Feature/fixes

_routes.php

@@ -17,7 +17,7 @@
 $check_js_middleware = function (\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Server\RequestHandlerInterface $handler) use ($container) {
     //check if JS has been generated
     if (!file_exists(__DIR__ . '/webroot/maps-main.bundle.min.js')) {
-        $container->get('flash')->addMessageNow(
+        $container->get(\Slim\Flash\Messages::class)->addMessageNow(
             'error_detected',
             _T('Javascript libraries has not been built!', 'maps')
         );

lib/GaletteMaps/Controllers/MapsController.php

@@ -34,6 +34,20 @@ class MapsController extends AbstractPluginController
     #[Inject("Plugin Galette Maps")]
     protected array $module_info;
 
+    /**
+     * Member dependencies to load; groups are loaded on demand by access checks
+     *
+     * @return array<string, bool>
+     */
+    private function getMemberDeps(): array
+    {
+        return [
+            'picture'   => false,
+            'groups'    => false,
+            'dues'      => false
+        ];
+    }
+
     /**
      * Main route
      *
@@ -82,41 +96,29 @@ public function localizeMember(Request $request, Response $response, ?int $id =
         if ($id === null) {
             $id = (int)$this->login->id;
         }
-        $deps = [
-            'picture'   => false,
-            'groups'    => false,
-            'dues'      => false
-        ];
-        $member = new Adherent($this->zdb, $id, $deps);
-
-        if (
-            $this->login->id != $id
-            && !$this->login->isAdmin()
-            && !$this->login->isStaff()
-            && $this->login->isGroupManager()
-        ) {
-            //check if requested member is part of managed groups
-            $groups = $member->groups;
-            $is_managed = false;
-            foreach ($groups as $g) {
-                if ($this->login->isGroupManager($g->getId())) {
-                    $is_managed = true;
-                    break;
-                }
-            }
-            if ($is_managed !== true) {
-                //requested member is not part of managed groups, fall back to logged
-                //in member
-                //FIXME: silent fallback is maybe not the best to do
-                $member->load($this->login->id);
-            }
+        $member = new Adherent($this->zdb, $id, $this->getMemberDeps());
+
+        if (!$member->canShow($this->login)) {
+            Analog::log(
+                'Logged in member ' . $this->login->login
+                . ' has tried to display coordinates of member #' . $id
+                . ' without the right to show them.',
+                Analog::WARNING
+            );
+            return $this->redirectWithErrors(
+                response: $response,
+                errors: [_T("You do not have permission for requested URL.")],
+                redirect_url: $this->routeparser->urlFor('me')
+            );
         }
+        $can_edit = $member->canEdit($this->login);
 
         $coords = new Coordinates();
         $mcoords = $coords->getCoords($member->id);
 
         $towns = false;
-        if (count($mcoords) === 0) {
+        //towns are only proposed to choose a location
+        if ($can_edit && count($mcoords) === 0) {
             if ($member->town != '') {
                 $t = new NominatimTowns($this->preferences);
                 $towns = $t->search(
@@ -133,6 +135,7 @@ public function localizeMember(Request $request, Response $response, ?int $id =
                 _T('%member geographic position', 'maps')
             ),
             'member'            => $member,
+            'can_edit'          => $can_edit,
             'require_dialog'    => true,
             'adh_map'           => true,
             'module_id'         => $this->getModuleId(),
@@ -253,40 +256,26 @@ public function ILiveHere(Request $request, Response $response, ?int $id = null)
     {
         $error = null;
         $message = null;
+        $status = 200;
 
         if ($id === null && $this->login->isSuperAdmin()) {
             Analog::log(
                 'SuperAdmin does not live anywhere!',
                 Analog::INFO
             );
             $error = _T('Superadmin cannot be localized.', 'maps');
-        } elseif ($id === null) {
-            $member = new Adherent($this->zdb, $this->login->login);
-            $id = $member->id;
-        } elseif (
-            !$this->login->isSuperAdmin()
-            && !$this->login->isAdmin()
-            && !$this->login->isStaff()
-            && $this->login->isGroupManager()
-        ) {
-            $member = new Adherent($this->zdb, $id);
-            //check if current logged-in user can manage loaded member
-            $groups = $member->groups;
-            $can_manage = false;
-            foreach ($groups as $group) {
-                if ($this->login->isGroupManager($group->getId())) {
-                    $can_manage = true;
-                    break;
-                }
-            }
-            if ($can_manage !== true) {
+        } else {
+            $id ??= (int)$this->login->id;
+            $member = new Adherent($this->zdb, $id, $this->getMemberDeps());
+            if (!$member->canEdit($this->login)) {
                 Analog::log(
                     'Logged in member ' . $this->login->login
-                    . ' has tried to load member #' . $id
-                    . ' but do not manage any groups he belongs to.',
+                    . ' has tried to change coordinates of member #' . $id
+                    . ' without the right to edit them.',
                     Analog::WARNING
                 );
-                $error = _T('Coordinates has not been removed :(', 'maps');
+                $error = _T('You do not have permission for requested URL.');
+                $status = 403;
             }
         }
 
@@ -320,7 +309,9 @@ public function ILiveHere(Request $request, Response $response, ?int $id = null)
             }
         }
 
-        $response = $response->withHeader('Content-type', 'application/json');
+        $response = $response
+            ->withStatus($status)
+            ->withHeader('Content-type', 'application/json');
 
         $res = [
             'res'       => $error === null,

lib/GaletteMaps/Coordinates.php

@@ -84,7 +84,9 @@ public function listCoords(): array
                 [
                     'a' => PREFIX_DB . Adherent::TABLE
                 ],
-                'a.' . self::PK . '=' . 'c.' . self::PK
+                'a.' . self::PK . '=' . 'c.' . self::PK,
+                //only what the map displays
+                ['nom_adh', 'prenom_adh', 'pseudo_adh', 'societe_adh']
             )->where->equalTo(
                 'activite_adh',
                 new Expression('true')
@@ -145,16 +147,15 @@ public function listCoords(): array
 
             $res = [];
             foreach ($results as $r) {
-                $a = new Adherent($zdb, $r);
                 $m = [
-                    'id_adh'    => $a->id,
+                    'id_adh'    => (int)$r->{self::PK},
                     'lat'       => $r->latitude,
                     'lng'       => $r->longitude,
-                    'name'      => $a->sname,
-                    'nickname'  => $a->nickname
+                    'name'      => Adherent::getNameWithCase($r->nom_adh, $r->prenom_adh),
+                    'nickname'  => $r->pseudo_adh
                 ];
-                if ($a->isCompany()) {
-                    $m['company'] = $a->company_name;
+                if (trim($r->societe_adh ?? '') !== '') {
+                    $m['company'] = $r->societe_adh;
                 }
                 $res[] = $m;
             }

templates/default/maps.html.twig

@@ -25,7 +25,7 @@
     {% else %}
         {% set icon = 'galetteIcon' %}
     {% endif %}
-        _member = [{{ l.lat }}, {{ l.lng }}, {{ icon }}, '<p><strong>{{ l.name|e("js") }}</strong>{% if l.nickname != '' %} {{ _T("aka", "maps")|e("js") }} <em>{{ l.nickname|e("js") }}</em>{% endif %}{% if l.company is defined %}<br/>{{ l.company|e("js") }}{% endif %}</p>'];
+        _member = [{{ l.lat }}, {{ l.lng }}, {{ icon }}, '<p><strong>{{ l.name|e|e("js") }}</strong>{% if l.nickname != '' %} {{ _T("aka", "maps")|e("js") }} <em>{{ l.nickname|e|e("js") }}</em>{% endif %}{% if l.company is defined %}<br/>{{ l.company|e|e("js") }}{% endif %}</p>'];
         _markers.push(_member);
 {% endfor %}
         var _group = L.markerClusterGroup();

templates/default/mymap.html.twig

@@ -56,6 +56,7 @@
     var _mapsBinded = function(map)
     {
 
+{% if can_edit %}
         function onMapClick(e) {
             var popup = L.popup();
             popup
@@ -85,6 +86,7 @@
             _a.data('latlng', e.popup._latlng);
             _iLiveHere(_a.attr('id'));
         });
+{% endif %}
 
 
 {% if town is defined %}
@@ -150,7 +152,7 @@
         };
 
         L.marker([_lat, _lon], {icon: galetteIcon}).addTo(map)
-            .bindPopup('<strong>{{ member.sfullname|escape }}</strong><br/>{% if mymap is defined %}{{ _T("I live here!", "maps")|e("js") }}{% else %}{{ _T("Member lives here!", "maps")|e("js") }}{% endif %}<br/><span id="removecoords" class="ui button">{{ _T("Remove")|e("js") }}</span>').openPopup();
+            .bindPopup('<strong>{{ member.sfullname|e|e("js") }}</strong><br/>{% if mymap is defined %}{{ _T("I live here!", "maps")|e("js") }}{% else %}{{ _T("Member lives here!", "maps")|e("js") }}{% endif %}{% if can_edit %}<br/><span id="removecoords" class="ui button">{{ _T("Remove")|e("js") }}</span>{% endif %}').openPopup();
 {% else %}
         {# Town is not known. Show possibilities #}
         var _towns = $('#possible_towns');