From beac831e4ec94a35f6f1ba4e6802e7ad89af38a9 Mon Sep 17 00:00:00 2001
From: Florian Hatat <galette@hatat.me>
Date: Mon, 18 Jul 2022 15:34:01 +0200
Subject: [PATCH 1/4] Add canEdit method on groups

---
 galette/lib/Galette/Entity/Group.php | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/galette/lib/Galette/Entity/Group.php b/galette/lib/Galette/Entity/Group.php
index 5f59d60b..993cd023 100644
--- a/galette/lib/Galette/Entity/Group.php
+++ b/galette/lib/Galette/Entity/Group.php
@@ -904,4 +904,28 @@ class Group
         $this->login = $login;
         return $this;
     }
+
+    /**
+     * Can current logged-in user edit group
+     *
+     * @param Login $login Login instance
+     *
+     * @return boolean
+     */
+    public function canEdit(Login $login): bool
+    {
+        global $preferences;
+
+        //admin and staff users can edit
+        if ($login->isAdmin() || $login->isStaff()) {
+            return true;
+        }
+
+        //group managers can edit groups they manage when pref is on
+        if ($preferences->pref_bool_groupsmanagers_edit_member && $this->isManager($login)) {
+            return true;
+        }
+
+        return false;
+    }
 }
-- 
2.35.1


From 0c8c2ae01329d1c0be5ce635011e38ba60367fef Mon Sep 17 00:00:00 2001
From: Florian Hatat <galette@hatat.me>
Date: Mon, 18 Jul 2022 15:10:33 +0200
Subject: [PATCH 2/4] Server-side permission check for group editions

---
 galette/lib/Galette/Controllers/Crud/GroupsController.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/galette/lib/Galette/Controllers/Crud/GroupsController.php b/galette/lib/Galette/Controllers/Crud/GroupsController.php
index 52d0e08d..318cbe09 100644
--- a/galette/lib/Galette/Controllers/Crud/GroupsController.php
+++ b/galette/lib/Galette/Controllers/Crud/GroupsController.php
@@ -337,6 +337,9 @@ class GroupsController extends CrudController
     {
         $post = $request->getParsedBody();
         $group = new Group($id);
+        if (!$group->canEdit($this->login)) {
+            throw new \RuntimeException('Trying to edit group without appropriate permissions');
+        }
 
         $group->setName($post['group_name']);
         try {
-- 
2.35.1


From 5f212a1313e10413f7304e6bb8080a5722a7f4a9 Mon Sep 17 00:00:00 2001
From: Florian Hatat <galette@hatat.me>
Date: Mon, 18 Jul 2022 15:46:18 +0200
Subject: [PATCH 3/4] Group detail display only for managers

---
 galette/lib/Galette/Controllers/Crud/GroupsController.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/galette/lib/Galette/Controllers/Crud/GroupsController.php b/galette/lib/Galette/Controllers/Crud/GroupsController.php
index 318cbe09..dfa250a5 100644
--- a/galette/lib/Galette/Controllers/Crud/GroupsController.php
+++ b/galette/lib/Galette/Controllers/Crud/GroupsController.php
@@ -213,6 +213,9 @@ class GroupsController extends CrudController
         $post = $request->getParsedBody();
         $id = $post['id_group'];
         $group = new Group((int)$id);
+        if (!$group->canEdit($this->login)) {
+            throw new \RuntimeException('Trying to edit group without appropriate permissions');
+        }
 
         $groups = new Groups($this->zdb, $this->login);
 
-- 
2.35.1


From 84d4d2c6afcf5d3eb91c4da5230bb26410be547b Mon Sep 17 00:00:00 2001
From: Florian Hatat <galette@hatat.me>
Date: Mon, 18 Jul 2022 15:46:39 +0200
Subject: [PATCH 4/4] Group template uses canEdit method

---
 galette/templates/default/elements/group.html.twig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/galette/templates/default/elements/group.html.twig b/galette/templates/default/elements/group.html.twig
index 0a202d6f..342953f4 100644
--- a/galette/templates/default/elements/group.html.twig
+++ b/galette/templates/default/elements/group.html.twig
@@ -1,4 +1,4 @@
-{% set can_edit = login.isGroupManager() and preferences.pref_bool_groupsmanagers_edit_groups or login.isAdmin() or login.isStaff() %}
+{% set can_edit = group.canEdit(login) %}
 
 {% set managers = group.getManagers() %}
 {% set members = group.getMembers() %}
-- 
2.35.1

