Merge pull request #5611 from christianbeeznest/ofaj-21692-4

Forum: Fix notification and forum permission issues - refs BT#21692

public/main/forum/forumfunction.inc.php

@@ -30,16 +30,18 @@ use Chamilo\CoreBundle\Component\Utils\ActionIcon;
 function handleForum($url)
 {
     $id = isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : null;
+    $lp_id = isset($_REQUEST['lp_id']) ? (int) $_REQUEST['lp_id'] : null;
+    $content = $_REQUEST['content'] ?? '';
+    $action = $_REQUEST['action'] ?? null;
+    $isAllowedToEdit = api_is_allowed_to_edit(false, true);
+    if (!$isAllowedToEdit) {
+        $isAllowedToEdit = ('notify' === $action && !api_is_anonymous() && api_is_allowed_to_session_edit(false, true));
+    }
 
-    if (api_is_allowed_to_edit(false, true)) {
+    if ($isAllowedToEdit) {
         $course = api_get_course_entity();
         $session = api_get_session_entity();
         $linksRepo = Database::getManager()->getRepository(ResourceLink::class);
-
-        //if is called from a learning path lp_id
-        $lp_id = isset($_REQUEST['lp_id']) ? (int) $_REQUEST['lp_id'] : null;
-        $content = $_REQUEST['content'] ?? '';
-        $action = $_REQUEST['action'] ?? null;
         $repo = null;
         switch ($content) {
             case 'forumcategory':
@@ -85,11 +87,6 @@ function handleForum($url)
                 return $formContent;
                 break;
             case 'notify':
-                if (0 != api_get_session_id() &&
-                    false == api_is_allowed_to_session_edit(false, true)
-                ) {
-                    api_not_allowed();
-                }
                 $message = set_notification($content, $id);
                 Display::addFlash(Display::return_message($message, 'confirm', false));
 

public/main/forum/index.php

@@ -2,6 +2,7 @@
 
 /* For licensing terms, see /license.txt */
 
+use Chamilo\CourseBundle\Entity\CForum;
 use Chamilo\CourseBundle\Entity\CForumPost;
 use ChamiloSession as Session;
 use Chamilo\CoreBundle\Component\Utils\ActionIcon;
@@ -404,6 +405,7 @@ if (is_array($forumCategories)) {
         if (!empty($forumsInCategory)) {
             $forumsDetailsList = [];
             // We display all the forums in this category.
+            /* @var CForum $forum*/
             foreach ($forumsInCategory as $forum) {
                 $forumId = $forum->getIid();
 
@@ -545,7 +547,7 @@ if (is_array($forumCategories)) {
                         /*if (api_is_allowed_to_edit(false, true)
                             && !(0 == $forum->getSessionId() && 0 != $sessionId)
                         ) {*/
-                        if (api_is_allowed_to_edit(false, true)) {
+                        if (api_is_allowed_to_edit(false, true)  && !(null === $forum->getFirstResourceLink()->getSession() && 0 != $sessionId)) {
                             $toolActions .= '<a href="'.api_get_self().'?'.api_get_cidreq()
                                 .'&action=edit_forum&content=forum&id='.$forumId.'">'
                                 .Display::getMdiIcon(ActionIcon::EDIT, 'ch-tool-icon', null, ICON_SIZE_SMALL, get_lang('Edit'))
@@ -565,14 +567,6 @@ if (is_array($forumCategories)) {
                                 $forumVisibility
                             );
 
-                            $notifyDisabled = true;
-                            $sessionForumNotification = $_SESSION['forum_notification']['forum'] ?? [];
-                            if (in_array($forumId, $sessionForumNotification)) {
-                                $notifyDisabled = false;
-                            }
-                            $toolActions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&action=notify&content=forum&id='.$forumId.'">'.
-                                Display::getMdiIcon('email-alert', ($notifyDisabled ? 'ch-tool-icon-disabled' : 'ch-tool-icon'), '', ICON_SIZE_SMALL, get_lang('Notify me')).'</a>';
-
                             $toolActions .= returnLockUnlockIcon(
                                 'forum',
                                 $forumId,
@@ -586,6 +580,16 @@ if (is_array($forumCategories)) {
                             );
                         }
 
+                        if (!api_is_anonymous() && api_is_allowed_to_session_edit(false, true)) {
+                            $notifyDisabled = true;
+                            $sessionForumNotification = $_SESSION['forum_notification']['forum'] ?? [];
+                            if (in_array($forumId, $sessionForumNotification)) {
+                                $notifyDisabled = false;
+                            }
+                            $toolActions .= '<a href="' . api_get_self() . '?' . api_get_cidreq() . '&action=notify&content=forum&id=' . $forumId . '">' .
+                                Display::getMdiIcon('email-alert', ($notifyDisabled ? 'ch-tool-icon-disabled' : 'ch-tool-icon'), '', ICON_SIZE_SMALL, get_lang('Notify me')) . '</a>';
+                        }
+
                         $forumInfo['tools'] = $toolActions;
                         $forumsDetailsList[] = $forumInfo;
                     }

public/main/forum/viewforum.php

@@ -435,15 +435,17 @@ if (is_array($threads)) {
                 );
             }
 
+            $forumSessionId = 0;
+            if (null !== $forumEntity->getFirstResourceLink()->getSession()) {
+                $forumSessionId = (int) $forumEntity->getFirstResourceLink()->getSession()->getId();
+            }
+
             $id_attach = !empty($attachment_list) ? $attachment_list['id'] : '';
             $iconsEdit = '';
             if ('learnpath' !== $origin) {
                 if (api_is_allowed_to_edit(false, true)
-                    /*&& @todo fix session validation
+                    &&
-                    !(
+                    !(api_is_session_general_coach() && $forumSessionId != $sessionId)
-                        api_is_session_general_coach() &&
-                        $current_forum['session_id'] != $sessionId
-                    )*/
                 ) {
                     $iconsEdit .= '<a href="'.$forumUrl.'editthread.php?'.api_get_cidreq()
                         .'&forum='.$forumId.'&thread='