From 2e328d06598f21be48122940de6f690c1bcb97f1 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Joshua=20R=C3=BCsweg?= <josh@bastelstu.be>
Date: Sat, 15 Jul 2017 21:48:45 +0200
Subject: [PATCH] Disallow user trophy edit for automatically awarded trophies

See #2315
---
 .../files/acp/templates/userTrophyList.tpl        |  9 +++++++--
 .../data/user/trophy/UserTrophyAction.class.php   | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/wcfsetup/install/files/acp/templates/userTrophyList.tpl b/wcfsetup/install/files/acp/templates/userTrophyList.tpl
index e1bf0d4e40..b278e32f37 100644
--- a/wcfsetup/install/files/acp/templates/userTrophyList.tpl
+++ b/wcfsetup/install/files/acp/templates/userTrophyList.tpl
@@ -94,8 +94,13 @@
 			{foreach from=$objects item=userTrophy}
 				<tr class="userTrophyRow">
 					<td class="columnIcon">
-						<a href="{link controller='UserTrophyEdit' id=$userTrophy->userTrophyID}{/link}" title="{lang}wcf.global.button.edit{/lang}" class="jsTooltip"><span class="icon icon16 fa-pencil"></span></a>
-						<span class="icon icon16 fa-times pointer jsDeleteButton jsTooltip" data-confirm-message-html="{lang __encode="true"}wcf.acp.trophy.userTrophy.delete.confirmMessage{/lang}" data-object-id="{@$userTrophy->getObjectID()}" title="{lang}wcf.global.button.delete{/lang}"></span>
+						{if $userTrophy->getTrophy()->awardAutomatically}
+							<span class="icon icon16 fa-pencil disabled" title="{lang}wcf.global.button.edit{/lang}"></span>
+							<span class="icon icon16 fa-times disabled" title="{lang}wcf.global.button.delete{/lang}"></span>
+						{else}
+							<a href="{link controller='UserTrophyEdit' id=$userTrophy->userTrophyID}{/link}" title="{lang}wcf.global.button.edit{/lang}" class="jsTooltip"><span class="icon icon16 fa-pencil{if $userTrophy->getTrophy()->awardAutomatically} disabled{/if}"></span></a>
+							<span class="icon icon16 fa-times pointer jsDeleteButton jsTooltip{if $userTrophy->getTrophy()->awardAutomatically} disabled{/if}" data-confirm-message-html="{lang __encode="true"}wcf.acp.trophy.userTrophy.delete.confirmMessage{/lang}" data-object-id="{@$userTrophy->getObjectID()}" title="{lang}wcf.global.button.delete{/lang}"></span>
+						{/if}
 					</td>
 					<td class="columnID columnUserTrophyID">{@$userTrophy->userTrophyID}</td>
 					<td class="columnText columnUsername"><a href="{link controller='UserEdit' id=$userTrophy->userID}{/link}" title="{lang}wcf.acp.user.edit{/lang}">{$userTrophy->getUserProfile()->username}</a></td>
diff --git a/wcfsetup/install/files/lib/data/user/trophy/UserTrophyAction.class.php b/wcfsetup/install/files/lib/data/user/trophy/UserTrophyAction.class.php
index 1a42571dce..418b59314f 100644
--- a/wcfsetup/install/files/lib/data/user/trophy/UserTrophyAction.class.php
+++ b/wcfsetup/install/files/lib/data/user/trophy/UserTrophyAction.class.php
@@ -2,6 +2,7 @@
 namespace wcf\data\user\trophy;
 use wcf\data\user\UserAction;
 use wcf\data\AbstractDatabaseObjectAction;
+use wcf\system\exception\PermissionDeniedException;
 
 /**
  * Provides user trophy actions. 
@@ -33,6 +34,20 @@ class UserTrophyAction extends AbstractDatabaseObjectAction {
 		return $returnValues; 
 	}
 	
+	/**
+	 * @inheritDoc
+	 */
+	public function validateDelete() {
+		parent::validateDelete();
+		
+		/** @var UserTrophy $object */
+		foreach ($this->objects as $object) {
+			if ($object->getTrophy()->awardAutomatically) {
+				throw new PermissionDeniedException(); 
+			}
+		}
+	}
+	
 	/**
 	 * @inheritDoc
 	 */
-- 
2.20.1