From bad5ecd70f383903d98dd299b3f748a1beca8b68 Mon Sep 17 00:00:00 2001
From: Beu <benoit@virtit.fr>
Date: Mon, 14 Aug 2023 18:18:10 +0200
Subject: [PATCH] ensure to have right to perform actions on the map list

---
 core/Maps/MapList.php    | 6 +++++-
 core/Maps/MapManager.php | 4 ++++
 core/Maps/MapQueue.php   | 8 ++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/core/Maps/MapList.php b/core/Maps/MapList.php
index d4dc0652..289f69b2 100644
--- a/core/Maps/MapList.php
+++ b/core/Maps/MapList.php
@@ -111,6 +111,8 @@ class MapList implements ManialinkPageAnswerListener, CallbackListener {
 	 */
 	public function checkUpdates(array $chatCallback, Player $player) {
 		// Update Mx Infos
+		if (!$this->maniaControl->getAuthenticationManager()->checkPermission($player, MapManager::SETTING_PERMISSION_CHECK_UPDATE)) return;
+
 		$this->maniaControl->getMapManager()->getMXManager()->fetchManiaExchangeMapInformation();
 
 		// Reshow the Maplist
@@ -340,7 +342,7 @@ class MapList implements ManialinkPageAnswerListener, CallbackListener {
 					$description = $map->getEscapedName() . ' is on Map-Queue Position: ' . $queuedMaps[$map->uid];
 					$label->addTooltipLabelFeature($descriptionLabel, $description);
 				}
-			} else {
+			} else if ($this->maniaControl->getAuthenticationManager()->checkPermission($player, MapQueue::SETTING_PERMISSION_ADD_TO_QUEUE)) {
 				// Map-Queue-Map-Button
 				$queueLabel = new Label_Button();
 				$mapFrame->addChild($queueLabel);
@@ -584,6 +586,8 @@ class MapList implements ManialinkPageAnswerListener, CallbackListener {
 				}
 				break;
 			case self::ACTION_SWITCH_MAP:
+				if (!$this->maniaControl->getAuthenticationManager()->checkPermission($player, MapManager::SETTING_PERMISSION_SKIP_MAP)) return;
+
 				// Don't queue on Map-Change
 				$this->maniaControl->getMapManager()->getMapQueue()->dontQueueNextMapChange();
 				try {
diff --git a/core/Maps/MapManager.php b/core/Maps/MapManager.php
index b8c5ad10..bf60f315 100644
--- a/core/Maps/MapManager.php
+++ b/core/Maps/MapManager.php
@@ -195,6 +195,8 @@ class MapManager implements CallbackListener, CommunicationListener, UsageInform
 	 * @param string      $uid
 	 */
 	public function updateMap($admin, $uid) {
+		if (!$this->maniaControl->getAuthenticationManager()->checkPermission($admin, self::SETTING_PERMISSION_ADD_MAP)) return;
+
 		$this->updateMapTimestamp($uid);
 
 		if (!isset($uid) || !isset($this->maps[$uid])) {
@@ -272,6 +274,8 @@ class MapManager implements CallbackListener, CommunicationListener, UsageInform
 	 * @return bool
 	 */
 	public function removeMap($admin, $uid, $eraseFile = false, $message = true) {
+		if (!$this->maniaControl->getAuthenticationManager()->checkPermission($admin, self::SETTING_PERMISSION_REMOVE_MAP)) return;
+
 		if (!isset($this->maps[$uid])) {
 			if ($admin) {
 				$this->maniaControl->getChat()->sendError('Map does not exist!', $admin);
diff --git a/core/Maps/MapQueue.php b/core/Maps/MapQueue.php
index 18b9e4d0..3d09ec10 100644
--- a/core/Maps/MapQueue.php
+++ b/core/Maps/MapQueue.php
@@ -36,6 +36,7 @@ class MapQueue implements CallbackListener, CommandListener, UsageInformationAbl
 	const SETTING_MAPLIMIT_ADMIN            = 'Maximum maps per admin (Admin+) in the Map-Queue (-1 = unlimited)';
 	const SETTING_MESSAGE_FORMAT            = 'Message Format';
 	const SETTING_BUFFERSIZE                = 'Size of the Map-Queue buffer (recently played maps)';
+	const SETTING_PERMISSION_ADD_TO_QUEUE   = 'Add map to queue';
 	const SETTING_PERMISSION_CLEAR_MAPQUEUE = 'Clear MapQueue';
 	const SETTING_PERMISSION_QUEUE_BUFFER   = 'Queue maps in buffer';
 
@@ -74,6 +75,7 @@ class MapQueue implements CallbackListener, CommandListener, UsageInformationAbl
 		$this->maniaControl->getSettingManager()->initSetting($this, self::SETTING_BUFFERSIZE, 10);
 
 		// Permissions
+		$this->maniaControl->getAuthenticationManager()->definePermissionLevel(self::SETTING_PERMISSION_ADD_TO_QUEUE, AuthenticationManager::AUTH_LEVEL_PLAYER, AuthenticationManager::AUTH_LEVEL_PLAYER);
 		$this->maniaControl->getAuthenticationManager()->definePermissionLevel(self::SETTING_PERMISSION_CLEAR_MAPQUEUE, AuthenticationManager::AUTH_LEVEL_MODERATOR);
 		$this->maniaControl->getAuthenticationManager()->definePermissionLevel(self::SETTING_PERMISSION_QUEUE_BUFFER, AuthenticationManager::AUTH_LEVEL_ADMIN);
 
@@ -283,6 +285,8 @@ class MapQueue implements CallbackListener, CommandListener, UsageInformationAbl
 			return;
 		}
 
+		if (!$this->maniaControl->getAuthenticationManager()->checkPermission($player, self::SETTING_PERMISSION_ADD_TO_QUEUE)) return;
+
 		// Check if the Player is muted
 		if ($player->isMuted()) {
 			$this->maniaControl->getChat()->sendError('Muted Players are not allowed to queue a map.', $player);
@@ -369,6 +373,10 @@ class MapQueue implements CallbackListener, CommandListener, UsageInformationAbl
 		if (!isset($this->queuedMaps[$uid])) {
 			return;
 		}
+
+		$queuer = $this->maniaControl->getMapManager()->getMapQueue()->getQueuer($uid);
+		if (($queuer === null || $queuer->login !== $player->login) && !$this->maniaControl->getAuthenticationManager()->checkPermission($player, self::SETTING_PERMISSION_CLEAR_MAPQUEUE)) return;
+
 		/** @var Map $map */
 		$map = $this->queuedMaps[$uid][1];
 		unset($this->queuedMaps[$uid]);