diff --git a/api/v1/submissions/PKPSubmissionHandler.inc.php b/api/v1/submissions/PKPSubmissionHandler.inc.php index fd30c36aa7e..7d3c7b40c17 100644 --- a/api/v1/submissions/PKPSubmissionHandler.inc.php +++ b/api/v1/submissions/PKPSubmissionHandler.inc.php @@ -698,7 +698,7 @@ public function editPublication($slimRequest, $response, $args) { // Prevent users from editing publications if they do not have permission. Except for admins. $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); - if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission->getId(), $currentUser->getId())) { + if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission, $currentUser->getId())) { return $response->withStatus(403)->withJsonError('api.submissions.403.userCantEdit'); } diff --git a/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php b/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php index 1060c87b0da..d283fe69a61 100644 --- a/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php +++ b/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php @@ -37,7 +37,7 @@ public function effect() // Prevent users from editing publications if they do not have permission. Except for admins. $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); - if (in_array(ROLE_ID_SITE_ADMIN, $userRoles) || Services::get('submission')->canEditPublication($submission->getId(), $this->_currentUser->getId())) { + if (in_array(ROLE_ID_SITE_ADMIN, $userRoles) || Services::get('submission')->canEditPublication($submission, $this->_currentUser->getId())) { return AUTHORIZATION_PERMIT; } diff --git a/classes/services/PKPSubmissionService.inc.php b/classes/services/PKPSubmissionService.inc.php index b8fb44dad65..f06ef7dbb3b 100644 --- a/classes/services/PKPSubmissionService.inc.php +++ b/classes/services/PKPSubmissionService.inc.php @@ -176,7 +176,7 @@ public function getProperties($submission, $props, $args = null) { // Retrieve the submission's context for properties that require it if (array_intersect(['_href', 'urlAuthorWorkflow', 'urlEditorialWorkflow'], $props)) { - $submissionContext = $request->getContext(); + $submissionContext = $request->getContext(); if (!$submissionContext || $submissionContext->getId() != $submission->getData('contextId')) { $submissionContext = Services::get('context')->get($submission->getData('contextId')); } @@ -251,7 +251,7 @@ function($publication) use ($args, $submission, $submissionContext) { } } - $values = Services::get('schema')->addMissingMultilingualValues(SCHEMA_SUBMISSION, $values, $request->getContext()->getSupportedSubmissionLocales()); + $values = Services::get('schema')->addMissingMultilingualValues(SCHEMA_SUBMISSION, $values, $submissionContext); \HookRegistry::call('Submission::getProperties::values', array(&$values, $submission, $props, $args)); @@ -317,7 +317,10 @@ public function getPropertyReviewAssignments($submission) { $request = \Application::get()->getRequest(); $currentUser = $request->getUser(); - $context = $request->getContext(); + $context = $request->getContext(); + if (!$context || $context->getId() != $submission->getData('contextId')) { + $context = Services::get('context')->get($submission->getData('contextId')); + } $dateFormatShort = $context->getLocalizedDateFormatShort(); $due = is_null($reviewAssignment->getDateDue()) ? null : strftime($dateFormatShort, strtotime($reviewAssignment->getDateDue())); $responseDue = is_null($reviewAssignment->getDateResponseDue()) ? null : strftime($dateFormatShort, strtotime($reviewAssignment->getDateResponseDue())); @@ -397,6 +400,9 @@ public function getPropertyStages($submission, $stageIds = null) { $currentUser = \Application::get()->getRequest()->getUser(); $context = \Application::get()->getRequest()->getContext(); + if (!$context || $context->getId() != $submission->getData('contextId')) { + $context = Services::get('context')->get($submission->getData('contextId')); + } $contextId = $context ? $context->getId() : CONTEXT_ID_NONE; $stages = array(); @@ -788,13 +794,30 @@ public function delete($submission) { /** * Check if a user can edit a publications metadata * - * @param int $submissionId + * @param Submission $submission * @param int $userId * @return boolean */ - public function canEditPublication($submissionId, $userId) { + public function canEditPublication($submission, $userId) { + $contextId = $submission->getData('contextId'); $stageAssignmentDao = DAORegistry::getDAO('StageAssignmentDAO'); /* @var $stageAssignmentDao StageAssignmentDAO */ - $stageAssignments = $stageAssignmentDao->getBySubmissionAndUserIdAndStageId($submissionId, $userId, null)->toArray(); + $stageAssignments = $stageAssignmentDao->getBySubmissionAndUserIdAndStageId($submission->getId(), $userId, null)->toArray(); + $userIsAuthor = !empty($stageAssignmentDao->getBySubmissionAndRoleId($submission->getId(), ROLE_ID_AUTHOR, null, $userId)->toArray()); + // If the submission is rejected and the user's only role is an author + if ($submission->getStatus() == STATUS_DECLINED && $userIsAuthor) { + $userIsOnlyAuthorOrReader = true; + $roleDao = DAORegistry::getDAO('RoleDAO'); /* @var $roleDao RoleDAO */ + $roles = $roleDao->getByUserId($userId, $contextId); + foreach ($roles as $role) { + if ($role->getRoleId() != ROLE_ID_AUTHOR && $role->getRoleId() != ROLE_ID_READER) { + $userIsOnlyAuthorOrReader = false; + break; + } + } + if ($userIsOnlyAuthorOrReader) { + return false; + } + } // Check for permission from stage assignments foreach ($stageAssignments as $stageAssignment) { if ($stageAssignment->getCanChangeMetadata()) { @@ -802,8 +825,7 @@ public function canEditPublication($submissionId, $userId) { } } // If user has no stage assigments, check if user can edit anyway ie. is manager - $context = Application::get()->getRequest()->getContext(); - if (count($stageAssignments) == 0 && $this->_canUserAccessUnassignedSubmissions($context->getId(), $userId)) { + if (count($stageAssignments) == 0 && $this->_canUserAccessUnassignedSubmissions($contextId, $userId)) { return true; } // Else deny access diff --git a/controllers/grid/users/author/AuthorGridHandler.inc.php b/controllers/grid/users/author/AuthorGridHandler.inc.php index bfe928f2d87..390ea7e1ccb 100644 --- a/controllers/grid/users/author/AuthorGridHandler.inc.php +++ b/controllers/grid/users/author/AuthorGridHandler.inc.php @@ -256,7 +256,7 @@ function canAdminister($user) { if ($submission->getDateSubmitted() == null) return true; // The user may not be allowed to edit the metadata - if (Services::get('submission')->canEditPublication($submission->getId(), $user->getId())) { + if (Services::get('submission')->canEditPublication($submission, $user->getId())) { return true; } diff --git a/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php b/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php index b75696f3186..59a3d3230b0 100644 --- a/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php +++ b/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php @@ -287,7 +287,7 @@ function setupTemplate($request) { // Check if current author can edit metadata $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); $canEditPublication = true; - if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission->getId(), $user->getId())) { + if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission, $user->getId())) { $canEditPublication = false; } diff --git a/pages/workflow/PKPWorkflowHandler.inc.php b/pages/workflow/PKPWorkflowHandler.inc.php index 526a675af6a..c551ddd7930 100644 --- a/pages/workflow/PKPWorkflowHandler.inc.php +++ b/pages/workflow/PKPWorkflowHandler.inc.php @@ -145,7 +145,7 @@ function index($args, $request) { $currentStageId = $submission->getStageId(); $accessibleWorkflowStages = $this->getAuthorizedContextObject(ASSOC_TYPE_ACCESSIBLE_WORKFLOW_STAGES); $canAccessPublication = false; // View title, metadata, etc. - $canEditPublication = Services::get('submission')->canEditPublication($submission->getId(), $request->getUser()->getId()); + $canEditPublication = Services::get('submission')->canEditPublication($submission, $request->getUser()->getId()); $canAccessProduction = false; // Access to galleys and issue entry $canPublish = false; // Ability to publish, unpublish and create versions $canAccessEditorialHistory = false; // Access to activity log