lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix permissions

Browse Source
This commit is contained in:
Laurent Destailleur 2022-05-17 07:30:02 +02:00
parent ddd0848acc
commit a2e814b079
2 changed files with 159 additions and 150 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
htdocs/core/lib/security.lib.php
View File

@ -378,6 +378,7 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
$nbko++; $nbko++;
} }
} elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level } elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level
var_dump($user->rights);
if (empty($user->rights->$feature->lire) if (empty($user->rights->$feature->lire)
&& empty($user->rights->$feature->read) && empty($user->rights->$feature->read)
&& empty($user->rights->$feature->run)) { && empty($user->rights->$feature->run)) {

94
htdocs/ticket/index.php
View File

@ -52,9 +52,6 @@ if ($user->socid) {
} }
$userid = $user->id; $userid = $user->id;
// Security check
$result = restrictedArea($user, 'ticket', 0, '', '', '', '');
$nowarray = dol_getdate(dol_now(), true); $nowarray = dol_getdate(dol_now(), true);
$nowyear = $nowarray['year']; $nowyear = $nowarray['year'];
$year = GETPOST('year', 'int') > 0 ? GETPOST('year', 'int') : $nowyear; $year = GETPOST('year', 'int') > 0 ? GETPOST('year', 'int') : $nowyear;
@ -63,6 +60,12 @@ $endyear = $year;
$object = new Ticket($db); $object = new Ticket($db);
// Security check
//$result = restrictedArea($user, 'ticket|knowledgemanagement', 0, '', '', '', '');
if (empty($user->rights->ticket->read) && empty($user->rights->knowledgemanagement->knowledgerecord->read)) {
accessforbidden('Not enought permissions');
}
/* /*
* Actions * Actions
@ -240,15 +243,16 @@ $stringtoshow .= '<input type="image" alt="'.$langs->trans("Refresh").'" src="'.
$stringtoshow .= '</form>'; $stringtoshow .= '</form>';
$stringtoshow .= '</div>'; $stringtoshow .= '</div>';
print '<div class="div-table-responsive-no-min">'; if (!empty($user->rights->ticket->read)) {
print '<table class="noborder centpercent">'; print '<div class="div-table-responsive-no-min">';
print '<tr class="liste_titre"><th >'.$langs->trans("Statistics").' '.$endyear.' '.img_picto('', 'filter.png', 'id="idsubimgDOLUSERCOOKIE_ticket_by_status" class="linkobject"').'</th></tr>'; print '<table class="noborder centpercent">';
print '<tr class="liste_titre"><th >'.$langs->trans("Statistics").' '.$endyear.' '.img_picto('', 'filter.png', 'id="idsubimgDOLUSERCOOKIE_ticket_by_status" class="linkobject"').'</th></tr>';
print '<tr><td class="center">'; print '<tr><td class="center">';
print $stringtoshow; print $stringtoshow;
// don't display graph if no series // don't display graph if no series
if (!empty($dataseries) && count($dataseries) > 1) { if (!empty($dataseries) && count($dataseries) > 1) {
$totalnb = 0; $totalnb = 0;
foreach ($dataseries as $key => $value) { foreach ($dataseries as $key => $value) {
$totalnb += $value['data']; $totalnb += $value['data'];
@ -287,16 +291,19 @@ if (!empty($dataseries) && count($dataseries) > 1) {
$px1->draw($filenamenb, $fileurlnb); $px1->draw($filenamenb, $fileurlnb);
print $px1->show($totalnb ? 0 : 1); print $px1->show($totalnb ? 0 : 1);
} }
}
print '</td></tr>';
print '</table>';
print '</div>';
} }
print '</td></tr>';
print '</table>'; if (!empty($user->rights->ticket->read)) {
print '</div>'; // Build graphic number of object
$data = $stats->getNbByMonthWithPrevYear($endyear, $startyear);
// Build graphic number of object print '<br>'."\n";
$data = $stats->getNbByMonthWithPrevYear($endyear, $startyear); }
print '<br>'."\n";
print $resultboxes['boxlista']; print $resultboxes['boxlista'];
@ -304,44 +311,45 @@ print '</div>'."\n";
print '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">'; print '<div class="secondcolumn fichehalfright boxhalfright" id="boxhalfright">';
/* if (!empty($user->rights->ticket->read)) {
/*
* Latest unread tickets * Latest unread tickets
*/ */
$max = 10; $max = 10;
$sql = "SELECT t.rowid, t.ref, t.track_id, t.datec, t.subject, t.type_code, t.category_code, t.severity_code, t.fk_statut, t.progress,"; $sql = "SELECT t.rowid, t.ref, t.track_id, t.datec, t.subject, t.type_code, t.category_code, t.severity_code, t.fk_statut, t.progress,";
$sql .= " type.code as type_code, type.label as type_label,"; $sql .= " type.code as type_code, type.label as type_label,";
$sql .= " category.code as category_code, category.label as category_label,"; $sql .= " category.code as category_code, category.label as category_label,";
$sql .= " severity.code as severity_code, severity.label as severity_label"; $sql .= " severity.code as severity_code, severity.label as severity_label";
$sql .= " FROM ".MAIN_DB_PREFIX."ticket as t"; $sql .= " FROM ".MAIN_DB_PREFIX."ticket as t";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_type as type ON type.code=t.type_code"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_type as type ON type.code=t.type_code";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_category as category ON category.code=t.category_code"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_category as category ON category.code=t.category_code";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_severity as severity ON severity.code=t.severity_code"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."c_ticket_severity as severity ON severity.code=t.severity_code";
if (empty($user->rights->societe->client->voir) && !$socid) { if (empty($user->rights->societe->client->voir) && !$socid) {
$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc"; $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
} }
$sql .= ' WHERE t.entity IN ('.getEntity('ticket').')'; $sql .= ' WHERE t.entity IN ('.getEntity('ticket').')';
$sql .= " AND t.fk_statut=0"; $sql .= " AND t.fk_statut=0";
if (empty($user->rights->societe->client->voir) && !$socid) { if (empty($user->rights->societe->client->voir) && !$socid) {
$sql .= " AND t.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id); $sql .= " AND t.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
} }
if ($user->socid > 0) { if ($user->socid > 0) {
$sql .= " AND t.fk_soc= ".((int) $user->socid); $sql .= " AND t.fk_soc= ".((int) $user->socid);
} else { } else {
// Restricted to assigned user only // Restricted to assigned user only
if (!empty($conf->global->TICKET_LIMIT_VIEW_ASSIGNED_ONLY) && !$user->rights->ticket->manage) { if (!empty($conf->global->TICKET_LIMIT_VIEW_ASSIGNED_ONLY) && !$user->rights->ticket->manage) {
$sql .= " AND t.fk_user_assign = ".((int) $user->id); $sql .= " AND t.fk_user_assign = ".((int) $user->id);
} }
} }
$sql .= $db->order("t.datec", "DESC"); $sql .= $db->order("t.datec", "DESC");
$sql .= $db->plimit($max, 0); $sql .= $db->plimit($max, 0);
//print $sql; //print $sql;
$result = $db->query($sql); $result = $db->query($sql);
if ($result) { if ($result) {
$num = $db->num_rows($result); $num = $db->num_rows($result);
$i = 0; $i = 0;
@ -420,11 +428,11 @@ if ($result) {
print '</div>'; print '</div>';
print '<br>'; print '<br>';
} else { } else {
dol_print_error($db); dol_print_error($db);
}
} }
print $resultboxes['boxlistb']; print $resultboxes['boxlistb'];
print '</div>'; print '</div>';