lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix permissions

Browse Source
This commit is contained in:
Laurent Destailleur 2022-05-17 07:30:02 +02:00
parent ddd0848acc
commit a2e814b079
2 changed files with 159 additions and 150 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
htdocs/core/lib/security.lib.php
View File

@ -378,6 +378,7 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
$nbko++; $nbko++;
} }
} elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level } elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level
var_dump($user->rights);
if (empty($user->rights->$feature->lire) if (empty($user->rights->$feature->lire)
&& empty($user->rights->$feature->read) && empty($user->rights->$feature->read)
&& empty($user->rights->$feature->run)) { && empty($user->rights->$feature->run)) {

16
htdocs/ticket/index.php
View File

@ -52,9 +52,6 @@ if ($user->socid) {
} }
$userid = $user->id; $userid = $user->id;
// Security check
$result = restrictedArea($user, 'ticket', 0, '', '', '', '');
$nowarray = dol_getdate(dol_now(), true); $nowarray = dol_getdate(dol_now(), true);
$nowyear = $nowarray['year']; $nowyear = $nowarray['year'];
$year = GETPOST('year', 'int') > 0 ? GETPOST('year', 'int') : $nowyear; $year = GETPOST('year', 'int') > 0 ? GETPOST('year', 'int') : $nowyear;
@ -63,6 +60,12 @@ $endyear = $year;
$object = new Ticket($db); $object = new Ticket($db);
// Security check
//$result = restrictedArea($user, 'ticket|knowledgemanagement', 0, '', '', '', '');
if (empty($user->rights->ticket->read) && empty($user->rights->knowledgemanagement->knowledgerecord->read)) {
accessforbidden('Not enought permissions');
}
/* /*
* Actions * Actions
@ -240,6 +243,7 @@ $stringtoshow .= '<input type="image" alt="'.$langs->trans("Refresh").'" src="'.
$stringtoshow .= '</form>'; $stringtoshow .= '</form>';
$stringtoshow .= '</div>'; $stringtoshow .= '</div>';
if (!empty($user->rights->ticket->read)) {
print '<div class="div-table-responsive-no-min">'; print '<div class="div-table-responsive-no-min">';
print '<table class="noborder centpercent">'; print '<table class="noborder centpercent">';
print '<tr class="liste_titre"><th >'.$langs->trans("Statistics").' '.$endyear.' '.img_picto('', 'filter.png', 'id="idsubimgDOLUSERCOOKIE_ticket_by_status" class="linkobject"').'</th></tr>'; print '<tr class="liste_titre"><th >'.$langs->trans("Statistics").' '.$endyear.' '.img_picto('', 'filter.png', 'id="idsubimgDOLUSERCOOKIE_ticket_by_status" class="linkobject"').'</th></tr>';
@ -292,11 +296,14 @@ print '</td></tr>';
print '</table>'; print '</table>';
print '</div>'; print '</div>';
}
if (!empty($user->rights->ticket->read)) {
// Build graphic number of object // Build graphic number of object
$data = $stats->getNbByMonthWithPrevYear($endyear, $startyear); $data = $stats->getNbByMonthWithPrevYear($endyear, $startyear);
print '<br>'."\n"; print '<br>'."\n";
}
print $resultboxes['boxlista']; print $resultboxes['boxlista'];
@ -304,6 +311,7 @@ print '</div>'."\n";
print '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">'; print '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">';
if (!empty($user->rights->ticket->read)) {
/* /*
* Latest unread tickets * Latest unread tickets
*/ */
@ -423,7 +431,7 @@ if ($result) {
} else { } else {
dol_print_error($db); dol_print_error($db);
} }
}
print $resultboxes['boxlistb']; print $resultboxes['boxlistb'];