From 55f2e7c6a2d289ea993d3de38ba93fd6d84c91cd Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Fri, 15 Jun 2018 15:21:10 -0400
Subject: [PATCH] Fix #2124.  Always allow selection of checkboxes, include
 canEdit(Events) in button disabling.

---
 web/skins/classic/js/skin.js.php     |  2 ++
 web/skins/classic/views/events.php   |  7 +++---
 web/skins/classic/views/js/events.js | 36 ++++++++++++++++++----------
 3 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/web/skins/classic/js/skin.js.php b/web/skins/classic/js/skin.js.php
index f726f06a5..f072a911e 100644
--- a/web/skins/classic/js/skin.js.php
+++ b/web/skins/classic/js/skin.js.php
@@ -34,6 +34,8 @@ var skinPath = "<?php echo ZM_SKIN_PATH ?>";
 
 var canEditSystem = <?php echo canEdit('System' )?'true':'false' ?>;
 var canViewSystem = <?php echo canView('System' )?'true':'false' ?>;
+var canEditEvents = <?php echo canEdit('Events' )?'true':'false' ?>;
+var canViewEvents = <?php echo canView('Events' )?'true':'false' ?>;
 
 var canEditGroups = <?php echo canEdit('Groups' )?'true':'false' ?>;
 
diff --git a/web/skins/classic/views/events.php b/web/skins/classic/views/events.php
index 3b62541ce..eb5ccb14d 100644
--- a/web/skins/classic/views/events.php
+++ b/web/skins/classic/views/events.php
@@ -142,7 +142,6 @@ if ( $pages > 1 ) {
 $count = 0;
 $disk_space_total = 0;
 
-Logger::Debug("EventSql: $eventsSql");
 $results = dbQuery($eventsSql);
 while ( $event_row = dbFetchNext($results) ) {
   $event = new Event($event_row);
@@ -173,7 +172,7 @@ while ( $event_row = dbFetchNext($results) ) {
     }
     if ( ZM_WEB_EVENT_DISK_SPACE ) {
 ?>
-              <th class="colDiskSpace"><a href="<?php echo sortHeader( 'DiskSpace' ) ?>"><?php echo translate('DiskSpace') ?><?php echo sortTag( 'DiskSpace' ) ?></a></th>
+              <th class="colDiskSpace"><a href="<?php echo sortHeader('DiskSpace') ?>"><?php echo translate('DiskSpace') ?><?php echo sortTag('DiskSpace') ?></a></th>
 <?php
     }
     if ( ZM_WEB_LIST_THUMBS ) {
@@ -182,7 +181,7 @@ while ( $event_row = dbFetchNext($results) ) {
 <?php
     }
 ?>
-              <th class="colMark"><input type="checkbox" name="toggleCheck" value="1" onclick="toggleCheckbox( this, 'markEids' );"<?php if ( !canEdit( 'Events' ) ) { ?> disabled="disabled"<?php } ?>/></th>
+              <th class="colMark"><input type="checkbox" name="toggleCheck" value="1" onclick="toggleCheckbox(this, 'markEids');"/></th>
             </tr>
 <?php
   }
@@ -226,7 +225,7 @@ while ( $event_row = dbFetchNext($results) ) {
       echo '</td>';
   } // end if ZM_WEB_LIST_THUMBS
 ?>
-              <td class="colMark"><input type="checkbox" name="markEids[]" value="<?php echo $event->Id() ?>" onclick="configureButton( this, 'markEids' );"<?php if ( !canEdit( 'Events' ) ) { ?> disabled="disabled"<?php } ?>/></td>
+              <td class="colMark"><input type="checkbox" name="markEids[]" value="<?php echo $event->Id() ?>" onclick="configureButton(this, 'markEids');"/></td>
             </tr>
 <?php
 }
diff --git a/web/skins/classic/views/js/events.js b/web/skins/classic/views/js/events.js
index b8946ec4d..1b784eaea 100644
--- a/web/skins/classic/views/js/events.js
+++ b/web/skins/classic/views/js/events.js
@@ -11,13 +11,13 @@ function toggleCheckbox( element, name ) {
   for (var i = 0; i < form.elements.length; i++)
     if (form.elements[i].name.indexOf(name) == 0)
       form.elements[i].checked = checked;
-  form.viewBtn.disabled = !checked;
-  form.editBtn.disabled = !checked;
+  form.viewBtn.disabled = !(canViewEvents && checked);
+  form.editBtn.disabled = !(canEditEvents && checked);
   form.archiveBtn.disabled = unarchivedEvents?!checked:true;
-  form.unarchiveBtn.disabled = archivedEvents?!checked:true;
-  form.downloadBtn.disabled = !checked;
-  form.exportBtn.disabled = !checked;
-  form.deleteBtn.disabled = !checked;
+  form.unarchiveBtn.disabled = !(canEditEvents && archivedEvents && checked);
+  form.downloadBtn.disabled = !(canViewEvents && checked);
+  form.exportBtn.disabled = !(canViewEvents && checked);
+  form.deleteBtn.disabled = !(canEditEvents && checked);
 }
 
 function configureButton( element, name ) {
@@ -35,16 +35,20 @@ function configureButton( element, name ) {
   }
   if ( !element.checked )
     form.toggleCheck.checked = false;
-  form.viewBtn.disabled = !checked;
-  form.editBtn.disabled = !checked;
+  form.viewBtn.disabled = !(canViewEvents && checked);
+  form.editBtn.disabled = !(canEditEvents && checked);
   form.archiveBtn.disabled = (!checked)||(!unarchivedEvents);
-  form.unarchiveBtn.disabled = (!checked)||(!archivedEvents);
-  form.downloadBtn.disabled = !checked;
-  form.exportBtn.disabled = !checked;
-  form.deleteBtn.disabled = !checked;
+  form.unarchiveBtn.disabled = !(canEditEvents && checked && archivedEvents);
+  form.downloadBtn.disabled = !(canViewEvents && checked);
+  form.exportBtn.disabled = !(canViewEvents && checked);
+  form.deleteBtn.disabled = !(canEditEvents && checked);
 }
 
 function deleteEvents( element, name ) {
+  if ( ! canEditEvents ) {
+    alert("You do not have permission to delete events.");
+    return;
+  }
   var form = element.form;
   var count = 0;
   for (var i = 0; i < form.elements.length; i++) {
@@ -64,6 +68,10 @@ function deleteEvents( element, name ) {
 }
 
 function editEvents( element, name ) {
+  if ( ! canEditEvents ) {
+    alert("You do not have permission to delete events.");
+    return;
+  }
   var form = element.form;
   var eids = new Array();
   for (var i = 0; i < form.elements.length; i++) {
@@ -125,6 +133,10 @@ function archiveEvents( element, name ) {
 }
 
 function unarchiveEvents(element, name) {
+  if ( ! canEditEvents ) {
+    alert("You do not have permission to delete events.");
+    return;
+  }
   var form = element.form;
   form.elements['action'].value = 'unarchive';
   form.submit();