diff --git a/htdocs/core/lib/company.lib.php b/htdocs/core/lib/company.lib.php
index c90630b39a5..67bdefa6fc9 100644
--- a/htdocs/core/lib/company.lib.php
+++ b/htdocs/core/lib/company.lib.php
@@ -435,7 +435,7 @@ function show_projects($conf,$langs,$db,$object,$backtopage='')
$projectstatic->fetch($obj->rowid);
// To verify role of users
- $userAccess = $projectstatic->restrictedProjectArea($user,1);
+ $userAccess = $projectstatic->restrictedProjectArea($user);
if ($user->rights->projet->lire && $userAccess > 0)
{
diff --git a/htdocs/core/lib/project.lib.php b/htdocs/core/lib/project.lib.php
index 00a53319a8c..6d0dc520c89 100644
--- a/htdocs/core/lib/project.lib.php
+++ b/htdocs/core/lib/project.lib.php
@@ -687,7 +687,7 @@ function print_projecttasks_array($db, $socid, $projectsListId, $mytasks=0)
$projectstatic->public = $objp->public;
// Check is user has read permission on project
- $userAccess = $projectstatic->restrictedProjectArea($user,1);
+ $userAccess = $projectstatic->restrictedProjectArea($user);
if ($userAccess >= 0)
{
$var=!$var;
diff --git a/htdocs/projet/class/project.class.php b/htdocs/projet/class/project.class.php
index 94e75a45637..3d682c7ca37 100644
--- a/htdocs/projet/class/project.class.php
+++ b/htdocs/projet/class/project.class.php
@@ -170,9 +170,9 @@ class Project extends CommonObject
function update($user, $notrigger=0)
{
global $langs, $conf;
-
+
$error=0;
-
+
// Clean parameters
$this->title = trim($this->title);
$this->description = trim($this->description);
@@ -499,7 +499,7 @@ class Project extends CommonObject
global $langs, $conf;
$error=0;
-
+
if ($this->statut != 1)
{
$this->db->begin();
@@ -558,7 +558,7 @@ class Project extends CommonObject
global $langs, $conf;
$error=0;
-
+
if ($this->statut != 2)
{
$this->db->begin();
@@ -789,21 +789,21 @@ class Project extends CommonObject
}
/**
- * Check if user has read permission on project
+ * Check if user has permission on current project
*
* @param User $user Object user to evaluate
- * @param int $noprint 0=Print forbidden message if no permission, 1=Return -1 if no permission
- * @return void
+ * @param string $mode Type of permission we want to know: 'read', 'write'
+ * @return int >0 if user has permission, <0 if user has no permission
*/
- function restrictedProjectArea($user, $noprint=0)
+ function restrictedProjectArea($user, $mode='read')
{
// To verify role of users
$userAccess = 0;
- if ($user->rights->projet->all->lire)
+ if (($mode == 'read' && $user->rights->projet->all->lire) || ($mode == 'write' && $user->rights->projet->all->creer) || ($mode == 'delete' && $user->rights->projet->all->supprimer))
{
$userAccess = 1;
}
- else if ($this->public && $user->rights->projet->lire)
+ else if ($this->public && (($mode == 'read' && $user->rights->projet->lire) || ($mode == 'write' && $user->rights->projet->creer) || ($mode == 'delete' && $user->rights->projet->supprimer)))
{
$userAccess = 1;
}
@@ -819,7 +819,9 @@ class Project extends CommonObject
{
if (preg_match('/PROJECT/', $userRole[$nblinks]['code']) && $user->id == $userRole[$nblinks]['id'])
{
- $userAccess++;
+ if ($mode == 'read' && $user->rights->projet->lire) $userAccess++;
+ if ($mode == 'write' && $user->rights->projet->creer) $userAccess++;
+ if ($mode == 'delete' && $user->rights->projet->supprimer) $userAccess++;
}
$nblinks++;
}
@@ -833,19 +835,7 @@ class Project extends CommonObject
//}
}
- if (!$userAccess)
- {
- if (!$noprint)
- {
- accessforbidden('', 0);
- }
- else
- {
- return -1;
- }
- }
-
- return $userAccess;
+ return ($userAccess?$userAccess:-1);
}
/**
diff --git a/htdocs/projet/contact.php b/htdocs/projet/contact.php
index 9409a9dc997..2a218703394 100644
--- a/htdocs/projet/contact.php
+++ b/htdocs/projet/contact.php
@@ -30,7 +30,8 @@ require_once(DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php');
$langs->load("projects");
$langs->load("companies");
-$projectid = isset($_GET["id"])?$_GET["id"]:'';
+$id = GETPOST('id');
+$ref= GETPOST('ref');
$mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
@@ -38,7 +39,7 @@ $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
// Security check
$socid=0;
if ($user->societe_id) $socid=$user->societe_id;
-$result = restrictedArea($user, 'projet', $projectid);
+$result = restrictedArea($user, 'projet', $id);
/*
@@ -51,9 +52,9 @@ if ($_POST["action"] == 'addcontact' && $user->rights->projet->creer)
$result = 0;
$project = new Project($db);
- $result = $project->fetch($projectid);
+ $result = $project->fetch($id);
- if ($result > 0 && $projectid > 0)
+ if ($result > 0 && $id > 0)
{
$result = $project->add_contact($_POST["contactid"], $_POST["type"], $_POST["source"]);
}
@@ -81,7 +82,7 @@ if ($_POST["action"] == 'addcontact' && $user->rights->projet->creer)
if ($_GET["action"] == 'swapstatut' && $user->rights->projet->creer)
{
$project = new Project($db);
- if ($project->fetch($projectid))
+ if ($project->fetch($id))
{
$result=$project->swapContactStatus(GETPOST('ligne'));
}
@@ -95,7 +96,7 @@ if ($_GET["action"] == 'swapstatut' && $user->rights->projet->creer)
if ($_GET["action"] == 'deleteline' && $user->rights->projet->creer)
{
$project = new Project($db);
- $project->fetch($projectid);
+ $project->fetch($id);
$result = $project->delete_contact($_GET["lineid"]);
if ($result >= 0)
@@ -130,8 +131,6 @@ $userstatic=new User($db);
/* *************************************************************************** */
dol_htmloutput_mesg($mesg);
-$id = $_GET['id'];
-$ref= $_GET['ref'];
if ($id > 0 || ! empty($ref))
{
$project = new Project($db);
@@ -141,7 +140,10 @@ if ($id > 0 || ! empty($ref))
if ($project->societe->id > 0) $result=$project->societe->fetch($project->societe->id);
// To verify role of users
- $userAccess = $project->restrictedProjectArea($user);
+ //$userAccess = $project->restrictedProjectArea($user,'read');
+ $userWrite = $project->restrictedProjectArea($user,'write');
+ //$userDelete = $project->restrictedProjectArea($user,'delete');
+ //print "userAccess=".$userAccess." userWrite=".$userWrite." userDelete=".$userDelete;
$head = project_prepare_head($project);
dol_fiche_head($head, 'contact', $langs->trans("Project"), 0, ($project->public?'projectpub':'project'));
@@ -157,8 +159,11 @@ if ($id > 0 || ! empty($ref))
// Ref
print '
'.$langs->trans('Ref').'
';
// Define a complementary filter for search of next/prev ref.
- $projectsListId = $project->getProjectsAuthorizedForUser($user,$mine,1);
- $project->next_prev_filter=" rowid in (".$projectsListId.")";
+ if (! $user->rights->projet->all->lire)
+ {
+ $projectsListId = $project->getProjectsAuthorizedForUser($user,$mine,0);
+ $project->next_prev_filter=" rowid in (".(count($projectsListId)?join(',',array_keys($projectsListId)):'0').")";
+ }
print $form->showrefnav($project,'ref',$linkback,1,'ref','ref','');
print '
';
@@ -194,7 +199,7 @@ if ($id > 0 || ! empty($ref))
* Ajouter une ligne de contact
* Non affiche en mode modification de ligne
*/
- if ($_GET["action"] != 'editline' && $user->rights->projet->creer && $userAccess)
+ if ($_GET["action"] != 'editline')
{
print '