Add missign permission checks for reactions

See #2508

diff --git a/com.woltlab.wcf/templates/article.tpl b/com.woltlab.wcf/templates/article.tpl
index 38c669098cb78f922db3773b89a238315d00cfcf..d1ab534bfd62cac81613c4c95f0b1e7dc84b2127 100644 (file)
--- a/com.woltlab.wcf/templates/article.tpl
+++ b/com.woltlab.wcf/templates/article.tpl
@@ -151,18 +151,25 @@
                        </ul>
                {/if}
                
-               <div class="row articleLikeSection">
-                       <div class="col-xs-12 col-md-6">
-                               <div class="articleLikesSummery">
-                                       {include file="reactionSummaryList" reactionData=$articleLikeData objectType="com.woltlab.wcf.likeableArticle" objectID=$article->articleID}
-                               </div>
-                       </div>
-                       <div class="col-xs-12 col-md-6">
-                               <ul class="articleLikeButtons buttonGroup">
-                                       <li class="jsOnly"><span class="button reactButton{if $articleLikeData[$article->articleID]|isset && $articleLikeData[$article->articleID]->reactionTypeID} active{/if}" title="{lang}wcf.reactions.react{/lang}">{if $articleLikeData[$article->articleID]|isset && $articleLikeData[$article->articleID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($articleLikeData[$article->articleID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType" alt="">{/if}</span></li>
-                               </ul>
+               {if MODULE_LIKE && ARTICLE_ENABLE_LIKE && ($__wcf->session->getPermission('user.like.canLike') || $__wcf->session->getPermission('user.like.canViewLike'))}
+                       <div class="row articleLikeSection">
+                               {if $__wcf->session->getPermission('user.like.canViewLike')}
+                                       <div class="col-xs-12 col-md-6">
+                                               <div class="articleLikesSummery">
+                                                       {include file="reactionSummaryList" reactionData=$articleLikeData objectType="com.woltlab.wcf.likeableArticle" objectID=$article->articleID}
+                                               </div>
+                                       </div>
+                               {/if}
+                               
+                               {if MODULE_LIKE && $__wcf->session->getPermission('user.like.canLike') && (LIKE_ALLOW_FOR_OWN_CONTENT || $article->userID != $__wcf->user->userID)}
+                                       <div class="col-xs-12 col-md-6">
+                                               <ul class="articleLikeButtons buttonGroup">
+                                                       <li class="jsOnly"><span class="button reactButton{if $articleLikeData[$article->articleID]|isset && $articleLikeData[$article->articleID]->reactionTypeID} active{/if}" title="{lang}wcf.reactions.react{/lang}">{if $articleLikeData[$article->articleID]|isset && $articleLikeData[$article->articleID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($articleLikeData[$article->articleID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType" alt="">{/if}</span></li>
+                                               </ul>
+                                       </div>
+                               {/if}
                        </div>
-               </div>
+               {/if}
        </div>
        
        {event name='afterArticleContent'}

diff --git a/com.woltlab.wcf/templates/commentList.tpl b/com.woltlab.wcf/templates/commentList.tpl
index abfad31c99b7601e57547dc6dd237724e50a2a34..20ab1684be5102c776f5ff606e1aa829bdd25a29 100644 (file)
--- a/com.woltlab.wcf/templates/commentList.tpl
+++ b/com.woltlab.wcf/templates/commentList.tpl
@@ -55,7 +55,10 @@
                                                                        <li class="jsReportCommentComment jsOnly" data-object-id="{@$comment->commentID}"><a href="#" title="{lang}wcf.moderation.report.reportContent{/lang}" class="jsTooltip"><span class="icon icon16 fa-exclamation-triangle"></span> <span class="invisible">{lang}wcf.moderation.report.reportContent{/lang}</span></a></li>
                                                                {/if}
                                                                
-                                                               {if MODULE_LIKE}<li class="jsOnly"><a href="#" class="reactButton jsTooltip" title="{lang}wcf.reactions.react{/lang}">{if $likeData[comment][$comment->commentID]|isset && $likeData[comment][$comment->commentID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($likeData[comment][$comment->commentID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType">{/if} <span class="invisible">{lang}wcf.reactions.react{/lang}</span></a></li>{/if}
+                                                               {if MODULE_LIKE && $__wcf->session->getPermission('user.like.canLike') && (LIKE_ALLOW_FOR_OWN_CONTENT || $comment->userID != $__wcf->user->userID)}
+                                                                       <li class="jsOnly"><a href="#" class="reactButton jsTooltip" title="{lang}wcf.reactions.react{/lang}">{if $likeData[comment][$comment->commentID]|isset && $likeData[comment][$comment->commentID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($likeData[comment][$comment->commentID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType">{/if} <span class="invisible">{lang}wcf.reactions.react{/lang}</span></a></li>
+                                                               {/if}
+                                                               
                                                                {event name='commentOptions'}
                                                        </ul>
                                                </nav>

diff --git a/com.woltlab.wcf/templates/commentResponseList.tpl b/com.woltlab.wcf/templates/commentResponseList.tpl
index 0204703c7b45464a49368aa7c8158a89214072db..714cab266eb7e634b00908ad53fe3cebef123177 100644 (file)
--- a/com.woltlab.wcf/templates/commentResponseList.tpl
+++ b/com.woltlab.wcf/templates/commentResponseList.tpl
@@ -48,7 +48,7 @@
                                                                <li class="jsReportCommentResponse jsOnly" data-object-id="{@$response->responseID}"><a href="#" title="{lang}wcf.moderation.report.reportContent{/lang}" class="jsTooltip"><span class="icon icon16 fa-exclamation-triangle"></span> <span class="invisible">{lang}wcf.moderation.report.reportContent{/lang}</span></a></li>
                                                        {/if}
                                                        
-                                                       <li class="jsOnly"><a href="#" class="reactButton jsTooltip" title="{lang}wcf.reactions.react{/lang}">{if $likeData[response][$response->responseID]|isset && $likeData[response][$response->responseID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($likeData[response][$response->responseID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType">{/if} <span class="invisible">{lang}wcf.reactions.react{/lang}</span></a></li>
+                                                       {if MODULE_LIKE && $__wcf->session->getPermission('user.like.canLike') && (LIKE_ALLOW_FOR_OWN_CONTENT || $response->userID != $__wcf->user->userID)}<li class="jsOnly"><a href="#" class="reactButton jsTooltip" title="{lang}wcf.reactions.react{/lang}">{if $likeData[response][$response->responseID]|isset && $likeData[response][$response->responseID]->reactionTypeID}{@$__wcf->getReactionHandler()->getReactionTypeByID($likeData[response][$response->responseID]->reactionTypeID)->renderIcon()}{else}<img src="{$__wcf->getPath()}/images/reaction/reactionIcon.svg" class="reactionType">{/if} <span class="invisible">{lang}wcf.reactions.react{/lang}</span></a></li>{/if}
                                                        
                                                        {event name='commentOptions'}
                                                </ul>

diff --git a/com.woltlab.wcf/templates/reactionSummaryList.tpl b/com.woltlab.wcf/templates/reactionSummaryList.tpl
index dcefe25b723ae666e760e3da533e4b7547d88a53..f9108f15f9e57fe20e842f9144cd1ec7ae0880fb 100644 (file)
--- a/com.woltlab.wcf/templates/reactionSummaryList.tpl
+++ b/com.woltlab.wcf/templates/reactionSummaryList.tpl
@@ -1,7 +1,9 @@
-<ul class="reactionSummaryList{if $isTiny|isset && $isTiny} reactionSummaryListTiny{/if} jsOnly" data-object-type="{$objectType}" data-object-id="{$objectID}">
-       {if $reactionData[$objectID]|isset && $reactionData[$objectID]->getReactions()|is_array}
-               {foreach from=$reactionData[$objectID]->getReactions() key=reactionTypeID item=reaction}
-                       <li class="reactCountButton jsTooltip" data-reaction-type-id="{$reactionTypeID}" title="{lang}wcf.reactions.summary.listReactions{/lang}">{@$reaction[renderedReactionIcon]} <span class="reactionCount">{$reaction[reactionCount]|shortUnit}</span></li>
-               {/foreach}
-       {/if}
-</ul>
\ No newline at end of file
+{if $__wcf->session->getPermission('user.like.canViewLike')}
+       <ul class="reactionSummaryList{if $isTiny|isset && $isTiny} reactionSummaryListTiny{/if} jsOnly" data-object-type="{$objectType}" data-object-id="{$objectID}">
+               {if $reactionData[$objectID]|isset && $reactionData[$objectID]->getReactions()|is_array}
+                       {foreach from=$reactionData[$objectID]->getReactions() key=reactionTypeID item=reaction}
+                               <li class="reactCountButton jsTooltip" data-reaction-type-id="{$reactionTypeID}" title="{lang}wcf.reactions.summary.listReactions{/lang}">{@$reaction[renderedReactionIcon]} <span class="reactionCount">{$reaction[reactionCount]|shortUnit}</span></li>
+                       {/foreach}
+               {/if}
+       </ul>
+{/if}
\ No newline at end of file

diff --git a/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Like/Handler.js b/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Like/Handler.js
index 951b729e0be4fe60b2f62104c3dcffa3fc5744f1..b5fa93554fb86eb4d268422a85f8bf2a586b6a7b 100644 (file)
--- a/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Like/Handler.js
+++ b/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Like/Handler.js
@@ -129,7 +129,7 @@ define(
                                isSummaryPosition = false;
                        }
                        
-                       if (badgeContainer !== null) {
+                       if (badgeContainer !== null && this._options.canViewSummary) {
                                summaryList = elCreate('ul');
                                summaryList.className = 'reactionSummaryList' + (isSummaryPosition ? ' likesSummary' : ' reactionSummaryListTiny') + ((isSummaryPosition && this._options.badgeClassNames) ? ' ' + this._options.badgeClassNames : '');
                                

diff --git a/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Reaction/Handler.js b/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Reaction/Handler.js
index fcf8390a37ab7d5cb39434d52f718a98b83b13d5..e04c6fbca738da0f2159d5a2138b38e00908ed56 100644 (file)
--- a/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Reaction/Handler.js
+++ b/wcfsetup/install/files/js/WoltLabSuite/Core/Ui/Reaction/Handler.js
@@ -109,7 +109,8 @@ define(
                                elementData.reactButton = elBySel(this._options.buttonSelector, element);
                                
                                if (elementData.reactButton === null || elementData.reactButton.length === 0) {
-                                       throw new Error("[WoltLabSuite/Core/Ui/Reaction/Handler] Unable to find reactButton.");
+                                       // the element may have no react button 
+                                       return; 
                                }
                                
                                elementData.reactButton.addEventListener(WCF_CLICK_EVENT, this._toggleReactPopover.bind(this, elementData.objectId, elementData.reactButton));

diff --git a/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php b/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
index 21e3ba9dd2de5e3d5b3f33790790a73fa8dba6f2..57b68115dbb086a89bc732b93d790ac1b8cf1bb1 100644 (file)
--- a/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
+++ b/wcfsetup/install/files/lib/data/reaction/ReactionAction.class.php
@@ -66,6 +66,10 @@ class ReactionAction extends AbstractDatabaseObjectAction {
        public function validateGetReactionDetails() {
                $this->validateObjectParameters();
                
+               if (!WCF::getSession()->getPermission('user.like.canViewLike')) {
+                       throw new PermissionDeniedException();
+               }
+               
                $this->readInteger('reactionTypeID');
                $this->readInteger('pageNo');