lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX: task time screen: prevent users with access to all project from assigning to tasks they're not allowed to do

Browse Source
This commit is contained in:
Marc de Lima Lucio 2018-10-30 12:28:04 +01:00
parent 7c81124e66
commit 8911d72be8
3 changed files with 24 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
htdocs/core/class/html.formprojet.class.php
View File

@ -295,22 +295,29 @@ class FormProjets
/** /**
* Output a combo list with projects qualified for a third party * Output a combo list with projects qualified for a third party
* *
* @param int $socid Id third party (-1=all, 0=only projects not linked to a third party, id=projects not linked or linked to third party id) * @param int $socid Id third party (-1=all, 0=only projects not linked to a third party, id=projects not linked or linked to third party id)
* @param int $selected Id task preselected * @param int $selected Id task preselected
* @param string $htmlname Name of HTML select * @param string $htmlname Name of HTML select
* @param int $maxlength Maximum length of label * @param int $maxlength Maximum length of label
* @param int $option_only Return only html options lines without the select tag * @param int $option_only Return only html options lines without the select tag
* @param string $show_empty Add an empty line ('1' or string to show for empty line) * @param string $show_empty Add an empty line ('1' or string to show for empty line)
* @param int $discard_closed Discard closed projects (0=Keep,1=hide completely,2=Disable) * @param int $discard_closed Discard closed projects (0=Keep,1=hide completely,2=Disable)
* @param int $forcefocus Force focus on field (works with javascript only) * @param int $forcefocus Force focus on field (works with javascript only)
* @param int $disabled Disabled * @param int $disabled Disabled
* @param string $morecss More css added to the select component * @param string $morecss More css added to the select component
* @return int Nbr of project if OK, <0 if KO * @param User $usertofilter User object to use for filtering
* @param int $forceuserfilter 1=Force individual task user rights even if user has right to see all
* @return int Nbr of project if OK, <0 if KO
*/ */
function selectTasks($socid=-1, $selected='', $htmlname='taskid', $maxlength=24, $option_only=0, $show_empty='1', $discard_closed=0, $forcefocus=0, $disabled=0, $morecss='maxwidth500') function selectTasks($socid=-1, $selected='', $htmlname='taskid', $maxlength=24, $option_only=0, $show_empty='1', $discard_closed=0, $forcefocus=0, $disabled=0, $morecss='maxwidth500', $usertofilter=null, $forceuserfilter=0)
{ {
global $user,$conf,$langs; global $user,$conf,$langs;
if(is_null($usertofilter))
{
$usertofilter = $user;
}
require_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php'; require_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
$out=''; $out='';
@ -319,10 +326,10 @@ class FormProjets
if (! empty($conf->global->PROJECT_HIDE_UNSELECTABLES)) $hideunselectables = true; if (! empty($conf->global->PROJECT_HIDE_UNSELECTABLES)) $hideunselectables = true;
$projectsListId = false; $projectsListId = false;
if (empty($user->rights->projet->all->lire)) if (empty($usertofilter->rights->projet->all->lire) || $forceuserfilter)
{ {
$projectstatic=new Project($this->db); $projectstatic=new Project($this->db);
$projectsListId = $projectstatic->getProjectsAuthorizedForUser($user,0,1); $projectsListId = $projectstatic->getProjectsAuthorizedForUser($usertofilter,0,1);
} }
// Search all projects // Search all projects
@ -367,7 +374,7 @@ class FormProjets
{ {
$obj = $this->db->fetch_object($resql); $obj = $this->db->fetch_object($resql);
// If we ask to filter on a company and user has no permission to see all companies and project is linked to another company, we hide project. // If we ask to filter on a company and user has no permission to see all companies and project is linked to another company, we hide project.
if ($socid > 0 && (empty($obj->fk_soc) || $obj->fk_soc == $socid) && empty($user->rights->societe->lire)) if ($socid > 0 && (empty($obj->fk_soc) || $obj->fk_soc == $socid) && empty($usertofilter->rights->societe->lire))
{ {
// Do nothing // Do nothing
} }

2
htdocs/projet/activity/perday.php
View File

@ -399,7 +399,7 @@ print '<div class="float valignmiddle">';
$titleassigntask = $langs->trans("AssignTaskToMe"); $titleassigntask = $langs->trans("AssignTaskToMe");
if ($usertoprocess->id != $user->id) $titleassigntask = $langs->trans("AssignTaskToUser", $usertoprocess->getFullName($langs)); if ($usertoprocess->id != $user->id) $titleassigntask = $langs->trans("AssignTaskToUser", $usertoprocess->getFullName($langs));
print '<div class="taskiddiv inline-block">'; print '<div class="taskiddiv inline-block">';
$formproject->selectTasks($socid?$socid:-1, $taskid, 'taskid', 32, 0, 1, 1); $formproject->selectTasks($socid?$socid:-1, $taskid, 'taskid', 32, 0, 1, 1, 0, 0, '', $usertoprocess, 1);
print '</div>'; print '</div>';
print ' '; print ' ';
print $formcompany->selectTypeContact($object, '', 'type','internal','rowid', 0, 'maxwidth200'); print $formcompany->selectTypeContact($object, '', 'type','internal','rowid', 0, 'maxwidth200');

2
htdocs/projet/activity/perweek.php
View File

@ -402,7 +402,7 @@ print '<div class="float valignmiddle">';
$titleassigntask = $langs->trans("AssignTaskToMe"); $titleassigntask = $langs->trans("AssignTaskToMe");
if ($usertoprocess->id != $user->id) $titleassigntask = $langs->trans("AssignTaskToUser", $usertoprocess->getFullName($langs)); if ($usertoprocess->id != $user->id) $titleassigntask = $langs->trans("AssignTaskToUser", $usertoprocess->getFullName($langs));
print '<div class="taskiddiv inline-block">'; print '<div class="taskiddiv inline-block">';
$formproject->selectTasks($socid?$socid:-1, $taskid, 'taskid', 32, 0, 1, 1); $formproject->selectTasks($socid?$socid:-1, $taskid, 'taskid', 32, 0, 1, 1, 0, 0, '', $usertoprocess, 1);
print '</div>'; print '</div>';
print ' '; print ' ';
print $formcompany->selectTypeContact($object, '', 'type','internal','rowid', 0, 'maxwidth200'); print $formcompany->selectTypeContact($object, '', 'type','internal','rowid', 0, 'maxwidth200');