Merge branch '2.2.x' of dev.sourcefabric.org:airtime into cc-4585

airtime_mvc/application/controllers/LibraryController.php

@@ -181,7 +181,8 @@ class LibraryController extends Zend_Controller_Action
                     }
                 }
             }
-            if ($isAdminOrPM) {
+            
+            if ($isAdminOrPM || $file->getFileOwnerId() == $user->getId()) {
                 $menu["del"] = array("name"=> "Delete", "icon" => "delete", "url" => "/library/delete");
                 $menu["edit"] = array("name"=> "Edit Metadata", "icon" => "edit", "url" => "/library/edit-file-md/id/{$id}");
             }
@@ -276,6 +277,7 @@ class LibraryController extends Zend_Controller_Action
         $streams   = array();
 
         $message = null;
+        $noPermissionMsg = "You don't have permission to delete selected items.";
 
         foreach ($mediaItems as $media) {
 
@@ -293,19 +295,21 @@ class LibraryController extends Zend_Controller_Action
         try {
             Application_Model_Playlist::deletePlaylists($playlists, $user->getId());
         } catch (PlaylistNoPermissionException $e) {
-            $this->view->message = "You don't have permission to delete selected items.";
-
-            return;
+            $message = $noPermissionMsg;
         }
 
         try {
             Application_Model_Block::deleteBlocks($blocks, $user->getId());
+        } catch (BlockNoPermissionException $e) {
+            $message = $noPermissionMsg;
         } catch (Exception $e) {
             //TODO: warn user that not all blocks could be deleted.
         }
 
         try {
             Application_Model_Webstream::deleteStreams($streams, $user->getId());
+        } catch (WebstreamNoPermissionException $e) {
+            $message = $noPermissionMsg;
         } catch (Exception $e) {
             //TODO: warn user that not all streams could be deleted.
             Logging::info($e);
@@ -318,6 +322,8 @@ class LibraryController extends Zend_Controller_Action
             if (isset($file)) {
                 try {
                     $res = $file->delete(true);
+                } catch (FileNoPermissionException $e) {
+                    $message = $noPermissionMsg;
                 } catch (Exception $e) {
                     //could throw a scheduled in future exception.
                     $message = "Could not delete some scheduled files.";
@@ -364,15 +370,17 @@ class LibraryController extends Zend_Controller_Action
     {
         $user = Application_Model_User::getCurrentUser();
         $isAdminOrPM = $user->isUserType(array(UTYPE_ADMIN, UTYPE_PROGRAM_MANAGER));
-        if (!$isAdminOrPM) {
-            return;
-        }
 
         $request = $this->getRequest();
-        $form = new Application_Form_EditAudioMD();
 
         $file_id = $this->_getParam('id', null);
         $file = Application_Model_StoredFile::Recall($file_id);
+
+        if (!$isAdminOrPM && $file->getFileOwnerId() != $user->getId()) {
+            return;
+        }
+        
+        $form = new Application_Form_EditAudioMD();
         $form->populate($file->getDbColMetadata());
 
         if ($request->isPost()) {

airtime_mvc/application/models/StoredFile.php

@@ -344,6 +344,13 @@ SQL;
             throw new DeleteScheduledFileException();
         }
 
+        $userInfo = Zend_Auth::getInstance()->getStorage()->read();
+        $user = new Application_Model_User($userInfo->id);
+        $isAdminOrPM = $user->isUserType(array(UTYPE_ADMIN, UTYPE_PROGRAM_MANAGER));
+        if (!$isAdminOrPM && $this->getFileOwnerId() != $user->getId()) {
+            throw new FileNoPermissionException();
+        }
+
         $music_dir = Application_Model_MusicDir::getDirByPK($this->_file->getDbDirectory());
         $type = $music_dir->getType();
 
@@ -1161,6 +1168,10 @@ SQL;
         return $this->_file->getDbFileExists();
     }
 
+    public function getFileOwnerId()
+    {
+        return $this->_file->getDbOwnerId();
+    }
 
     // note: never call this method from controllers because it does a sleep
     public function uploadToSoundCloud()
@@ -1209,3 +1220,4 @@ SQL;
 
 class DeleteScheduledFileException extends Exception {}
 class FileDoesNotExistException extends Exception {}
+class FileNoPermissionException extends Exception {}

airtime_mvc/application/models/Webstream.php

@@ -92,7 +92,7 @@ class Application_Model_Webstream implements Application_Model_LibraryEditable
         if (count($leftOver) == 0) {
             CcWebstreamQuery::create()->findPKs($p_ids)->delete();
         } else {
-            throw new Exception("Invalid user permissions");
+            throw new WebstreamNoPermissionException;
         }
     }
 
@@ -370,3 +370,6 @@ class Application_Model_Webstream implements Application_Model_LibraryEditable
         return $webstream->getDbId();
     }
 }
+
+class WebstreamNoPermissionException extends Exception {}
+

airtime_mvc/application/views/scripts/library/edit-file-md.phtml

@@ -1,6 +1,6 @@
 <div class="ui-widget ui-widget-content block-shadow simple-formblock clearfix padded-strong">
     <h2>Edit Metadata</h2>
 
-    <?php $this->form->setAction($this->url());
+    <?php //$this->form->setAction($this->url());
         echo $this->form; ?>
 </div>