lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #yogosha5645

Browse Source
This commit is contained in:
Laurent Destailleur 2021-03-16 10:59:01 +01:00
parent 71e7f10a54
commit 1495630254
3 changed files with 75 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/holiday/card.php
View File

@ -51,6 +51,8 @@ $fuserid = (GETPOST('fuserid', 'int') ?GETPOST('fuserid', 'int') : $user->id);
// Load translation files required by the page
$langs->loadLangs(array("other", "holiday", "mails"));
$error = 0;
$now = dol_now();
$childids = $user->getAllChildIds(1);
@ -60,8 +62,6 @@ if (!empty($conf->global->HOLIDAY_HIDE_FOR_NON_SALARIES)) {
$morefilter = 'AND employee = 1';
}
$error = 0;
$object = new Holiday($db);
$extrafields = new ExtraFields($db);

60
htdocs/holiday/document.php
View File

@ -44,12 +44,6 @@ $ref = GETPOST('ref', 'alpha');
$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
// Security check
if ($user->socid) {
$socid = $user->socid;
}
$result = restrictedArea($user, 'holiday', $id, 'holiday');
// Get parameters
$limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'aZ09comma');
@ -69,12 +63,64 @@ if (!$sortfield) {
}
$childids = $user->getAllChildIds(1);
$morefilter = '';
if (!empty($conf->global->HOLIDAY_HIDE_FOR_NON_SALARIES)) {
$morefilter = 'AND employee = 1';
}
$object = new Holiday($db);
$object->fetch($id, $ref);
$extrafields = new ExtraFields($db);
// fetch optionals attributes and labels
$extrafields->fetch_name_optionals_label($object->table_element);
if (($id > 0) || $ref) {
$object->fetch($id, $ref);
// Check current user can read this leave request
$canread = 0;
if (!empty($user->rights->holiday->readall)) {
$canread = 1;
}
if (!empty($user->rights->holiday->read) && in_array($object->fk_user, $childids)) {
$canread = 1;
}
if (!$canread) {
accessforbidden();
}
}
/*$cancreate = 0;
if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->holiday->writeall_advance)) {
$cancreate = 1;
}
if (!empty($user->rights->holiday->write) && in_array($fuserid, $childids)) {
$cancreate = 1;
}
$candelete = 0;
if (!empty($user->rights->holiday->delete)) {
$candelete = 1;
}
if ($object->statut == Holiday::STATUS_DRAFT && $user->rights->holiday->write && in_array($object->fk_user, $childids)) {
$candelete = 1;
}
*/
$upload_dir = $conf->holiday->dir_output.'/'.get_exdir(0, 0, 0, 1, $object, '');
$modulepart = 'holiday';
// Protection if external user
if ($user->socid) {
$socid = $user->socid;
}
$result = restrictedArea($user, 'holiday', $object->id, 'holiday');
/*
* Actions

30
htdocs/holiday/info.php
View File

@ -34,26 +34,30 @@ $langs->load("holiday");
$id = GETPOST('id', 'int');
$ref = GETPOST('ref', 'alpha');
$childids = $user->getAllChildIds(1);
// Security check
if ($user->socid) {
$socid = $user->socid;
$morefilter = '';
if (!empty($conf->global->HOLIDAY_HIDE_FOR_NON_SALARIES)) {
$morefilter = 'AND employee = 1';
}
$result = restrictedArea($user, 'holiday', $id, 'holiday');
$object = new Holiday($db);
if (!$object->fetch($id, $ref) > 0) {
dol_print_error($db);
}
if ($object->id > 0) {
// Check current user can read this expense report
$extrafields = new ExtraFields($db);
// fetch optionals attributes and labels
$extrafields->fetch_name_optionals_label($object->table_element);
if (($id > 0) || $ref) {
$object->fetch($id, $ref);
// Check current user can read this leave request
$canread = 0;
if (!empty($user->rights->holiday->readall)) {
$canread = 1;
}
if (!empty($user->rights->holiday->lire) && in_array($object->fk_user_author, $childids)) {
if (!empty($user->rights->holiday->read) && in_array($object->fk_user, $childids)) {
$canread = 1;
}
if (!$canread) {
@ -61,6 +65,12 @@ if ($object->id > 0) {
}
}
// Security check
if ($user->socid) {
$socid = $user->socid;
}
$result = restrictedArea($user, 'holiday', $object->id, 'holiday');
/*
* View