Fix: move profile content not possible

protected/humhub/docs/CHANGELOG.md

@@ -25,6 +25,7 @@ HumHub Change Log
 - Fix: #3211: escaped html rendered on space list modal
 - Fix: invalid userpicker translation syntax in czech language
 - Fix: added missing layout-snippet-container class in space and profile layout
+- Fix: move profile content not possible
 
 1.3.0-beta.1  (July 4, 2018)
 ----------------------------

protected/humhub/modules/content/models/Content.php

@@ -10,6 +10,8 @@ namespace humhub\modules\content\models;
 
 use humhub\components\behaviors\GUID;
 use humhub\components\behaviors\PolymorphicRelation;
+use humhub\components\Module;
+use humhub\modules\admin\permissions\ManageUsers;
 use humhub\modules\content\components\ContentActiveRecord;
 use humhub\modules\content\components\ContentContainerActiveRecord;
 use humhub\modules\content\components\ContentContainerModule;
@@ -330,7 +332,7 @@ class Content extends ContentDeprecated implements Movable
             return false;
         }
 
-        return $this->getContainer()->permissionManager->can(new ManageContent());
+        return $this->getContainer()->permissionManager->can(ManageContent::class);
     }
 
     /**
@@ -413,21 +415,14 @@ class Content extends ContentDeprecated implements Movable
     public function canMove(ContentContainerActiveRecord $container = null)
     {
         $model = $this->getModel();
-        $isContentOwner = $model->isOwner();
 
-        $canModelBeMoved = $model->canMove();
+        $canModelBeMoved = $this->isModelMovable($container);
         if ($canModelBeMoved !== true) {
             return $canModelBeMoved;
         }
 
-        // Check for legacy modules
-        if (!$model->getModuleId()) {
-            return Yii::t('ContentModule.base', 'This content type can\'t be moved due to a missing module-id setting.');
-        }
-
         if (!$container) {
-            // The content type is movable and no container was provided
-            return true;
+            return $this->checkMovePermission() ? true : Yii::t('ContentModule.base', 'You do not have the permission to move this content.');
         }
 
         if ($container->contentcontainer_id === $this->contentcontainer_id) {
@@ -436,18 +431,19 @@ class Content extends ContentDeprecated implements Movable
 
         // Check if the related module is installed on the target space
         if (!$container->moduleManager->isEnabled($model->getModuleId())) {
+            /* @var $module Module */
             $module = Yii::$app->getModule($model->getModuleId());
             $moduleName = ($module instanceof ContentContainerModule) ? $module->getContentContainerName($container) : $module->getName();
             return Yii::t('ContentModule.base', 'The module {moduleName} is not enabled on the selected target space.', ['moduleName' => $moduleName]);
         }
 
         // Check if the current user is allowed to move this content at all
-        if (!$isContentOwner && !$this->container->can(ManageContent::class)) {
+        if (!$this->checkMovePermission()) {
             return Yii::t('ContentModule.base', 'You do not have the permission to move this content.');
         }
 
         // Check if the current user is allowed to move this content to the given target space
-        if (!$isContentOwner && !$container->can(ManageContent::class)) {
+        if (!$this->checkMovePermission($container)) {
             return Yii::t('ContentModule.base', 'You do not have the permission to move this content to the given space.');
         }
 
@@ -464,6 +460,41 @@ class Content extends ContentDeprecated implements Movable
         return true;
     }
 
+    public function isModelMovable(ContentContainerActiveRecord $container = null)
+    {
+        $model = $this->getModel();
+        $canModelBeMoved = $model->canMove($container);
+        if ($canModelBeMoved !== true) {
+            return $canModelBeMoved;
+        }
+
+        // Check for legacy modules
+        if (!$model->getModuleId()) {
+            return Yii::t('ContentModule.base', 'This content type can\'t be moved due to a missing module-id setting.');
+        }
+
+        return true;
+    }
+
+    /**
+     * Checks if the current user has generally the permission to move this content on the given container or the current container if no container was provided.
+     *
+     * Note this function is only used for a general permission check use [[canMove()]] for a
+     *
+     * This is the case if:
+     *
+     * - The current user is the owner of this content
+     * @param ContentContainerActiveRecord|null $container
+     * @return bool determines if the current user is generally permitted to move content on the given container (or the related container if no container was provided)
+     */
+    public function checkMovePermission(ContentContainerActiveRecord $container = null)
+    {
+        if(!$container) {
+            $container = $this->container;
+        }
+        return $this->getModel()->isOwner() || Yii::$app->user->can(ManageUsers::class) || $container->can(ManageContent::class);
+    }
+
     /**
      * {@inheritdoc}
      */

protected/humhub/modules/content/models/forms/MoveContentForm.php

@@ -106,6 +106,6 @@ class MoveContentForm extends Model
 
     public function isMovable()
     {
-        return $this->content->canMove();
+        return $this->content->isModelMovable();
     }
 }

protected/humhub/modules/content/permissions/ManageContent.php

@@ -61,6 +61,6 @@ class ManageContent extends \humhub\libs\BasePermission
      */
     public function getDescription()
     {
-        return Yii::t('CommentModule.permissions', 'Can manage (e.g. archive, stick or delete) arbitrary content');
+        return Yii::t('CommentModule.permissions', 'Can manage (e.g. archive, stick, move or delete) arbitrary content');
     }
 }

protected/humhub/modules/content/widgets/MoveContentLink.php

@@ -8,7 +8,6 @@
 
 namespace humhub\modules\content\widgets;
 
-use humhub\modules\content\permissions\ManageContent;
 use Yii;
 
 /**
@@ -55,6 +54,7 @@ class MoveContentLink extends WallEntryControlLink
      */
     public function preventRender()
     {
-        return !$this->model->isOwner() && !$this->model->content->container->can(ManageContent::class);
+        // We show the move content link in case the user is generally allowed to move content within the container not considering other move content checks.
+        return !$this->model->content->checkMovePermission();
     }
 }