Skip to content

Commit 4c1620f

Browse files
Vitaliy-1Vitaliy-1
authored
Merge pull request #11225 from Hafsa-Naeem/i10263-stable_3_5_0-fix
#10263 Relax editing metadata on published/posted materials
2 parents 1bd63d3 + b600bf2 commit 4c1620f

File tree

8 files changed

+47
-52
lines changed

8 files changed

+47
-52
lines changed

‎api/v1/submissions/PKPSubmissionController.php

Lines changed: 21 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@
7171
use PKP\submission\reviewAssignment\ReviewAssignment;
7272
use PKP\submissionFile\SubmissionFile;
7373
use PKP\userGroup\UserGroup;
74+
use PKP\observers\events\MetadataChanged;
75+
use PKP\stageAssignment\StageAssignment;
76+
7477

7578
class PKPSubmissionController extends PKPBaseController
7679
{
@@ -1237,16 +1240,12 @@ public function editPublication(Request $illuminateRequest): JsonResponse
12371240
], Response::HTTP_FORBIDDEN);
12381241
}
12391242

1240-
// Publications can not be edited when they are published
1241-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
1242-
return response()->json([
1243-
'error' => __('api.publication.403.cantEditPublished'),
1244-
], Response::HTTP_FORBIDDEN);
1245-
}
1246-
1247-
// Prevent users from editing publications if they do not have permission. Except for admins.
1243+
// only proceed if user is allowed to edit publications
12481244
$userRoles = $this->getAuthorizedContextObject(Application::ASSOC_TYPE_USER_ROLES);
1249-
if (!in_array(Role::ROLE_ID_SITE_ADMIN, $userRoles) && !Repo::submission()->canEditPublication($submission->getId(), $currentUser->getId())) {
1245+
if (
1246+
!in_array(Role::ROLE_ID_SITE_ADMIN, $userRoles) &&
1247+
!Repo::submission()->canEditPublication($submission->getId(), $currentUser->getId())
1248+
) {
12501249
return response()->json([
12511250
'error' => __('api.submissions.403.userCantEdit'),
12521251
], Response::HTTP_FORBIDDEN);
@@ -1276,6 +1275,8 @@ public function editPublication(Request $illuminateRequest): JsonResponse
12761275

12771276
Repo::publication()->edit($publication, $params);
12781277
$publication = Repo::publication()->get($publication->getId());
1278+
event(new MetadataChanged($submission));
1279+
12791280

12801281
$userGroups = UserGroup::withContextIds($submission->getData('contextId'))->cursor();
12811282

@@ -1335,6 +1336,17 @@ public function publishPublication(Request $illuminateRequest): JsonResponse
13351336

13361337
Repo::publication()->publish($publication);
13371338

1339+
$stageAssignments = StageAssignment::withSubmissionIds([$submission->getId()])
1340+
->get();
1341+
1342+
foreach ($stageAssignments as $stageAssignment) {
1343+
$userGroup = $stageAssignment->userGroup;
1344+
if ($userGroup && $userGroup->roleId === Role::ROLE_ID_AUTHOR){
1345+
$stageAssignment->canChangeMetadata = 0;
1346+
$stageAssignment->save();
1347+
}
1348+
}
1349+
13381350
$publication = Repo::publication()->get($publication->getId());
13391351

13401352
$userGroups = UserGroup::withContextIds($submission->getData('contextId'))->cursor();
@@ -1531,13 +1543,6 @@ public function addContributor(Request $illuminateRequest): JsonResponse
15311543
], Response::HTTP_FORBIDDEN);
15321544
}
15331545

1534-
// Publications can not be edited when they are published
1535-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
1536-
return response()->json([
1537-
'error' => __('api.publication.403.cantEditPublished'),
1538-
], Response::HTTP_FORBIDDEN);
1539-
}
1540-
15411546
$params = $this->convertStringsToSchema(PKPSchemaService::SCHEMA_AUTHOR, $illuminateRequest->input());
15421547
$params['publicationId'] = $publication->getId();
15431548

@@ -1603,12 +1608,6 @@ public function deleteContributor(Request $illuminateRequest): JsonResponse
16031608
], Response::HTTP_NOT_FOUND);
16041609
}
16051610

1606-
// Publications can not be edited when they are published
1607-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
1608-
return response()->json([
1609-
'error' => __('api.publication.403.cantEditPublished'),
1610-
], Response::HTTP_FORBIDDEN);
1611-
}
16121611

16131612
if ($submission->getId() !== $publication->getData('submissionId')) {
16141613
return response()->json([
@@ -1665,13 +1664,6 @@ public function editContributor(Request $illuminateRequest): JsonResponse
16651664
], Response::HTTP_FORBIDDEN);
16661665
}
16671666

1668-
// Publications can not be edited when they are published
1669-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
1670-
return response()->json([
1671-
'error' => __('api.publication.403.cantEditPublished'),
1672-
], Response::HTTP_FORBIDDEN);
1673-
}
1674-
16751667
$params = $this->convertStringsToSchema(PKPSchemaService::SCHEMA_AUTHOR, $illuminateRequest->input());
16761668
$params['id'] = $author->getId();
16771669

@@ -1758,13 +1750,6 @@ public function saveContributorsOrder(Request $illuminateRequest): JsonResponse
17581750
], Response::HTTP_FORBIDDEN);
17591751
}
17601752

1761-
// Publications can not be edited when they are published
1762-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
1763-
return response()->json([
1764-
'error' => __('api.publication.403.cantEditPublished'),
1765-
], Response::HTTP_FORBIDDEN);
1766-
}
1767-
17681753
if (!empty($params['sortedAuthors'])) {
17691754
$authors = [];
17701755
foreach ($params['sortedAuthors'] as $author) {

‎classes/author/Repository.php

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,6 @@ public function validate($author, $props, Submission $submission, Context $conte
130130
$publication = Repo::publication()->get($props['publicationId']);
131131
if (!$publication) {
132132
$validator->errors()->add('publicationId', __('author.publicationNotFound'));
133-
} elseif ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
134-
$validator->errors()->add('publicationId', __('author.editPublishedDisabled'));
135133
}
136134
}
137135
});

‎classes/galley/Repository.php

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,6 @@ public function validate(?Galley $object, array $props, array $allowedLocales, s
152152
$publication = Repo::publication()->get($props['publicationId']);
153153
if (!$publication) {
154154
$validator->errors()->add('publicationId', __('galley.publicationNotFound'));
155-
} elseif (in_array($publication->getData('status'), [Submission::STATUS_PUBLISHED, Submission::STATUS_SCHEDULED])) {
156-
$validator->errors()->add('publicationId', __('galley.editPublishedDisabled'));
157155
}
158156
}
159157
});

‎classes/security/authorization/internal/RepresentationUploadAccessPolicy.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,6 @@ public function dataObjectEffect()
8989
}
9090

9191
// Representations can not be modified on published publications
92-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
93-
$this->setAdvice(AuthorizationPolicy::AUTHORIZATION_ADVICE_DENY_MESSAGE, 'galley.editPublishedDisabled');
94-
return AuthorizationPolicy::AUTHORIZATION_DENY;
95-
}
9692

9793
$this->addAuthorizedContextObject(Application::ASSOC_TYPE_REPRESENTATION, $representation);
9894

‎classes/submission/Repository.php

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -514,18 +514,32 @@ public function canCurrentUserDelete(Submission $submission): bool
514514
*/
515515
public function canEditPublication(int $submissionId, int $userId): bool
516516
{
517-
// Replaces StageAssignmentDAO::getBySubmissionAndUserIdAndStageId
518-
$stageAssignments = StageAssignment::withSubmissionIds([$submissionId])
517+
// block authors can never edit a published publication even if an editor granted them canChangeMetadata
518+
$assignments = StageAssignment::withSubmissionIds([$submissionId])
519519
->withUserId($userId)
520520
->get();
521521

522-
// Check for permission from stage assignments
523-
if ($stageAssignments->contains(fn ($stageAssignment) => $stageAssignment->canChangeMetadata)) {
522+
$submission = $this->get($submissionId);
523+
// any published or scheduled then probe
524+
$hasLockedPublication = $submission
525+
&& $submission->getData('publications')
526+
->contains(fn($p) =>
527+
in_array(
528+
$p->getData('status'),
529+
[Submission::STATUS_PUBLISHED, Submission::STATUS_SCHEDULED]
530+
)
531+
);
532+
533+
if ($hasLockedPublication && !$assignments->contains(fn($sa) => $sa->userGroup && $sa->userGroup->roleId !== Role::ROLE_ID_AUTHOR)) {
534+
return false;
535+
}
536+
537+
if ($assignments->contains(fn($sa) => $sa->canChangeMetadata)) {
524538
return true;
525539
}
526540
// If user has no stage assigments, check if user can edit anyway ie. is manager
527541
$context = Application::get()->getRequest()->getContext();
528-
if ($stageAssignments->isEmpty() && $this->_canUserAccessUnassignedSubmissions($context->getId(), $userId)) {
542+
if ($assignments->isEmpty() && $this->_canUserAccessUnassignedSubmissions($context->getId(), $userId)) {
529543
return true;
530544
}
531545
// Else deny access

‎classes/task/PublishSubmissions.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
use APP\submission\Submission;
2121
use PKP\core\Core;
2222
use PKP\scheduledTask\ScheduledTask;
23+
use PKP\observers\events\MetadataChanged;
24+
2325

2426
class PublishSubmissions extends ScheduledTask
2527
{
@@ -50,6 +52,8 @@ public function executeActions(): bool
5052
$datePublished = $submission->getCurrentPublication()->getData('datePublished');
5153
if ($datePublished && strtotime($datePublished) <= strtotime(Core::getCurrentDate())) {
5254
Repo::publication()->publish($submission->getCurrentPublication());
55+
// dispatch the MetadataChanged event after publishing
56+
event(new MetadataChanged($submission));
5357
}
5458
}
5559
}

‎controllers/grid/users/author/AuthorGridHandler.php

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -275,9 +275,6 @@ public function canAdminister($user)
275275
$submission = $this->getSubmission();
276276
$userRoles = $this->getAuthorizedContextObject(Application::ASSOC_TYPE_USER_ROLES);
277277

278-
if ($publication->getData('status') === PKPSubmission::STATUS_PUBLISHED) {
279-
return false;
280-
}
281278

282279
if (in_array(Role::ROLE_ID_SITE_ADMIN, $userRoles)) {
283280
return true;

‎locale/en/submission.po

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ msgstr "Please provide a ROR affiliation or at least one affiliation name."
3939
msgid "author.affiliationNamePrimaryLocaleMissing"
4040
msgstr "Please provide affiliation name in the submission primary locale."
4141

42+
msgid "publication.editorEditWarning"
43+
msgstr "Warning: This version has been published. Editing it may impact the published content."
44+
4245
msgid "ror.nameRequired"
4346
msgstr "A ROR name is required."
4447

0 commit comments

Comments
 (0)