lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #24337 from hregis/fix_right_access_problem

Browse Source 
FIX missing "multidir_output" for project sharing (Multicompany)
This commit is contained in:
Laurent Destailleur 2023-03-31 11:25:47 +02:00 committed by GitHub
commit 95d774d750
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 24 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/core/lib/files.lib.php
View File

@ -2813,7 +2813,7 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
} }
$original_file = $conf->commande->multidir_output[$entity].'/'.$original_file; $original_file = $conf->commande->multidir_output[$entity].'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('order').")"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('order').")";
} elseif ($modulepart == 'project' && !empty($conf->project->dir_output)) { } elseif ($modulepart == 'project' && !empty($conf->project->multidir_output[$entity])) {
// Wrapping pour les projets // Wrapping pour les projets
if ($fuser->rights->projet->{$lire} || preg_match('/^specimen/i', $original_file)) { if ($fuser->rights->projet->{$lire} || preg_match('/^specimen/i', $original_file)) {
$accessallowed = 1; $accessallowed = 1;
@ -2825,9 +2825,9 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
$accessallowed = checkUserAccessToObject($user, array('projet'), $tmpproject->id, 'projet&project', '', '', 'rowid', ''); $accessallowed = checkUserAccessToObject($user, array('projet'), $tmpproject->id, 'projet&project', '', '', 'rowid', '');
} }
} }
$original_file = $conf->project->dir_output.'/'.$original_file; $original_file = $conf->project->multidir_output[$entity].'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."projet WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('project').")"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."projet WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('project').")";
} elseif ($modulepart == 'project_task' && !empty($conf->project->dir_output)) { } elseif ($modulepart == 'project_task' && !empty($conf->project->multidir_output[$entity])) {
if ($fuser->rights->projet->{$lire} || preg_match('/^specimen/i', $original_file)) { if ($fuser->rights->projet->{$lire} || preg_match('/^specimen/i', $original_file)) {
$accessallowed = 1; $accessallowed = 1;
// If we known $id of project, call checkUserAccessToObject to check permission on properties and contact of project // If we known $id of project, call checkUserAccessToObject to check permission on properties and contact of project
@ -2838,7 +2838,7 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
$accessallowed = checkUserAccessToObject($user, array('projet_task'), $tmptask->id, 'projet_task&project', '', '', 'rowid', ''); $accessallowed = checkUserAccessToObject($user, array('projet_task'), $tmptask->id, 'projet_task&project', '', '', 'rowid', '');
} }
} }
$original_file = $conf->project->dir_output.'/'.$original_file; $original_file = $conf->project->multidir_output[$entity].'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."projet WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('project').")"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."projet WHERE ref='".$db->escape($refname)."' AND entity IN (".getEntity('project').")";
} elseif (($modulepart == 'commande_fournisseur' || $modulepart == 'order_supplier') && !empty($conf->fournisseur->commande->dir_output)) { } elseif (($modulepart == 'commande_fournisseur' || $modulepart == 'order_supplier') && !empty($conf->fournisseur->commande->dir_output)) {
// Wrapping pour les commandes fournisseurs // Wrapping pour les commandes fournisseurs

4
htdocs/core/lib/project.lib.php
View File

@ -275,7 +275,7 @@ function project_prepare_head(Project $project, $moreparam = '')
} else { } else {
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
$upload_dir = $conf->project->dir_output."/".dol_sanitizeFileName($project->ref); $upload_dir = $conf->project->multidir_output[$project->entity]."/".dol_sanitizeFileName($project->ref);
$nbFiles = count(dol_dir_list($upload_dir, 'files', 0, '', '(\.meta|_preview.*\.png)$')); $nbFiles = count(dol_dir_list($upload_dir, 'files', 0, '', '(\.meta|_preview.*\.png)$'));
$nbLinks = Link::count($db, $project->element, $project->id); $nbLinks = Link::count($db, $project->element, $project->id);
$totalAttached = $nbFiles + $nbLinks; $totalAttached = $nbFiles + $nbLinks;
@ -401,7 +401,7 @@ function task_prepare_head($object)
} }
$head[$h][0] = DOL_URL_ROOT.'/projet/tasks/document.php?id='.$object->id.(GETPOST('withproject') ? '&withproject=1' : ''); $head[$h][0] = DOL_URL_ROOT.'/projet/tasks/document.php?id='.$object->id.(GETPOST('withproject') ? '&withproject=1' : '');
$filesdir = $conf->project->dir_output."/".dol_sanitizeFileName($object->project->ref).'/'.dol_sanitizeFileName($object->ref); $filesdir = $conf->project->multidir_output[$object->entity]."/".dol_sanitizeFileName($object->project->ref).'/'.dol_sanitizeFileName($object->ref);
include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
include_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php'; include_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
$nbFiles = count(dol_dir_list($filesdir, 'files', 0, '', '(\.meta|_preview.*\.png)$')); $nbFiles = count(dol_dir_list($filesdir, 'files', 0, '', '(\.meta|_preview.*\.png)$'));

4
htdocs/core/modules/project/doc/pdf_baleine.modules.php
View File

@ -195,11 +195,11 @@ class pdf_baleine extends ModelePDFProjects
// Load traductions files required by page // Load traductions files required by page
$outputlangs->loadLangs(array("main", "dict", "companies", "projects")); $outputlangs->loadLangs(array("main", "dict", "companies", "projects"));
if ($conf->project->dir_output) { if ($conf->project->multidir_output[$object->entity]) {
//$nblines = count($object->lines); // This is set later with array of tasks //$nblines = count($object->lines); // This is set later with array of tasks
$objectref = dol_sanitizeFileName($object->ref); $objectref = dol_sanitizeFileName($object->ref);
$dir = $conf->project->dir_output; $dir = $conf->project->multidir_output[$object->entity];
if (!preg_match('/specimen/i', $objectref)) { if (!preg_match('/specimen/i', $objectref)) {
$dir .= "/".$objectref; $dir .= "/".$objectref;
} }

4
htdocs/core/modules/project/doc/pdf_beluga.modules.php
View File

@ -242,11 +242,11 @@ class pdf_beluga extends ModelePDFProjects
// Load traductions files required by page // Load traductions files required by page
$outputlangs->loadLangs(array("main", "dict", "companies", "projects")); $outputlangs->loadLangs(array("main", "dict", "companies", "projects"));
if ($conf->project->dir_output) { if ($conf->project->multidir_output[$object->entity]) {
//$nblines = count($object->lines); // This is set later with array of tasks //$nblines = count($object->lines); // This is set later with array of tasks
$objectref = dol_sanitizeFileName($object->ref); $objectref = dol_sanitizeFileName($object->ref);
$dir = $conf->project->dir_output; $dir = $conf->project->multidir_output[$object->entity];
if (!preg_match('/specimen/i', $objectref)) { if (!preg_match('/specimen/i', $objectref)) {
$dir .= "/".$objectref; $dir .= "/".$objectref;
} }

4
htdocs/core/modules/project/doc/pdf_timespent.modules.php
View File

@ -195,11 +195,11 @@ class pdf_timespent extends ModelePDFProjects
// Load traductions files required by page // Load traductions files required by page
$outputlangs->loadLangs(array("main", "dict", "companies", "projects")); $outputlangs->loadLangs(array("main", "dict", "companies", "projects"));
if ($conf->project->dir_output) { if ($conf->project->multidir_output[$object->entity]) {
//$nblines = count($object->lines); // This is set later with array of tasks //$nblines = count($object->lines); // This is set later with array of tasks
$objectref = dol_sanitizeFileName($object->ref); $objectref = dol_sanitizeFileName($object->ref);
$dir = $conf->project->dir_output; $dir = $conf->project->multidir_output[$object->entity];
if (!preg_match('/specimen/i', $objectref)) { if (!preg_match('/specimen/i', $objectref)) {
$dir .= "/".$objectref; $dir .= "/".$objectref;
} }

8
htdocs/projet/card.php
View File

@ -390,7 +390,7 @@ if (empty($reshook)) {
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
$langs->load("other"); $langs->load("other");
$upload_dir = $conf->project->dir_output; $upload_dir = $conf->project->multidir_output[$object->entity];
$file = $upload_dir.'/'.GETPOST('file'); $file = $upload_dir.'/'.GETPOST('file');
$ret = dol_delete_file($file, 0, 0, 0, $object); $ret = dol_delete_file($file, 0, 0, 0, $object);
if ($ret) { if ($ret) {
@ -1402,12 +1402,12 @@ if ($action == 'create' && $user->rights->projet->creer) {
* Generated documents * Generated documents
*/ */
$filename = dol_sanitizeFileName($object->ref); $filename = dol_sanitizeFileName($object->ref);
$filedir = $conf->project->dir_output."/".dol_sanitizeFileName($object->ref); $filedir = $conf->project->multidir_output[$object->entity]."/".dol_sanitizeFileName($object->ref);
$urlsource = $_SERVER["PHP_SELF"]."?id=".$object->id; $urlsource = $_SERVER["PHP_SELF"]."?id=".$object->id;
$genallowed = ($user->rights->projet->lire && $userAccess > 0); $genallowed = ($user->rights->projet->lire && $userAccess > 0);
$delallowed = ($user->rights->projet->creer && $userWrite > 0); $delallowed = ($user->rights->projet->creer && $userWrite > 0);
print $formfile->showdocuments('project', $filename, $filedir, $urlsource, $genallowed, $delallowed, $object->model_pdf); print $formfile->showdocuments('project', $filename, $filedir, $urlsource, $genallowed, $delallowed, $object->model_pdf, 1, 0, 0, 0, 0, '', '', '', '', '', $object);
print '</div><div class="fichehalfright">'; print '</div><div class="fichehalfright">';
@ -1426,7 +1426,7 @@ if ($action == 'create' && $user->rights->projet->creer) {
// Presend form // Presend form
$modelmail = 'project'; $modelmail = 'project';
$defaulttopic = 'SendProjectRef'; $defaulttopic = 'SendProjectRef';
$diroutput = $conf->project->dir_output; $diroutput = $conf->project->multidir_output[$object->entity];
$autocopy = 'MAIN_MAIL_AUTOCOPY_PROJECT_TO'; // used to know the automatic BCC to add $autocopy = 'MAIN_MAIL_AUTOCOPY_PROJECT_TO'; // used to know the automatic BCC to add
$trackid = 'proj'.$object->id; $trackid = 'proj'.$object->id;

1
htdocs/projet/class/project.class.php
View File

@ -1347,6 +1347,7 @@ class Project extends CommonObject
// Initialise parameters // Initialise parameters
$this->id = 0; $this->id = 0;
$this->ref = 'SPECIMEN'; $this->ref = 'SPECIMEN';
$this->entity = $conf->entity;
$this->specimen = 1; $this->specimen = 1;
$this->socid = 1; $this->socid = 1;
$this->date_c = $now; $this->date_c = $now;

4
htdocs/projet/class/task.class.php
View File

@ -198,7 +198,7 @@ class Task extends CommonObjectLine
$sql .= ", progress"; $sql .= ", progress";
$sql .= ", budget_amount"; $sql .= ", budget_amount";
$sql .= ") VALUES ("; $sql .= ") VALUES (";
$sql .= ((int) $conf->entity); $sql .= (!empty($this->entity) ? (int) $this->entity : (int) $conf->entity);
$sql .= ", ".((int) $this->fk_project); $sql .= ", ".((int) $this->fk_project);
$sql .= ", ".(!empty($this->ref) ? "'".$this->db->escape($this->ref)."'" : 'null'); $sql .= ", ".(!empty($this->ref) ? "'".$this->db->escape($this->ref)."'" : 'null');
$sql .= ", ".((int) $this->fk_task_parent); $sql .= ", ".((int) $this->fk_task_parent);
@ -274,6 +274,7 @@ class Task extends CommonObjectLine
$sql = "SELECT"; $sql = "SELECT";
$sql .= " t.rowid,"; $sql .= " t.rowid,";
$sql .= " t.ref,"; $sql .= " t.ref,";
$sql .= " t.entity,";
$sql .= " t.fk_projet as fk_project,"; $sql .= " t.fk_projet as fk_project,";
$sql .= " t.fk_task_parent,"; $sql .= " t.fk_task_parent,";
$sql .= " t.label,"; $sql .= " t.label,";
@ -318,6 +319,7 @@ class Task extends CommonObjectLine
$this->id = $obj->rowid; $this->id = $obj->rowid;
$this->ref = $obj->ref; $this->ref = $obj->ref;
$this->entity = $obj->entity;
$this->fk_project = $obj->fk_project; $this->fk_project = $obj->fk_project;
$this->fk_task_parent = $obj->fk_task_parent; $this->fk_task_parent = $obj->fk_task_parent;
$this->label = $obj->label; $this->label = $obj->label;

4
htdocs/projet/document.php
View File

@ -49,7 +49,7 @@ if (!empty($conf->global->PROJECT_ALLOW_COMMENT_ON_PROJECT) && method_exists($ob
} }
if ($id > 0 || !empty($ref)) { if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->project->dir_output."/".dol_sanitizeFileName($object->ref); $upload_dir = $conf->project->multidir_output[$object->entity]."/".dol_sanitizeFileName($object->ref);
} }
// Get parameters // Get parameters
@ -109,7 +109,7 @@ llxHeader('', $title, $help_url);
$form = new Form($db); $form = new Form($db);
if ($object->id > 0) { if ($object->id > 0) {
$upload_dir = $conf->project->dir_output.'/'.dol_sanitizeFileName($object->ref); $upload_dir = $conf->project->multidir_output[$object->entity].'/'.dol_sanitizeFileName($object->ref);
// To verify role of users // To verify role of users
//$userAccess = $object->restrictedProjectArea($user,'read'); //$userAccess = $object->restrictedProjectArea($user,'read');

1
htdocs/projet/tasks.php
View File

@ -336,6 +336,7 @@ if ($action == 'createtask' && $user->rights->projet->creer) {
$task = new Task($db); $task = new Task($db);
$task->fk_project = $projectid; $task->fk_project = $projectid;
$task->entity = $object->entity; // Task have the same entity of project
$task->ref = $taskref; $task->ref = $taskref;
$task->label = $label; $task->label = $label;
$task->description = $description; $task->description = $description;

2
htdocs/projet/tasks/document.php
View File

@ -110,7 +110,7 @@ if ($id > 0 || !empty($ref)) {
$object->project = clone $projectstatic; $object->project = clone $projectstatic;
$upload_dir = $conf->project->dir_output.'/'.dol_sanitizeFileName($projectstatic->ref).'/'.dol_sanitizeFileName($object->ref); $upload_dir = $conf->project->multidir_output[$projectstatic->entity].'/'.dol_sanitizeFileName($projectstatic->ref).'/'.dol_sanitizeFileName($object->ref);
} }
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php'; include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';