From b6cacbe0f98aacb381856c9375b782263371b04d Mon Sep 17 00:00:00 2001
From: KDSBrowne <kert.browne85@gmail.com>
Date: Mon, 16 Sep 2024 09:55:10 -0400
Subject: [PATCH] fix(whiteboard): Update shape restriction logic (#21111)

* restrict local access to shapes for viewers to their own

* unlock / lock shapes when presenter or moderator role changes
---
 .../ui/components/whiteboard/container.jsx    | 44 ++++++++++++-------
 1 file changed, 27 insertions(+), 17 deletions(-)

diff --git a/bigbluebutton-html5/imports/ui/components/whiteboard/container.jsx b/bigbluebutton-html5/imports/ui/components/whiteboard/container.jsx
index 3bf6deda5a..4058d15358 100644
--- a/bigbluebutton-html5/imports/ui/components/whiteboard/container.jsx
+++ b/bigbluebutton-html5/imports/ui/components/whiteboard/container.jsx
@@ -49,27 +49,37 @@ const WhiteboardContainer = (props) => {
   const layoutContextDispatch = layoutDispatch();
 
   const { shapes } = props;
+  
   const hasShapeAccess = (id) => {
-    const owner = shapes[id]?.userId;
+    const shape = shapes[id];
+    const owner = shape?.userId;
     const isBackgroundShape = id?.includes('slide-background');
-    const isPollsResult = shapes[id]?.name?.includes('poll-result');
-    const hasAccess =
-      (!isBackgroundShape && !isPollsResult) ||
-      (isPresenter &&
-        ((owner && owner === currentUser?.userId) ||
-          !owner ||
-          isPresenter ||
-          isModerator));
+    const isPollsResult = shape?.name?.includes('poll-result');
 
-    return hasAccess;
-  };
-  // set shapes as locked for those who aren't allowed to edit it
-  Object.entries(shapes).forEach(([shapeId, shape]) => {
-    if (!shape.isLocked && !hasShapeAccess(shapeId) && !shape.name?.includes('poll-result')) {
-      const modShape = shape;
-      modShape.isLocked = true;
+    // Only the presenter has access to poll result shapes
+    if (isPollsResult) {
+      return isPresenter;
     }
-  });
+
+    // No one should have access to background shapes
+    if (isBackgroundShape) {
+      return false;
+    }
+
+    // Viewers can only access their own shapes
+    // Presenters and moderators have access to all shapes
+    return (!owner || owner === currentUser?.userId) || isPresenter || isModerator;
+  };
+
+  React.useEffect(() => {
+    Object.entries(shapes).forEach(([shapeId, shape]) => {
+      if (!hasShapeAccess(shapeId)) {
+        shape.isLocked = true;
+      } else {
+        shape.isLocked = false;
+      }
+    });
+  }, [shapes, isPresenter, isModerator]);
 
   return (
     <Whiteboard