diff --git a/api/v1/submissions/PKPSubmissionHandler.inc.php b/api/v1/submissions/PKPSubmissionHandler.inc.php index fd30c36aa7e..7d3c7b40c17 100644 --- a/api/v1/submissions/PKPSubmissionHandler.inc.php +++ b/api/v1/submissions/PKPSubmissionHandler.inc.php @@ -698,7 +698,7 @@ public function editPublication($slimRequest, $response, $args) { // Prevent users from editing publications if they do not have permission. Except for admins. $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); - if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission->getId(), $currentUser->getId())) { + if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission, $currentUser->getId())) { return $response->withStatus(403)->withJsonError('api.submissions.403.userCantEdit'); } diff --git a/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php b/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php index 1060c87b0da..d283fe69a61 100644 --- a/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php +++ b/classes/security/authorization/internal/PublicationCanBeEditedPolicy.inc.php @@ -37,7 +37,7 @@ public function effect() // Prevent users from editing publications if they do not have permission. Except for admins. $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); - if (in_array(ROLE_ID_SITE_ADMIN, $userRoles) || Services::get('submission')->canEditPublication($submission->getId(), $this->_currentUser->getId())) { + if (in_array(ROLE_ID_SITE_ADMIN, $userRoles) || Services::get('submission')->canEditPublication($submission, $this->_currentUser->getId())) { return AUTHORIZATION_PERMIT; } diff --git a/classes/services/PKPSubmissionService.inc.php b/classes/services/PKPSubmissionService.inc.php index b8fb44dad65..9f93c0a1931 100644 --- a/classes/services/PKPSubmissionService.inc.php +++ b/classes/services/PKPSubmissionService.inc.php @@ -788,13 +788,26 @@ public function delete($submission) { /** * Check if a user can edit a publications metadata * - * @param int $submissionId + * @param Submission $submission * @param int $userId * @return boolean */ - public function canEditPublication($submissionId, $userId) { + public function canEditPublication($submission, $userId) { + $contextId = Application::get()->getRequest()->getContext()->getId(); $stageAssignmentDao = DAORegistry::getDAO('StageAssignmentDAO'); /* @var $stageAssignmentDao StageAssignmentDAO */ - $stageAssignments = $stageAssignmentDao->getBySubmissionAndUserIdAndStageId($submissionId, $userId, null)->toArray(); + $stageAssignments = $stageAssignmentDao->getBySubmissionAndUserIdAndStageId($submission->getId(), $userId, null)->toArray(); + $userIsAuthor = !empty($stageAssignmentDao->getBySubmissionAndRoleId($submission->getId(), ROLE_ID_AUTHOR, null, $userId)->toArray()); + // If the submission is rejected and the user's only role is an author + if ($submission->getStatus() == STATUS_DECLINED && $userIsAuthor) { + $roleDao = DAORegistry::getDAO('RoleDAO'); /* @var $roleDao RoleDAO */ + $roles = $roleDao->getByUserId($userId, $contextId); + foreach ($roles as $role) { + if ($role->getRoleId() != ROLE_ID_AUTHOR && $role->getRoleId() != ROLE_ID_READER) { + return true; + } + } + return false; + } // Check for permission from stage assignments foreach ($stageAssignments as $stageAssignment) { if ($stageAssignment->getCanChangeMetadata()) { @@ -802,8 +815,7 @@ public function canEditPublication($submissionId, $userId) { } } // If user has no stage assigments, check if user can edit anyway ie. is manager - $context = Application::get()->getRequest()->getContext(); - if (count($stageAssignments) == 0 && $this->_canUserAccessUnassignedSubmissions($context->getId(), $userId)) { + if (count($stageAssignments) == 0 && $this->_canUserAccessUnassignedSubmissions($contextId, $userId)) { return true; } // Else deny access diff --git a/controllers/grid/users/author/AuthorGridHandler.inc.php b/controllers/grid/users/author/AuthorGridHandler.inc.php index bfe928f2d87..390ea7e1ccb 100644 --- a/controllers/grid/users/author/AuthorGridHandler.inc.php +++ b/controllers/grid/users/author/AuthorGridHandler.inc.php @@ -256,7 +256,7 @@ function canAdminister($user) { if ($submission->getDateSubmitted() == null) return true; // The user may not be allowed to edit the metadata - if (Services::get('submission')->canEditPublication($submission->getId(), $user->getId())) { + if (Services::get('submission')->canEditPublication($submission, $user->getId())) { return true; } diff --git a/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php b/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php index b75696f3186..59a3d3230b0 100644 --- a/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php +++ b/pages/authorDashboard/PKPAuthorDashboardHandler.inc.php @@ -287,7 +287,7 @@ function setupTemplate($request) { // Check if current author can edit metadata $userRoles = $this->getAuthorizedContextObject(ASSOC_TYPE_USER_ROLES); $canEditPublication = true; - if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission->getId(), $user->getId())) { + if (!in_array(ROLE_ID_SITE_ADMIN, $userRoles) && !Services::get('submission')->canEditPublication($submission, $user->getId())) { $canEditPublication = false; } diff --git a/pages/workflow/PKPWorkflowHandler.inc.php b/pages/workflow/PKPWorkflowHandler.inc.php index 526a675af6a..c551ddd7930 100644 --- a/pages/workflow/PKPWorkflowHandler.inc.php +++ b/pages/workflow/PKPWorkflowHandler.inc.php @@ -145,7 +145,7 @@ function index($args, $request) { $currentStageId = $submission->getStageId(); $accessibleWorkflowStages = $this->getAuthorizedContextObject(ASSOC_TYPE_ACCESSIBLE_WORKFLOW_STAGES); $canAccessPublication = false; // View title, metadata, etc. - $canEditPublication = Services::get('submission')->canEditPublication($submission->getId(), $request->getUser()->getId()); + $canEditPublication = Services::get('submission')->canEditPublication($submission, $request->getUser()->getId()); $canAccessProduction = false; // Access to galleys and issue entry $canPublish = false; // Ability to publish, unpublish and create versions $canAccessEditorialHistory = false; // Access to activity log