibo/+bug/1321509

*Laercio Junior*
Cel./Pessoal: (21) 99162-7440
Email Pessoal: <email address hidden>
MSN: <email address hidden>
Skype: laercionit

2014-09-06 12:18 GMT-03:00 Laercio Mendonça <email address hidden>:

> The problem of Schedule Now this resolved.
> Just to SCHEDULE_WITH_VIEW_PERMISSION = NO, the link found trouble editing
> event
> Test case:
> 3 displays for the user Artivinco
> Artivinco Itatiba-and-Artivinco SantaRosa permisson VIEW
> Display Artivinco-Claudia - Permission - EDIT
>
> [image: Imagem inline 2]
>
>
> [image: Imagem inline 1]
>
> ERROR: Can I create event for displays with permission EDIT just this
> perfect, but after creating can not edit, the event is no link.
>
> In schedule.class.php file
> 1776 Line IsEventEditable private function ($ eventDGIDs)
> 1778 line scheduleWithView = $ (Config :: GetSetting
> ('SCHEDULE_WITH_VIEW_PERMISSION') == 'Yes');
> We should have one for $ scheduleWithView = IF (Config :: GetSetting
> ('SCHEDULE_WITH_VIEW_PERMISSION') == 'NO');
>
> *Am I right or wrong in my analysis of the code?*
>
>
> *Laercio Junior*
> Cel./Pessoal: (21) 99162-7440
> Email Pessoal: <email address hidden>
> MSN: <email address hidden>
> Skype: laercionit
>
>
>
>
> 2014-09-06 10:48 GMT-03:00 Dan Garner <email address hidden>:
>
> I've found the issue with the schedule now form.
>>
>> I can't find the issue with the edit link - can you please retest that
>> making sure that ALL DISPLAYS the event is for has the edit permissions
>> required.
>>
>> ** Attachment added: "lib/pages/schedule.class.php"
>>
>> https://bugs.launchpad.net/xibo/+bug/1341390/+attachment/4197037/+files/schedule.class.php
>>
>> ** Changed in: xibo
>> Status: In Progress => Fix Committed
>>
>> --
>> You received this bug notification because you are subscribed to the bug
>> report.
>> https://bugs.launchpad.net/bugs/1341390
>>
>> Title:
>> Schedule Now - Validation Error Permission
>>
>> Status in Xibo Open Source Digital Signage:
>> Fix Committed
>>
>> Bug description:
>> Schedule Now - Validation Error Permission
>>
>> The Schedule Now this functionality not respecting
>> SCHEDULE_WITH_VIEW_PERMISSION configuration.
>>
>> By setting displays with permission only View as images attached, the
>> user can perform scheduling.
>>
>> Blocking this only applies to the schedule via the menu / index.php? &
>> P = schedule
>>
>> The same problem happens for the Campaign Item.
>>
>>
>> Display
>>
>> To manage notifications about this bug go to:
>> https://bugs.launchpad.net/xibo/+bug/1341390/+subscriptions
>>
>
>

Revision history for this message
Dan Garner (dangarner) wrote :

I really don't understand what this means:

"ERROR: Can I create event for displays with permission EDIT just this
perfect, but after creating can not edit, the event is no link."

Or what that has to do with the screen shots you sent ?

In the display page only displays with view permissions are in the list - this is essential for security of the system. If the user doesn't have view permissions, the display will NOT show.

If the user has view permissions, they will only get a schedule now menu item if they either have edit permission or schedule_with_view_permission = Yes.

Revision history for this message
Laercio (laercionit) wrote :

Dan, the images presented are to ratify the permissions of each.

The settings you made are perfect. But to create an event we do not have link to access the FORM editing.

This error did not link just happens to schedule_with_view_permission = NO

Revision history for this message
Laercio (laercionit) wrote :

Dan, the registry system through response to email bug did you not
understand what I wrote.
The email was listed below, after expanding the text.

see:

[image: Imagem inline 1]

Revision history for this message
Dan Garner (dangarner) wrote :

I tried to recreate the problem but couldn't - meaning I created an event, went to the schedule and I could edit it (the edit link was there).

That is why I wondered if I had misunderstood.

Are you suggesting that for any user you can't edit schedules?

Revision history for this message
Laercio (laercionit) wrote :

DAN, I performed new tests. I think the latest changes made ​​solved the problem!

BUG FIXED!

Dan Garner (dangarner)
Changed in xibo:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.