mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 11:02:33 -05:00
Lauri Ojansivu
f4a3690256
Admin Panel / Settings / Visibility / Rules gets "Boards may show their Rules to members, read-only", off by default (Settings rulesReadOnlyForMembers, site admin only). With it on, a board admin ticks "Show these Rules to board members, read-only" on the board's Rules page (rulesVisibleToMembers). Members of that board then get Rules in Board Settings and see the rules list and each rule's details, with no control that changes a rule; the methods that change rules keep their board-admin checks, so nothing is granted. Without both ticks only board and site admins see the Rules page, which until now drew its list for any member who opened the address. models/lib/rulesReadOnly.js decides 'edit', 'read' or 'none', and client/lib/rulesAccess.js is the one place the Rules page, Board Settings and rule details ask. tests/rulesReadOnly.test.cjs covers both switches, each alone, a non-member, and that a reader's page has no edit control. boardMenuOrder now leaves the reader's alternative branch out of the admin's sequence and pins it alone; instanceFeatures counts the fourth site-admin method; roleHelperRegressions follows the canAdmin check to rulesAccess.js. The new strings are English placeholders until the next translation pass. Thanks to justinr1234 and xet7 ! Fixes #2217.
25 lines
1.1 KiB
JavaScript
25 lines
1.1 KiB
JavaScript
'use strict';
|
|
|
|
// #2217: board members may see a board's Rules, read-only.
|
|
//
|
|
// Two switches, both off by default, and both needed:
|
|
// - Admin Panel / Settings / Visibility: `rulesReadOnlyForMembers` on the
|
|
// Settings document lets boards offer it at all;
|
|
// - the board's Rules page: `rulesVisibleToMembers`, ticked by a board
|
|
// admin, offers it on that board.
|
|
// Board admins (and site admins) edit Rules as before. A member who may read
|
|
// them gets the Rules entry in Board Settings and the rules list and rule
|
|
// details, with no control that changes anything - and the server methods
|
|
// that change rules keep their own board-admin checks, so this grants no
|
|
// right. Pure: tests/rulesReadOnly.test.cjs.
|
|
|
|
function rulesAccess({ setting, board, isBoardAdmin, isSiteAdmin, isActiveMember }) {
|
|
if (isBoardAdmin || isSiteAdmin) return 'edit';
|
|
if (!isActiveMember) return 'none';
|
|
if (!(setting && setting.rulesReadOnlyForMembers === true)) return 'none';
|
|
if (!(board && board.rulesVisibleToMembers === true)) return 'none';
|
|
return 'read';
|
|
}
|
|
|
|
module.exports = { rulesAccess };
|