Added permission visiblity control to image-delete button

Includes test to cover.
For #3697

diff --git a/app/Http/Controllers/Images/ImageController.php b/app/Http/Controllers/Images/ImageController.php
index b5bc840a1c1240af9f5f18e5c51af2feff86834c..4b0ba8b459bb45c66dbacdc293d7410aac921c95 100644 (file)
--- a/app/Http/Controllers/Images/ImageController.php
+++ b/app/Http/Controllers/Images/ImageController.php
@@ -14,12 +14,9 @@ use Illuminate\Validation\ValidationException;
 
 class ImageController extends Controller
 {
-    protected $imageRepo;
-    protected $imageService;
-
-    /**
-     * ImageController constructor.
-     */
+    protected ImageRepo $imageRepo;
+    protected ImageService $imageService;
+    
     public function __construct(ImageRepo $imageRepo, ImageService $imageService)
     {
         $this->imageRepo = $imageRepo;

diff --git a/resources/views/pages/parts/image-manager-form.blade.php b/resources/views/pages/parts/image-manager-form.blade.php
index 81041fcac04e4fecd79861301f43ccaca92da2f5..aa21e31bb6b5193cd4f6658518c4760a887da7c4 100644 (file)
--- a/resources/views/pages/parts/image-manager-form.blade.php
+++ b/resources/views/pages/parts/image-manager-form.blade.php
@@ -20,10 +20,12 @@
         </div>
         <div class="grid half">
             <div>
-                <button type="button"
+                @if(userCan('image-delete', $image))
+                    <button type="button"
                         id="image-manager-delete"
                         title="{{ trans('common.delete') }}"
                         class="button icon outline">@icon('delete')</button>
+                @endif
             </div>
             <div class="text-right">
                 <button type="submit"

diff --git a/tests/Uploads/ImageTest.php b/tests/Uploads/ImageTest.php
index 2a3023a9eafe470418d3354aaed614d506002afd..84f9e47f48deb804c14e56094e9daf9528e5d88b 100644 (file)
--- a/tests/Uploads/ImageTest.php
+++ b/tests/Uploads/ImageTest.php
@@ -457,6 +457,32 @@ class ImageTest extends TestCase
         $this->assertFalse(file_exists(public_path($relPath)), 'Uploaded image has not been deleted as expected');
     }
 
+    public function test_image_manager_delete_button_only_shows_with_permission()
+    {
+        $page = Page::query()->first();
+        $this->asAdmin();
+        $imageName = 'first-image.png';
+        $relPath = $this->getTestImagePath('gallery', $imageName);
+        $this->deleteImage($relPath);
+        $viewer = $this->getViewer();
+
+        $this->uploadImage($imageName, $page->id);
+        $image = Image::first();
+
+        $resp = $this->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementExists('button#image-manager-delete[title="Delete"]');
+
+        $resp = $this->actingAs($viewer)->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementNotExists('button#image-manager-delete[title="Delete"]');
+
+        $this->giveUserPermissions($viewer, ['image-delete-all']);
+
+        $resp = $this->actingAs($viewer)->get("/images/edit/{$image->id}");
+        $this->withHtml($resp)->assertElementExists('button#image-manager-delete[title="Delete"]');
+
+        $this->deleteImage($relPath);
+    }
+
     protected function getTestProfileImage()
     {
         $imageName = 'profile.png';