Index: openacs-4/packages/notifications/tcl/notification-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/notifications/tcl/notification-procs.tcl,v diff -u -r1.22 -r1.23 --- openacs-4/packages/notifications/tcl/notification-procs.tcl 9 May 2018 15:33:33 -0000 1.22 +++ openacs-4/packages/notifications/tcl/notification-procs.tcl 17 Aug 2018 13:02:43 -0000 1.23 @@ -64,7 +64,7 @@ set intervals_pretty [list] foreach elm $intervals { lassign $elm elm_name elm_id - lappend intervals_pretty [list [_ notifications.${elm_name}] $elm_id] + lappend intervals_pretty [list [lang::util::localize ${elm_name}] $elm_id] } return $intervals_pretty } else { Index: openacs-4/packages/notifications/tcl/notifications-security-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/notifications/tcl/notifications-security-procs.tcl,v diff -u -r1.8 -r1.9 --- openacs-4/packages/notifications/tcl/notifications-security-procs.tcl 7 Jun 2018 17:07:21 -0000 1.8 +++ openacs-4/packages/notifications/tcl/notifications-security-procs.tcl 17 Aug 2018 13:02:43 -0000 1.9 @@ -29,14 +29,12 @@ return [db_string user_approved_p {} -default 0] } - ad_proc -deprecated -public can_notify_object_p { + ad_proc -public can_notify_object_p { {-user_id ""} {-object_id:required} } { This checks if a user can request notification on a given object. - Deprecated: reduce the amount of wrappers to permission::permission_p - @param user_id @param object_id @@ -45,52 +43,64 @@ return [permission::permission_p -party_id $user_id -object_id $object_id -privilege "read"] } - ad_proc -deprecated -public require_notify_object { + ad_proc -public require_notify_object { {-user_id ""} {-object_id:required} } { Require the ability to notify on an object. - Deprecated: just a wrapper to permission::require_permission - @param user_id @param object_id @see permission::require_permission } { - permission::require_permission -party_id $user_id -object_id $object_id -privilege "read" + # require user to be logged in + auth::require_login + return [can_notify_object_p -user_id $user_id -object_id $object_id] } - ad_proc -deprecated -public can_admin_request_p { + ad_proc -public can_admin_request_p { {-user_id ""} {-request_id:required} } { Checks if a user can manage a given notification request. - Deprecated: reduce the amount of wrappers to permission::permission_p - @param user_id @param request_id @see permission::permission_p } { - return [permission::permission_p -party_id $user_id -object_id $request_id -privilege "admin"] + # owner of notification or side-wide admin + set allowed 0 + if {$user_id eq ""} { + set user_id [ad_conn user_id] + } + if {[acs_user::site_wide_admin_p -user_id $user_id]} { + set allowed 1 + } else { + set sql "select user_id from notification_requests where object_id = :request_id" + set owner_id [db_string get_user_id $sql -default ""] + if {$owner_id eq $user_id} { + set allowed 1 + } + } + return $allowed } - ad_proc -deprecated -public require_admin_request { + ad_proc -public require_admin_request { {-user_id ""} {-request_id:required} } { Require the ability to admin a request. - Deprecated: just a wrapper to permission::require_permission - @param user_id @param request_id @see permission::require_permission } { - permission::require_permission -party_id $user_id -object_id $request_id -privilege "admin" + # require user to be logged in + auth::require_login + return [can_admin_request_p -user_id $user_id -request_id $request_id] } } Index: openacs-4/packages/notifications/www/request-delete.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/notifications/www/request-delete.tcl,v diff -u -r1.6 -r1.7 --- openacs-4/packages/notifications/www/request-delete.tcl 7 Jun 2018 17:09:17 -0000 1.6 +++ openacs-4/packages/notifications/www/request-delete.tcl 17 Aug 2018 13:02:43 -0000 1.7 @@ -12,7 +12,7 @@ } # Security Check -permission::require_permission -object_id $request_id -privilege "admin" +notification::security::require_admin_request -request_id $request_id # Actually Delete notification::request::delete -request_id $request_id