lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor function to use it into API

Browse Source 
New function checkUserAccessToObject() is a piece of restrictedArea() function.
This commit is contained in:
jfefe 2015-05-03 14:41:51 +02:00
parent 31e5b4786a
commit 46ce77c571
1 changed files with 178 additions and 152 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
htdocs/core/lib/security.lib.php
View File

@ -331,6 +331,35 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
// is linked to a company allowed to $user. // is linked to a company allowed to $user.
if (! empty($objectid) && $objectid > 0) if (! empty($objectid) && $objectid > 0)
{ {
$ok = checkUserAccessToObject($user, $featuresarray,$objectid,$dbtablename,$feature2,$dbt_keyfield,$dbt_select);
return $ok ? 1 : accessforbidden();
}
return 1;
}
/**
* Check access by user to object
*
* @param User $user User to check
* @param array $featuresarray Features/modules to check
* @param int $objectid Object ID if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
* @param string $dbtablename 'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity. Not used if objectid is null (optional)
* @param string $feature2 Feature to check, second level of permission (optional). Can be or check with 'level1|level2'.
* @param string $dbt_keyfield Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional)
* @param string $dbt_select Field name for select if not rowid. Not used if objectid is null (optional)
*
* @return bool True if user has access, False otherwise
*/
function checkUserAccessToObject($user, $featuresarray, $objectid=0, $dbtablename='', $feature2='', $dbt_keyfield='', $dbt_select='')
{
global $db, $conf;
// More parameters
$params = explode('&', $dbtablename);
$dbtablename=(! empty($params[0]) ? $params[0] : '');
$sharedelement=(! empty($params[1]) ? $params[1] : $dbtablename);
foreach ($featuresarray as $feature) foreach ($featuresarray as $feature)
{ {
$sql=''; $sql='';
@ -365,7 +394,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
// If external user: Check permission for external users // If external user: Check permission for external users
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
if ($user->societe_id <> $objectid) accessforbidden(); if ($user->societe_id <> $objectid) return false;
} }
// If internal user: Check permission for internal users that are restricted on their objects // If internal user: Check permission for internal users that are restricted on their objects
else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir)) else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
@ -424,7 +453,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
$projectstatic=new Project($db); $projectstatic=new Project($db);
$tmps=$projectstatic->getProjectsAuthorizedForUser($user,0,1,0); $tmps=$projectstatic->getProjectsAuthorizedForUser($user,0,1,0);
$tmparray=explode(',',$tmps); $tmparray=explode(',',$tmps);
if (! in_array($objectid,$tmparray)) accessforbidden(); if (! in_array($objectid,$tmparray)) return false;
} }
else else
{ {
@ -475,20 +504,17 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
$resql=$db->query($sql); $resql=$db->query($sql);
if ($resql) if ($resql)
{ {
if ($db->num_rows($resql) == 0) accessforbidden(); if ($db->num_rows($resql) == 0) return false;
} }
else else
{ {
accessforbidden(); return false;
} }
} }
} }
} return true;
return 1;
} }
/** /**
* Show a message to say access is forbidden and stop program * Show a message to say access is forbidden and stop program
* Calling this function terminate execution of PHP. * Calling this function terminate execution of PHP.