From a68c928896a94c377134f29a7183aa0b5a423720 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Wed, 24 Jul 2019 15:01:05 +0300
Subject: Prevent isCommentOnly user adding attachments, editing list names,
 moving lists, and seeing board settings menu. Show non-editable Custom Fields
 to isCommentOnly user.

Thanks to xet7 !

Closes wekan/wekan-snap#97,
closes #2416,
closes #2255
---
 client/components/cards/attachments.jade      | 26 ++++++++++++++------------
 client/components/cards/cardCustomFields.jade | 16 ++++++++++++++++
 2 files changed, 30 insertions(+), 12 deletions(-)

(limited to 'client/components/cards')

diff --git a/client/components/cards/attachments.jade b/client/components/cards/attachments.jade
index 0f79323b..2a96f4f4 100644
--- a/client/components/cards/attachments.jade
+++ b/client/components/cards/attachments.jade
@@ -37,17 +37,19 @@ template(name="attachmentsGalery")
               i.fa.fa-download
               | {{_ 'download'}}
             if currentUser.isBoardMember
-              if isImage
-                a(class="{{#if $eq ../coverId _id}}js-remove-cover{{else}}js-add-cover{{/if}}")
-                  i.fa.fa-thumb-tack
-                  if($eq ../coverId _id)
-                    | {{_ 'remove-cover'}}
-                  else
-                    | {{_ 'add-cover'}}
-              a.js-confirm-delete
-                i.fa.fa-close
-                | {{_ 'delete'}}
+              unless currentUser.isCommentOnly
+                if isImage
+                  a(class="{{#if $eq ../coverId _id}}js-remove-cover{{else}}js-add-cover{{/if}}")
+                    i.fa.fa-thumb-tack
+                    if($eq ../coverId _id)
+                      | {{_ 'remove-cover'}}
+                    else
+                      | {{_ 'add-cover'}}
+                a.js-confirm-delete
+                  i.fa.fa-close
+                  | {{_ 'delete'}}
 
     if currentUser.isBoardMember
-      li.attachment-item.add-attachment
-        a.js-add-attachment {{_ 'add-attachment' }}
+      unless currentUser.isCommentOnly
+        li.attachment-item.add-attachment
+          a.js-add-attachment {{_ 'add-attachment' }}
diff --git a/client/components/cards/cardCustomFields.jade b/client/components/cards/cardCustomFields.jade
index c4fa6863..0a4d26e5 100644
--- a/client/components/cards/cardCustomFields.jade
+++ b/client/components/cards/cardCustomFields.jade
@@ -31,6 +31,10 @@ template(name="cardCustomField-text")
                         = value
                 else
                     | {{_ 'edit'}}
+    else
+      +viewer
+        = value
+
 
 template(name="cardCustomField-number")
     if canModifyCard
@@ -45,6 +49,9 @@ template(name="cardCustomField-number")
                     = value
                 else
                     | {{_ 'edit'}}
+    else
+        if value
+            = value
 
 template(name="cardCustomField-date")
     if canModifyCard
@@ -55,6 +62,11 @@ template(name="cardCustomField-date")
                         | {{showDate}}
             else
                 | {{_ 'edit'}}
+    else
+        if value
+            div.card-date
+                time(datetime="{{showISODate}}")
+                    | {{showDate}}
 
 template(name="cardCustomField-dropdown")
     if canModifyCard
@@ -79,3 +91,7 @@ template(name="cardCustomField-dropdown")
                         = selectedItem
                 else
                     | {{_ 'edit'}}
+    else
+        if value
+            +viewer
+                = selectedItem
-- 
cgit v1.2.3-1-g7c22