Updated string so the Oxford comma sticklers don’t kill me

app/Http/Controllers/Api/UsersController.php

@@ -397,27 +397,34 @@ class UsersController extends Controller
      */
     public function selectlist(Request $request) : array
     {
-        $users = User::select(
-            [
-                'users.id',
-                'users.username',
-                'users.employee_num',
-                'users.first_name',
-                'users.last_name',
-                'users.display_name',
-                'users.gravatar',
-                'users.avatar',
-                'users.email',
-            ]
-            )->where('show_in_list', '=', '1');
+
+        $select_array = [
+            'users.id',
+            'users.username',
+            'users.employee_num',
+            'users.first_name',
+            'users.last_name',
+            'users.display_name',
+            'users.gravatar',
+            'users.avatar',
+        ];
+
+        if (auth()->user()->can('manageContactInfo')) {
+            array_push($select_array, 'users.email');
+        }
+
+        $users = User::select($select_array)->where('show_in_list', '=', '1');
+
 
         if ($request->filled('search')) {
             $users = $users->where(function ($query) use ($request) {
-                $query->SimpleNameSearch($request->input('search'))
-                    ->orWhere('username', 'LIKE', '%'.$request->input('search').'%')
-                    ->orWhere('display_name', 'LIKE', '%'.$request->input('search').'%')
-                    ->orWhere('email', 'LIKE', '%'.$request->input('search').'%')
-                    ->orWhere('employee_num', 'LIKE', '%'.$request->input('search').'%');
+                $query->SimpleNameSearch($request->input('search'));
+
+                // Check that the requesting user can search against the email field
+                if (auth()->user()->can('manageContactInfo')) {
+                    $query->orWhere('users.email', 'LIKE', '%'.$request->input('search').'%');
+                }
+
             });
         }
 
@@ -568,6 +575,7 @@ class UsersController extends Controller
         $user->fill($request->except(['password', 'username', 'email', 'activated', 'permissions', 'activation_code', 'remember_token', 'two_factor_secret', 'two_factor_enrolled', 'two_factor_optin']));
 
 
+
         if (auth()->user()->can('canEditAuthFields', $user) && auth()->user()->can('editableOnDemo')) {
 
             if ($request->filled('password')) {

app/Http/Controllers/Users/UsersController.php

@@ -89,7 +89,19 @@ class UsersController extends Controller
         $this->authorize('create', User::class);
         $user = new User;
         //Username, email, and password need to be handled specially because the need to respect config values on an edit.
-        $user->email = trim($request->input('email'));
+
+        if (auth()->user()->can('manageContactInfo')) {
+            $user->email = trim($request->input('email'));
+            $user->phone = $request->input('phone');
+            $user->mobile = $request->input('mobile');
+            $user->address = $request->input('address', null);
+            $user->city = $request->input('city', null);
+            $user->state = $request->input('state', null);
+            $user->country = $request->input('country', null);
+            $user->zip = $request->input('zip', null);
+            $user->website = $request->input('website', null);
+        }
+
         $user->username = trim($request->input('username'));
         $user->display_name = $request->input('display_name');
         if ($request->filled('password')) {
@@ -101,20 +113,15 @@ class UsersController extends Controller
         $user->employee_num = $request->input('employee_num');
         $user->activated = $request->input('activated', 0);
         $user->jobtitle = $request->input('jobtitle');
-        $user->phone = $request->input('phone');
-        $user->mobile = $request->input('mobile');
+
         $user->location_id = $request->input('location_id', null);
         $user->department_id = $request->input('department_id', null);
         $user->company_id = Company::getIdForUser($request->input('company_id', null));
         $user->manager_id = $request->input('manager_id', null);
         $user->notes = $request->input('notes');
-        $user->address = $request->input('address', null);
-        $user->city = $request->input('city', null);
-        $user->state = $request->input('state', null);
-        $user->country = $request->input('country', null);
-        $user->zip = $request->input('zip', null);
+
         $user->remote = $request->input('remote', 0);
-        $user->website = $request->input('website', null);
+
         $user->created_by = auth()->id();
         $user->start_date = $request->input('start_date', null);
         $user->end_date = $request->input('end_date', null);
@@ -269,6 +276,19 @@ class UsersController extends Controller
 
         // Update the user fields
 
+        if (auth()->user()->can('manageContactInfo')) {
+            $user->email = trim($request->input('email'));
+            $user->phone = $request->input('phone');
+            $user->mobile = $request->input('mobile');
+            $user->address = $request->input('address', null);
+            $user->city = $request->input('city', null);
+            $user->state = $request->input('state', null);
+            $user->country = $request->input('country', null);
+            $user->zip = $request->input('zip', null);
+            $user->website = $request->input('website', null);
+        }
+
+
         $user->first_name = $request->input('first_name');
         $user->last_name = $request->input('last_name');
         $user->display_name = $request->input('display_name');
@@ -276,21 +296,13 @@ class UsersController extends Controller
         $user->locale = $request->input('locale');
         $user->employee_num = $request->input('employee_num');
         $user->jobtitle = $request->input('jobtitle', null);
-        $user->phone = $request->input('phone');
-        $user->mobile = $request->input('mobile');
         $user->location_id = $request->input('location_id', null);
         $user->company_id = Company::getIdForUser($request->input('company_id', null));
         $user->manager_id = $request->input('manager_id', null);
         $user->notes = $request->input('notes');
         $user->department_id = $request->input('department_id', null);
-        $user->address = $request->input('address', null);
-        $user->city = $request->input('city', null);
-        $user->state = $request->input('state', null);
-        $user->country = $request->input('country', null);
-        $user->zip = $request->input('zip', null);
         $user->remote = $request->input('remote', 0);
         $user->vip = $request->input('vip', 0);
-        $user->website = $request->input('website', null);
         $user->start_date = $request->input('start_date', null);
         $user->end_date = $request->input('end_date', null);
         $user->autoassign_licenses = $request->input('autoassign_licenses', 0);
@@ -487,11 +499,15 @@ class UsersController extends Controller
             // Blank out some fields
             $user->first_name = '';
             $user->last_name = '';
-            $user->email = substr($user->email, ($pos = strpos($user->email, '@')) !== false ? $pos : 0);
+
             $user->id = null;
             $user->username = null;
             $user->avatar = null;
 
+            if (auth()->user()->can('manageContactInfo')) {
+                $user->email = substr($user->email, ($pos = strpos($user->email, '@')) !== false ? $pos : 0);
+            }
+
             // Get this user's groups
             $userGroups = $user_to_clone->groups()->pluck('name', 'id');
 
@@ -666,7 +682,7 @@ class UsersController extends Controller
                             ($user->userloc) ? $user->userloc->name : '',
                             ($user->department) ? $user->department->name : '',
                             (($user->department) && ($user->department->manager)) ? $user->department->manager->display_name : '',
-                            $user->assets->count(),
+                            $user->assets_count,
                             $user->licenses_count,
                             $user->accessories_count,
                             $user->consumables_count,

app/Models/User.php

@@ -1095,9 +1095,11 @@ class User extends SnipeModel implements AuthenticatableContract, AuthorizableCo
      */
     public function scopeSimpleNameSearch($query, $search)
     {
-        return $query->where('first_name', 'LIKE', '%' . $search . '%')
-            ->orWhere('last_name', 'LIKE', '%' . $search . '%')
-            ->orWhere('display_name', 'LIKE', '%' . $search . '%')
+        return $query->where('users.first_name', 'LIKE', '%' . $search . '%')
+            ->orWhere('users.last_name', 'LIKE', '%' . $search . '%')
+            ->orWhere('users.username', 'LIKE', '%' . $search . '%')
+            ->orWhere('users.display_name', 'LIKE', '%' . $search . '%')
+            ->orWhere('users.employee_num', 'LIKE', '%' . $search . '%')
             ->orWhereMultipleColumns(
                 [
                 'users.first_name',

app/Presenters/UserPresenter.php

@@ -129,7 +129,7 @@ class UserPresenter extends Presenter
                 'visible' => false,
                 'formatter' => 'trueFalseFormatter',
             ]
-            ];
+        ];
 
 
         $sensitive_fields = [
@@ -211,8 +211,11 @@ class UserPresenter extends Presenter
             ]
         ];
 
+        // Add the sensitive fields in if the user can see them
         if (auth()->user()->can('manageContactInfo')) {
-            array_push($layout, $sensitive_fields);
+            foreach ($sensitive_fields as $sensitive_field) {
+                array_push($layout, $sensitive_field);
+            }
         }
 
         array_push($layout,

resources/lang/en-US/permissions.php

@@ -234,7 +234,7 @@ return array(
 
     'userscontact' => [
         'name' => 'View/Edit User Contact Info',
-        'note' => 'Allows the user to view and edit personal contact information about the user. This includes: address, city, state/province, country, postal code, phone number, mobile number, email and website. ',
+        'note' => 'Allows the user to view and edit personal contact information about the user. This includes: address, city, state/province, country, postal code, phone number, mobile number, email address, and website.',
     ],
     'models'   => [
         'name' => 'Models',

resources/views/users/bulk-edit.blade.php

@@ -107,7 +107,7 @@
                             </div>
                         </div>
 
-                        @can('manageContactInfo', $user)
+                        @can('manageContactInfo')
                         <!-- City -->
                         <div class="form-group{{ $errors->has('city') ? ' has-error' : '' }}">
                             <label class="col-md-3 control-label" for="city">{{ trans('general.city') }}</label>

resources/views/users/edit.blade.php

@@ -237,7 +237,7 @@
                           </div>
                   </div>
 
-                  @can('manageContactInfo', $user)
+                  @can('manageContactInfo')
                       <!-- Email -->
                     <div class="form-group {{ $errors->has('email') ? 'has-error' : '' }}">
                       <label class="col-md-3 control-label" for="email">{{ trans('admin/users/table.email') }} </label>
@@ -445,7 +445,7 @@
                               <!-- Location -->
                               @include ('partials.forms.edit.location-select', ['translated_name' => trans('general.location'), 'fieldname' => 'location_id'])
 
-                              @can('manageContactInfo', $user)
+                              @can('manageContactInfo')
                                   <!-- Phone -->
                                   <div class="form-group {{ $errors->has('phone') ? 'has-error' : '' }}">
                                       <label class="col-md-3 control-label" for="phone">{{ trans('admin/users/table.phone') }}</label>

resources/views/users/view.blade.php

@@ -377,7 +377,7 @@
                    </div>
                    @endif
 
-                   @can('manageContactInfo', $user)
+                   @can('manageContactInfo')
                     <!-- address -->
                     @if (($user->address) || ($user->city) || ($user->state) || ($user->country))
                     <div class="row">
@@ -516,7 +516,7 @@
                     @endif
 
 
-                   @can('manageContactInfo', $user)
+                   @can('manageContactInfo')
                     @if ($user->email)
                     <!-- email -->
                     <div class="row">