lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Project not linked to companies must be visible.

Browse Source
This commit is contained in:
Laurent Destailleur 2009-11-29 19:05:22 +00:00
parent 178ec9ccc5
commit 5da8b40812
2 changed files with 24 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
htdocs/lib/functions.lib.php
View File

@ -1640,8 +1640,11 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
{ {
$sql=''; $sql='';
$check = array('user','usergroup','produit','service','produit|service'); $check = array('user','usergroup','produit','service','produit|service'); // Test on entity only (Objects with no link to company)
$nocheck = array('categorie','barcode','stock','fournisseur'); $checksoc = array('societe'); // Test for societe object
$checkother = array('contact','projet'); // Test on entity and link to societe. Allowed if link is empty (Ex: contacts, projects...).
// Others: Test on entity and link to societe. Not allowed if link is empty (Ex: invoice, orders...).
$nocheck = array('categorie','barcode','stock','fournisseur'); // No test
// If dbtable not defined, we use same name for table than module name // If dbtable not defined, we use same name for table than module name
if (empty($dbtablename)) $dbtablename = $feature; if (empty($dbtablename)) $dbtablename = $feature;
@ -1654,7 +1657,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql.= " WHERE dbt.".$dbt_select." = ".$objectid; $sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
$sql.= " AND dbt.entity IN (0,".$conf->entity.")"; $sql.= " AND dbt.entity IN (0,".$conf->entity.")";
} }
else if ($feature == 'societe') else if (in_array($feature,$checksoc))
{ {
// If external user: Check permission for external users // If external user: Check permission for external users
if ($user->societe_id > 0) if ($user->societe_id > 0)
@ -1681,33 +1684,33 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql.= " AND s.entity = ".$conf->entity; $sql.= " AND s.entity = ".$conf->entity;
} }
} }
else if ($feature == 'contact') else if (in_array($feature,$checkother))
{ {
// If external user: Check permission for external users // If external user: Check permission for external users
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
$sql = "SELECT sp.rowid"; $sql = "SELECT dbt.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX."socpeople as sp"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE sp.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND sp.fk_soc = ".$user->societe_id; $sql.= " AND dbt.fk_soc = ".$user->societe_id;
} }
// If internal user: Check permission for internal users that are restricted on their objects // If internal user: Check permission for internal users that are restricted on their objects
else if (! $user->rights->societe->client->voir) else if (! $user->rights->societe->client->voir)
{ {
$sql = "SELECT sp.rowid"; $sql = "SELECT dbt.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX."socpeople as sp"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sp.fk_soc = sc.fk_soc AND sc.fk_user = '".$user->id."'"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = '".$user->id."'";
$sql.= " WHERE sp.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND (sp.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user $sql.= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user
$sql.= " AND sp.entity = ".$conf->entity; $sql.= " AND dbt.entity = ".$conf->entity;
} }
// If multicompany and internal users with all permissions, check user is in correct entity // If multicompany and internal users with all permissions, check user is in correct entity
else if ($conf->global->MAIN_MODULE_MULTICOMPANY) else if ($conf->global->MAIN_MODULE_MULTICOMPANY)
{ {
$sql = "SELECT sp.rowid"; $sql = "SELECT dbt.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX."socpeople as sp"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE sp.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND sp.entity = ".$conf->entity; $sql.= " AND dbt.entity = ".$conf->entity;
} }
} }
else if (!in_array($feature,$nocheck)) else if (!in_array($feature,$nocheck))

7
htdocs/projet/liste.php
View File

@ -72,14 +72,13 @@ $staticsoc=new Societe($db);
$sql = "SELECT p.rowid as projectid, p.ref, p.title, ".$db->pdate("p.dateo")." as do, p.fk_user_resp,"; $sql = "SELECT p.rowid as projectid, p.ref, p.title, ".$db->pdate("p.dateo")." as do, p.fk_user_resp,";
$sql.= " u.login,"; $sql.= " u.login,";
$sql.= " s.nom, s.rowid as socid, s.client"; $sql.= " s.nom, s.rowid as socid, s.client";
$sql.= " FROM (".MAIN_DB_PREFIX."projet as p"; $sql.= " FROM ".MAIN_DB_PREFIX."projet as p";
if (!$user->rights->societe->client->voir && !$socid) $sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql.= ")";
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid";
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on p.fk_user_resp = u.rowid"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."user as u on p.fk_user_resp = u.rowid";
if (!$user->rights->societe->client->voir && !$socid) $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON p.fk_soc = sc.fk_soc AND sc.fk_user = ".$user->id;
$sql.= " WHERE p.entity = ".$conf->entity; $sql.= " WHERE p.entity = ".$conf->entity;
if ($_REQUEST["mode"]=='mine') $sql.=' AND p.fk_user_resp='.$user->id; if ($_REQUEST["mode"]=='mine') $sql.=' AND p.fk_user_resp='.$user->id;
if (!$user->rights->societe->client->voir && !$socid) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = ".$user->id; if (!$user->rights->societe->client->voir && !$socid) $sql.= " AND (p.fk_soc IS NULL or sc.fk_soc IS NOT NULL)";
if ($socid) $sql.= " AND s.rowid = ".$socid; if ($socid) $sql.= " AND s.rowid = ".$socid;
if ($_GET["search_ref"]) if ($_GET["search_ref"])