From 34e42c0d926bf569ceaf8da784c2569bc7f83cec Mon Sep 17 00:00:00 2001
From: Mark Wells <mark@freeside.biz>
Date: Sun, 27 Nov 2016 16:43:19 -0800
Subject: [PATCH] add RT ACL for bulk updating tickets, #72964

---
 FS/FS/TicketSystem.pm              | 19 +++++++++++++++++++
 rt/FREESIDE_MODIFIED               |  6 ++++++
 rt/lib/RT/System.pm                |  4 ++++
 rt/share/html/Elements/Tabs        |  5 ++++-
 rt/share/html/Search/Bulk.html     |  7 +++++++
 rt/share/html/Ticket/Elements/Tabs | 13 +++++++++----
 6 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/FS/FS/TicketSystem.pm b/FS/FS/TicketSystem.pm
index e81d89328..a683d12ae 100644
--- a/FS/FS/TicketSystem.pm
+++ b/FS/FS/TicketSystem.pm
@@ -381,6 +381,25 @@ sub _upgrade_data {
     warn "Fixed $rows transactions with empty time values\n" if $rows > 0;
   }
 
+  # One-time fix: We've created a "BulkUpdateTickets" access right; grant
+  # it to all auth'd users initially.
+  eval "use FS::upgrade_journal;";
+  my $upgrade = 'RT_add_BulkUpdateTickets_ACL';
+  if (!FS::upgrade_journal->is_done($upgrade)) {
+    my $groups = RT::Groups->new(RT->SystemUser);
+    $groups->LimitToEnabled;
+    $groups->LimitToSystemInternalGroups;
+    $groups->Limit(FIELD => 'Type', VALUE => 'Privileged', OPERATOR => '=');
+    my $group = $groups->First
+      or die "No RT internal group found for Privileged users";
+    my ($val, $msg) = $group->PrincipalObj->GrantRight(
+      Right => 'BulkUpdateTickets', Object => RT->System
+    );
+    die "Couldn't grant BulkUpdateTickets right to all users: $msg\n"
+      if !$val;
+    FS::upgrade_journal->set_done($upgrade);
+  }
+
   return;
 }
 
diff --git a/rt/FREESIDE_MODIFIED b/rt/FREESIDE_MODIFIED
index 05ffb2a46..db5212d5a 100644
--- a/rt/FREESIDE_MODIFIED
+++ b/rt/FREESIDE_MODIFIED
@@ -171,3 +171,9 @@ share/html/Search/Schedule.html
 share/html/Elements/CalendarSlotSchedule
 share/html/Ticket/Display.html
 
+# BulkUpdateTickets ACL
+lib/RT/System.pm
+share/html/Elements/Tabs
+share/html/Search/Bulk.html
+share/html/Ticket/Elements/Tabs
+
diff --git a/rt/lib/RT/System.pm b/rt/lib/RT/System.pm
index 456223878..3bc36c3f4 100644
--- a/rt/lib/RT/System.pm
+++ b/rt/lib/RT/System.pm
@@ -86,6 +86,8 @@ our $RIGHTS = {
     LoadSavedSearch => "Allow loading of saved searches",     # loc_pair
     CreateSavedSearch => "Allow creation of saved searches",      # loc_pair
     ExecuteCode => "Allow writing Perl code in templates, scrips, etc", # loc_pair
+    #freeside
+    BulkUpdateTickets => "Bulk update tickets",
 };
 
 our $RIGHT_CATEGORIES = {
@@ -98,6 +100,8 @@ our $RIGHT_CATEGORIES = {
     LoadSavedSearch        => 'General',
     CreateSavedSearch      => 'General',
     ExecuteCode            => 'Admin',
+    #freeside
+    BulkUpdateTickets      => 'Staff',
 };
 
 # Tell RT::ACE that this sort of object can get acls granted
diff --git a/rt/share/html/Elements/Tabs b/rt/share/html/Elements/Tabs
index bc2badf4a..30f4908c2 100755
--- a/rt/share/html/Elements/Tabs
+++ b/rt/share/html/Elements/Tabs
@@ -756,7 +756,10 @@ my $build_main_nav = sub {
         }
 
         if ( $has_query ) {
-            $current_search_menu->child( bulk  => title => loc('Bulk Update'), path => "/Search/Bulk.html$args" );
+            #freeside
+            if ( $session{'CurrentUser'}->HasRight( Right => 'BulkUpdateTickets', Object => RT->System ) ) {
+              $current_search_menu->child( bulk  => title => loc('Bulk Update'), path => "/Search/Bulk.html$args" );
+            }
             $current_search_menu->child( chart => title => loc('Chart'),       path => "/Search/Chart.html$args" );
 
             #formerly Callbacks/RTx-Calendar/Ticket/Element/Tabs/Default
diff --git a/rt/share/html/Search/Bulk.html b/rt/share/html/Search/Bulk.html
index 89e850bfa..03e6bf027 100755
--- a/rt/share/html/Search/Bulk.html
+++ b/rt/share/html/Search/Bulk.html
@@ -236,6 +236,13 @@ unless ( defined $Rows ) {
 }
 my $title = loc("Update multiple tickets");
 
+#freeside
+unless ( $session{'CurrentUser'}
+         ->HasRight( Right => 'BulkUpdateTickets', Object => RT->System) )
+{
+    Abort('You are not allowed to bulk-update tickets.');
+}
+
 # Iterate through the ARGS hash and remove anything with a null value.
 map ( $ARGS{$_} =~ /^$/ && ( delete $ARGS{$_} ), keys %ARGS );
 
diff --git a/rt/share/html/Ticket/Elements/Tabs b/rt/share/html/Ticket/Elements/Tabs
index 2f89dc61c..bcc97e52a 100755
--- a/rt/share/html/Ticket/Elements/Tabs
+++ b/rt/share/html/Ticket/Elements/Tabs
@@ -326,10 +326,15 @@ if ($has_query) {
         title => loc('Show Results'),
     };
 
-    $tabs->{"j"} = {
-        path  => "Search/Bulk.html$args",
-        title => loc('Bulk Update'),
-    };
+    #freeside
+    if ( $session{'CurrentUser'}
+         ->HasRight(Right => 'BulkUpdateTickets', Object => $RT::System) )
+    {
+      $tabs->{"j"} = {
+          path  => "Search/Bulk.html$args",
+          title => loc('Bulk Update'),
+      };
+    }
 
     $tabs->{"k"} = {
         path  => "Search/Chart.html$args",
-- 
2.11.0