fixed: do not allow to create a course or see a houshold from the search result, if the user does not have any rights to do it

This commit is contained in:
Julien Fastré 2022-07-11 13:54:12 +02:00
parent 16fed67dd0
commit 4ef48216ed
2 changed files with 7 additions and 5 deletions

View File

@ -1,13 +1,15 @@
{% macro button_person_after(person) %}
{% set household = person.getCurrentHousehold %}
{% if household is not null %}
{% if household is not null and is_granted('CHILL_PERSON_HOUSEHOLD_SEE', household) %}
<li>
<a href="{{ path('chill_person_household_summary', { 'household_id': household.id }) }}" class="btn btn-sm btn-chill-beige"><i class="fa fa-home"></i></a>
</li>
{% endif %}
<li>
<a href="{{ path('chill_person_accompanying_course_new', { 'person_id': [ person.id ]}) }}" class="btn btn-sm btn-create change-icon" title="{{ 'Create an accompanying period'|trans }}"><i class="fa fa-random"></i></a>
</li>
{% if is_granted('CHILL_PERSON_ACCOMPANYING_PERIOD_CREATE', person) %}
<li>
<a href="{{ path('chill_person_accompanying_course_new', { 'person_id': [ person.id ]}) }}" class="btn btn-sm btn-create change-icon" title="{{ 'Create an accompanying period'|trans }}"><i class="fa fa-random"></i></a>
</li>
{% endif %}
{% endmacro %}
{% macro accompanying_period(acp, person) %}

View File

@ -113,7 +113,7 @@ class AccompanyingPeriodVoter extends AbstractChillVoter implements ProvideRoleH
->generate(self::class)
->addCheckFor(null, [self::CREATE, self::REASSIGN_BULK])
->addCheckFor(AccompanyingPeriod::class, [self::TOGGLE_CONFIDENTIAL, ...self::ALL])
->addCheckFor(Person::class, [self::SEE])
->addCheckFor(Person::class, [self::SEE, self::CREATE])
->build();
}