Fix: #2579 - only editors can download original media files

1 files changed, 71 insertions, 54 deletions

diff --git a/resources/views/media-page.phtml b/resources/views/media-page.phtml
index f7e7a65730..914ab83332 100644
--- a/resources/views/media-page.phtml
+++ b/resources/views/media-page.phtml
@@ -1,8 +1,23 @@
-<?php use Fisharebest\Webtrees\Auth; ?>
-<?php use Fisharebest\Webtrees\Functions\FunctionsPrint; ?>
-<?php use Fisharebest\Webtrees\Functions\FunctionsPrintFacts; ?>
-<?php use Fisharebest\Webtrees\GedcomTag; ?>
-<?php use Fisharebest\Webtrees\I18N; ?>
+<?php
+
+use Fisharebest\Webtrees\Auth;
+use Fisharebest\Webtrees\Functions\FunctionsPrint;
+use Fisharebest\Webtrees\Functions\FunctionsPrintFacts;
+use Fisharebest\Webtrees\GedcomTag;
+use Fisharebest\Webtrees\I18N;
+use Fisharebest\Webtrees\Media;
+use Illuminate\Support\Collection;
+
+/**
+ * @var Collection $clipboard_facts
+ * @var Collection $facts
+ * @var Collection $families
+ * @var Collection $individuals
+ * @var Media      $media
+ * @var Collection $notes
+ * @var Collection $sources
+ */
+?>
 
 <?php if ($media->isPendingDeletion()) : ?>
     <?php if (Auth::isModerator($media->tree())) : ?>
@@ -35,27 +50,27 @@
             </a>
         </li>
         <li class="nav-item">
-            <a class="nav-link<?= empty($individuals) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#individuals">
+            <a class="nav-link<?= $individuals->isEmpty() ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#individuals">
                 <?= I18N::translate('Individuals') ?>
-                <?= view('components/badge', ['count' => count($individuals)]) ?>
+                <?= view('components/badge', ['count' => $individuals->count()]) ?>
             </a>
         </li>
         <li class="nav-item">
-            <a class="nav-link<?= empty($families) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#families">
+            <a class="nav-link<?= $families->isEmpty() ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#families">
                 <?= I18N::translate('Families') ?>
-                <?= view('components/badge', ['count' => count($families)]) ?>
+                <?= view('components/badge', ['count' => $families->count()]) ?>
             </a>
         </li>
         <li class="nav-item">
-            <a class="nav-link<?= empty($sources) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#sources">
+            <a class="nav-link<?= $sources->isEmpty() ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#sources">
                 <?= I18N::translate('Sources') ?>
-                <?= view('components/badge', ['count' => count($sources)]) ?>
+                <?= view('components/badge', ['count' => $sources->count()]) ?>
             </a>
         </li>
         <li class="nav-item">
-            <a class="nav-link<?= empty($notes) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#notes">
+            <a class="nav-link<?= $notes->isEmpty() ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#notes">
                 <?= I18N::translate('Notes') ?>
-                <?= view('components/badge', ['count' => count($notes)]) ?>
+                <?= view('components/badge', ['count' => $notes->count()]) ?>
             </a>
         </li>
     </ul>
@@ -64,59 +79,61 @@
         <div class="tab-pane active fade show" role="tabpanel" id="details">
             <table class="table wt-facts-table">
                 <?php foreach ($media->mediaFiles() as $media_file) : ?>
-                <tr class="<?= $media_file->isPendingAddition() ? 'wt-new' : '' ?><?= $media_file->isPendingDeletion() ? 'wt-old' : '' ?>">
-                    <th scope="row">
-                        <?= I18N::translate('Media file') ?>
-                        <?php if ($media->canEdit()) : ?>
-                            <div class="editfacts">
-                                <a class="btn btn-link" href="#" data-toggle="modal" data-target="#wt-ajax-modal" data-href="<?=route('edit-media-file', ['ged' => $media->tree()->name(), 'xref' => $media->xref(), 'fact_id' => $media_file->factId()]) ?>" title="<?= I18N::translate('Edit') ?>">
-                                    <?= view('icons/edit') ?>
-                                    <span class="sr-only">
+                    <tr class="<?= $media_file->isPendingAddition() ? 'wt-new' : '' ?><?= $media_file->isPendingDeletion() ? 'wt-old' : '' ?>">
+                        <th scope="row">
+                            <?= I18N::translate('Media file') ?>
+                            <?php if ($media->canEdit()) : ?>
+                                <div class="editfacts">
+                                    <a class="btn btn-link" href="#" data-toggle="modal" data-target="#wt-ajax-modal" data-href="<?= route('edit-media-file', ['ged' => $media->tree()->name(), 'xref' => $media->xref(), 'fact_id' => $media_file->factId()]) ?>" title="<?= I18N::translate('Edit') ?>">
+                                        <?= view('icons/edit') ?>
+                                        <span class="sr-only">
                                         <?= I18N::translate('Edit') ?>
                                     </span>
-                                </a>
+                                    </a>
 
-                                <?php if (count($media->mediaFiles()) > 1) : ?>
-                                    <a class="btn btn-link" href="#" onclick="return delete_fact('<?= I18N::translate('Are you sure you want to delete this fact?') ?>', '<?= e($media->tree()->name()) ?>', '<?= e($media->xref()) ?>', '<?= e($media_file->factId()) ?>');" title="<?= I18N::translate('Delete') ?>">
-                                        <?= view('icons/delete') ?>
-                                        <span class="sr-only">
+                                    <?php if (count($media->mediaFiles()) > 1) : ?>
+                                        <a class="btn btn-link" href="#" onclick="return delete_fact('<?= I18N::translate('Are you sure you want to delete this fact?') ?>', '<?= e($media->tree()->name()) ?>', '<?= e($media->xref()) ?>', '<?= e($media_file->factId()) ?>');" title="<?= I18N::translate('Delete') ?>">
+                                            <?= view('icons/delete') ?>
+                                            <span class="sr-only">
                                         <?= I18N::translate('Delete') ?>
                                     </span>
-                                    </a>
+                                        </a>
 
+                                    <?php endif ?>
+                                </div>
+                            <?php endif ?>
+                        </th>
+                        <td class="d-flex justify-content-between">
+                            <div>
+                                <?php if ($media_file->isExternal()) : ?>
+                                    <?= GedcomTag::getLabelValue('URL', $media_file->filename()) ?>
+                                <?php elseif (Auth::isEditor($media->tree())) :?>
+                                    <?php if (!$media_file->fileExists()) : ?>
+                                        <p class="alert alert-danger">
+                                            <?= I18N::translate('The file “%s” does not exist.', $media_file->filename()) ?>
+                                        </p>
+                                    <?php endif ?>
+                                    <?= GedcomTag::getLabelValue('FILE', $media_file->filename()) ?>
                                 <?php endif ?>
+
+                                <?= GedcomTag::getLabelValue('TITL', $media_file->title()) ?>
+                                <?= GedcomTag::getLabelValue('TYPE', $media_file->type()) ?>
+                                <?= GedcomTag::getLabelValue('FORM', $media_file->format()) ?>
                             </div>
-                        <?php endif ?>
-                    </th>
-                    <td class="d-flex justify-content-between">
-                        <div>
-                            <?php if ($media_file->isExternal()) : ?>
-                                <?= GedcomTag::getLabelValue('URL', $media_file->filename()) ?>
-                            <?php elseif (Auth::isEditor($media->tree())) : ?>
-                                <?= GedcomTag::getLabelValue('FILE', $media_file->filename()) ?>
-                                <?php if ($media_file->fileExists()) : ?>
-                                    <?php if ($media->tree()->getPreference('SHOW_MEDIA_DOWNLOAD') >= Auth::accessLevel($media->tree())) : ?>
-                                    — <a href="<?= $media_file->imageUrl(0, 0, '') ?>">
+
+                            <div>
+                                <?php if (!$media_file->isExternal()) : ?>
+                                    <?= $media_file->displayImage(200, 150, 'contain', []) ?>
+                                    <?php if ($media->tree()->getPreference('SHOW_MEDIA_DOWNLOAD') >= Auth::accessLevel($media->tree()) && $media_file->fileExists()) : ?>
+                                        <br>
+                                        <a href="<?= $media_file->imageUrl(0, 0, '') ?>">
                                             <?= I18N::translate('Download file') ?>
                                         </a>
                                     <?php endif ?>
-                                <?php elseif (!$media_file->isExternal()) : ?>
-                                    <p class="alert alert-danger">
-                                        <?= I18N::translate('The file “%s” does not exist.', $media_file->filename()) ?>
-                                    </p>
                                 <?php endif ?>
-                            <?php endif ?>
-                            <?= GedcomTag::getLabelValue('TITL', $media_file->title()) ?>
-                            <?= GedcomTag::getLabelValue('TYPE', $media_file->type()) ?>
-                            <?= GedcomTag::getLabelValue('FORM', $media_file->format()) ?>
-                        </div>
-                        <div>
-                            <?php if (!$media_file->isExternal()) : ?>
-                                <?= $media_file->displayImage(200, 150, 'contain', []) ?>
-                            <?php endif ?>
-                        </div>
-                    </td>
-                </tr>
+                            </div>
+                        </td>
+                    </tr>
                 <?php endforeach ?>
                 <?php foreach ($facts as $fact) : ?>
                     <?php if ($fact->getTag() !== 'FILE') : ?>