diff --git a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/IOrderModel.java b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/IOrderModel.java index 708766031..451195287 100644 --- a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/IOrderModel.java +++ b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/IOrderModel.java @@ -119,4 +119,6 @@ public interface IOrderModel { boolean userCanRead(Order order, String loginName); + boolean userCanWrite(Order order, String loginName); + } diff --git a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderCRUDController.java b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderCRUDController.java index b7b9561ce..55fcdb776 100644 --- a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderCRUDController.java +++ b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderCRUDController.java @@ -471,16 +471,26 @@ public class OrderCRUDController extends GenericForwardComposer { } public void confirmRemove(Order order) { - try { - int status = Messagebox.show(_("Confirm deleting {0}. Are you sure?", order.getName()), "Delete", - Messagebox.OK | Messagebox.CANCEL, Messagebox.QUESTION); - if (Messagebox.OK == status) { - remove(order); + if(orderModel.userCanWrite(order, SecurityUtils.getSessionUserLoginName())) { + try { + int status = Messagebox.show(_("Confirm deleting {0}. Are you sure?", order.getName()), + "Delete", Messagebox.OK | Messagebox.CANCEL, Messagebox.QUESTION); + if (Messagebox.OK == status) { + remove(order); + } + } catch (InterruptedException e) { + messagesForUser.showMessage( + Level.ERROR, e.getMessage()); + LOG.error(_("Error on showing removing element: ", order.getId()), e); + } + } + else { + try { + Messagebox.show(_("You don't have permissions to edit this order"), + _("Information"), Messagebox.OK, Messagebox.INFORMATION); + } catch (InterruptedException e) { + throw new RuntimeException(e); } - } catch (InterruptedException e) { - messagesForUser.showMessage( - Level.ERROR, e.getMessage()); - LOG.error(_("Error on showing removing element: ", order.getId()), e); } } @@ -732,18 +742,20 @@ public class OrderCRUDController extends GenericForwardComposer { } private void appendButtonDelete(final Hbox hbox, final Order order) { - Button buttonDelete = new Button(); - buttonDelete.setSclass("icono"); - buttonDelete.setImage("/common/img/ico_borrar1.png"); - buttonDelete.setHoverImage("/common/img/ico_borrar.png"); - buttonDelete.setTooltiptext(_("Delete")); - buttonDelete.addEventListener("onClick",new EventListener() { - @Override - public void onEvent(Event event) throws Exception { - confirmRemove(order); - } - }); - hbox.appendChild(buttonDelete); + if(orderModel.userCanWrite(order, SecurityUtils.getSessionUserLoginName())) { + Button buttonDelete = new Button(); + buttonDelete.setSclass("icono"); + buttonDelete.setImage("/common/img/ico_borrar1.png"); + buttonDelete.setHoverImage("/common/img/ico_borrar.png"); + buttonDelete.setTooltiptext(_("Delete")); + buttonDelete.addEventListener("onClick",new EventListener() { + @Override + public void onEvent(Event event) throws Exception { + confirmRemove(order); + } + }); + hbox.appendChild(buttonDelete); + } } private void appendButtonPlan(final Hbox hbox, final Order order) { diff --git a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderModel.java b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderModel.java index f29e0da3c..b70ba48af 100644 --- a/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderModel.java +++ b/navalplanner-webapp/src/main/java/org/navalplanner/web/orders/OrderModel.java @@ -720,4 +720,27 @@ public class OrderModel implements IOrderModel { return false; } + @Override + @Transactional(readOnly = true) + public boolean userCanWrite(Order order, String loginName) { + if (SecurityUtils.isUserInRole(UserRole.ROLE_EDIT_ALL_ORDERS)) { + return true; + } + try { + User user = userDAO.findByLoginName(loginName); + for(OrderAuthorization authorization : + orderAuthorizationDAO.listByOrderUserAndItsProfiles(order, user)) { + if(authorization.getAuthorizationType() == + OrderAuthorizationType.WRITE_AUTHORIZATION) { + return true; + } + } + } + catch(InstanceNotFoundException e) { + //this case shouldn't happen, because it would mean that there isn't a logged user + //anyway, if it happenned we don't allow the user to pass + } + return false; + } + }