FEATURE #2048: prepare routes for ACL, add some more permissions

app/CMS/Handlers/BaseHandler.php

@@ -1,16 +1,22 @@
 <?php
+
 namespace App\CMS\Handlers;
 
 use App\CMS\Contracts\Modules\BaseModuleHandler;
 use App\CMS\Enumerations\TemplatePathsHumanReadableRootOnly;
 use App\CMS\Enumerations\WidgetTypes;
+use App\Models\ActionLog\ActionLogType;
+use App\Models\FileManager\File;
+use App\Models\Settings;
+use App\Models\Templates\Template;
 use App\Models\User;
+use App\Models\Widgets\Widget;
+use App\Models\Widgets\WidgetArea;
 
 abstract class BaseHandler implements BaseModuleHandler
 {
     /**
      * Register admin menu (or multiple ones)
-     *
      * This cannot be in ServiceProvider because Session is started at middleware. And ServiceProvider is called before
      * starting any middleware..
      *
@@ -25,12 +31,11 @@ abstract class BaseHandler implements BaseModuleHandler
         }
 
         // create instance of main menu
-        \Menu::create('mainMenu', function ($menu) {
+        \Menu::create('mainMenu', function ($menu) use ($user) {
             //            $menu->route('admin.dashboard', trans('admin/mainMenu.dashboard'), [], 10, ['icon' => 'fa fa-fw fa-dashboard']);
 
             /**
              * Content pages
-             *
              * Submenus can be registered later
              */
             $menu->dropdown(trans('admin/mainMenu.contentPages'), function ($sub) {
@@ -40,63 +45,82 @@ abstract class BaseHandler implements BaseModuleHandler
             /**
              * File manager
              */
-            $menu->route('upload.overview', trans('admin/mainMenu.fileManager'), [], 40, ['icon' => 'fa fa-fw fa-folder']);
+            if ($user->can('manage', File::class)) {
+                $menu->route('upload.overview', trans('admin/mainMenu.fileManager'), [], 40, ['icon' => 'fa fa-fw fa-folder']);
+            }
 
             /**
              * Widgets and widget areas
              */
-            $menu->dropdown(trans('admin/mainMenu.widgets'), function ($sub) {
+            if ($user->can('manage', Widget::class) || $user->can('manage', WidgetArea::class)) {
-                // create list of all widget types
+                $menu->dropdown(trans('admin/mainMenu.widgets'), function ($sub) use ($user) {
-                $widgets = WidgetTypes::getWithTranslations();
+                    // create list of all widget types
+                    $widgets = WidgetTypes::getWithTranslations();
 
-                if (!empty($widgets)) {
+                    if (!empty($widgets) && $user->can('create-widgets', Widget::class)) {
-                    $sub->dropdown(trans('admin/mainMenu.newWidget'), function ($sub) use ($widgets) {
+                        $sub->dropdown(trans('admin/mainMenu.newWidget'), function ($sub) use ($widgets) {
-                        $i = 1;
+                            $i = 1;
-                        foreach ($widgets as $type => $name) {
+                            foreach ($widgets as $type => $name) {
-                            $sub->route('widgets.new', $name, ['type' => $type], $i++);
+                                $sub->route('widgets.new', $name, ['type' => $type], $i++);
-                        }
+                            }
-                    }, 10, ['icon' => 'fa fa-fw fa-plus']);
+                        }, 10, ['icon' => 'fa fa-fw fa-plus']);
-                }
+                    }
 
-                $sub->route('widgets.overview', trans('admin/mainMenu.widgetsOverview'), [], 20, ['icon' => 'fa fa-fw fa-list']);
+                    $sub->route('widgets.overview', trans('admin/mainMenu.widgetsOverview'), [], 20, ['icon' => 'fa fa-fw fa-list']);
 
-                // menu for widget areas
+                    // menu for widget areas
-                $sub->dropdown(trans('admin/mainMenu.widgetAreas'), function ($sub) {
+                    if ($user->can('manage', WidgetArea::class)) {
-                    $sub->route('widgetareas.new', trans('admin/mainMenu.newWidgetArea'), [], 1, ['icon' => 'fa fa-fw fa-plus']);
+                        $sub->dropdown(trans('admin/mainMenu.widgetAreas'), function ($sub) use ($user) {
-                    $sub->route('widgetareas.overview', trans('admin/mainMenu.widgetAreaOverview'), [], 2, ['icon' => 'fa fa-fw fa-list']);
+                            if ($user->can('create-widgetareas', WidgetArea::class)) {
-                }, 50, ['icon' => 'fa fa-fw fa-object-group']);
+                                $sub->route('widgetareas.new', trans('admin/mainMenu.newWidgetArea'), [], 1, ['icon' => 'fa fa-fw fa-plus']);
-            }, 50, ['icon' => 'fa fa-fw fa-puzzle-piece']);
+                            }
+                            $sub->route('widgetareas.overview', trans('admin/mainMenu.widgetAreaOverview'), [], 2, ['icon' => 'fa fa-fw fa-list']);
+                        }, 50, ['icon' => 'fa fa-fw fa-object-group']);
+                    }
+                }, 50, ['icon' => 'fa fa-fw fa-puzzle-piece']);
+            }
 
             /**
              * Divide system entries and other links in menu
              */
             $menu->addDivider(9999);
 
-            $menu->dropdown(trans('admin/mainMenu.system'), function ($sub) {
+            $menu->dropdown(trans('admin/mainMenu.system'), function ($sub) use ($user) {
 
                 /**
                  * User management
                  */
-                $sub->dropdown(trans('admin/mainMenu.userManagement'), function ($sub) {
+                if ($user->can('manage', User::class)) {
-                    $sub->route('users.new', trans('admin/mainMenu.newUser'), [], 10, ['icon' => 'fa fa-fw fa-user-plus']);
+                    $sub->dropdown(trans('admin/mainMenu.userManagement'), function ($sub) use ($user) {
-                    $sub->route('users.overview', trans('admin/mainMenu.usersOverview'), [], 30, ['icon' => 'fa fa-fw fa-users']);
+                        if ($user->can('create', User::class)) {
-                }, 20, ['icon' => 'fa fa-fw fa-users']);
+                            $sub->route('users.new', trans('admin/mainMenu.newUser'), [], 10, ['icon' => 'fa fa-fw fa-user-plus']);
+                        }
+                        $sub->route('users.overview', trans('admin/mainMenu.usersOverview'), [], 30, ['icon' => 'fa fa-fw fa-users']);
+                    }, 20, ['icon' => 'fa fa-fw fa-users']);
+                }
 
                 /**
                  * Templates
                  */
-                $templatePaths = TemplatePathsHumanReadableRootOnly::getWithTranslations();
+                if ($user->can('manage', Template::class)) {
-                if (!empty($templatePaths)) {
+                    $templatePaths = TemplatePathsHumanReadableRootOnly::getWithTranslations();
-                    $sub->dropdown(trans('admin/mainMenu.templates'), function ($sub) use ($templatePaths) {
+                    if (!empty($templatePaths)) {
-                        $i = 1;
+                        $sub->dropdown(trans('admin/mainMenu.templates'), function ($sub) use ($templatePaths) {
-                        foreach ($templatePaths as $id => $name) {
+                            $i = 1;
-                            $sub->route('templates.overview', $name, ['id' => $id], $i++);
+                            foreach ($templatePaths as $id => $name) {
-                        }
+                                $sub->route('templates.overview', $name, ['id' => $id], $i++);
-                    }, 60, ['icon' => 'fa fa-fw fa-file-code-o']);
+                            }
+                        }, 60, ['icon' => 'fa fa-fw fa-file-code-o']);
+                    }
                 }
 
-                $sub->route('log.overview', trans('admin/mainMenu.actionLog'), [], 70, ['icon' => 'fa fa-fw fa-history']);
+                if ($user->can('manage', ActionLogType::class)) {
-                $sub->route('settings.overview', trans('admin/mainMenu.settings'), [], 80, ['icon' => 'fa fa-fw fa-gear']);
+                    $sub->route('log.overview', trans('admin/mainMenu.actionLog'), [], 70, ['icon' => 'fa fa-fw fa-history']);
+                }
+
+                if ($user->can('manage', Settings::class)) {
+                    $sub->route('settings.overview', trans('admin/mainMenu.settings'), [], 80, ['icon' => 'fa fa-fw fa-gear']);
+                }
             }, 10000, ['icon' => 'fa fa-fw fa-gears']);
         });
 

app/CMS/MenuPresenters/MetismenuPresenter.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\CMS\MenuPresenters;
 
 use Nwidart\Menus\MenuItem;
@@ -27,6 +28,10 @@ class MetismenuPresenter extends Presenter
      */
     public function getMenuWithoutDropdownWrapper($item)
     {
+        if (!is_string($item->getUrl())) {
+            return null;
+        }
+
         return '<li' . $this->getActiveState($item) . '><a href="' . $item->getUrl() . '">' . $item->getIcon() . ' ' . $item->title . '</a></li>' . PHP_EOL;
     }
 

app/CMS/Repositories/Content/Content.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\CMS\Repositories\Content;
 
 use App\CMS\Contracts\Repositories\Content as IContent;
@@ -113,6 +114,7 @@ class Content extends Repository implements IContent
                              ->whereNull('contents.deleted_at')
                              ->where('contents.language', LaravelLocalization::getCurrentLocale())
                              ->where('modules.enabled', 1)
+                             ->with('module')
                              ->orderBy('contents.created_at', 'DESC');
 
         // filter results using handler

app/CMS/Repositories/Permissions/Permission.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\CMS\Repositories\Permissions;
+
+use App\Models\Permissions\Permission as PermissionModel;
+
+class Permission
+{
+    public function getRootPermissions()
+    {
+        return PermissionModel::whereNull('parent_id')
+                              ->with('subpermissions')
+                              ->get();
+    }
+}

app/Http/Controllers/Admin/Permissions.php

@@ -2,85 +2,40 @@
 
 namespace App\Http\Controllers\Admin;
 
-use Illuminate\Http\Request;
 use App\Http\Controllers\Controller;
-use Illuminate\Support\Facades\Auth;
+use App\Models\Permissions\Permission;
+use App\Models\User;
+use Illuminate\Http\Request;
 
 class Permissions extends Controller
 {
-    /**
-     * Display a listing of the resource.
-     *
-     * @return \Illuminate\Http\Response
-     */
-    public function index()
-    {
-        dd(Auth::user()->permissions);
-    }
-
-    /**
-     * Show the form for creating a new resource.
-     *
-     * @return \Illuminate\Http\Response
-     */
-    public function create()
-    {
-        //
-    }
-
-    /**
-     * Store a newly created resource in storage.
-     *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
-     */
-    public function store(Request $request)
-    {
-        //
-    }
-
-    /**
-     * Display the specified resource.
-     *
-     * @param  int  $id
-     * @return \Illuminate\Http\Response
-     */
-    public function show($id)
-    {
-        //
-    }
-
-    /**
-     * Show the form for editing the specified resource.
-     *
-     * @param  int  $id
-     * @return \Illuminate\Http\Response
-     */
-    public function edit($id)
-    {
-        //
-    }
-
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
+     * @param  \Illuminate\Http\Request $request
-     * @param  int  $id
+     * @param  int                      $id
-     * @return \Illuminate\Http\Response
-     */
-    public function update(Request $request, $id)
-    {
-        //
-    }
-
-    /**
-     * Remove the specified resource from storage.
      *
-     * @param  int  $id
      * @return \Illuminate\Http\Response
      */
-    public function destroy($id)
+    public function update(Request $request, User $user)
     {
-        //
+        $permissionIds = $request->get('permissions', []);
+        $permissions = Permission::whereIn('string_id', array_keys($permissionIds))
+                                 ->get();
+
+        \DB::transaction(function () use ($user, $permissions) {
+            // remove all permissions
+            $user->permissions()
+                 ->detach();
+
+            foreach ($permissions as $permission) {
+                $user->permissions()
+                     ->attach($permission->id);
+            }
+        });
+
+        return redirect()
+            ->back()
+            ->with('success', trans('admin/permissions.successfullySet'));
     }
 }

app/Http/Controllers/Admin/Users/UserDetail.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Admin\Users;
 use App\CMS\Enumerations\UserRoles;
 use App\CMS\Enumerations\UserStates;
 use App\Cms\Repositories\ActionLog\Actions;
+use App\CMS\Repositories\Permissions\Permission;
 use App\Http\Controllers\Admin\Controller;
 use App\Models\ActionLog\ActionLog;
 use App\Models\User;
@@ -29,16 +30,17 @@ class UserDetail extends Controller
             $user = Auth::user();
         }
 
-
         $actions = $this->log->getUserActions($user->id, 10);
         $roles = UserRoles::getWithTranslations();
         $states = UserStates::getWithTranslations();
+        $permissions = app(Permission::class)->getRootPermissions();
 
         return view('admin.userManagement.detail', [
-            'user'     => $user,
+            'user'        => $user,
-            'statuses' => $states,
+            'statuses'    => $states,
-            'roles'    => $roles,
+            'roles'       => $roles,
-            'actions'  => $actions
+            'actions'     => $actions,
+            'permissions' => $permissions
         ]);
     }
 }

app/Http/Kernel.php

@@ -57,7 +57,6 @@ class Kernel extends HttpKernel
     protected $routeMiddleware = [
         'can'                   => Authorize::class,
         'auth'                  => Middleware\Admin\Authenticate::class,
-        'onlyAdmin'             => Middleware\Admin\RequireAdminRole::class,
         'adminMenu'             => Middleware\Admin\AdminMenuRegistrator::class,
         'guest'                 => Middleware\RedirectIfAuthenticated::class,
         'throttle'              => ThrottleRequests::class,

app/Http/Middleware/Admin/RequireAdminRole.php

@@ -1,28 +0,0 @@
-<?php
-
-namespace App\Http\Middleware\Admin;
-
-use App\Models\User;
-use Closure;
-
-class RequireAdminRole
-{
-    /**
-     * Handle an incoming request.
-     *
-     * @param  \Illuminate\Http\Request $request
-     * @param  \Closure                 $next
-     *
-     * @return mixed
-     */
-    public function handle($request, Closure $next)
-    {
-        if (\Auth::user()->role != User::ROLE_ADMIN) {
-            return redirect()
-                ->back()
-                ->with('error', trans('auth.accessDenied'));
-        }
-
-        return $next($request);
-    }
-}

app/Models/FileManager/ModelTraits/File.php

@@ -6,6 +6,7 @@ use App\Events\UploadFile;
 use App\Models\FileManager\File as FileModel;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Gate;
 use Symfony\Component\HttpFoundation\File\File as SymphonyFile;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 
@@ -36,6 +37,8 @@ trait File
      */
     public function upload(UploadedFile $file, $data = [])
     {
+        abort_unless(Auth::user()->can('upload', FileModel::class), 403);
+
         $data = (object)$data;
 
         $destination = config('app.upload_path');

app/Models/Permission.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Models;
-
-use Illuminate\Database\Eloquent\Model;
-
-class Permission extends Model
-{
-    protected $fillable = [
-        'string_id',
-        'parent_id',
-        'group',
-        'name',
-    ];
-
-    public function parent() {
-        return $this->hasOne(Permission::class, 'parent_id');
-    }
-}

app/Models/Permissions/Permission.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Models\Permissions;
+
+use Illuminate\Database\Eloquent\Model;
+
+class Permission extends Model
+{
+    public $timestamps = false;
+    protected $fillable = [
+        'string_id',
+        'parent_id',
+        'group',
+        'name',
+        'default'
+    ];
+    protected $casts = [
+        'default' => 'boolean'
+    ];
+
+    /**
+     * Assign observer for this model for logging
+     */
+    protected static function boot()
+    {
+        parent::boot();
+
+        self::observe(PermissionObserver::class);
+    }
+
+    public function parent()
+    {
+        return $this->hasOne(Permission::class, 'parent_id');
+    }
+
+    public function subpermissions()
+    {
+        return $this->hasMany(Permission::class, 'parent_id');
+    }
+}

app/Models/Permissions/PermissionObserver.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models\Permissions;
+
+use App\Models\User;
+
+class PermissionObserver
+{
+    /**
+     * Sets default permissions when creating new
+     *
+     * @param Permission $permission
+     */
+    public function created(Permission $permission)
+    {
+        if ($permission->default) {
+            $users = User::where('role', '!=', User::ROLE_VISITOR)
+                         ->get();
+
+            foreach ($users as $user) {
+                $user->permissions()
+                     ->attach($permission->id);
+            }
+        }
+    }
+}

app/Models/User.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Permissions\Permission;
 use App\Notifications\ResetPasswordNotification;
 use Illuminate\Auth\Authenticatable;
 use Illuminate\Contracts\Auth\Authenticatable as AuthenticableInterface;

app/Policies/BasicPolicy.php

@@ -4,17 +4,43 @@ namespace App\Policies;
 
 use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Database\Eloquent\Model;
 
 abstract class BasicPolicy
 {
     use HandlesAuthorization;
 
+    protected $entity;
+
     public function before(User $user, $ability)
     {
-        if ($user->role == User::ROLE_ADMIN) {
+        // check if user can operate on given entity
-            return true;
+        if (!$this->manage($user)) {
+            return false;
         }
+    }
 
-        return null;
+    /**
+     * Can user manage given entity?
+     *
+     * @param User $user
+     *
+     * @return bool
+     */
+    public function manage(User $user) {
+        return $user->hasAbility($this->entity.'-management');
+    }
+
+    /**
+     * Determine whether the user can delete the content.
+     *
+     * @param  \App\Models\User $user
+     * @param Model             $model
+     *
+     * @return mixed
+     */
+    public function delete(User $user, Model $model)
+    {
+        return $user->hasAbility('delete-'.$this->entity);
     }
 }

app/Policies/ContentPolicy.php

@@ -2,48 +2,28 @@
 
 namespace App\Policies;
 
-use App\Models\User;
 use App\Models\Content\Content;
+use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
 
 class ContentPolicy extends BasicPolicy
 {
     use HandlesAuthorization;
-
+    protected $entity = 'contents';
-    /**
-     * Determine whether the user can view the content.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Models\Content\Content  $content
-     * @return mixed
-     */
-    public function view(User $user, Content $content)
-    {
-        //
-    }
-
-    /**
-     * Determine whether the user can create contents.
-     *
-     * @param  \App\Models\User  $user
-     * @return mixed
-     */
-    public function create(User $user)
-    {
-        return true;
-    }
 
     /**
      * Determine whether the user can update the content.
      *
-     * @param  \App\Models\User  $user
+     * @param  \App\Models\User            $user
-     * @param  \App\Models\Content\Content  $content
+     * @param  \App\Models\Content\Content $content
+     *
      * @return mixed
      */
     public function update(User $user, Content $content)
     {
-        if (!$user->hasAbility('update-contents-'.$content->module->alias))
+        if (!$user->hasAbility('update-contents-' . $content->module->alias)) {
             return false;
+        }
 
         if ($user->id != $content->user_id) {
             return $user->hasAbility('update-contents') && $user->hasAbility('update-all-contents');
@@ -52,15 +32,21 @@ class ContentPolicy extends BasicPolicy
         return $user->hasAbility('update-contents');
     }
 
-    /**
+    public function create(User $user, Content $content) {
-     * Determine whether the user can delete the content.
+        return $user->hasAbility('create-contents');
-     *
+    }
-     * @param  \App\Models\User  $user
+
-     * @param  \App\Models\Content\Content  $content
+    public function publish(User $user, Content $content)
-     * @return mixed
-     */
-    public function delete(User $user, Content $content)
     {
-        return $user->hasAbility('delete-contents');
+        return $user->hasAbility('publish-contents');
+    }
+
+    public function setHomepage(User $user, Content $content)
+    {
+        return $user->hasAbility('set-homepage-contents');
+    }
+
+    public function viewHistory(User $user, Content $content) {
+        return $user->hasAbility('view-history-contents');
     }
 }

app/Policies/FilesPolicy.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\FileManager\File;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class FilesPolicy extends BasicPolicy
+{
+    use HandlesAuthorization;
+    protected $entity = 'files';
+
+    /**
+     * Determine whether the user can create appModelsFileManagerFiles.
+     *
+     * @param  User $user
+     * @param File  $file
+     *
+     * @return mixed
+     */
+    public function create(User $user, File $file)
+    {
+        return $user->hasAbility('upload-files');
+    }
+
+    /**
+     * Determine whether the user can update the appModelsFileManagerFile.
+     *
+     * @param  User  $user
+     * @param  File $file
+     *
+     * @return mixed
+     */
+    public function update(User $user, File $file)
+    {
+        return $user->hasAbility('update-files');
+    }
+}

app/Policies/ModulePolicy.php

@@ -2,25 +2,15 @@
 
 namespace App\Policies;
 
-use App\Models\User;
 use App\Models\Module;
+use App\Models\User;
 use Illuminate\Auth\Access\HandlesAuthorization;
+use Illuminate\Database\Eloquent\Model;
 
 class ModulePolicy extends BasicPolicy
 {
     use HandlesAuthorization;
-
+    protected $entity = 'modules';
-    /**
-     * Determine whether the user can view the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function view(User $user, Module $module)
-    {
-        //
-    }
 
     /**
      * Determine whether the user can create modules.
@@ -30,32 +20,8 @@ class ModulePolicy extends BasicPolicy
      *
      * @return mixed
      */
-    public function create(User $user, Module $module)
+    public function create(User $user, Model $module)
     {
-        return $user->hasAbility('create-contents-'.$module->alias);
+        return $user->hasAbility('create-contents-' . $module->alias);
-    }
-
-    /**
-     * Determine whether the user can update the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function update(User $user, Module $module)
-    {
-        //
-    }
-
-    /**
-     * Determine whether the user can delete the module.
-     *
-     * @param  \App\Models\User  $user
-     * @param  \App\Module  $module
-     * @return mixed
-     */
-    public function delete(User $user, Module $module)
-    {
-        //
     }
 }

app/Policies/UserPolicy.php

@@ -8,51 +8,80 @@ use Illuminate\Auth\Access\HandlesAuthorization;
 class UserPolicy extends BasicPolicy
 {
     use HandlesAuthorization;
+    protected $entity = 'users';
 
     /**
-     * Determine whether the user can view the user.
+     * Can current user updates other users (or himself?)
      *
-     * @param  \App\Models\User  $user
+     * @param User $currentUser
-     * @param  \App\Models\User  $user
+     * @param User $user
-     * @return mixed
+     *
+     * @return bool
      */
-    public function view(User $user, User $user)
+    public function update(User $currentUser, User $user)
     {
-
+        return $currentUser->id == $user->id || $currentUser->hasAbility('update-users');
     }
 
     /**
-     * Determine whether the user can create users.
+     * Can user create other users?
      *
-     * @param  \App\Models\User  $user
+     * @param User $user
-     * @return mixed
+     *
+     * @return bool
      */
-    public function create(User $user)
+    public function create(User $user) {
-    {
+        return $user->hasAbility('create-users');
-        //
     }
 
     /**
-     * Determine whether the user can update the user.
+     * Does current user has permissions for setting permissions to other users?
      *
-     * @param  \App\Models\User  $user
+     * @param User $currentUser
-     * @param  \App\Models\User  $user
+     * @param User $user
-     * @return mixed
+     *
+     * @return bool
      */
-    public function update(User $user, User $user)
+    public function setPermissions(User $currentUser, User $user)
     {
-        //
+        if ($currentUser->id == $user->id || $user->role == User::ROLE_VISITOR) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('set-permissions-users');
     }
 
     /**
-     * Determine whether the user can delete the user.
+     * Can logged user change status of other users?
      *
-     * @param  \App\Models\User  $user
+     * @param User $currentUser
-     * @param  \App\Models\User  $user
+     * @param User $user
-     * @return mixed
+     *
+     * @return bool
      */
-    public function delete(User $user, User $user)
+    public function changeStatus(User $currentUser, User $user)
     {
-        //
+        if ($currentUser->id == $user->id) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('change-status-users');
+    }
+
+    /**
+     * Can current user change role of other users?
+     *
+     * @param User $currentUser
+     * @param User $user
+     *
+     * @return bool
+     */
+    public function changeRole(User $currentUser, User $user)
+    {
+        if ($currentUser->id == $user->id) {
+            return false;
+        }
+
+        return $currentUser->hasAbility('change-role-users');
     }
 }

app/Providers/AuthServiceProvider.php

@@ -3,9 +3,11 @@
 namespace App\Providers;
 
 use App\Models\Content\Content;
+use App\Models\FileManager\File;
 use App\Models\Module;
 use App\Models\User;
 use App\Policies\ContentPolicy;
+use App\Policies\FilesPolicy;
 use App\Policies\ModulePolicy;
 use App\Policies\UserPolicy;
 use Illuminate\Foundation\Support\Providers\AuthServiceProvider as IlluminateAuthServiceProvider;
@@ -20,6 +22,7 @@ class AuthServiceProvider extends IlluminateAuthServiceProvider
         Content::class => ContentPolicy::class,
         User::class    => UserPolicy::class,
         Module::class  => ModulePolicy::class,
+        File::class    => FilesPolicy::class,
     ];
 
     /**

database/migrations/2017_08_10_214109_add_default_permissions.php

@@ -0,0 +1,66 @@
+<?php
+
+use App\Models\Permissions\Permission;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddDefaultPermissions extends Migration
+{
+    /**
+     * Run the migrations.
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('permissions', function (Blueprint $table) {
+            $table->boolean('default')
+                  ->default(false);
+        });
+
+        Permission::getQuery()
+                  ->delete();
+
+        $permissions = [
+            'contents'    => ['create', 'update', 'update-all', 'delete', 'set-homepage', 'publish', 'draft', 'protect', 'view-history'],
+            'users'       => ['create', 'update', 'delete', 'set-permissions', 'change-status', 'change-role'],
+            'files'       => ['upload', 'update', 'delete', 'move-to-directories'],
+            'directories' => ['create', 'edit', 'delete'],
+            'widgetareas' => ['create', 'edit', 'delete'],
+            'widgets' => ['create', 'edit', 'delete', 'assign', 'unassign'],
+            'templates' => ['copy', 'edit'],
+            'actions' => [],
+            'settings' => []
+        ];
+        foreach ($permissions as $entity => $abilities) {
+
+            $parent = Permission::create([
+                                             'name'      => 'admin/permissions.' . $entity . '.management',
+                                             'string_id' => $entity . '-management',
+                                             'group'     => $entity,
+                                             'default'   => true,
+                                         ]);
+
+            foreach ($abilities as $ability) {
+                Permission::create([
+                                       'name'      => 'admin/permissions.' . $entity . '.' . $ability,
+                                       'string_id' => $ability . '-' . $entity,
+                                       'group'     => $entity,
+                                       'parent_id' => $parent->id,
+                                       'default'   => true,
+                                   ]);
+            }
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('permissions', function (Blueprint $table) {
+            $table->dropColumn('default');
+        });
+    }
+}

resources/assets/admin/js/app.js

@@ -317,23 +317,6 @@ $ (function () {
 
 });
 
-$ (function () {
-
-	$ ("body").addClass ("loaded");
-
-	var notification = $ ('.notification');
-	if (notification.length) {
-
-		notification.click (function () {
-			$ (this).fadeOut ('fast');
-		});
-
-		setTimeout (function () {
-			notification.fadeOut (1500)
-		}, 5 * 1000)
-	}
-});
-
 /**
  * Makes slug from input string
  *
@@ -370,6 +353,21 @@ function slugify(text, trimSpaces) {
 
 // bind some custom methods
 $ (document).ready (function () {
+
+	$ ("body").addClass ("loaded");
+
+	var notification = $ ('.notification');
+	if (notification.length) {
+
+		notification.click (function () {
+			$ (this).fadeOut ('fast');
+		});
+
+		setTimeout (function () {
+			notification.fadeOut (1500)
+		}, 5 * 1000)
+	}
+
 	var previousTitle, previousMessage;
 
 	$ ('.confirm').click (function (e) {
@@ -439,3 +437,11 @@ $ (document).ready (function () {
 
 	$('form').areYouSure();
 });
+
+$('.checkbox').change(function() {
+	var e = $(this);
+	var checked = e.is(':checked');
+	var id = e.data('id');
+
+	$('.child-'+id).prop('checked', checked);
+});

resources/lang/cs/admin/permissions.php

@@ -0,0 +1,64 @@
+<?php
+return [
+    'successfullySet' => 'Oprávnění úspěšně nastavena.',
+    'contents'        => [
+        'management'   => 'Správa obsahu',
+        'create'       => 'Vytvořit novou stránku',
+        'update'       => 'Upravovat své stránky',
+        'update-all'   => 'Upravovat i cizí stránky',
+        'delete'       => 'Mazat',
+        'set-homepage' => 'Nastavovat domovskou stránku',
+        'publish'      => 'Publikovat',
+        'protect'      => 'Publikovat jen pro přihlášené',
+        'draft'        => 'Skrýt publikovanou stránku',
+    ],
+    'users'           => [
+        'management'      => 'Správa uživatelů',
+        'create'          => 'Vytvořit nového uživatele',
+        'update'          => 'Upravovat ostatní uživatele',
+        'block'           => 'Zablokovat',
+        'delete'          => 'Mazat',
+        'unblock'         => 'Odblokovat',
+        'set-permissions' => 'Nastavovat oprávnění',
+        'change-role'     => 'Změnit roli',
+        'change-status'   => 'Změnit status uživatele (zablokovat/odblokovat)'
+    ],
+    'files'           => [
+        'management'          => 'Správa souborů',
+        'upload'              => 'Nahrávání',
+        'update'              => 'Úprava',
+        'delete'              => 'Mazání',
+        'move-to-directories' => 'Přesouvat soubory mezi adresáři'
+    ],
+    'directories'     => [
+        'management' => 'Správa složek',
+        'create'     => 'Vytváření',
+        'edit'       => 'Úprava',
+        'delete'     => 'Mazání'
+    ],
+    'widgetareas'     => [
+        'management' => 'Správa ploch pro widgety',
+        'create'     => 'Vytváření',
+        'edit'       => 'Úprava',
+        'delete'     => 'Mazání'
+    ],
+    'widgets'         => [
+        'management' => 'Správa widgetů',
+        'create'     => 'Vytváření',
+        'edit'       => 'Úprava',
+        'delete'     => 'Mazání',
+        'assign'     => 'Přiřazování widgetů do plochy',
+        'unassign'   => 'Odstraňování widgetů z plochy'
+    ],
+    'templates'       => [
+        'management' => 'Správa šablon',
+        'copy'       => 'Kopírování',
+        'edit'       => 'Úprava',
+    ],
+    'actions'         => [
+        'management' => 'Zobrazení přehledu akcí',
+    ],
+    'settings'        => [
+        'management' => 'Správa nastavení',
+    ]
+];

resources/lang/cs/admin/userManagement.php

@@ -1,32 +1,32 @@
 <?php
 return [
-    "addNewUser" => "Přidat nového uživatele",
+    "addNewUser"              => "Přidat nového uživatele",
-    "allStatuses" => "Všechny",
+    "allStatuses"             => "Všechny",
-    "detail" => "Detaily uživatele :name (:email)",
+    "detail"                  => "Detaily uživatele :name (:email)",
-    "edit" => "Upravit uživatele",
+    "edit"                    => "Upravit uživatele",
-    "editUser" => "Editace uživatele :name (:email)",
+    "editUser"                => "Editace uživatele :name (:email)",
-    "email" => "E-mail",
+    "email"                   => "E-mail",
-    "gravatarLink" => 'Nastavte si avatar na <a href="http://gravatar.com">gravatar.com</a>',
+    "gravatarLink"            => 'Nastavte si avatar na <a href="http://gravatar.com">gravatar.com</a>',
-    "moreUserActions" => "Zobrazit více...",
+    "moreUserActions"         => "Zobrazit více...",
-    "name" => "Celé jméno",
+    "name"                    => "Celé jméno",
-    "noActions" => "Uživatel zatím v systému nic neudělal.",
+    "noActions"               => "Uživatel zatím v systému nic neudělal.",
-    "noUsers" => "Žádní uživatelé.",
+    "noUsers"                 => "Žádní uživatelé.",
-    "overview" => "Seznam všech uživatelů",
+    "overview"                => "Seznam všech uživatelů",
-    "password" => "Heslo",
+    "password"                => "Heslo",
-    "passwordLeaveEmpty" => "Nevyplňujte, pokud nechcete změnit heslo.",
+    "passwordLeaveEmpty"      => "Nevyplňujte, pokud nechcete změnit heslo.",
-    "profile" => "Profil uživatele",
+    "profile"                 => "Profil uživatele",
-    "register" => "Vytvořit uživatele",
+    "register"                => "Vytvořit uživatele",
     "registrationSuccessfull" => "Nový úživatel úspěšně přidán.",
-    "role_admin" => "Administrátor",
+    "role_admin"              => "Uživatel s přístupem do administrace",
-    "role_editor" => "Editor",
+    "role_visitor"            => "Návštěvník (bez přístupu do administrace)",
-    "role_visitor" => "Návštěvník",
+    "roles"                   => "Prosím, zvolte roli uživatele",
-    "roles" => "Prosím, zvolte roli uživatele",
+    "status"                  => "Stav",
-    "status" => "Stav",
+    "status_active"           => "Aktivní",
-    "status_active" => "Aktivní",
+    "status_blocked"          => "Zablokovaný",
-    "status_blocked" => "Zablokovaný",
+    "status_deleted"          => "Smazaný",
-    "status_deleted" => "Smazaný",
+    "update"                  => "Upravit informace",
-    "update" => "Upravit informace",
+    "userDetail"              => "Informace",
-    "userDetail" => "Informace",
+    "userSuccessfullyEdited"  => "Uživatel úspěšně upraven.",
-    "userSuccessfullyEdited" => "Uživatel úspěšně upraven.",
+    "usersActions"            => "Akce uživatele",
-    "usersActions" => "Akce uživatele",
+    'permissions'             => 'Oprávnění'
 ];

resources/views/admin/content/edit.blade.php

@@ -21,9 +21,12 @@
             </div>
 
             @if ($historySize > 0)
-                <div class="columns text-right col-lg-6">
+                @can('viewHistory', $page)
-                    <a class="btn btn-secondary" href="{{route('content.history', ['id' => $page->id])}}">@lang('admin/contents.showHistory', ['count' => $historySize])</a>
+                    <div class="columns text-right col-lg-6">
-                </div>
+                        <a class="btn btn-secondary"
+                           href="{{route('content.history', ['id' => $page->id])}}">@lang('admin/contents.showHistory', ['count' => $historySize])</a>
+                    </div>
+                @endcan
             @endif
         </div>
     </form>

resources/views/admin/content/overview.blade.php

@@ -4,9 +4,11 @@
 @section('headerButtons')
 
     @if($module->exists === true)
-        <a href="{{route('content.new', ['module' => $module])}}" class="btn btn-primary btn-sm rounded">
+        @can('create', $module)
-            <i class="fa fa-plus"></i>
+            <a href="{{route('content.new', ['module' => $module])}}" class="btn btn-primary btn-sm rounded">
-        </a>
+                <i class="fa fa-plus"></i>
+            </a>
+        @endcan
     @endif
 @endsection
 
@@ -36,26 +38,38 @@
                     @foreach($pages as $page)
                         <div class="row p-tb-15">
                             <div class="col-md-1 hidden-sm-down text-center with-placeholder">
-                                <a href="{{route('content.edit', ['page' => $page])}}">
+                                @can('update', $page)
-                                    @if(!view()->exists(template_name($page->template, false)))
+                                    <a href="{{route('content.edit', ['page' => $page])}}">
-                                        <i class="fa fa-2x text-warning fa-warning" data-toggle="tooltip"
+                                        @if(!view()->exists(template_name($page->template, false)))
-                                           title="@lang('admin/contents.invalidTemplateSelected')"></i>
+                                            <i class="fa fa-2x text-warning fa-warning" data-toggle="tooltip"
-                                    @else
+                                               title="@lang('admin/contents.invalidTemplateSelected')"></i>
-                                        @if(!empty($page->titlePhoto))
-                                            <img src="@thumbnail($page->titlePhoto)" class="placeholder"
-                                                 alt="{{$page->title}}" />
                                         @else
-                                            <img src="{{asset('resources/assets/admin/img/placeholder.png')}}"
+                                            @if(!empty($page->titlePhoto))
-                                                 class="placeholder"
+                                                <img src="@thumbnail($page->titlePhoto)" class="placeholder"
-                                                 alt="{{$page->title}}" />
+                                                     alt="{{$page->title}}" />
+                                            @else
+                                                <img src="{{asset('resources/assets/admin/img/placeholder.png')}}"
+                                                     class="placeholder"
+                                                     alt="{{$page->title}}" />
+                                            @endif
                                         @endif
+                                    </a>
+                                @else
+                                    @if(!empty($page->titlePhoto))
+                                        <img src="@thumbnail($page->titlePhoto)" class="placeholder"
+                                             alt="{{$page->title}}" />
                                     @endif
-                                </a>
+                                @endcannot
                             </div>
                             <div class="col-xs-10 col-md-3 col-lg-4">
-                                <a href="{{route('content.edit', ['page' => $page])}}">
+                                @can('update', $page)
+                                    <a href="{{route('content.edit', ['page' => $page])}}">
+                                        {{$page->title}}
+                                    </a>
+                                @else
                                     {{$page->title}}
-                                </a>
+                                @endcan
+
 
                                 @if($page->isHomepage) <span
                                         class="m-l-10 tag tag-primary">@lang('admin/contents.homepage')</span> @endif
@@ -85,38 +99,45 @@
                                         <ul class="item-actions-list">
 
                                             @if(!$page->isHomepage)
-                                                <li>
+                                                @can('set-homepage', $page)
-
+                                                    <li>
-                                                    <a href="{{route('content.setHomepage', ['page' => $page])}}"
+                                                        <a href="{{route('content.setHomepage', ['page' => $page])}}"
-                                                       data-toggle="tooltip"
+                                                           data-toggle="tooltip"
-                                                       title="@lang('admin/contents.setHomepage')">
+                                                           title="@lang('admin/contents.setHomepage')">
-                                                        <i class="fa fa-home"></i>
+                                                            <i class="fa fa-home"></i>
-                                                    </a>
+                                                        </a>
-                                                </li>
+                                                    </li>
+                                                @endcan
                                             @endif
 
-                                            <li>
+                                            @can('update', $page)
-                                                <a class="edit" href="{{route('content.edit', ['page' => $page])}}"
+                                                <li>
-                                                   data-toggle="tooltip" title="@lang('admin/contents.editPlain')">
+                                                    <a class="edit" href="{{route('content.edit', ['page' => $page])}}"
-                                                    <i class="fa fa-pencil"></i>
+                                                       data-toggle="tooltip" title="@lang('admin/contents.editPlain')">
-                                                </a>
+                                                        <i class="fa fa-pencil"></i>
-                                            </li>
+                                                    </a>
+                                                </li>
+                                            @endcan
 
                                             @if($page->isDraft())
-                                                <li>
+                                                @can('publish', $page)
-                                                    <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'public'])}}"
+                                                    <li>
-                                                       class="confirm" data-toggle="tooltip"
+                                                        <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'public'])}}"
-                                                       title="@lang('admin/contents.makePublic')">
+                                                           class="confirm" data-toggle="tooltip"
-                                                        <i class="fa fa-eye"></i>
+                                                           title="@lang('admin/contents.makePublic')">
-                                                    </a>
+                                                            <i class="fa fa-eye"></i>
-                                                </li>
+                                                        </a>
-                                                <li>
+                                                    </li>
-                                                    <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'protected'])}}"
+                                                @endcan
-                                                       class="confirm" data-toggle="tooltip"
+                                                @can('protect', $page)
-                                                       title="@lang('admin/contents.makeProtected')">
+                                                    <li>
-                                                        <i class="fa fa-lock"></i>
+                                                        <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'protected'])}}"
-                                                    </a>
+                                                           class="confirm" data-toggle="tooltip"
-                                                </li>
+                                                           title="@lang('admin/contents.makeProtected')">
+                                                            <i class="fa fa-lock"></i>
+                                                        </a>
+                                                    </li>
+                                                @endcan
                                             @else
                                                 <li>
                                                     <a href="{{route('page.content', ['url' => $page->url])}}"
@@ -125,26 +146,30 @@
                                                        class="button tiny secondary"><i class="fa fa-globe"></i>
                                                     </a>
                                                 </li>
-                                                <li>
+                                                @can('draft', $page)
-                                                    <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'draft'])}}"
+                                                    <li>
-                                                       class="button tiny warning confirm" data-toggle="tooltip"
+                                                        <a href="{{route('content.changeStatus', ['page' => $page, 'status' => 'draft'])}}"
-                                                       title="@lang('admin/contents.makeDraft')">
+                                                           class="button tiny warning confirm" data-toggle="tooltip"
-                                                        <i class="fa fa-eye-slash"></i>
+                                                           title="@lang('admin/contents.makeDraft')">
-                                                    </a>
+                                                            <i class="fa fa-eye-slash"></i>
-                                                </li>
+                                                        </a>
+                                                    </li>
+                                                @endcan
                                             @endif
 
-                                            <li>
+                                            @can('delete', $page)
-                                                <a href="{{route('content.delete', ['page' => $page])}}"
+                                                <li>
-                                                   class="button tiny alert remove confirm" data-toggle="tooltip"
+                                                    <a href="{{route('content.delete', ['page' => $page])}}"
-                                                   title="@lang('admin/contents.deletePage')"><i
+                                                       class="button tiny alert remove confirm" data-toggle="tooltip"
-                                                            class="fa fa-trash-o"></i>
+                                                       title="@lang('admin/contents.deletePage')"><i
-                                                </a>
+                                                                class="fa fa-trash-o"></i>
-                                            </li>
+                                                    </a>
+                                                </li>
+                                            @endcan
+
                                         </ul>
                                     </div>
                                 </div>
-
                             </div>
                         </div>
                     @endforeach

resources/views/admin/fileManager/edit.blade.php

@@ -2,10 +2,13 @@
 
 @section('pageHeading', @trans('admin/fileManager.edit', ['name' => $file->original_filename]))
 @section('headerButtons')
-    <a href="{{route('upload.delete', ['id' => $file->id])}}" class="btn btn-danger btn-sm confirm rounded" title="@lang('admin/fileManager.delete')">
+    @can('delete', $file)
-        <i class="fa fa-trash"></i>
+        <a href="{{route('upload.delete', ['id' => $file->id])}}" class="btn btn-danger btn-sm confirm rounded"
-    </a>
+           title="@lang('admin/fileManager.delete')">
-    @endsection
+            <i class="fa fa-trash"></i>
+        </a>
+    @endcan
+@endsection
 
 
 @section('content')
@@ -18,21 +21,24 @@
         <div class="col-lg-4">
 
             <div class="row callout secondary">
-                    <h3>{{$file->original_filename}}</h3>
+                <h3>{{$file->original_filename}}</h3>
 
-                    <ul>
+                <ul>
-                        <li>@lang('admin/fileManager.createdAt'): {{$file->created_at}}</li>
+                    <li>@lang('admin/fileManager.createdAt'): {{$file->created_at}}</li>
-                        <li>@lang('admin/fileManager.updatedAt'): {{$file->updated_at}}</li>
+                    <li>@lang('admin/fileManager.updatedAt'): {{$file->updated_at}}</li>
-                        <li>@lang('admin/fileManager.mime'): {{$file->mime_type}}</li>
+                    <li>@lang('admin/fileManager.mime'): {{$file->mime_type}}</li>
-                        <li>@lang('admin/fileManager.hash'): <span title="{{$file->file_hash}}">{{str_limit($file->file_hash, 10)}}</span></li>
+                    <li>@lang('admin/fileManager.hash'): <span
-                        <li>@lang('admin/fileManager.url'): <a href="{{config('app.upload_url')}}/{{$file->filename}}">{{$file->filename}}</a></li>
+                                title="{{$file->file_hash}}">{{str_limit($file->file_hash, 10)}}</span></li>
-                        <li>@lang('admin/fileManager.fileSize'): {{\App\CMS\Helpers\FileManager::getFormattedSize($file)}}</li>
+                    <li>@lang('admin/fileManager.url'): <a
+                                href="{{config('app.upload_url')}}/{{$file->filename}}">{{$file->filename}}</a></li>
+                    <li>@lang('admin/fileManager.fileSize')
+                        : {{\App\CMS\Helpers\FileManager::getFormattedSize($file)}}</li>
 
-                        @foreach($extraInfo as $column => $info)
+                    @foreach($extraInfo as $column => $info)
-                            <li>{{$column}}: {{$info}}</li>
+                        <li>{{$column}}: {{$info}}</li>
-                        @endforeach
+                    @endforeach
 
-                    </ul>
+                </ul>
             </div>
 
             <div class="row">
@@ -49,6 +55,6 @@
 @section('javascripts')
     <script type="text/javascript" src="{{asset('/resources/assets/js/vendor/highlightjs/highlight.min.js')}}"></script>
     <script type="text/javascript">
-        hljs.initHighlightingOnLoad();
+		 hljs.initHighlightingOnLoad ();
     </script>
 @stop

resources/views/admin/fileManager/editForm.blade.php

@@ -1,33 +1,34 @@
-<form method="POST" action="{{route('upload.postEdit', ['id' => $file->id])}}" enctype="multipart/form-data">
+@can('update', $file)
-    {!! csrf_field() !!}
+    <form method="POST" action="{{route('upload.postEdit', ['id' => $file->id])}}" enctype="multipart/form-data">
+        {!! csrf_field() !!}
 
-    <label class="control-label">
+        <label class="control-label">
-        @lang('admin/fileManager.name')
+            @lang('admin/fileManager.name')
-    </label>
+        </label>
 
-    <input class="form-control" type="text" name="name" id="name" value="{{$file->name}}" />
+        <input class="form-control" type="text" name="name" id="name" value="{{$file->name}}" />
 
-    <label class="control-label">
+        <label class="control-label">
-        @lang('admin/fileManager.keywords')
+            @lang('admin/fileManager.keywords')
-    </label>
+        </label>
 
-    <input class="form-control" type="text" name="keywords" id="keywords" value="{{$file->keywords}}" />
+        <input class="form-control" type="text" name="keywords" id="keywords" value="{{$file->keywords}}" />
 
-    <lavel class="control-label">
+        <lavel class="control-label">
-        @lang('admin/fileManager.directory')
+            @lang('admin/fileManager.directory')
-    </lavel>
+        </lavel>
 
-    <select name="directory_id" class="form-control">
+        <select name="directory_id" class="form-control">
-        @include('admin/fileManager.directories.subdirectoriesOptionList', ['directory' => $root, 'depth' => 0, 'file' => $file])
+            @include('admin/fileManager.directories.subdirectoriesOptionList', ['directory' => $root, 'depth' => 0, 'file' => $file])
-    </select>
+        </select>
 
-    <label class="control-label">
+        <label class="control-label">
-        @lang('admin/fileManager.description')
+            @lang('admin/fileManager.description')
-    </label>
+        </label>
 
-    <textarea class="form-control" rows="3" name="description" id="description">{{$file->description}}</textarea>
+        <textarea class="form-control" rows="3" name="description" id="description">{{$file->description}}</textarea>
-
-    <button type="submit" class="btn btn-primary">@lang('admin/fileManager.editButton')</button>
-</form>
 
+        <button type="submit" class="btn btn-primary">@lang('admin/fileManager.editButton')</button>
+    </form>
+@endcan
 

resources/views/admin/fileManager/filesTiles.blade.php

@@ -4,7 +4,7 @@
         'body' => '<a href="'.route('upload.detail', ['id' => $file->id]).'">'.\App\CMS\Helpers\FileManager::getPreview($file).'</a>',
         'footerClass' => 'text-right',
         'cardClass' => 'file-preview',
-        'footer' => (!isset($hideDelete) || !$hideDelete) ? '<a href="'.route('upload.delete', ['id' => $file->id]).'" data-toggle="tooltip"
+        'footer' => \Auth::user()->can('delete', $file) && (!isset($hideDelete) || !$hideDelete) ? '<a href="'.route('upload.delete', ['id' => $file->id]).'" data-toggle="tooltip"
                class="btn btn-sm btn-danger confirm"
                title="'.trans('admin/fileManager.delete').'">
                 <i class="fa fa-trash"></i>

resources/views/admin/fileManager/overview.blade.php

@@ -16,20 +16,24 @@
 
         <div class="col-lg-4">
             <div id="file-manager-controls" role="tablist" aria-multiselectable="true">
-                <div class="panel panel-default">
+                @can('upload', \App\Models\FileManager\File::class)
-                    <div class="panel-heading" role="tab" id="new-file-title">
+
-                        <h5 class="panel-title">
+                    <div class="panel panel-default">
-                            <a class="collapsed" data-toggle="collapse" data-parent="#file-manager-controls"
+                        <div class="panel-heading" role="tab" id="new-file-title">
-                               href="#new-file" aria-expanded="false" aria-controls="new-file">
+                            <h5 class="panel-title">
-                                @lang('admin/fileManager.newFile')
+                                <a class="collapsed" data-toggle="collapse" data-parent="#file-manager-controls"
-                            </a>
+                                   href="#new-file" aria-expanded="false" aria-controls="new-file">
-                        </h5>
+                                    @lang('admin/fileManager.newFile')
+                                </a>
+                            </h5>
+                        </div>
+                        <div id="new-file" class="panel-collapse collapse" role="tabpanel"
+                             aria-labelledby="new-file-title">
+                            @include('admin.fileManager.newFileForm')
+                        </div>
                     </div>
-                    <div id="new-file" class="panel-collapse collapse" role="tabpanel"
+                @endcan
-                         aria-labelledby="new-file-title">
+
-                        @include('admin.fileManager.newFileForm')
-                    </div>
-                </div>
 
                 @if (!$directory->is_root)
                     <div class="panel panel-default">
@@ -48,20 +52,22 @@
                     </div>
                 @endif
 
-                <div class="panel panel-default">
+                @can('create', \App\Models\FileManager\Directory::class)
-                    <div class="panel-heading" role="tab" id="new-dir-title">
+                    <div class="panel panel-default">
-                        <h5 class="panel-title">
+                        <div class="panel-heading" role="tab" id="new-dir-title">
-                            <a class="collapsed" data-toggle="collapse" data-parent="#file-manager-controls"
+                            <h5 class="panel-title">
-                               href="#new-dir" aria-expanded="false" aria-controls="new-dir">
+                                <a class="collapsed" data-toggle="collapse" data-parent="#file-manager-controls"
-                                @lang('admin/fileManager.newDirectory')
+                                   href="#new-dir" aria-expanded="false" aria-controls="new-dir">
-                            </a>
+                                    @lang('admin/fileManager.newDirectory')
-                        </h5>
+                                </a>
+                            </h5>
+                        </div>
+                        <div id="new-dir" class="panel-collapse collapse" role="tabpanel"
+                             aria-labelledby="new-dir-title">
+                            @include('admin.fileManager.directories.form', ['directory' => $newDirectory, 'action' => route('upload.postNewDirectory')])
+                        </div>
                     </div>
-                    <div id="new-dir" class="panel-collapse collapse" role="tabpanel"
+                @endcan
-                         aria-labelledby="new-dir-title">
-                        @include('admin.fileManager.directories.form', ['directory' => $newDirectory, 'action' => route('upload.postNewDirectory')])
-                    </div>
-                </div>
             </div>
         </div>
     </div>

resources/views/admin/history/overview.blade.php

@@ -33,7 +33,9 @@
         @endforeach
     </ul>
 
-    <a href="{{route('content.edit', ['id' => $page->id])}}" class="btn btn-primary">
+    @can('update', $page)
-        @lang('admin/history.backToEdit')
+        <a href="{{route('content.edit', ['id' => $page->id])}}" class="btn btn-primary">
-    </a>
+            @lang('admin/history.backToEdit')
+        </a>
+    @endcan
 @stop

resources/views/admin/userManagement/detail.blade.php

@@ -32,12 +32,24 @@
                     </a>
                 </li>
 
-                <li class="nav-item">
+                @can('update', $user)
-                    <a class="nav-link" data-toggle="tab" href="#user-edit" role="tab" id="user-edit-tab"
+                    <li class="nav-item">
-                       aria-controls="user-edit">
+                        <a class="nav-link" data-toggle="tab" href="#user-edit" role="tab" id="user-edit-tab"
-                        @lang('admin/userManagement.edit')
+                           aria-controls="user-edit">
-                    </a>
+                            @lang('admin/userManagement.edit')
-                </li>
+                        </a>
+                    </li>
+                @endcan
+
+                @can('set-permissions', $user)
+                    <li class="nav-item">
+                        <a class="nav-link" data-toggle="tab" href="#user-permissions" role="tab"
+                           id="user-permissions-tab"
+                           aria-controls="user-edit">
+                            @lang('admin/userManagement.permissions')
+                        </a>
+                    </li>
+                @endcan
 
                 <li class="nav-item">
                     <a class="nav-link" data-toggle="tab" href="#user-actions" role="tab" id="user-actions-tab"
@@ -60,9 +72,17 @@
 
                 </div>
 
-                <div class="tab-pane" id="user-edit" role="tabpanel">
+                @can('update', $user)
-                    @include('admin.userManagement.editForm', ['states' => $statuses])
+                    <div class="tab-pane" id="user-edit" role="tabpanel">
-                </div>
+                        @include('admin.userManagement.editForm', ['states' => $statuses])
+                    </div>
+                @endcan
+
+                @can('set-permissions', $user)
+                    <div class="tab-pane" id="user-permissions" role="tabpanel">
+                        @include('admin.userManagement.permissions.form')
+                    </div>
+                @endcan
 
                 <div class="tab-pane" id="user-actions" role="tabpanel">
                     @if (!empty($actions))

resources/views/admin/userManagement/editForm.blade.php

@@ -29,8 +29,9 @@
            name="password"
            value="">
 
-    @if (\Auth::user()->role == \App\Models\User::ROLE_ADMIN && \Auth::user()->id != $user->id)
+    <div class="row">
-        <div class="row">
+        @can('change-role', $user)
+
             <div class="col-lg-6">
 
                 <label class="label-control">
@@ -43,7 +44,9 @@
                     @endforeach
                 </select>
             </div>
+        @endcan
 
+        @can('change-status', $user)
             <div class="col-lg-6">
                 <label class="label-control">
                     @lang('admin/userManagement.status')
@@ -55,8 +58,8 @@
                     @endforeach
                 </select>
             </div>
-        </div>
+        @endcan
-    @endif
+    </div>
 
     <button type="submit" class="btn btn-primary">@lang('admin/userManagement.update')</button>
 </form>

resources/views/admin/userManagement/permissions/form.blade.php

@@ -0,0 +1,34 @@
+<form action="{{route('permissions.update', ['user' => $user])}}" method="post">
+    {!! csrf_field() !!}
+
+    @foreach($permissions as $permission)
+
+        <div>
+            <label>
+                <input class="checkbox" data-id="{{$permission->id}}" value="1"
+                       @if($user->hasAbility($permission->string_id))
+                       checked
+                       @endif name="permissions[{{$permission->string_id}}]" type="checkbox">
+                <span>{{trans($permission->name)}}</span>
+            </label>
+        </div>
+
+        @if($permission->subpermissions->count() > 0)
+            @foreach($permission->subpermissions as $subpermission)
+                <div>
+                    <label>
+                        <i class="fa fa-fw"></i>
+                        <input class="checkbox child-{{$subpermission->parent_id}}" value="1"
+                               @if($user->hasAbility($permission->string_id) && $user->hasAbility($subpermission->string_id))
+                               checked
+                               @endif name="permissions[{{$subpermission->string_id}}]" type="checkbox">
+                        <span>{{trans($subpermission->name)}}</span>
+                    </label>
+                </div>
+            @endforeach
+        @endif
+
+    @endforeach
+
+    <button class="btn btn-primary">Ulozit</button>
+</form>

routes/admin.php

@@ -31,7 +31,8 @@ Route::group([
 
     // list of all actions
     Route::get('actions', 'ActionLog\Overview@index')
-         ->name('log.overview');
+         ->name('log.overview')
+         ->middleware('can:manage,' . \App\Models\ActionLog\ActionLog::class);
 
     // search form with results
     Route::get('search', 'Search@getSearch')

routes/admin/contents.php

@@ -2,7 +2,8 @@
 Route::group(['namespace' => 'Contents'], function () {
     // list of all static pages
     Route::get('content/overview/{module?}', 'ContentOverview@index')
-         ->name('content.overview');
+         ->name('content.overview')
+         ->middleware('can:manage,' . \App\Models\Content\Content::class);
 
     // form for creating new static page
     Route::get('content/new/{module}', 'CreateNewContent@create')
@@ -16,29 +17,36 @@ Route::group(['namespace' => 'Contents'], function () {
 
     // post method for creating new static page
     Route::post('content/new/{module}', 'CreateNewContent@store')
-         ->name('content.newPost');
+         ->name('content.newPost')
+         ->middleware('can:create,module');
 
     // post method for creating new static page
     Route::post('content/edit/{page}', 'EditContent@update')
-         ->name('content.editPost');
+         ->name('content.editPost')
+         ->middleware('can:update,page');
 
     // change status of page (protected, public or draft)
     Route::get('content/status/{page}/{status}', 'ContentActions@changeStatus')
-         ->name('content.changeStatus');
+         ->name('content.changeStatus')
+         ->middleware('can:changeStatus,page');
 
     // set homepage
     Route::get('content/homepage/{page}', 'ContentActions@setHomepage')
-         ->name('content.setHomepage');
+         ->name('content.setHomepage')
+         ->middleware('can:setHomepage,page');
 
     // delete page
     Route::get('content/delete/{page}', 'ContentActions@delete')
-         ->name('content.delete');
+         ->name('content.delete')
+         ->middleware('can:delete,page');
 
     // history of changes for specified page
     Route::get('history/{page}', 'History@getOverview')
-         ->name('content.history');
+         ->name('content.history')
+         ->middleware('can:viewHistory,page');
 
     // history of changes for specified page
     Route::get('history/{revision}', 'History@getDiff')
-         ->name('history.diff');
+         ->name('history.diff')
+         ->middleware('can:viewHistory,page');
 });

routes/admin/fileManager.php

@@ -2,28 +2,36 @@
 Route::group(['namespace' => 'FileManager'], function () {
 
     Route::get('files/overview/{directory?}', 'UploadedFilesOverview@index')
-         ->name('upload.overview');
+         ->name('upload.overview')
+         ->middleware('can:manage,' . \App\Models\FileManager\File::class);
 
     // uploader methods
     Route::get('directories/edit/{directory}', 'EditDirectory@edit')
-         ->name('upload.editDirectory');
+         ->name('upload.editDirectory')
+         ->middleware('can:update,directory');
 
     Route::post('directories/edit/{directory}', 'EditDirectory@update')
-         ->name('upload.postEditDirectory');
+         ->name('upload.postEditDirectory')
+         ->middleware('can:update,directory');
 
     route::post('directories/new', 'CreateNewDirectory@store')
-         ->name('upload.postNewDirectory');
+         ->name('upload.postNewDirectory')
+         ->middleware('can:create,directory');
 
     Route::get('upload/detail/{file}', 'EditUploadedFile@show')
-         ->name('upload.detail');
+         ->name('upload.detail')
+         ->middleware('can:manage,' . \App\Models\FileManager\File::class);
 
     Route::post('upload/detail/{file}', 'EditUploadedFile@update')
-         ->name('upload.postEdit');
+         ->name('upload.postEdit')
+         ->middleware('can:update,file');
 
     Route::get('upload/delete/{file}', 'EditUploadedFile@delete')
-         ->name('upload.delete');
+         ->name('upload.delete')
+         ->middleware('can:delete,file');
 
     // uploader methods
     Route::post('upload', 'UploadFile@store')
-         ->name('upload.postFile');
+         ->name('upload.postFile')
+         ->middleware('can:upload,' . \App\Models\FileManager\File::class);
 });

routes/admin/permissions.php

@@ -1,3 +1,5 @@
 <?php
 
-Route::resource('permissions', 'Permissions');
+Route::post('permissions/{user}', 'Permissions@update')
+     ->middleware('can:set-permissions,user')
+     ->name('permissions.update');

routes/admin/settings.php

@@ -1,7 +1,9 @@
 <?php
 // form with settings
 Route::get('settings', 'Settings@getOverview')
-     ->name('settings.overview');
+     ->name('settings.overview')
+     ->middleware('can:manage,' . \App\Models\Settings::class);
 
 Route::post('settings', 'Settings@saveSettings')
-     ->name('settings.save');
+     ->name('settings.save')
+     ->middleware('can:manage,' . \App\Models\Settings::class);

routes/admin/templates.php

@@ -1,15 +1,19 @@
 <?php
 // these routes are available only for user with role admin
-Route::group(['middleware' => 'onlyAdmin', 'namespace' => 'Templates'], function () {
+Route::group(['namespace' => 'Templates'], function () {
     Route::get('templates/overview/path/{templatePath}', 'TemplateOverview@getPath')
-         ->name('templates.overview');
+         ->name('templates.overview')
+         ->middleware('can:manage,' . \App\Models\Templates\Template::class);
 
     Route::post('templates/copy', 'CopyTemplate@createCopy')
-         ->name('templates.postCopy');
+         ->name('templates.postCopy')
+         ->middleware('can:copy,' . \App\Models\Templates\Template::class);
 
     Route::get('templates/edit/{template}', 'EditTemplate@getEdit')
-         ->name('templates.edit');
+         ->name('templates.edit')
+         ->middleware('can:update,template');
 
     Route::post('templates/edit/{template}', 'EditTemplate@postEdit')
-         ->name('templates.postEdit');
+         ->name('templates.postEdit')
+         ->middleware('can:update,template');
 });

routes/admin/users.php

@@ -2,26 +2,32 @@
 Route::group(['namespace' => 'Users'], function () {
     // display form for creating new user
     Route::get('users/new', 'CreateNewUser@getNewUser')
-         ->name('users.new');
+         ->name('users.new')
+         ->middleware('can:create,' . \App\Models\User::class);
 
     // POST methods
     // display form for creating new user
     Route::post('users/new', 'CreateNewUser@postRegistration')
-         ->name('users.newPost');
+         ->name('users.newPost')
+         ->middleware('can:create,' . \App\Models\User::class);
 
     // display form for edit of existing user
     Route::get('users/edit/{user}', 'EditUser@getEditUser')
-         ->name('users.edit');
+         ->name('users.edit')
+         ->middleware('can:update,user');
 
     // display user detail in admin
     Route::get('users/detail/{user?}', 'UserDetail@getDetail')
-         ->name('users.detail');
+         ->name('users.detail')
+         ->middleware('can:manage,' . \App\Models\User::class);
 
     // method for saving edited data of user
     Route::post('users/edit/{user}', 'EditUser@postEdit')
-         ->name('users.editPost');
+         ->name('users.editPost')
+         ->middleware('can:update,user');
 
     // display list of all users registered into our system
     Route::get('users/overview/{state?}/{perPage?}', 'UsersOverview@getOverview')
-         ->name('users.overview');
+         ->name('users.overview')
+         ->middleware('can:manage,' . \App\Models\User::class);
 });

routes/admin/widgets.php

@@ -4,25 +4,31 @@ Route::group(['namespace' => 'Widgets'], function () {
 
     // list of all installed widget types
     Route::get('widgets', 'WidgetsOverview@index')
-         ->name('widgets.overview');
+         ->name('widgets.overview')
+         ->middleware('can:update,' . \App\Models\Widgets\Widget::class);
 
     // create new instance of widget of given type
     Route::get('widgets/new/{widgetType}', 'CreateNewWidget@getNew')
-         ->name('widgets.new');
+         ->name('widgets.new')
+         ->middleware('can:create,' . \App\Models\Widgets\Widget::class);
 
     Route::post('widgets/new/{widgetType}', 'CreateNewWidget@postNew')
-         ->name('widgets.postNew');
+         ->name('widgets.postNew')
+         ->middleware('can:createf,' . \App\Models\Widgets\Widget::class);
 
     // edit widget settings
     Route::get('widgets/edit/{widget}', 'EditWidget@getEdit')
-         ->name('widgets.edit');
+         ->name('widgets.edit')
+         ->middleware('can:update,widget');
 
     // delete widget settings
     Route::get('widgets/delete/{widget}', 'EditWidget@deleteWidget')
-         ->name('widgets.delete');
+         ->name('widgets.delete')
+         ->middleware('can:delete,widget');
 
     Route::post('widgets/edit/{widget}', 'EditWidget@postEdit')
-         ->name('widgets.postEdit');
+         ->name('widgets.postEdit')
+         ->middleware('can:update,widget');
 
     // display form for association of widget and widget area
     Route::get('widgets/associate/{widgetArea}', 'AssociateWidget@getList')