Fix detection of the layer id.

Merge branch 'master' into feature/permissions
Implement permission checks.
2025-11-28 11:04:08 +01:00 · 2018-12-07 14:26:58 +01:00 · 2018-12-07 13:28:36 +01:00 · 2018-12-05 14:05:01 +01:00 · 2018-12-05 11:15:37 +01:00 · 2018-12-05 09:52:59 +01:00
32 changed files with 1270 additions and 200 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,16 +1,8 @@
-dist: xenial
-
-addons:
-  apt:
-    packages:
-      - ant-optional
-
 language: php

 php:
-  - "7.3"
-  - "7.2"
  - "7.1"
+  - "7.2"

 env:
  - CONTAO_VERSION=contao/core-bundle ~4.4.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,38 +6,6 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

-## 3.1.3 - 2019-01-10
-
-[Full Changelog](https://github.com/netzmacht/contao-leaflet-maps/compare/3.1.2...3.1.3)
-
-### Fixed
-
- - Fix broken api routes in Contao 4.6/Symfony 4 (#69)
- - Fix broken about.html.twig template. Error block was missing
-
-## 3.1.2 - 2018-12-18
-
-[Full Changelog](https://github.com/netzmacht/contao-leaflet-maps/compare/3.1.1...3.1.2)
-
-### Fixed
-
- - Fix broken MapBox integration: Access token is now required
- - Fix broken OpenWeatherMap integration: Api key is now required
- - Fix broken Thunderforest integration: Api key is now required
-
-### Added
-
- - Add missing OpenPtMap of leaflet-providers
- - Add missing OpenRailwayMap of leaflet-providers
- - Add missing OpenFireMap of leaflet-providers
- - Add missing SafeCast of leaflet-providers
- - Add missing map types `normalNightTransit`, `normalNightTransitMobile`, `reducedDay`, `reducedNight`, 
-   `hybridDayTransit` and `hybridDayGrey` of HERE provider
- - Add missing map types `Voyager`, `VoyagerNoLabels`, `VoyagerOnlyLabels` and `VoyagerLabelsUnder` of CartoDB provider
- - Add missing Wikimedia of leaflet-providers
- - Add missing GeoportailFrance of leaflet-providers
- - Add missing OneMapSG of leaflet-providers
-
 ## 3.1.1 - 2018-12-07

 [Full Changelog](https://github.com/netzmacht/contao-leaflet-maps/compare/3.1.0...3.1.1)
--- a/composer.json
+++ b/composer.json
@@ -34,15 +34,16 @@
    "symfony/http-kernel": "~3.3 || ~4.0",
    "symfony/translation": "~3.3 || ~4.0",
    "symfony/templating": "~3.3 || ~4.0",
-    "netzmacht/contao-leaflet-libraries": "^1.3.4",
+    "netzmacht/contao-leaflet-libraries": "^1.0",
    "netzmacht/contao-leaflet-geocode-widget": "^1.2",
    "netzmacht/php-javascript-builder": "^1.0",
-    "netzmacht/php-leaflet": "^1.1.0",
+    "netzmacht/php-leaflet": "^1.0.2",
    "netzmacht/contao-toolkit": "~3.0",
    "netzmacht/contao-page-context": "~1.0",
    "contao-community-alliance/meta-palettes": "^2.0 || ^1.5",
    "menatwork/contao-multicolumnwizard": "^3.2",
-    "doctrine/cache": "^1.0"
+    "doctrine/cache": "^1.0",
+    "codefog/contao-widget_tree_picker": "^2.4"
  },
  "require-dev": {
    "phpcq/all-tasks": "^1.2",
--- a/src/Bundle/Resources/config/listeners.yml
+++ b/src/Bundle/Resources/config/listeners.yml
@@ -51,6 +51,8 @@ services:
      - '@netzmacht.contao_toolkit.repository_manager'
      - '@translator'
      - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+      - '@netzmacht.contao_toolkit.dca.listeners.state_button_callback'
      - '@netzmacht.contao_toolkit.contao.backend_adapter'
      - '%netzmacht.contao_leaflet.layers%'
      - '%netzmacht.contao_leaflet.providers%'
@@ -63,6 +65,7 @@ services:
    arguments:
      - '@database_connection'
      - '@netzmacht.contao_toolkit.repository_manager'
+      - '@netzmacht.contao_toolkit.contao.backend_user'

  netzmacht.contao_leaflet.listeners.dca.vector:
    class: Netzmacht\Contao\Leaflet\Listener\Dca\VectorDcaListener
@@ -70,20 +73,52 @@ services:
    arguments:
      - '@netzmacht.contao_toolkit.dca.manager'
      - '@netzmacht.contao_toolkit.repository_manager'
+      - '@netzmacht.contao_toolkit.contao.backend_user'
      - '%netzmacht.contao_leaflet.vectors%'

  netzmacht.contao_leaflet.listeners.dca.icon:
    class: Netzmacht\Contao\Leaflet\Listener\Dca\IconDcaListener
    public: true
    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
      - '%netzmacht.contao_leaflet.icons%'

  netzmacht.contao_leaflet.listeners.dca.style:
    class: Netzmacht\Contao\Leaflet\Listener\Dca\StyleDcaListener
    public: true
    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
      - '%netzmacht.contao_leaflet.styles%'

+  netzmacht.contao_leaflet.listeners.dca.popup:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\PopupDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+
+  netzmacht.contao_leaflet.listeners.dca.user:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\UserDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.dca.manager'
+      - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@translator'
+      - '%netzmacht.contao_leaflet.layers%'
+      -
+  netzmacht.contao_leaflet.listeners.dca.user_group:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\UserGroupDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.dca.manager'
+      - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@translator'
+      - '%netzmacht.contao_leaflet.layers%'
+
+  Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener:
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+
  netzmacht.contao_leaflet.listeners.geo_json_listener:
    class: Netzmacht\Contao\Leaflet\Listener\GeoJsonListener
    arguments:
--- a/src/Bundle/Resources/config/providers.yml
+++ b/src/Bundle/Resources/config/providers.yml
@@ -1,22 +1,13 @@
 parameters:
  netzmacht.contao_leaflet.providers:
    OpenStreetMap:
-      variants: ['Mapnik', 'BlackAndWhite', 'DE', 'CH', 'France', 'HOT', 'BZH']
+      variants: ['Mapnik', 'BlackAndWhite', 'DE', 'France', 'HOT', 'BZH']

    OpenSeaMap: []

    OpenTopoMap: []

-    OpenPtMap: []
-
-    OpenRailwayMap: []
-
-    OpenFireMap: []
-
-    SafeCast: []
-
    Thunderforest:
-      class: 'Netzmacht\LeafletPHP\Plugins\LeafletProviders\ThunderforestProvider'
      variants:
        - 'OpenCycleMap'
        - 'Transport'
@@ -25,9 +16,6 @@ parameters:
        - 'Landscape'
        - 'Outdoors'
        - 'Pioneer'
-      options:
-        apiKey: 'tile_provider_key'
-      fields: ['tile_provider_key']

    OpenMapSurfer:
      variants: ['Roads', 'AdminBounds', 'Grayscale']
@@ -38,8 +26,7 @@ parameters:
    MapBox:
      class: 'Netzmacht\LeafletPHP\Plugins\LeafletProviders\MapBoxProvider'
      options:
-        accessToken: 'tile_provider_key'
-      fields: ['tile_provider_key']
+        key: 'tile_provider_key'

    Stamen:
      variants:
@@ -69,7 +56,6 @@ parameters:
        - 'WorldGrayCanvas'

    OpenWeatherMap:
-      class: 'Netzmacht\LeafletPHP\Plugins\LeafletProviders\OpenWeatherMapProvider'
      variants:
        - 'Clouds'
        - 'CloudsClassic'
@@ -82,9 +68,6 @@ parameters:
        - 'Wind'
        - 'Temperature'
        - 'Snow'
-      options:
-        apiKey: 'tile_provider_key'
-      fields: ['tile_provider_key']

    HERE:
      class: 'Netzmacht\LeafletPHP\Plugins\LeafletProviders\HereProvider'
@@ -100,18 +83,12 @@ parameters:
        - 'normalNightMobile'
        - 'normalNightGrey'
        - 'normalNightGreyMobile'
-        - 'normalNightTransit'
-        - 'normalNightTransitMobile'
-        - 'reducedDay'
-        - 'reducedNight'
        - 'basicMap'
        - 'mapLabels'
        - 'trafficFlow'
        - 'carnavDayGrey'
        - 'hybridDay'
        - 'hybridDayMobile'
-        - 'hybridDayTransit'
-        - 'hybridDayGrey'
        - 'pedestrianDay'
        - 'pedestrianNight'
        - 'satelliteDay'
@@ -146,10 +123,6 @@ parameters:
        - 'DarkMatter'
        - 'DarkMatterNoLabels'
        - 'DarkMatterOnlyLabels'
-        - 'Voyager'
-        - 'VoyagerNoLabels'
-        - 'VoyagerOnlyLabels'
-        - 'VoyagerLabelsUnder'

    HikeBike:
      variants:
@@ -182,20 +155,3 @@ parameters:
        - 'ModisTerraChlorophyll'

    NLS: []
-
-    Wikimedia: []
-
-    GeoportailFrance:
-      variants:
-        - 'parcels'
-        - 'ignMaps'
-        - 'maps'
-        - 'orthos'
-
-    OneMapSG:
-      variants:
-        - 'Default'
-        - 'Night'
-        - 'Original'
-        - 'Grey'
-        - 'LandLot'
--- a/src/Bundle/Resources/config/services.yml
+++ b/src/Bundle/Resources/config/services.yml
@@ -128,13 +128,11 @@ services:
      - { name: Netzmacht\Contao\PageContext\Request\PageIdDeterminator }

  Netzmacht\Contao\Leaflet\Frontend\Action\LayerDataAction:
-    public: true
    arguments:
      - '@netzmacht.contao_leaflet.map.provider'
      - '@netzmacht.contao_leaflet.filter_factory'

  Netzmacht\Contao\Leaflet\Backend\Action\AboutAction:
-    public: true
    arguments:
      - '@templating'
      - '%kernel.project_dir%'
--- a/src/Bundle/Resources/contao/config/config.php
+++ b/src/Bundle/Resources/contao/config/config.php
@@ -11,7 +11,7 @@
 */

 /*
- * Backend module.
+ * Backend modules
 */

 array_insert(
@@ -44,12 +44,13 @@ array_insert(
    ]
 );

-if (defined('TL_MODE') && TL_MODE === 'BE') {
+if (TL_MODE === 'BE') {
    $GLOBALS['TL_CSS'][] = 'bundles/netzmachtcontaoleaflet/css/backend_global.css';
 }

+
 /*
- * Models.
+ * Models
 */

 $GLOBALS['TL_MODELS']['tl_leaflet_control'] = \Netzmacht\Contao\Leaflet\Model\ControlModel::class;
@@ -60,3 +61,12 @@ $GLOBALS['TL_MODELS']['tl_leaflet_marker']  = \Netzmacht\Contao\Leaflet\Model\Ma
 $GLOBALS['TL_MODELS']['tl_leaflet_popup']   = \Netzmacht\Contao\Leaflet\Model\PopupModel::class;
 $GLOBALS['TL_MODELS']['tl_leaflet_style']   = \Netzmacht\Contao\Leaflet\Model\StyleModel::class;
 $GLOBALS['TL_MODELS']['tl_leaflet_vector']  = \Netzmacht\Contao\Leaflet\Model\VectorModel::class;
+
+
+/*
+ * Permissions
+ */
+
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_layers';
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_layer_permissions';
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_tables';
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_icon.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_icon.php
@@ -10,6 +10,8 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
    'config' => [
        'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
                'alias' => 'unique',
            ],
        ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.icon', 'checkPermission'],
+        ],
        'onsubmit_callback' => [
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
        ],
@@ -45,16 +50,19 @@ $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
                'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
            ],
            'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
+
            ],
            'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_layer.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_layer.php
@@ -10,14 +10,13 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
    'config' => [
        'dataContainer'     => 'Table',
        'enableVersioning'  => true,
        'ctable'            => ['tl_leaflet_vector', 'tl_leaflet_marker'],
-        'ondelete_callback' => [
-            ['netzmacht.contao_leaflet.listeners.dca.layer', 'deleteRelations'],
-        ],
        'sql'               => [
            'keys' => [
                'id'    => 'primary',
@@ -26,8 +25,12 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
            ],
        ],
        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.layer', 'checkPermissions'],
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'loadLanguageFile'],
        ],
+        'ondelete_callback' => [
+            ['netzmacht.contao_leaflet.listeners.dca.layer', 'deleteRelations'],
+        ],
        'onsubmit_callback' => [
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
        ],
@@ -48,22 +51,25 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
        ],
        'global_operations' => [
            'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
            ],
            'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
            ],
            'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
@@ -86,27 +92,31 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateVectorsButton'],
            ],
            'edit'    => [
-                'label' => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['edit'],
-                'href'  => 'act=edit',
-                'icon'  => 'header.gif',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['edit'],
+                'href'            => 'act=edit',
+                'icon'            => 'header.gif',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateEditButton'],
            ],
            'copy'    => [
-                'label' => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['copy'],
-                'href'  => 'act=copy',
-                'icon'  => 'copy.gif',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['copy'],
+                'href'            => 'act=copy',
+                'icon'            => 'copy.gif',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateCopyButton'],
            ],
            'cut'     => [
                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['cut'],
                'href'       => 'act=paste&amp;mode=cut',
                'icon'       => 'cut.gif',
                'attributes' => 'onclick="Backend.getScrollOffset()"',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateEditButton'],
            ],
            'delete'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['delete'],
-                'href'       => 'act=delete',
-                'icon'       => 'delete.gif',
-                'attributes' => 'onclick="if(!confirm(\'' . $GLOBALS['TL_LANG']['MSC']['deleteConfirm']
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['delete'],
+                'href'            => 'act=delete',
+                'icon'            => 'delete.gif',
+                'attributes'      => 'onclick="if(!confirm(\'' . $GLOBALS['TL_LANG']['MSC']['deleteConfirm']
                    . '\'))return false;Backend.getScrollOffset()"',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateDeleteButton'],
            ],
            'toggle'  => [
                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['toggle'],
@@ -114,8 +124,8 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
                'attributes'      => 'onclick="Backend.getScrollOffset(); 
                    return ContaoLeafletAjaxRequest.toggleVisibility(this,%s)"',
                'button_callback' => [
-                    'netzmacht.contao_toolkit.dca.listeners.state_button_callback',
-                    'handleButtonCallback',
+                    'netzmacht.contao_leaflet.listeners.dca.layer',
+                    'generateToggleButton',
                ],
                'toolkit'         => [
                    'state_button' => [
@@ -232,10 +242,8 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
            'provider' => ['tile_provider', 'tile_provider_variant'],
        ],
        'tile_provider' => [
-            'MapBox'         => ['tile_provider_key'],
-            'HERE'           => ['tile_provider_key', 'tile_provider_code'],
-            'OpenWeatherMap' => ['tile_provider_key'],
-            'Thunderforest'  => ['tile_provider_key'],
+            'MapBox' => ['tile_provider_key'],
+            'HERE'   => ['tile_provider_key', 'tile_provider_code'],
        ],
        'fileFormat'    => [
            '!' => ['file'],
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_marker.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_marker.php
@@ -10,6 +10,8 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
    'config' => [
        'dataContainer'     => 'Table',
@@ -23,6 +25,7 @@ $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
            ],
        ],
        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.marker', 'checkPermissions'],
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'loadLanguageFile'],
        ],
        'onsubmit_callback' => [
@@ -45,16 +48,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
        ],
        'global_operations' => [
            'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['icons'],
-                'href'       => 'table=tl_leaflet_icon&id=',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['icons'],
+                'href'            => 'table=tl_leaflet_icon&id=',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();" accesskey="e"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
            ],
            'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_popup.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_popup.php
@@ -10,6 +10,8 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
    'config' => [
        'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
                'alias' => 'unique',
            ],
        ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.popup', 'checkPermission'],
+        ],
        'onsubmit_callback' => [
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
        ],
@@ -45,16 +50,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
                'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
            ],
            'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
            ],
            'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_style.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_style.php
@@ -10,6 +10,8 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
    'config' => [
        'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
                'alias' => 'unique',
            ],
        ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.style', 'checkPermission'],
+        ],
        'onsubmit_callback' => [
            ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
        ],
@@ -45,16 +50,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
                'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
            ],
            'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_style']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_style']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
            ],
            'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_style']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_style']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
--- a/src/Bundle/Resources/contao/dca/tl_leaflet_vector.php
+++ b/src/Bundle/Resources/contao/dca/tl_leaflet_vector.php
@@ -10,6 +10,8 @@
 * @filesource
 */

+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_vector'] = [
    'config' => [
        'dataContainer'     => 'Table',
@@ -45,16 +47,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_vector'] = [
        ],
        'global_operations' => [
            'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
            ],
            'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
            ],
            'all'    => [
                'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
--- a/src/Bundle/Resources/contao/dca/tl_user.php
+++ b/src/Bundle/Resources/contao/dca/tl_user.php
@@ -0,0 +1,68 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+use Contao\CoreBundle\DataContainer\PaletteManipulator;
+
+PaletteManipulator::create()
+    ->addLegend('leaflet_legend', 'amg_legend', PaletteManipulator::POSITION_BEFORE)
+    ->addField(
+        ['leaflet_layers', 'leaflet_layer_permissions', 'leaflet_tables'],
+        'leaflet_legend',
+        PaletteManipulator::POSITION_APPEND
+    )
+    ->applyToPalette('extend', 'tl_user')
+    ->applyToPalette('custom', 'tl_user');
+
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_layers'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'],
+    'exclude'   => true,
+    'inputType' => 'treePicker',
+    'eval'      => [
+        'foreignTable'   => 'tl_leaflet_layer',
+        'titleField'     => 'title',
+        'searchField'    => 'title',
+        'managerHref'    => 'do=leaflet_layer',
+        'fieldType'      => 'checkbox',
+        'selectParents'  => true,
+        'multiple'       => true,
+        'pickerCallback' => ['netzmacht.contao_leaflet.listeners.dca.user', 'generateLayersRowLabel']
+    ],
+    'sql'       => 'blob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_tables'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['tl_leaflet_style', 'tl_leaflet_icon', 'tl_leaflet_popup'],
+    'reference' => &$GLOBALS['TL_LANG']['MOD'],
+    'eval'      => [
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_layer_permissions'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['create', 'edit', 'delete', 'data'],
+    'reference' => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options'],
+    'eval'      => [
+        'helpwizard' => true,
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
--- a/src/Bundle/Resources/contao/dca/tl_user_group.php
+++ b/src/Bundle/Resources/contao/dca/tl_user_group.php
@@ -0,0 +1,67 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+use Contao\CoreBundle\DataContainer\PaletteManipulator;
+
+PaletteManipulator::create()
+    ->addLegend('leaflet_legend', 'amg_legend', PaletteManipulator::POSITION_BEFORE)
+    ->addField(
+        ['leaflet_layers', 'leaflet_layer_permissions', 'leaflet_tables'],
+        'leaflet_legend',
+        PaletteManipulator::POSITION_APPEND
+    )
+    ->applyToPalette('default', 'tl_user_group');
+
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_layers'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'],
+    'exclude'   => true,
+    'inputType' => 'treePicker',
+    'eval'      => [
+        'foreignTable'   => 'tl_leaflet_layer',
+        'titleField'     => 'title',
+        'searchField'    => 'title',
+        'managerHref'    => 'do=leaflet_layer',
+        'fieldType'      => 'checkbox',
+        'selectParents'  => true,
+        'multiple'       => true,
+        'pickerCallback' => ['netzmacht.contao_leaflet.listeners.dca.user_group', 'generateLayersRowLabel']
+    ],
+    'sql'       => 'blob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_tables'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['tl_leaflet_style', 'tl_leaflet_icon', 'tl_leaflet_popup'],
+    'reference' => &$GLOBALS['TL_LANG']['MOD'],
+    'eval'      => [
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_layer_permissions'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['create', 'edit', 'delete', 'data'],
+    'reference' => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options'],
+    'eval'      => [
+        'helpwizard' => true,
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
--- a/src/Bundle/Resources/contao/languages/en/modules.php
+++ b/src/Bundle/Resources/contao/languages/en/modules.php
@@ -22,6 +22,8 @@ $GLOBALS['TL_LANG']['MOD']['leaflet_about'][1] = 'About the Leaflet integration
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_map']     = 'Maps';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_layer']   = 'Layers';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_icon']    = 'Icons';
+$GLOBALS['TL_LANG']['MOD']['tl_leaflet_style']   = 'Styles';
+$GLOBALS['TL_LANG']['MOD']['tl_leaflet_popup']   = 'Popup';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_marker']  = 'Markers';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_control'] = 'Controls';

--- a/src/Bundle/Resources/contao/languages/en/tl_leaflet_layer.php
+++ b/src/Bundle/Resources/contao/languages/en/tl_leaflet_layer.php
@@ -149,10 +149,6 @@ $GLOBALS['TL_LANG']['tl_leaflet_layer']['fileFormat'][0]                 = 'File
 $GLOBALS['TL_LANG']['tl_leaflet_layer']['fileFormat'][1]                 = 'Choose which file format is used.';
 $GLOBALS['TL_LANG']['tl_leaflet_layer']['file'][0]                       = 'File';
 $GLOBALS['TL_LANG']['tl_leaflet_layer']['file'][1]                       = 'Choose a file containing geodata. Supported formats are: %s.';
-$GLOBALS['TL_LANG']['tl_leaflet_layer']['tile_provider_key'][0]          = 'API key / Access token';
-$GLOBALS['TL_LANG']['tl_leaflet_layer']['tile_provider_key'][1]          = 'Please define the API key / access token which is required for this tile provider.';
-$GLOBALS['TL_LANG']['tl_leaflet_layer']['tile_provider_code'][0]         = 'App code';
-$GLOBALS['TL_LANG']['tl_leaflet_layer']['tile_provider_code'][1]         = 'Please define the required app code for this tile provider.';

 $GLOBALS['TL_LANG']['tl_leaflet_layer']['groupTypes']['layer'][0]   = 'Layer group';
 $GLOBALS['TL_LANG']['tl_leaflet_layer']['groupTypes']['layer'][1]   = 'Basic layer group. <br> See <a href="http://leafletjs.com/reference.html#layergroup" target="_blank">http://leafletjs.com/reference.html#layergroup</a>';
--- a/src/Bundle/Resources/contao/languages/en/tl_user.php
+++ b/src/Bundle/Resources/contao/languages/en/tl_user.php
@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_legend'] = 'Leaflet Maps Permissions';
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'][0]            = 'Allowed map layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'][1]            = 'Please choose the allowed map layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'][0] = 'Layer permissions';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'][1] = 'Please choose which permissions are allowed for the map layer.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'][0]            = 'Allows map tables';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'][1]            = 'Please choose which tables are allowed.';
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['create'][0] = 'Create layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['create'][1] = 'Grant permission to create new layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['edit'][0]   = 'Edit layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['edit'][1]   = 'Grant permission to edit layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['delete'][0] = 'Delete layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['delete'][1] = 'Grant permission to delete layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['data'][0]   = 'Edit data';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['data'][1]   = 'Grant permission to edit data of a layer.';
--- a/src/Bundle/Resources/contao/languages/en/tl_user_group.php
+++ b/src/Bundle/Resources/contao/languages/en/tl_user_group.php
@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_legend'] = 'Leaflet Maps Permissions';
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'][0]            = 'Allowed map layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'][1]            = 'Please choose the allowed map layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'][0] = 'Layer permissions';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'][1] = 'Please choose which permissions are allowed for the map layer.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'][0]            = 'Allows map tables';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'][1]            = 'Please choose which tables are allowed.';
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['create'][0] = 'Create layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['create'][1] = 'Grant permission to create new layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['edit'][0]   = 'Edit layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['edit'][1]   = 'Grant permission to edit layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['delete'][0] = 'Delete layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['delete'][1] = 'Grant permission to delete layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['data'][0]   = 'Edit data';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['data'][1]   = 'Grant permission to edit data of a layer.';
--- a/src/Bundle/Resources/contao/public/.htaccess
+++ b/src/Bundle/Resources/contao/public/.htaccess
@@ -0,0 +1,7 @@
+<IfModule !mod_authz_core.c>
+  Order allow,deny
+  Allow from all
+</IfModule>
+<IfModule mod_authz_core.c>
+  Require all granted
+</IfModule>
--- a/src/Bundle/Resources/views/backend/about.html.twig
+++ b/src/Bundle/Resources/views/backend/about.html.twig
@@ -2,8 +2,6 @@

 {% block headline %}{{ "MOD.leaflet_about.1"|trans({}, 'contao_modules') }}{% endblock %}

-{% block error %}{% endblock %}
-
 {% block main %}
    <div class="netzmacht-leaflet-credits">
        <div class="header">
--- a/src/Listener/Dca/AbstractUserDcaListener.php
+++ b/src/Listener/Dca/AbstractUserDcaListener.php
@@ -0,0 +1,109 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\Image;
+use Contao\StringUtil;
+use Netzmacht\Contao\Leaflet\Backend\Renderer\Label\Layer\LayerLabelRenderer;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
+use Netzmacht\Contao\Toolkit\Dca\Listener\AbstractListener;
+use Netzmacht\Contao\Toolkit\Dca\Manager;
+use Symfony\Component\Translation\TranslatorInterface as Translator;
+
+/**
+ * Class AbstractUserDcaListener
+ */
+abstract class AbstractUserDcaListener extends AbstractListener
+{
+    /**
+     * Layer label renderer.
+     *
+     * @var LayerLabelRenderer
+     */
+    private $labelRenderer;
+
+    /**
+     * Translator.
+     *
+     * @var Translator
+     */
+    private $translator;
+
+    /**
+     * Layers definitions.
+     *
+     * @var array
+     */
+    private $layers;
+
+    /**
+     * Constructor.
+     *
+     * @param Manager            $dcaManager    Dca manager.
+     * @param LayerLabelRenderer $labelRenderer Layer label renderer.
+     * @param Translator         $translator    Translator.
+     * @param array              $layers        Layers definition.
+     */
+    public function __construct(
+        Manager $dcaManager,
+        LayerLabelRenderer $labelRenderer,
+        Translator $translator,
+        array $layers
+    ) {
+        parent::__construct($dcaManager);
+
+        $this->labelRenderer = $labelRenderer;
+        $this->translator    = $translator;
+        $this->layers        = $layers;
+    }
+
+    /**
+     * Generate the layers row label.
+     *
+     * @param array $row Layer data row.
+     *
+     * @return string
+     */
+    public function generateLayersRowLabel(array $row): string
+    {
+        if (!empty($this->layers[$row['type']]['icon'])) {
+            $src = $this->layers[$row['type']]['icon'];
+        } else {
+            $src = 'iconPLAIN.gif';
+        }
+
+        $activeIcon   = $src;
+        $disabledIcon = preg_replace('/(\.[^\.]+)$/', '_1$1', $src);
+
+        if (!$row['active']) {
+            $src = $disabledIcon;
+        }
+
+        $alt        = $this->getFormatter(LayerModel::getTable())->formatValue('type', $row['type']);
+        $attributes = sprintf(
+            'class="list-icon" title="%s" data-icon="%s" data-icon-disabled="%s"',
+            StringUtil::specialchars(strip_tags($alt)),
+            $activeIcon,
+            $disabledIcon
+        );
+
+        $label  = $this->getFormatter(LayerModel::getTable())->formatValue('title', $row['title']);
+        $label .= sprintf(' <span class="tl_gray">[ID %s]</span>', $row['id']);
+        $icon   = Image::getHtml($src, $alt, $attributes);
+        $label  = $this->labelRenderer->render($row, $label, $this->translator);
+
+        return $icon . ' ' . $label;
+    }
+}
--- a/src/Listener/Dca/IconDcaListener.php
+++ b/src/Listener/Dca/IconDcaListener.php
@@ -14,6 +14,10 @@ declare(strict_types=1);

 namespace Netzmacht\Contao\Leaflet\Listener\Dca;

+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\IconModel;
+
 /**
 * Class IconDcaListener.
 *
@@ -21,6 +25,13 @@ namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 */
 class IconDcaListener
 {
+    /**
+     * Contao backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
    /**
     * Icon type options.
     *
@@ -31,13 +42,33 @@ class IconDcaListener
    /**
     * IconDcaListener constructor.
     *
-     * @param array $icons Icon type options.
+     * @param BackendUser $user  Backend user.
+     * @param array       $icons Icon type options.
     */
-    public function __construct(array $icons)
+    public function __construct(BackendUser $user, array $icons)
    {
+        $this->user  = $user;
        $this->icons = $icons;
    }

+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(IconModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', IconModel::getTable(), $this->user->id)
+        );
+    }
+
    /**
     * Get icon options.
     *
--- a/src/Listener/Dca/LayerDcaListener.php
+++ b/src/Listener/Dca/LayerDcaListener.php
@@ -13,9 +13,12 @@
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;

 use Contao\Backend;
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
 use Contao\CoreBundle\Framework\Adapter;
 use Contao\DataContainer;
 use Contao\Image;
+use Contao\Input;
 use Contao\StringUtil;
 use Doctrine\DBAL\Connection;
 use Netzmacht\Contao\Leaflet\Backend\Renderer\Label\Layer\LayerLabelRenderer;
@@ -23,6 +26,7 @@ use Netzmacht\Contao\Leaflet\Model\IconModel;
 use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
 use Netzmacht\Contao\Toolkit\Dca\Listener\AbstractListener;
+use Netzmacht\Contao\Toolkit\Dca\Listener\Button\StateButtonCallbackListener;
 use Netzmacht\Contao\Toolkit\Dca\Manager;
 use Netzmacht\Contao\Toolkit\Dca\Options\OptionsBuilder;
 use Symfony\Component\Translation\TranslatorInterface as Translator;
@@ -30,7 +34,7 @@ use Symfony\Component\Translation\TranslatorInterface as Translator;
 /**
 * Class Layer is the helper class for the tl_leaflet_layer dca.
 *
- * @package Netzmacht\Contao\Leaflet\Dca
+ * @SuppressWarnings(PHPMD.TooManyPublicMethods)
 */
 class LayerDcaListener extends AbstractListener
 {
@@ -76,6 +80,13 @@ class LayerDcaListener extends AbstractListener
     */
    private $translator;

+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
    /**
     * OSM amenities.
     *
@@ -104,19 +115,28 @@ class LayerDcaListener extends AbstractListener
     */
    private $backendAdapter;

+    /**
+     * State button callback listener.
+     *
+     * @var StateButtonCallbackListener
+     */
+    private $stateButtonCallbackListener;
+
    /**
     * Construct.
     *
-     * @param Manager            $manager           Data container manager.
-     * @param Connection         $connection        Database connection.
-     * @param RepositoryManager  $repositoryManager Repository manager.
-     * @param Translator         $translator        Translator.
-     * @param LayerLabelRenderer $labelRenderer     Layer label renderer.
-     * @param Adapter|Backend    $backendAdapter    Backend adapter.
-     * @param array              $layers            Leaflet layer configuration.
-     * @param array              $tileProviders     Tile providers.
-     * @param array              $amenities         OSM amenities.
-     * @param array              $fileFormats       File formats.
+     * @param Manager                     $manager                     Data container manager.
+     * @param Connection                  $connection                  Database connection.
+     * @param RepositoryManager           $repositoryManager           Repository manager.
+     * @param Translator                  $translator                  Translator.
+     * @param LayerLabelRenderer          $labelRenderer               Layer label renderer.
+     * @param BackendUser                 $backendUser                 Backend user.
+     * @param StateButtonCallbackListener $stateButtonCallbackListener State button callback listener.
+     * @param Adapter|Backend             $backendAdapter              Backend adapter.
+     * @param array                       $layers                      Leaflet layer configuration.
+     * @param array                       $tileProviders               Tile providers.
+     * @param array                       $amenities                   OSM amenities.
+     * @param array                       $fileFormats                 File formats.
     *
     * @SuppressWarnings(PHPMD.ExcessiveParameterList)
     */
@@ -126,6 +146,8 @@ class LayerDcaListener extends AbstractListener
        RepositoryManager $repositoryManager,
        Translator $translator,
        LayerLabelRenderer $labelRenderer,
+        BackendUser $backendUser,
+        StateButtonCallbackListener $stateButtonCallbackListener,
        $backendAdapter,
        array $layers,
        array $tileProviders,
@@ -134,15 +156,55 @@ class LayerDcaListener extends AbstractListener
    ) {
        parent::__construct($manager);

-        $this->connection        = $connection;
-        $this->layers            = $layers;
-        $this->tileProviders     = $tileProviders;
-        $this->translator        = $translator;
-        $this->amenities         = $amenities;
-        $this->labelRenderer     = $labelRenderer;
-        $this->fileFormats       = $fileFormats;
-        $this->repositoryManager = $repositoryManager;
-        $this->backendAdapter    = $backendAdapter;
+        $this->connection                  = $connection;
+        $this->layers                      = $layers;
+        $this->tileProviders               = $tileProviders;
+        $this->translator                  = $translator;
+        $this->amenities                   = $amenities;
+        $this->labelRenderer               = $labelRenderer;
+        $this->fileFormats                 = $fileFormats;
+        $this->repositoryManager           = $repositoryManager;
+        $this->backendAdapter              = $backendAdapter;
+        $this->backendUser                 = $backendUser;
+        $this->stateButtonCallbackListener = $stateButtonCallbackListener;
+    }
+
+    /**
+     * Check the permissions.
+     *
+     * @param DataContainer $dataContainer Data container.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If permissions are not granted.
+     */
+    public function checkPermissions(DataContainer $dataContainer): void
+    {
+        if ($this->backendUser->isAdmin) {
+            return;
+        }
+
+        $action     = Input::get('act');
+        $permission = $this->determinePermission($action);
+
+        if ($permission && !$this->backendUser->hasAccess($permission, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('Permission "%s" not granted to access layer "%s"', $permission, $dataContainer->id)
+            );
+        }
+
+        $this->getDefinition()->set(['list', 'sorting', 'root'], $this->backendUser->leaflet_layers);
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
+
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_CREATE, 'leaflet_layer_permissions')) {
+            $this->getDefinition()->set(['config', 'closed'], true);
+        }
    }

    /**
@@ -306,6 +368,148 @@ class LayerDcaListener extends AbstractListener
        return $buffer;
    }

+    /**
+     * Generate the edit button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateEditButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the cut button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateCutButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the copy button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateCopyButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('create', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the toggle button.
+     *
+     * @param array         $row               Current data row.
+     * @param string|null   $href              Button link.
+     * @param string|null   $label             Button label.
+     * @param string|null   $title             Button title.
+     * @param string|null   $icon              Enabled button icon.
+     * @param string|null   $attributes        Html attributes as string.
+     * @param string        $tableName         Table name.
+     * @param array|null    $rootIds           Root ids.
+     * @param array|null    $childRecordIds    Child record ids.
+     * @param bool          $circularReference Circular reference flag.
+     * @param string|null   $previous          Previous button name.
+     * @param string|null   $next              Next button name.
+     * @param DataContainer $dataContainer     Data container driver.
+     *
+     * @return string
+     *
+     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
+     * @SuppressWarnings(PHPMD.ExcessiveParameterList)
+     */
+    public function generateToggleButton(
+        array $row,
+        $href,
+        $label,
+        $title,
+        $icon,
+        $attributes,
+        string $tableName,
+        $rootIds,
+        $childRecordIds,
+        bool $circularReference,
+        $previous,
+        $next,
+        $dataContainer
+    ): string {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->stateButtonCallbackListener->handleButtonCallback(
+                $row,
+                $href,
+                $label,
+                $title,
+                $icon,
+                $attributes,
+                $tableName,
+                $rootIds,
+                $childRecordIds,
+                $circularReference,
+                $previous,
+                $next,
+                $dataContainer
+            );
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the edit button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateDeleteButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('delete', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
    /**
     * Generate the markers button.
     *
@@ -324,6 +528,10 @@ class LayerDcaListener extends AbstractListener
            return '';
        }

+        if (!$this->backendUser->hasAccess('data', 'leaflet_layer_permissions')) {
+            return '';
+        }
+
        return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
    }

@@ -345,6 +553,10 @@ class LayerDcaListener extends AbstractListener
            return '';
        }

+        if (!$this->backendUser->hasAccess('data', 'leaflet_layer_permissions')) {
+            return '';
+        }
+
        return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
    }

@@ -522,4 +734,82 @@ class LayerDcaListener extends AbstractListener
            Image::getHtml($icon, $label, $attributes)
        );
    }
+
+    /**
+     * Determine permission for current action.
+     *
+     * @param string|null $action Given action.
+     *
+     * @return string|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determinePermission(?string $action): ?string
+    {
+        $permission = null;
+
+        switch ($action) {
+            case 'edit':
+            case 'toggle':
+            case 'editAll':
+            case 'overrideAll':
+            case 'cutAll':
+                return LayerModel::PERMISSION_EDIT;
+
+            case 'delete':
+            case 'deleteAll':
+                return LayerModel::PERMISSION_DELETE;
+
+            case 'copyAll':
+                return LayerModel::PERMISSION_CREATE;
+
+            case 'paste':
+                $mode = Input::get('mode');
+
+                switch ($mode) {
+                    case 'create':
+                        return LayerModel::PERMISSION_CREATE;
+
+                    case 'cut':
+                        return LayerModel::PERMISSION_EDIT;
+
+                    default:
+                        return $permission;
+                }
+
+                // Comment just to please phpcs
+            default:
+                return $permission;
+        }
+    }
+
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case 'edit':
+            case 'delete':
+            case 'paste':
+            case 'show':
+                return (int) Input::get('id');
+
+            case 'editAll':
+            case 'deleteAll':
+            case 'overrideAll':
+            case 'cutAll':
+            case 'copyAll':
+                return (int) CURRENT_ID;
+
+            default:
+                return null;
+        }
+    }
 }
--- a/src/Listener/Dca/MarkerDcaListener.php
+++ b/src/Listener/Dca/MarkerDcaListener.php
@@ -12,10 +12,13 @@

 namespace Netzmacht\Contao\Leaflet\Listener\Dca;

-use Contao\Controller;
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Contao\Input;
 use Contao\StringUtil;
 use Doctrine\DBAL\Connection;
 use Netzmacht\Contao\Leaflet\Model\IconModel;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Leaflet\Model\PopupModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
 use Netzmacht\Contao\Toolkit\Dca\Options\OptionsBuilder;
@@ -41,16 +44,48 @@ class MarkerDcaListener
     */
    private $repositoryManager;

+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
    /**
     * MarkerDcaListener constructor.
     *
     * @param Connection        $connection        Database connection.
     * @param RepositoryManager $repositoryManager Repository manager.
+     * @param BackendUser       $backendUser       Backend user.
     */
-    public function __construct(Connection $connection, RepositoryManager $repositoryManager)
+    public function __construct(Connection $connection, RepositoryManager $repositoryManager, BackendUser $backendUser)
    {
        $this->connection        = $connection;
        $this->repositoryManager = $repositoryManager;
+        $this->backendUser       = $backendUser;
+    }
+
+    /**
+     * Check permissions.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException When permission is not granted.
+     */
+    public function checkPermissions(): void
+    {
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_DATA, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer data.', $this->backendUser->id)
+            );
+        }
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
    }

    /**
@@ -165,4 +200,25 @@ class MarkerDcaListener

        return '';
    }
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case '':
+            case 'create':
+            case 'select':
+                return (int) Input::get('id');
+
+            default:
+                return (int) CURRENT_ID;
+        }
+    }
 }
--- a/src/Listener/Dca/OperationsListener.php
+++ b/src/Listener/Dca/OperationsListener.php
@@ -0,0 +1,169 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\Backend;
+use Contao\BackendUser;
+use Netzmacht\Contao\Leaflet\Model\IconModel;
+use Netzmacht\Contao\Leaflet\Model\PopupModel;
+use Netzmacht\Contao\Leaflet\Model\StyleModel;
+
+/**
+ * Class OperationsListener
+ */
+final class OperationsListener
+{
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
+    /**
+     * OperationsListener constructor.
+     *
+     * @param BackendUser $user Backend user.
+     */
+    public function __construct(BackendUser $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Generate the style operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function styleOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(StyleModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Generate the icon operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function iconOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(IconModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Generate the popup operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function popupOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(PopupModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Check if user has permission to access the leaflet table.
+     *
+     * @param string $permission The table permission.
+     *
+     * @return bool
+     */
+    private function hasPermission(string $permission): bool
+    {
+        return (bool) $this->user->hasAccess($permission, 'leaflet_tables');
+    }
+
+    /**
+     * Generate the style operation.
+     *
+     * @param string $permission Table permission to check.
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    private function renderIfPermissionIsGranted(
+        string $permission,
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        if ($this->hasPermission($permission)) {
+            return $this->render($href, $label, $title, $class, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Render a button.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    private function render(string $href, string $label, string $title, string $class, string $attributes): string
+    {
+        return sprintf(
+            ' <a href="%s" title="%s" class="%s" %s>%s</a>',
+            Backend::addToUrl($href),
+            $title,
+            $class,
+            $attributes,
+            $label
+        );
+    }
+}
--- a/src/Listener/Dca/PopupDcaListener.php
+++ b/src/Listener/Dca/PopupDcaListener.php
@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\PopupModel;
+
+/**
+ * Class PopupDcaListener
+ */
+final class PopupDcaListener
+{
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
+    /**
+     * PopupDcaListener constructor.
+     *
+     * @param BackendUser $user Backend user.
+     */
+    public function __construct(BackendUser $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(PopupModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', PopupModel::getTable(), $this->user->id)
+        );
+    }
+}
--- a/src/Listener/Dca/StyleDcaListener.php
+++ b/src/Listener/Dca/StyleDcaListener.php
@@ -14,6 +14,10 @@ declare(strict_types=1);

 namespace Netzmacht\Contao\Leaflet\Listener\Dca;

+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\StyleModel;
+
 /**
 * Class StyleDcaListener.
 *
@@ -21,6 +25,13 @@ namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 */
 class StyleDcaListener
 {
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
    /**
     * Style type options.
     *
@@ -31,11 +42,31 @@ class StyleDcaListener
    /**
     * StyleDcaListener constructor.
     *
-     * @param array $styles Styles options.
+     * @param BackendUser $user   Backend user.
+     * @param array       $styles Styles options.
     */
-    public function __construct(array $styles)
+    public function __construct(BackendUser $user, array $styles)
    {
        $this->icons = $styles;
+        $this->user  = $user;
+    }
+
+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(StyleModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', StyleModel::getTable(), $this->user->id)
+        );
    }

    /**
--- a/src/Listener/Dca/UserDcaListener.php
+++ b/src/Listener/Dca/UserDcaListener.php
@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+/**
+ * Class UserDcaListener
+ */
+final class UserDcaListener extends AbstractUserDcaListener
+{
+    /**
+     * Data container name.
+     *
+     * @var string
+     */
+    protected static $name = 'tl_user';
+}
--- a/src/Listener/Dca/UserGroupDcaListener.php
+++ b/src/Listener/Dca/UserGroupDcaListener.php
@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+/**
+ * Class UserGroupDcaListener
+ */
+final class UserGroupDcaListener extends AbstractUserDcaListener
+{
+    /**
+     * Data container name.
+     *
+     * @var string
+     */
+    protected static $name = 'tl_user_group';
+}
--- a/src/Listener/Dca/VectorDcaListener.php
+++ b/src/Listener/Dca/VectorDcaListener.php
@@ -12,6 +12,10 @@

 namespace Netzmacht\Contao\Leaflet\Listener\Dca;

+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Contao\Input;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Leaflet\Model\PopupModel;
 use Netzmacht\Contao\Leaflet\Model\StyleModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
@@ -47,19 +51,55 @@ class VectorDcaListener extends AbstractListener
     */
    private $repositoryManager;

+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
    /**
     * Construct.
     *
     * @param Manager           $dcaManager        Data container manager.
     * @param RepositoryManager $repositoryManager Repository manager.
+     * @param BackendUser       $backendUser       Backend user.
     * @param array             $vectors           Vectors.
     */
-    public function __construct(Manager $dcaManager, RepositoryManager $repositoryManager, array $vectors)
-    {
+    public function __construct(
+        Manager $dcaManager,
+        RepositoryManager $repositoryManager,
+        BackendUser $backendUser,
+        array $vectors
+    ) {
        parent::__construct($dcaManager);

        $this->vectors           = $vectors;
        $this->repositoryManager = $repositoryManager;
+        $this->backendUser       = $backendUser;
+    }
+
+    /**
+     * Check permissions.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException When permission is not granted.
+     */
+    public function checkPermissions(): void
+    {
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_DATA, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer data.', $this->backendUser->id)
+            );
+        }
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
    }

    /**
@@ -114,4 +154,25 @@ class VectorDcaListener extends AbstractListener

        return $builder->getOptions();
    }
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case '':
+            case 'create':
+            case 'select':
+                return (int) Input::get('id');
+
+            default:
+                return (int) CURRENT_ID;
+        }
+    }
 }
--- a/src/Model/LayerModel.php
+++ b/src/Model/LayerModel.php
@@ -27,6 +27,14 @@ use Contao\Model\Collection;
 */
 class LayerModel extends AbstractActiveModel
 {
+    public const PERMISSION_EDIT = 'edit';
+
+    public const PERMISSION_CREATE = 'create';
+
+    public const PERMISSION_DELETE = 'delete';
+
+    public const PERMISSION_DATA = 'data';
+
    /**
     * Model table.
     *
Author	SHA1	Message	Date
David Molineus	bdca0adb56	Fix detection of the layer id.	2018-12-07 14:26:58 +01:00
David Molineus	20efff72d9	Merge branch 'master' into feature/permissions	2018-12-07 13:28:36 +01:00
David Molineus	fa1ceb9402	Implement permission checks.	2018-12-05 14:05:01 +01:00
David Molineus	f2959b2df0	Implement permission check for icons, popups and styles.	2018-12-05 11:15:37 +01:00
David Molineus	d7fbc361d7	Implement permission configuration.	2018-12-05 09:52:59 +01:00