From 3d1b448f5a6458e5796b52fee9913e96d0c249aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Volker=20Fr=C3=B6hlich?= <volker.froehlich@meduniwien.ac.at>
Date: Wed, 27 Aug 2014 11:33:01 +0200
Subject: [PATCH] ZBXNEXT-2122 -- Allow regular users to change their own media settings

---
 api/classes/CUser.php                       |   28 ++++++++-
 include/views/administration.users.edit.php |   80 +++++++++++++--------------
 profile.php                                 |    8 +--
 3 files changed, 67 insertions(+), 49 deletions(-)

diff --git a/api/classes/CUser.php b/api/classes/CUser.php
index a2f8dc6..32f4010 100644
--- a/api/classes/CUser.php
+++ b/api/classes/CUser.php
@@ -665,7 +665,7 @@ class CUser extends CZBXAPI {
 	 * @param string $data['medias']['period']
 	 */
 	protected function validateAddMedia(array $data) {
-		if (self::$userData['type'] < USER_TYPE_ZABBIX_ADMIN) {
+		if(!$this->checkPermissionsUsers($users)){
 			self::exception(ZBX_API_ERROR_PARAMETERS, _('Only Zabbix Admins can add user media.'));
 		}
 
@@ -843,7 +843,7 @@ class CUser extends CZBXAPI {
 	 * @param string $data['medias']['period']
 	 */
 	protected function validateUpdateMedia(array $data) {
-		if (self::$userData['type'] < USER_TYPE_ZABBIX_ADMIN) {
+		if(!$this->checkPermissionsUsers($users)){
 			self::exception(ZBX_API_ERROR_PERMISSIONS, _('Only Zabbix Admins can change user media.'));
 		}
 
@@ -924,7 +924,7 @@ class CUser extends CZBXAPI {
 	 * @throws APIException if the input is invalid
 	 */
 	protected function validateDeleteMedia(array $mediaIds) {
-		if (self::$userData['type'] < USER_TYPE_ZABBIX_ADMIN) {
+		if(!$this->checkPermissionsUsers($users)){
 			self::exception(ZBX_API_ERROR_PARAMETERS, _('Only Zabbix Admins can remove user media.'));
 		}
 
@@ -1365,6 +1365,28 @@ class CUser extends CZBXAPI {
 	}
 
 	/**
+	 * Checks if the currently logged in user has access to modify the given userIds
+	 *
+	 * @param array $userIds    user IDs to check
+	 *
+	 * @returns boolean         Returns true if all userIds can be edited, false otherwise
+	 */
+	protected function checkPermissionsUsers(array $userIds){
+		foreach($userIds as $user){
+			if(self::$userData['type'] == USER_TYPE_SUPER_ADMIN){
+				continue;
+			}
+			elseif(self::$userData['userid'] == $user["userid"]){
+				continue;
+			}
+			else{
+				return false;	
+			}
+		}
+		return true;
+	}
+
+	/**
 	 * Check if we're trying to delete the currently logged in user.
 	 *
 	 * @param array $userIds	user ids to check
diff --git a/include/views/administration.users.edit.php b/include/views/administration.users.edit.php
index 81a61ad..62bdaf4 100644
--- a/include/views/administration.users.edit.php
+++ b/include/views/administration.users.edit.php
@@ -166,56 +166,54 @@ $userFormList->addRow(_('URL (after login)'), new CTextBox('url', $this->data['u
 /*
  * Media tab
  */
-if (uint_in_array(CWebUser::$data['type'], array(USER_TYPE_ZABBIX_ADMIN, USER_TYPE_SUPER_ADMIN))) {
-	$userMediaFormList = new CFormList('userMediaFormList');
-	$userForm->addVar('user_medias', $this->data['user_medias']);
+$userMediaFormList = new CFormList('userMediaFormList');
+$userForm->addVar('user_medias', $this->data['user_medias']);
 
-	$mediaTableInfo = new CTableInfo(_('No media found.'));
+$mediaTableInfo = new CTableInfo(_('No media found.'));
 
-	foreach ($this->data['user_medias'] as $id => $media) {
-		if (!isset($media['active']) || !$media['active']) {
-			$status = new CLink(_('Enabled'), '#', 'enabled');
-			$status->onClick('return create_var("'.$userForm->getName().'","disable_media",'.$id.', true);');
-		}
-		else {
-			$status = new CLink(_('Disabled'), '#', 'disabled');
-			$status->onClick('return create_var("'.$userForm->getName().'","enable_media",'.$id.', true);');
-		}
-
-		$mediaUrl = '?dstfrm='.$userForm->getName().
-						'&media='.$id.
-						'&mediatypeid='.$media['mediatypeid'].
-						'&sendto='.urlencode($media['sendto']).
-						'&period='.$media['period'].
-						'&severity='.$media['severity'].
-						'&active='.$media['active'];
+foreach ($this->data['user_medias'] as $id => $media) {
+	if (!isset($media['active']) || !$media['active']) {
+		$status = new CLink(_('Enabled'), '#', 'enabled');
+		$status->onClick('return create_var("'.$userForm->getName().'","disable_media",'.$id.', true);');
+	}
+	else {
+		$status = new CLink(_('Disabled'), '#', 'disabled');
+		$status->onClick('return create_var("'.$userForm->getName().'","enable_media",'.$id.', true);');
+	}
 
-		foreach (getSeverityCaption() as $key => $caption) {
-			$mediaActive = ($media['severity'] & (1 << $key));
+	$mediaUrl = '?dstfrm='.$userForm->getName().
+					'&media='.$id.
+					'&mediatypeid='.$media['mediatypeid'].
+					'&sendto='.urlencode($media['sendto']).
+					'&period='.$media['period'].
+					'&severity='.$media['severity'].
+					'&active='.$media['active'];
 
-			$mediaSeverity[$key] = new CSpan(zbx_substr($caption, 0, 1), $mediaActive ? 'enabled' : null);
-			$mediaSeverity[$key]->setHint($caption.($mediaActive ? ' (on)' : ' (off)'));
-		}
+	foreach (getSeverityCaption() as $key => $caption) {
+		$mediaActive = ($media['severity'] & (1 << $key));
 
-		$mediaTableInfo->addRow(array(
-			new CCheckBox('user_medias_to_del['.$id.']', null, null, $id),
-			new CSpan($media['description'], 'nowrap'),
-			new CSpan($media['sendto'], 'nowrap'),
-			new CSpan($media['period'], 'nowrap'),
-			$mediaSeverity,
-			$status,
-			new CButton('edit_media', _('Edit'), 'return PopUp("popup_media.php'.$mediaUrl.'", 550, 400);', 'link_menu'))
-		);
+		$mediaSeverity[$key] = new CSpan(zbx_substr($caption, 0, 1), $mediaActive ? 'enabled' : null);
+		$mediaSeverity[$key]->setHint($caption.($mediaActive ? ' (on)' : ' (off)'));
 	}
 
-	$userMediaFormList->addRow(_('Media'), array($mediaTableInfo,
-		new CButton('add_media', _('Add'), 'return PopUp("popup_media.php?dstfrm='.$userForm->getName().'", 550, 400);', 'link_menu'),
-		SPACE,
-		SPACE,
-		(count($this->data['user_medias']) > 0) ? new CSubmit('del_user_media', _('Delete selected'), null, 'link_menu') : null
-	));
+	$mediaTableInfo->addRow(array(
+		new CCheckBox('user_medias_to_del['.$id.']', null, null, $id),
+		new CSpan($media['description'], 'nowrap'),
+		new CSpan($media['sendto'], 'nowrap'),
+		new CSpan($media['period'], 'nowrap'),
+		$mediaSeverity,
+		$status,
+		new CButton('edit_media', _('Edit'), 'return PopUp("popup_media.php'.$mediaUrl.'", 550, 400);', 'link_menu'))
+	);
 }
 
+$userMediaFormList->addRow(_('Media'), array($mediaTableInfo,
+	new CButton('add_media', _('Add'), 'return PopUp("popup_media.php?dstfrm='.$userForm->getName().'", 550, 400);', 'link_menu'),
+	SPACE,
+	SPACE,
+	(count($this->data['user_medias']) > 0) ? new CSubmit('del_user_media', _('Delete selected'), null, 'link_menu') : null
+));
+
 /*
  * Profile fields
  */
diff --git a/profile.php b/profile.php
index 2e972a1..358e774 100644
--- a/profile.php
+++ b/profile.php
@@ -151,13 +151,11 @@ elseif (isset($_REQUEST['save'])) {
 		updateMessageSettings($messages);
 
 		$result = API::User()->updateProfile($user);
-
-		if ($result && CwebUser::$data['type'] > USER_TYPE_ZABBIX_USER) {
-			$result = API::User()->updateMedia(array(
+		$data = array(
 				'users' => $user,
 				'medias' => $user['user_medias']
-			));
-		}
+				);
+		$result = API::User()->updateMedia($data);
 
 		$result = DBend($result);
 		if (!$result) {
-- 
1.7.1

