permission check for mark-as-exported buttons (#3313)

src/Controller/ExportController.php

@@ -120,7 +120,6 @@ class ExportController extends AbstractController
         $entries = $this->getEntries($query);
         $response = $renderer->render($entries, $query);
 
-        // TODO check entries if user is allowed to update export state - see https://github.com/kevinpapst/kimai2/issues/1473
         if ($query->isMarkAsExported()) {
             $this->export->setExported($entries);
         }
@@ -163,6 +162,7 @@ class ExportController extends AbstractController
         return $this->createForm(ExportToolbarForm::class, $query, [
             'action' => $this->generateUrl('export', []),
             'include_user' => $this->isGranted('view_other_timesheet'),
+            'include_export' => $this->isGranted('edit_export_other_timesheet'),
             'method' => $method,
             'timezone' => $this->getDateTimeFactory()->getTimezone()->getName(),
             'attr' => [

src/Controller/InvoiceController.php

@@ -669,6 +669,7 @@ final class InvoiceController extends AbstractController
             'action' => $this->generateUrl('invoice', []),
             'method' => 'GET',
             'include_user' => $this->isGranted('view_other_timesheet'),
+            'include_export' => $this->isGranted('edit_export_other_timesheet'),
             'timezone' => $this->getDateTimeFactory()->getTimezone()->getName(),
             'attr' => [
                 'id' => 'invoice-print-form'

src/Form/Toolbar/ExportToolbarForm.php

@@ -9,8 +9,8 @@
 
 namespace App\Form\Toolbar;
 
+use App\Form\Type\MarkAsExportedType;
 use App\Repository\Query\ExportQuery;
-use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
 use Symfony\Component\Form\Extension\Core\Type\HiddenType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
@@ -38,10 +38,9 @@ class ExportToolbarForm extends AbstractToolbarForm
         $this->addActivityMultiChoice($builder, [], true);
         $this->addExportRenderer($builder);
         $this->addTagInputField($builder);
-        $builder->add('markAsExported', CheckboxType::class, [
-            'label' => 'label.mark_as_exported',
-            'required' => false,
-        ]);
+        if ($options['include_export']) {
+            $builder->add('markAsExported', MarkAsExportedType::class);
+        }
     }
 
     /**
@@ -61,6 +60,7 @@ class ExportToolbarForm extends AbstractToolbarForm
             'data_class' => ExportQuery::class,
             'csrf_protection' => false,
             'include_user' => true,
+            'include_export' => true,
             'timezone' => date_default_timezone_get(),
         ]);
     }

src/Form/Toolbar/InvoiceToolbarSimpleForm.php

@@ -10,8 +10,8 @@
 namespace App\Form\Toolbar;
 
 use App\Form\Type\InvoiceTemplateType;
+use App\Form\Type\MarkAsExportedType;
 use App\Repository\Query\InvoiceQuery;
-use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 
@@ -29,10 +29,9 @@ class InvoiceToolbarSimpleForm extends AbstractToolbarForm
         $this->addDateRange($builder, ['timezone' => $options['timezone']]);
         $this->addCustomerMultiChoice($builder, ['required' => false, 'start_date_param' => null, 'end_date_param' => null, 'ignore_date' => true, 'placeholder' => ''], true);
         $this->addProjectMultiChoice($builder, ['ignore_date' => true], true, true);
-        $builder->add('markAsExported', CheckboxType::class, [
-            'label' => 'label.mark_as_exported',
-            'required' => false,
-        ]);
+        if ($options['include_export']) {
+            $builder->add('markAsExported', MarkAsExportedType::class);
+        }
     }
 
     protected function addTemplateChoice(FormBuilderInterface $builder)
@@ -52,6 +51,7 @@ class InvoiceToolbarSimpleForm extends AbstractToolbarForm
             'data_class' => InvoiceQuery::class,
             'csrf_protection' => false,
             'include_user' => true,
+            'include_export' => true,
             'timezone' => date_default_timezone_get(),
         ]);
     }

src/Form/Type/MarkAsExportedType.php

@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Form\Type;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+class MarkAsExportedType extends AbstractType
+{
+    public function configureOptions(OptionsResolver $resolver)
+    {
+        $resolver->setDefaults([
+            'label' => 'label.mark_as_exported',
+            'required' => false,
+        ]);
+    }
+
+    public function getParent(): string
+    {
+        return CheckboxType::class;
+    }
+}

templates/export/index.html.twig

@@ -50,7 +50,9 @@
             {{ form_row(form.billable) }}
             {{ form_row(form.exported) }}
             {{ form_row(form.state) }}
-            {{ form_row(form.markAsExported) }}
+            {% if form.markAsExported is defined %}
+                {{ form_row(form.markAsExported) }}
+            {% endif %}
         {% endblock %}
         {% block box_footer%}
             {{ search.searchButton(form) }}

templates/invoice/index.html.twig

@@ -53,7 +53,9 @@
                     {{ form_row(form.exported) }}
                 {% endif %}
                 {{ form_row(form.template) }}
-                {{ form_row(form.markAsExported) }}
+                {% if form.markAsExported is defined %}
+                    {{ form_row(form.markAsExported) }}
+                {% endif %}
             {% endblock %}
             {% block box_footer%}
                 {{ search.searchButton(form) }}