diff options
| -rw-r--r-- | perllib/FixMyStreet/App/Controller/Reports.pm | 27 | ||||
| -rw-r--r-- | perllib/FixMyStreet/DB/ResultSet/Nearby.pm | 3 | ||||
| -rw-r--r-- | perllib/FixMyStreet/DB/ResultSet/Problem.pm | 37 |
3 files changed, 51 insertions, 16 deletions
diff --git a/perllib/FixMyStreet/App/Controller/Reports.pm b/perllib/FixMyStreet/App/Controller/Reports.pm index 7c3796c42..15a220644 100644 --- a/perllib/FixMyStreet/App/Controller/Reports.pm +++ b/perllib/FixMyStreet/App/Controller/Reports.pm @@ -544,20 +544,27 @@ sub load_and_group_problems : Private { my $states = $c->stash->{filter_problem_states}; my $where = { - non_public => 0, state => [ keys %$states ] }; + + my $body = $c->stash->{body}; # Might be undef + + if ($c->user_exists && ($c->user->is_superuser || ($body && $c->user->has_permission_to('report_inspect', $body->id)))) { + # See all reports, no restriction + } else { + $where->{non_public} = 0; + } + my $filter = { order_by => $c->stash->{sort_order}, rows => $c->cobrand->reports_per_page, }; - if ($c->user_exists && $c->stash->{body}) { - my $bid = $c->stash->{body}->id; + if ($c->user_exists && $body) { my $prefetch = []; - if ($c->user->has_permission_to('planned_reports', $bid)) { + if ($c->user->has_permission_to('planned_reports', $body->id)) { push @$prefetch, 'user_planned_reports'; } - if ($c->user->has_permission_to('report_edit_priority', $bid) || $c->user->has_permission_to('report_inspect', $bid)) { + if ($c->user->has_permission_to('report_edit_priority', $body->id) || $c->user->has_permission_to('report_inspect', $body->id)) { push @$prefetch, 'response_priority'; } $prefetch = $prefetch->[0] if @$prefetch == 1; @@ -589,9 +596,9 @@ sub load_and_group_problems : Private { $where->{areas} = [ map { { 'like', '%,' . $_->{id} . ',%' } } @{$c->stash->{wards}} ]; - $problems = $problems->to_body($c->stash->{body}); - } elsif ($c->stash->{body}) { - $problems = $problems->to_body($c->stash->{body}); + $problems = $problems->to_body($body); + } elsif ($body) { + $problems = $problems->to_body($body); } if (my $bbox = $c->get_param('bbox')) { @@ -609,7 +616,7 @@ sub load_and_group_problems : Private { my ( %problems, @pins ); while ( my $problem = $problems->next ) { - if ( !$c->stash->{body} ) { + if ( !$body ) { add_row( $c, $problem, 0, \%problems, \@pins ); next; } @@ -623,7 +630,7 @@ sub load_and_group_problems : Private { # Add to bodies it was sent to my $bodies = $problem->bodies_str_ids; foreach ( @$bodies ) { - next if $_ != $c->stash->{body}->id; + next if $_ != $body->id; add_row( $c, $problem, $_, \%problems, \@pins ); } } diff --git a/perllib/FixMyStreet/DB/ResultSet/Nearby.pm b/perllib/FixMyStreet/DB/ResultSet/Nearby.pm index 6e5e0220f..ab554eb9d 100644 --- a/perllib/FixMyStreet/DB/ResultSet/Nearby.pm +++ b/perllib/FixMyStreet/DB/ResultSet/Nearby.pm @@ -17,13 +17,14 @@ sub nearby { } my $params = { - non_public => 0, state => [ keys %$states ], }; $params->{id} = { -not_in => $ids } if $ids; $params->{category} = $categories if $categories && @$categories; + FixMyStreet::DB::ResultSet::Problem->non_public_if_possible($params, $c); + $rs = $c->cobrand->problems_restriction($rs); my $attrs = { diff --git a/perllib/FixMyStreet/DB/ResultSet/Problem.pm b/perllib/FixMyStreet/DB/ResultSet/Problem.pm index 3f083c073..458efa179 100644 --- a/perllib/FixMyStreet/DB/ResultSet/Problem.pm +++ b/perllib/FixMyStreet/DB/ResultSet/Problem.pm @@ -15,15 +15,41 @@ sub set_restriction { $site_key = $key; } -sub to_body { - my ($rs, $bodies, $join) = @_; - return $rs unless $bodies; +sub body_query { + my ($rs, $bodies) = @_; unless (ref $bodies eq 'ARRAY') { $bodies = [ map { ref $_ ? $_->id : $_ } $bodies ]; } + \[ "regexp_split_to_array(bodies_str, ',') && ?", [ {} => $bodies ] ] +} + +# Edits PARAMS in place to either hide non_public reports, or show them +# if user is superuser (all) or inspector (correct body) +sub non_public_if_possible { + my ($rs, $params, $c) = @_; + if ($c->user_exists) { + if ($c->user->is_superuser) { + # See all reports, no restriction + } elsif ($c->user->has_body_permission_to('report_inspect')) { + $params->{'-or'} = [ + non_public => 0, + $rs->body_query($c->user->from_body->id), + ]; + } else { + $params->{non_public} = 0; + } + } else { + $params->{non_public} = 0; + } +} + +sub to_body { + my ($rs, $bodies, $join) = @_; + return $rs unless $bodies; $join = { join => 'problem' } if $join; $rs = $rs->search( - \[ "regexp_split_to_array(bodies_str, ',') && ?", [ {} => $bodies ] ], + # This isn't using $rs->body_query because $rs might be Problem, Comment, or Nearby + FixMyStreet::DB::ResultSet::Problem->body_query($bodies), $join ); return $rs; @@ -151,13 +177,14 @@ sub around_map { } my $q = { - non_public => 0, state => [ keys %{$p{states}} ], latitude => { '>=', $p{min_lat}, '<', $p{max_lat} }, longitude => { '>=', $p{min_lon}, '<', $p{max_lon} }, }; $q->{category} = $p{categories} if $p{categories} && @{$p{categories}}; + $rs->non_public_if_possible($q, $c); + my $problems = mySociety::Locale::in_gb_locale { $rs->search( $q, $attr )->include_comment_counts->page($p{page}); }; |