diff --git a/include/controllers/default/cockpit/api/siteconfig.php b/include/controllers/default/cockpit/api/siteconfig.php index aa32ea83e..2e0320bfe 100644 --- a/include/controllers/default/cockpit/api/siteconfig.php +++ b/include/controllers/default/cockpit/api/siteconfig.php @@ -6,11 +6,11 @@ class Controller_api_siteconfig extends Crunchbutton_Controller_RestAccount { case 'post': if (is_array($this->request()['key']) && is_array($this->request()['value'])) { foreach ($this->request()['key'] as $k => $key) { - c::config()->site->config($key)->set($this->request()['value'][$k]); + $this->save( $key, $this->request()['value'][$k] ); } } elseif ($this->request()['key'] && $this->request()['value']) { - c::config()->site->config($this->request()['key'])->set($this->request()['value']); + $this->save( $this->request()['key'], $this->request()['value'] ); } break; @@ -19,4 +19,30 @@ class Controller_api_siteconfig extends Crunchbutton_Controller_RestAccount { break; } } + + private function save( $key, $value ){ + + $hasPermisstion = c::admin()->permission()->check( [ 'global' ] ); + + if( !$hasPermisstion ){ + switch ( $key ) { + case 'support-phone-afterhours': + $hasPermisstion = c::admin()->permission()->check( [ 'global', 'support-all', 'support-settings' ] ); + break; + case 'referral-inviter-credit-value': + case 'referral-invited-credit-value': + case 'referral-add-credit-to-invited': + case 'referral-limit-per-code': + case 'referral-is-enable': + case 'referral-invites-limit-per-code': + $hasPermisstion = c::admin()->permission()->check( [ 'global', 'invite-promo' ] ); + break; + } + } + + if( $hasPermisstion ){ + c::config()->site->config($key)->set($value); + } + } + } diff --git a/include/controllers/default/cockpit/charts/community.php b/include/controllers/default/cockpit/charts/community.php index 9c005372e..3ea609e04 100644 --- a/include/controllers/default/cockpit/charts/community.php +++ b/include/controllers/default/cockpit/charts/community.php @@ -3,15 +3,27 @@ class Controller_charts_community extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global','community-metrics-all','community-metrics-view'])) { + if (!c::admin()->permission()->check( [ 'global', 'metrics-all', 'metrics-communities', 'metrics-communities-page'] )) { return ; } - + $hasPermissionFullPermission = c::admin()->permission()->check( [ 'global', 'metrics-all', 'metrics-communities-all' ] ); - c::view()->communities = c::admin()->communities(); + $communities = Restaurant::getCommunitiesWithRestaurantsNumber(); + + if( !$hasPermissionFullPermission ){ + $_communities = []; + foreach ( $communities as $community ) { + $permission_name = strtolower( $community->community ); + $permission_name = str_replace( ' ' , '-', $permission_name ); + $permission_name = "metrics-communities-{$permission_name}"; + if( c::admin()->permission()->check( [ $permission_name ] ) ){ + $_communities[] = $community; + } + } + $communities = $_communities; + } + c::view()->communities = $communities; c::view()->display( 'charts/community/index' ); - } - } \ No newline at end of file diff --git a/include/controllers/default/cockpit/charts/index.php b/include/controllers/default/cockpit/charts/index.php index fe1aa9ca0..183489515 100644 --- a/include/controllers/default/cockpit/charts/index.php +++ b/include/controllers/default/cockpit/charts/index.php @@ -3,7 +3,7 @@ class Controller_charts extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'metrics-manage-cohorts'])) { return ; } switch ( c::getPagePiece(1) ) { diff --git a/include/controllers/default/cockpit/customers/index.php b/include/controllers/default/cockpit/customers/index.php index 1eee66f53..7c31d86db 100644 --- a/include/controllers/default/cockpit/customers/index.php +++ b/include/controllers/default/cockpit/customers/index.php @@ -2,7 +2,7 @@ class Controller_customers extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','customers-all'])) { return ; } c::view()->display('customers/index'); diff --git a/include/controllers/default/cockpit/giftcards/content.php b/include/controllers/default/cockpit/giftcards/content.php index 9796594ad..940ef93a0 100644 --- a/include/controllers/default/cockpit/giftcards/content.php +++ b/include/controllers/default/cockpit/giftcards/content.php @@ -4,10 +4,12 @@ class Controller_giftcards_content extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { - return ; + $restaurant_id = $_REQUEST['restaurant']; + if( !c::admin()->permission()->check( [ 'global', 'orders-all', "gift-card-list-restaurant-{$restaurant_id}", "gift-card-list-restaurant-{$restaurant_id}", "gift-card-restaurant-{$restaurant_id}" ] ) ){ + return; } + $search = []; if ($_REQUEST['limit']) { diff --git a/include/controllers/default/cockpit/giftcards/credits.php b/include/controllers/default/cockpit/giftcards/credits.php index 332d2382c..bef851577 100644 --- a/include/controllers/default/cockpit/giftcards/credits.php +++ b/include/controllers/default/cockpit/giftcards/credits.php @@ -4,7 +4,7 @@ class Controller_giftcards_credits extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-anti-cheat'])) { return ; } diff --git a/include/controllers/default/cockpit/giftcards/groups.php b/include/controllers/default/cockpit/giftcards/groups.php index 959a027c3..b3443ee33 100644 --- a/include/controllers/default/cockpit/giftcards/groups.php +++ b/include/controllers/default/cockpit/giftcards/groups.php @@ -4,7 +4,7 @@ class Controller_giftcards_groups extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-groups'])) { return ; } diff --git a/include/controllers/default/cockpit/giftcards/index.php b/include/controllers/default/cockpit/giftcards/index.php index a16900f57..4866bc8bd 100644 --- a/include/controllers/default/cockpit/giftcards/index.php +++ b/include/controllers/default/cockpit/giftcards/index.php @@ -3,13 +3,19 @@ class Controller_giftcards extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'gift-card-all', 'gift-card-list-page', 'gift-card-list-all'])) { return ; } c::view()->page = 'giftcards'; if( c::getPagePiece(1) == 'new' ){ + + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-create', 'gift-card-create-all'])) { + return ; + } + + $id_user = $_GET[ 'id_user' ]; if( $id_user != '' ){ $user = Crunchbutton_User::o( $id_user ); @@ -39,12 +45,23 @@ class Controller_giftcards extends Crunchbutton_Controller_Account { c::view()->display('giftcards/new'); } else if( c::getPagePiece(1) == 'sms' ){ + + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-create', 'gift-card-create-all'])) { + return ; + } + c::view()->display('giftcards/sms'); } else if( c::getPagePiece(1) == 'email' ){ + + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-create', 'gift-card-create-all'])) { + return ; + } + c::view()->display('giftcards/email'); } else if( c::getPagePiece(1) == 'print' ){ + $giftcards = Crunchbutton_Promo::multiple( c::getPagePiece(2) ); c::view()->layout('layout/blank'); c::view()->giftcards = $giftcards; @@ -61,6 +78,11 @@ class Controller_giftcards extends Crunchbutton_Controller_Account { c::view()->display('giftcards/print/brown'); } else { $giftcard = Crunchbutton_Promo::o(c::getPagePiece(1)); + + if (!c::admin()->permission()->check(['global','gift-card-all', 'gift-card-create-all', 'gift-card-list-page', "gift-card-list-restaurant-{$giftcard->id_restaurant}", "gift-card-create-restaurant-{$giftcard->id_restaurant}", "gift-card-restaurant-{$giftcard->id_restaurant}"])) { + return; + } + if ($giftcard->id_promo) { c::view()->users = Crunchbutton_User::q('SELECT u.id_user, u.name, u.phone, u.email FROM user u INNER JOIN user_auth ua ON ua.id_user = u.id_user WHERE u.active = 1 ORDER BY u.name ASC');; c::view()->giftcard = $giftcard; diff --git a/include/controllers/default/cockpit/home/charts.php b/include/controllers/default/cockpit/home/charts.php index d664d0ce4..8ab95b637 100644 --- a/include/controllers/default/cockpit/home/charts.php +++ b/include/controllers/default/cockpit/home/charts.php @@ -19,10 +19,13 @@ class Controller_home_charts extends Crunchbutton_Controller_Account { foreach( $tags as $tag ){ $hasTag = true; $hasPermission = c::admin()->permission()->check( [ "metrics-{$tag}" ] ); + if( !$hasPermission && $tag == 'reps' ){ + $hasPermission = c::admin()->permission()->check( [ 'metrics-communities-all', "metrics-communities-{$_REQUEST[ 'community' ]}" ] ); + } if( $hasPermission ){ break; } } } - + if( !$hasTag ){ $hasPermission = c::admin()->permission()->check( [ 'metrics-no-grouped-charts' ] ); } diff --git a/include/controllers/default/cockpit/home/curation.php b/include/controllers/default/cockpit/home/curation.php index dbf4c780d..4c552372a 100644 --- a/include/controllers/default/cockpit/home/curation.php +++ b/include/controllers/default/cockpit/home/curation.php @@ -4,7 +4,7 @@ class Controller_home_curation extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'curation'])) { return ; } diff --git a/include/controllers/default/cockpit/home/marketing.php b/include/controllers/default/cockpit/home/marketing.php index b97d02f47..a1dbd2565 100644 --- a/include/controllers/default/cockpit/home/marketing.php +++ b/include/controllers/default/cockpit/home/marketing.php @@ -4,7 +4,7 @@ class Controller_home_marketing extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','marketing-events'])) { return ; } diff --git a/include/controllers/default/cockpit/issues/index.php b/include/controllers/default/cockpit/issues/index.php index 7c7f17ba5..c4e5bbe25 100644 --- a/include/controllers/default/cockpit/issues/index.php +++ b/include/controllers/default/cockpit/issues/index.php @@ -4,7 +4,7 @@ class Controller_issues extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','github'])) { return ; } diff --git a/include/controllers/default/cockpit/loc/index.php b/include/controllers/default/cockpit/loc/index.php index 6984412ac..d3d5eb81b 100644 --- a/include/controllers/default/cockpit/loc/index.php +++ b/include/controllers/default/cockpit/loc/index.php @@ -3,7 +3,7 @@ class Controller_loc extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check([ 'global','locations'])) { return ; } diff --git a/include/controllers/default/cockpit/logs/content.php b/include/controllers/default/cockpit/logs/content.php index 819e66286..667403124 100644 --- a/include/controllers/default/cockpit/logs/content.php +++ b/include/controllers/default/cockpit/logs/content.php @@ -3,7 +3,7 @@ class Controller_logs_content extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','logs'])) { return ; } diff --git a/include/controllers/default/cockpit/logs/index.php b/include/controllers/default/cockpit/logs/index.php index ad55eaccb..5a7d09ef3 100644 --- a/include/controllers/default/cockpit/logs/index.php +++ b/include/controllers/default/cockpit/logs/index.php @@ -3,7 +3,7 @@ class Controller_logs extends Crunchbutton_Controller_Account { public function init() { // @permission - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','logs'])) { return ; } c::view()->display('logs/index'); diff --git a/include/controllers/default/cockpit/orders/content.php b/include/controllers/default/cockpit/orders/content.php index 149b1eceb..083853c81 100644 --- a/include/controllers/default/cockpit/orders/content.php +++ b/include/controllers/default/cockpit/orders/content.php @@ -2,10 +2,14 @@ class Controller_orders_content extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global', 'orders'])) { - return ; + + $restaurant_id = $_REQUEST['restaurant']; + if( !c::admin()->permission()->check( [ 'global', 'orders-all', "orders-list-restaurant-{$restaurant_id}" ] ) ){ + return; } + $search = []; + if ($_REQUEST['limit']) { $search['limit'] = intval($_REQUEST['limit']); } @@ -37,7 +41,7 @@ class Controller_orders_content extends Crunchbutton_Controller_Account { if ($_REQUEST['restaurant']) { $search['restaurant'] = $_REQUEST['restaurant']; } - + if ($_REQUEST['community']) { $search['community'] = $_REQUEST['community']; } @@ -45,6 +49,11 @@ class Controller_orders_content extends Crunchbutton_Controller_Account { c::view()->orders = Order::find($search); if ($_REQUEST['export']) { + + if( !c::admin()->permission()->check(['global','orders-all','orders-export'] ) ) { + return; + } + c::view()->layout('layout/csv'); c::view()->display('orders/csv', ['display' => true, 'filter' => false]); } else { diff --git a/include/controllers/default/cockpit/orders/index.php b/include/controllers/default/cockpit/orders/index.php index a00906018..f89ad6f91 100644 --- a/include/controllers/default/cockpit/orders/index.php +++ b/include/controllers/default/cockpit/orders/index.php @@ -2,7 +2,7 @@ class Controller_orders extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','orders-all','orders-list-page'])) { return ; } c::view()->display('orders/index'); diff --git a/include/controllers/default/cockpit/orders/newusers.php b/include/controllers/default/cockpit/orders/newusers.php index f9106a7d5..a394be8b4 100644 --- a/include/controllers/default/cockpit/orders/newusers.php +++ b/include/controllers/default/cockpit/orders/newusers.php @@ -2,7 +2,7 @@ class Controller_orders_newusers extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','orders-all','orders-new-users'])) { return ; } if( c::getPagePiece( 2 ) == 'sendemail' ){ diff --git a/include/controllers/default/cockpit/orders/notify.php b/include/controllers/default/cockpit/orders/notify.php index 1d363827b..62853baba 100644 --- a/include/controllers/default/cockpit/orders/notify.php +++ b/include/controllers/default/cockpit/orders/notify.php @@ -2,7 +2,7 @@ class Controller_orders_notify extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','orders-all','orders-notification'])) { return ; } $order = new Order(c::getPagePiece(3)); diff --git a/include/controllers/default/cockpit/referral/index.php b/include/controllers/default/cockpit/referral/index.php index f9b470a70..d7ff6ab2e 100644 --- a/include/controllers/default/cockpit/referral/index.php +++ b/include/controllers/default/cockpit/referral/index.php @@ -2,7 +2,7 @@ class Controller_referral extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global','invite-promo'])) { return ; } diff --git a/include/controllers/default/cockpit/restaurants/index.php b/include/controllers/default/cockpit/restaurants/index.php index adcf848af..669b7eac3 100644 --- a/include/controllers/default/cockpit/restaurants/index.php +++ b/include/controllers/default/cockpit/restaurants/index.php @@ -41,16 +41,18 @@ class Controller_restaurants extends Crunchbutton_Controller_Account { * * @return void */ - private function _list() { + private function _list() + { + $view = Cana::view(); + /* @var $view Cana_View */ - $communities = Crunchbutton_Community::q('SELECT * FROM community'); - - c::view()->restaurants = c::admin()->restaurants(); - c::view()->communities = $communities; - c::view()->display('restaurants/index'); + $communities = Crunchbutton_Community::q('SELECT * FROM community'); + $view->communities = $communities; + $view->display('restaurants/index'); } public function init() { + c::view()->page = 'restaurants'; if(c::getPagePiece(1) == 'legacy') { @@ -65,13 +67,20 @@ class Controller_restaurants extends Crunchbutton_Controller_Account { $restaurant = Restaurant::o(c::getPagePiece($page_piece_index)); + if( $restaurant->id_restaurant != '' && $restaurant->id_restaurant ){ + if( !c::admin()->permission()->check( [ 'global', 'restaurants-all', 'restaurants-crud', "restaurant-{$restaurant->id_restaurant}-edit", "restaurant-{$restaurant->id_restaurant}-all" ] ) ){ + return; + } + } + /* @var $restaurant Crunchbutton_Restaurant */ $this->restaurant = $restaurant; c::view()->restaurant = $restaurant; if (c::getPagePiece($page_piece_index) == 'new') { + // @permission check for restaurant permissions - if (!c::admin()->permission()->check(['global','restaurants-all', 'restaurants-create'])) { + if (!c::admin()->permission()->check(['global','restaurants-all', 'restaurants-crud'])) { return; } $restaurant->save(); @@ -88,7 +97,7 @@ class Controller_restaurants extends Crunchbutton_Controller_Account { break; case 'image': // @permission - if (!c::admin()->permission()->check(['global','restaurants-all','restaurant-'.$restaurant->id_restaurant.'-all','restaurant-'.$restaurant->id_restaurant.'-image'])) { + if (!c::admin()->permission()->check(['global','restaurants-all', 'restaurants-crud', 'restaurant-'.$restaurant->id_restaurant.'-all', 'restaurant-'.$restaurant->id_restaurant.'-edit','restaurant-'.$restaurant->id_restaurant.'-image'])) { return; } if ($_FILES['image']) { @@ -104,7 +113,7 @@ class Controller_restaurants extends Crunchbutton_Controller_Account { break; case 'fax': // @permission - if (!c::admin()->permission()->check(['global','restaurants-all','restaurant-'.$restaurant->id_restaurant.'-all','restaurant-'.$restaurant->id_restaurant.'-fax'])) { + if (!c::admin()->permission()->check(['global', 'restaurants-all','restaurant-'.$restaurant->id_restaurant.'-all','restaurant-'.$restaurant->id_restaurant.'-fax'])) { return; } c::view()->notification = $restaurant->fax(); @@ -112,7 +121,7 @@ class Controller_restaurants extends Crunchbutton_Controller_Account { break; default: // @permission - if (!c::admin()->permission()->check(['global','restaurants-all','restaurant-'.$restaurant->id_restaurant,'restaurant-'.$restaurant->id_restaurant.'-all','restaurant-'.$restaurant->id_restaurant.'-edit'])) { + if (!c::admin()->permission()->check(['global','restaurants-all','restaurants-crud','restaurant-'.$restaurant->id_restaurant.'-all','restaurant-'.$restaurant->id_restaurant.'-edit'])) { return; } $this->_form(); diff --git a/include/controllers/default/cockpit/restaurants/weight.php b/include/controllers/default/cockpit/restaurants/weight.php index 65b2b9366..043919c48 100644 --- a/include/controllers/default/cockpit/restaurants/weight.php +++ b/include/controllers/default/cockpit/restaurants/weight.php @@ -33,7 +33,7 @@ class Controller_Restaurants_Weight extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'restaurants-all', 'restaurants-crud', 'restaurants-weight-adj-page'])) { return; } diff --git a/include/controllers/default/cockpit/suggestions/content.php b/include/controllers/default/cockpit/suggestions/content.php index 9f9afa835..e46286c4e 100644 --- a/include/controllers/default/cockpit/suggestions/content.php +++ b/include/controllers/default/cockpit/suggestions/content.php @@ -4,8 +4,9 @@ class Controller_suggestions_content extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { - return ; + $restaurant_id = $_REQUEST['restaurant']; + if( !c::admin()->permission()->check( [ 'global', 'suggestions-all', "suggestions-list-restaurant-{$restaurant_id}" ] ) ){ + return; } $search = []; diff --git a/include/controllers/default/cockpit/suggestions/index.php b/include/controllers/default/cockpit/suggestions/index.php index b91cd9040..767b698d1 100644 --- a/include/controllers/default/cockpit/suggestions/index.php +++ b/include/controllers/default/cockpit/suggestions/index.php @@ -3,7 +3,7 @@ class Controller_suggestions extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'suggestions-all', 'suggestions-list-page'])) { return ; } diff --git a/include/controllers/default/cockpit/support/index.php b/include/controllers/default/cockpit/support/index.php index aa16d16de..d885aa4fc 100644 --- a/include/controllers/default/cockpit/support/index.php +++ b/include/controllers/default/cockpit/support/index.php @@ -3,7 +3,7 @@ class Controller_support extends Crunchbutton_Controller_Account { public function init() { - if (!c::admin()->permission()->check(['global'])) { + if (!c::admin()->permission()->check(['global', 'support-all', 'support-view', 'support-crud' ])) { return ; } @@ -11,6 +11,11 @@ class Controller_support extends Crunchbutton_Controller_Account { switch ($action) { case 'new': + + if (!c::admin()->permission()->check(['global', 'support-all', 'support-crud' ])) { + return ; + } + self::create($support, $_REQUEST); header('Location: /support/'.$support->id_support); exit; @@ -40,26 +45,34 @@ class Controller_support extends Crunchbutton_Controller_Account { break; case 'conversation' : - self::setRep($support); - $sn = self::respond($support, $_POST); - c::view()->display('support/conversation.note', ['set' => ['note' => $sn]]); - exit; + if (c::admin()->permission()->check(['global', 'support-all', 'support-crud' ])) { + self::setRep($support); + $sn = self::respond($support, $_POST); + c::view()->display('support/conversation.note', ['set' => ['note' => $sn]]); + exit; + } break; case 'note' : - $support->addNote($_POST['text'], 'rep', 'internal'); - exit; + if (c::admin()->permission()->check(['global', 'support-all', 'support-crud' ])) { + $support->addNote($_POST['text'], 'rep', 'internal'); + exit; + } break; case 'update': - self::update( $support, $_POST ); - echo $support->json(); - exit; + if (c::admin()->permission()->check(['global', 'support-all', 'support-crud' ])) { + self::update( $support, $_POST ); + echo $support->json(); + exit; + } break; case 'actions': - self::setRep($support); - self::action($support, $_POST); + if (c::admin()->permission()->check(['global', 'support-all', 'support-crud' ])) { + self::setRep($support); + self::action($support, $_POST); + } break; } diff --git a/include/controllers/default/crunchbutton/api/giftcard/index.php b/include/controllers/default/crunchbutton/api/giftcard/index.php index 561131c02..d5f7e07f8 100644 --- a/include/controllers/default/crunchbutton/api/giftcard/index.php +++ b/include/controllers/default/crunchbutton/api/giftcard/index.php @@ -8,6 +8,36 @@ class Controller_api_Giftcard extends Crunchbutton_Controller_Rest { case 'post': if ($_SESSION['admin']) { + + // Verify the permissions + switch ( c::getPagePiece( 2 ) ) { + case 'sms': + case 'email': + case 'bunchemail': + case 'bunchsms': + case 'generate': + $ids_restaurant = $this->request()['id_restaurant']; + foreach ( $ids_restaurant as $id_restaurant ) { + if (!c::admin()->permission()->check( [ 'global','gift-card-all', 'gift-card-create-all', "gift-card-create-restaurant-{$id_restaurant}", "gift-card-restaurant-{$id_restaurant}"])) { + return ; + } + } + break; + case 'relateuser': + $giftcard = Crunchbutton_Promo::o( $this->request()['id_promo'] ); + if (!c::admin()->permission()->check( [ 'global','gift-card-all', 'gift-card-create-all', "gift-card-create-restaurant-{$giftcard->id_restaurant}", "gift-card-restaurant-{$giftcard->id_restaurant}"])) { + return; + } + break; + case 'delete': + case 'removecredit': + if (!c::admin()->permission()->check( [ 'global','gift-card-all', 'gift-card-delete'])) { + return ; + } + break; + } + + switch ( c::getPagePiece( 2 ) ) { case 'generate': @@ -42,6 +72,7 @@ class Controller_api_Giftcard extends Crunchbutton_Controller_Rest { foreach( $ids_restaurant as $id_restaurant ){ if( trim( $id_restaurant ) != '' ){ + for( $i = 1; $i<= $total; $i++) { $giftcard = new Crunchbutton_Promo; // id_restaurant == * means any restaurant diff --git a/include/controllers/default/crunchbutton/api/order/index.php b/include/controllers/default/crunchbutton/api/order/index.php index 4ebf6b634..c20083a60 100644 --- a/include/controllers/default/crunchbutton/api/order/index.php +++ b/include/controllers/default/crunchbutton/api/order/index.php @@ -17,6 +17,11 @@ class Controller_api_order extends Crunchbutton_Controller_Rest { switch (c::getPagePiece(3)) { case 'refund': + + if ( !c::admin()->permission()->check(['global','orders-all','orders-refund'])) { + return ; + } + if (!$order->get(0)->refund()) { echo json_encode(['status' => 'false', 'errors' => 'failed to refund']); exit; @@ -24,6 +29,11 @@ class Controller_api_order extends Crunchbutton_Controller_Rest { break; case 'pay_if_refunded': + + if ( !c::admin()->permission()->check(['global','orders-all','orders-refund'])) { + return ; + } + $order->pay_if_refunded = c::getPagePiece(4); $order->save(); echo json_encode(['status' => 'success']); @@ -31,6 +41,11 @@ class Controller_api_order extends Crunchbutton_Controller_Rest { break; case 'resend_notification': + + if ( !c::admin()->permission()->check(['global','orders-all','orders-notification'])) { + return ; + } + if ( $order->resend_notify() ) { echo json_encode(['status' => 'success']); exit; diff --git a/include/controllers/default/crunchbutton/api/referral/index.php b/include/controllers/default/crunchbutton/api/referral/index.php index c16a49861..3382af8ce 100644 --- a/include/controllers/default/crunchbutton/api/referral/index.php +++ b/include/controllers/default/crunchbutton/api/referral/index.php @@ -8,6 +8,10 @@ class Controller_api_referral extends Crunchbutton_Controller_Rest { case 'save': if ( $_SESSION['admin'] && $this->method() == 'post' ) { + if( !c::admin()->permission()->check( [ 'global', 'invite-promo' ] ) ){ + return; + } + Crunchbutton_Config::store( Crunchbutton_Referral::KEY_IS_REFERRAL_ENABLE, $this->request()['enabled'] ); Crunchbutton_Config::store( Crunchbutton_Referral::KEY_INVITER_CREDIT_VALUE, $this->request()['inviter_credit'] ); Crunchbutton_Config::store( Crunchbutton_Referral::KEY_INVITED_CREDIT_VALUE, $this->request()['invited_credit'] ); diff --git a/include/controllers/default/crunchbutton/api/restaurant/index.php b/include/controllers/default/crunchbutton/api/restaurant/index.php index f8c5eb834..b9e4567df 100644 --- a/include/controllers/default/crunchbutton/api/restaurant/index.php +++ b/include/controllers/default/crunchbutton/api/restaurant/index.php @@ -139,6 +139,42 @@ class Controller_api_restaurant extends Crunchbutton_Controller_Rest { $r = Restaurant::o(c::getPagePiece(2)); /* @var $r Crunchbutton_Restaurant */ + // Permissions + if( !c::admin() ){ + return; + } + + $hasPermission = c::admin()->permission()->check(['global', 'restaurants-all', "restaurant-{$r->id_restaurant}-all" ]); + if( !$hasPermission ){ + switch ($action) { + case 'fake-merchant': + case 'fakeremove-merchant': + case 'remove-bankinfo': + case 'paymentinfo': + case 'merchant': + case 'credit': + case 'bankinfo': + $hasPermission = c::admin()->permission()->check(['global', 'restaurants-all', "restaurant-{$r->id_restaurant}-pay" ]); + break; + + case 'weight-adj': + case 'categories': + case 'notifications': + case 'hours': + case 'delete-category': + case 'delete-dish': + case 'save-dish': + case 'dishes': + default: + $hasPermission = c::admin()->permission()->check(['global', 'restaurants-all', "restaurant-{$r->id_restaurant}-edit" ]); + break; + } + } + + if( !$hasPermission ){ + return; + } + $action = c::getPagePiece(3); switch ($action) { case 'categories': @@ -259,7 +295,7 @@ class Controller_api_restaurant extends Crunchbutton_Controller_Rest { $weight_adj = $this->request()['weight_adj']; $r->weight_adj = $weight_adj; $r->save(); - echo json_encode( [ 'success' => 'dish saved' ] ); + echo json_encode( [ 'success' => 'saved' ] ); break; default: diff --git a/include/views/default/cockpit/giftcards/giftcard.phtml b/include/views/default/cockpit/giftcards/giftcard.phtml index 7933eff8c..b5748ce8c 100644 --- a/include/views/default/cockpit/giftcards/giftcard.phtml +++ b/include/views/default/cockpit/giftcards/giftcard.phtml @@ -160,14 +160,18 @@ if ( $credit->id_credit ) { Print  Print flyer  - giftcard->phone ) { ?> -
Send by sms
  - - giftcard->email ) { ?> -
Send by email
  - - giftcard->user()->id_user && !$this->giftcard->note ) { ?> -
Relate user
  + permission()->check( [ 'global', 'gift-card-all', 'gift-card-create-all', "gift-card-restaurant-{$this->giftcard->id_restaurant}", "gift-card-restaurant-create-{$this->giftcard->id_restaurant}" ] ) ){ + ?> + giftcard->phone ) { ?> +
Send by sms
  + + giftcard->email ) { ?> +
Send by email
  + + giftcard->user()->id_user && !$this->giftcard->note ) { ?> +
Relate user
  + @@ -259,6 +263,9 @@ if ( $credit->id_credit ) { + permission()->check( [ 'global','gift-card-all', 'gift-card-delete'])) { + ?>
Danger Zone @@ -281,6 +288,7 @@ if ( $credit->id_credit ) {
+ diff --git a/include/views/default/cockpit/giftcards/index.phtml b/include/views/default/cockpit/giftcards/index.phtml index 63983d16c..685d930de 100644 --- a/include/views/default/cockpit/giftcards/index.phtml +++ b/include/views/default/cockpit/giftcards/index.phtml @@ -1,6 +1,9 @@ title = 'Gift cards'; $this->titleicon = 'gift'; + + $hasPermissionToAllRestaurants = c::admin()->permission()->check( [ 'global', 'gift-card-all', 'gift-card-list-all' ] ); + ?>
@@ -49,10 +52,21 @@
@@ -65,11 +79,20 @@
+ + + permission()->check(['global','gift-card-all', 'gift-card-anti-cheat'])) { ?>    Anti Cheat     + + + permission()->check(['global','gift-card-all', 'gift-card-groups'])) { ?>         Groups + + + permission()->check(['global','gift-card-all', 'gift-card-create', 'gift-card-create-all'])) { ?>    
+    
diff --git a/include/views/default/cockpit/giftcards/new.phtml b/include/views/default/cockpit/giftcards/new.phtml index 76e4aee9b..296507d1a 100644 --- a/include/views/default/cockpit/giftcards/new.phtml +++ b/include/views/default/cockpit/giftcards/new.phtml @@ -5,6 +5,9 @@ $this->title2 = 'Create'; $this->title2icon = 'file'; + + $hasPermissionToAllRestaurants = c::admin()->permission()->check( [ 'global', 'gift-card-all', 'gift-card-create-all' ] ); + ?> @@ -65,10 +68,21 @@ diff --git a/include/views/default/cockpit/home/index.phtml b/include/views/default/cockpit/home/index.phtml index 471977654..9836878cf 100644 --- a/include/views/default/cockpit/home/index.phtml +++ b/include/views/default/cockpit/home/index.phtml @@ -1,12 +1,12 @@ title = 'Dashboard'; - $this->subtitle = 'Crunchbutton overview'; - $this->titleicon = 'dashboard'; - ?> + $this->title = 'Dashboard'; + $this->subtitle = 'Crunchbutton overview'; + $this->titleicon = 'dashboard'; +?>
- permission()->check( [ 'global','restaurants-all','restaurants-create'] ) ) : ?> + permission()->check( [ 'global', 'restaurants-all', 'restaurants-crud','restaurants-create'] ) ) { ?>
@@ -16,19 +16,19 @@
- - permission()->check( [ 'global','support'] ) ) : ?> + + permission()->check( [ 'global','support-all', 'support-view', 'support-crud', 'support-settings' ] ) ) { ?>
- Support + Support data['all']['tickets']?>
- - permission()->check( [ 'global','issues'] ) ) : ?> + + permission()->check( [ 'global', 'github'] ) ) { ?>
@@ -37,9 +37,9 @@
- + - permission()->check( [ 'global','curation-all','curation-view'] ) ) : ?> + permission()->check( [ 'global','curation'] ) ) { ?>
@@ -48,8 +48,8 @@
- - permission()->check( [ 'global','marketing-all','marketing-view'] ) ) : ?> + + permission()->check( [ 'global','marketing-events'] ) ) { ?>
@@ -58,8 +58,8 @@
- - permission()->check( [ 'global','community-metrics-all','community-metrics-view'] ) ) : ?> + + permission()->check( [ 'global', 'metrics-all', 'metrics-communities', 'metrics-communities-page'] ) ) { ?>
@@ -68,9 +68,9 @@
- +
- permission()->check( [ 'global','metrics-all','metrics-view'] ) ) : ?> + permission()->check( [ 'global', 'metrics-all', 'metrics-main', 'metrics-investors', 'metrics-detailed-analytics', 'metrics-no-grouped-charts' ] ) ) { ?>
Metrics @@ -81,36 +81,39 @@
- graphs as $category => $graphs) : ?> -
- $graph) { - if ($count == 1) { - echo '
'; - } - $title = $graph['title']; - $divId = $id; - ?> + graphs as $category => $graphs ){ + ?> +
+ $graph ){ + + if( $count == 1 ){ + echo '
'; + } + $title = $graph[ 'title' ]; + $divId = $id; + ?>
-
- - -
+
+ + +
'; - $count = 0; - } - $count++; - } - if( $count != 1){ echo '
'; } - ?> + if( $count % 3 == 0 ){ + echo '
'; + $count = 0; + } + $count++; + } + if( $count != 1){ echo '
'; } + ?>
$graph ){ @@ -122,7 +125,7 @@
@@ -169,7 +172,7 @@
- +