#1283 Take user permissions into account when dealing with "Sharing" …

…sections (case, task, observable)
TheHive-Project · Apr 29, 2020 · 89b5c12 · 89b5c12
1 parent 0ed3917
commit 89b5c12
Show file tree

Hide file tree

Showing 7 changed files with 46 additions and 9 deletions.
diff --git a/frontend/app/index.html b/frontend/app/index.html
@@ -207,6 +207,7 @@
     <script src="scripts/directives/fixed-height.js"></script>
     <script src="scripts/directives/flow/flow-item.js"></script>
     <script src="scripts/directives/flow/flow.js"></script>
+    <script src="scripts/directives/if-not-permission.js"></script>
     <script src="scripts/directives/if-permission.js"></script>
     <script src="scripts/directives/logEntry.js"></script>
     <script src="scripts/directives/mini-report-list.js"></script>

diff --git a/frontend/app/scripts/components/sharing/SharingListCmp.js b/frontend/app/scripts/components/sharing/SharingListCmp.js
@@ -26,7 +26,8 @@
                 readOnly: '<',
                 //onReload: '&',
                 onUpdateProfile: '&',
-                onDelete: '&'
+                onDelete: '&',
+                permissions: '='
             }
         });
 })();
diff --git a/frontend/app/scripts/directives/if-not-permission.js b/frontend/app/scripts/directives/if-not-permission.js
@@ -0,0 +1,24 @@
+(function() {
+    'use strict';
+    angular.module('theHiveDirectives').directive('ifNotPermission', function(AuthenticationSrv, SecuritySrv) {
+        return {
+            restrict: 'A',
+            scope: false,
+            link: function(scope, element, attrs) {
+                var restrictedPermissions = _.map((attrs.ifNotPermission || '').split(','), function(item){
+                    return s.trim(item);
+                });
+
+                if(attrs.allowed !== undefined) {
+                    // Check the list of specified allowed permissions
+                    if(SecuritySrv.checkPermissions(restrictedPermissions, attrs.allowed)) {
+                        element.remove();
+                    }
+                } else if(AuthenticationSrv.hasPermission(restrictedPermissions)){
+                    // Check the user defined permissions
+                    element.remove();
+                }
+            }
+        };
+    });
+})();
diff --git a/frontend/app/views/components/sharing/sharing-list.html b/frontend/app/views/components/sharing/sharing-list.html
@@ -9,18 +9,26 @@
                 <th>Organisation</th>
                 <th width="250">Profile</th>
                 <th width="160">Shared At</th>
-                <th width="160" class="text-right">Actions</th>
+                <th width="160" class="text-right" if-permission="manageShare" allowed="{{$ctrl.permissions}}">Actions</th>
             </thead>
             <tbody>
                 <tr ng-repeat="share in $ctrl.shares | orderBy:'organisationName'">
-                    <td>{{share.organisationName}}</td>
+                    <td>{{share.organisationName}} - {{share.owner}}</td>
+                    <td ng-if="$ctrl.readOnly">
+                        <span>{{share.profileName}}</span>
+                    </td>
                     <td ng-if="!$ctrl.readOnly">
-                        <updatable-select options="$ctrl.profiles" value="share.profileName" on-update="$ctrl.updateProfile(share._id, newValue)"></updatable-select>
+                        <span if-not-permission="manageShare" allowed="{{$ctrl.permissions}}">{{share.profileName}}</span>
+                        <span if-permission="manageShare" allowed="{{$ctrl.permissions}}">
+                            <span ng-if="share.owner === true">{{share.profileName}}</span>
+                            <span ng-if="share.owner !== true">
+                                <updatable-select options="$ctrl.profiles" value="share.profileName" on-update="$ctrl.updateProfile(share._id, newValue)"></updatable-select>
+                            </span>
+                        </span>
                     </td>
-                    <td ng-if="$ctrl.readOnly">{{share.profileName}}</td>
                     <td>{{share.createdAt | shortDate}}</td>
-                    <td class="text-right">
-                        <span class="clickable text-danger" ng-click="$ctrl.remove(share)">
+                    <td class="text-right" if-permission="manageShare" allowed="{{$ctrl.permissions}}">
+                        <span class="clickable text-danger" ng-if="share.owner !== true" ng-click="$ctrl.remove(share)">
                             <i class="fa fa-trash"></i> Delete
                         </span>
                     </td>

diff --git a/frontend/app/views/partials/case/case.sharing.html b/frontend/app/views/partials/case/case.sharing.html
@@ -1,7 +1,7 @@
-<div class="row mb-s">
+<div class="row mb-s" if-permission="manageCase" allowed="{{userPermissions}}">
     <div class="col-md-12">
         <div class="btn-toolbar" role="toolbar">
-            <div class="btn-group" if-permission="manageCase" allowed="{{userPermissions}}">
+            <div class="btn-group">
                 <button class="btn btn-sm btn-primary" ng-click="$vm.shareCase()" ng-disabled="!$vm.enableAddButton">
                     <i class="fa fa-plus"></i>
                     Add share
@@ -29,6 +29,7 @@
             profiles="$vm.profiles"
             on-delete="$vm.removeShare(share)"
             on-update-profile="$vm.updateShareProfile(org, profile)"
+            permissions="userPermissions"
             ></sharing-list>
     </div>
 </div>
diff --git a/frontend/app/views/partials/case/case.tasks.item.html b/frontend/app/views/partials/case/case.tasks.item.html
@@ -235,6 +235,7 @@ <h4 class="vpad10 text-primary">Task sharing</h4>
                  shares="shares"
                  read-only="true"
                  on-delete="removeShare(share)"
+                 permissions="userPermissions"                 
                  ></sharing-list>
          </div>
     </div>

diff --git a/frontend/app/views/partials/observables/details/sharing.html b/frontend/app/views/partials/observables/details/sharing.html
@@ -14,6 +14,7 @@ <h4 class="vpad10 text-primary">Sharing</h4>
                  shares="shares"
                  read-only="true"
                  on-delete="removeShare(share)"
+                 permissions="userPermissions"                 
                  ></sharing-list>
          </div>
     </div>