lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More fix on project permission.

Browse Source 
There is still errors on task (too many task shown) but project lists are ok.
This commit is contained in:
Laurent Destailleur 2010-05-30 12:21:32 +00:00
parent 15338f6b3a
commit a7c809d0dd
20 changed files with 104 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
htdocs/core/class/html.form.class.php
View File

@ -2377,10 +2377,11 @@ class Form
* @param form_name Nom du formulaire de provenance. Utilise pour les dates en popup. * @param form_name Nom du formulaire de provenance. Utilise pour les dates en popup.
* @param d 1=Affiche aussi les jours, mois, annees * @param d 1=Affiche aussi les jours, mois, annees
* @param addnowbutton Add a button "Now" * @param addnowbutton Add a button "Now"
* @param nooutput Do not output zone but return it * @param nooutput Do not output html string but return it
* @param disabled Disable input fields
* @return nothing or string if nooutput is 1 * @return nothing or string if nooutput is 1
*/ */
function select_date($set_time='', $prefix='re', $h=0, $m=0, $empty=0, $form_name="", $d=1, $addnowbutton=0, $nooutput=0) function select_date($set_time='', $prefix='re', $h=0, $m=0, $empty=0, $form_name="", $d=1, $addnowbutton=0, $nooutput=0, $disabled=0)
{ {
global $conf,$langs; global $conf,$langs;
@ -2440,13 +2441,17 @@ class Form
{ {
// Zone de saisie manuelle de la date // Zone de saisie manuelle de la date
$retstring.='<input id="'.$prefix.'" name="'.$prefix.'" type="text" size="9" maxlength="11" value="'.$formated_date.'"'; $retstring.='<input id="'.$prefix.'" name="'.$prefix.'" type="text" size="9" maxlength="11" value="'.$formated_date.'"';
$retstring.=($disabled?' disabled="true"':'');
$retstring.=' onChange="dpChangeDay(\''.$prefix.'\',\''.$conf->format_date_short_java.'\'); "'; $retstring.=' onChange="dpChangeDay(\''.$prefix.'\',\''.$conf->format_date_short_java.'\'); "';
$retstring.='>'; $retstring.='>';
// Icone calendrier // Icone calendrier
if (! $disabled)
{
$retstring.='<button id="'.$prefix.'Button" type="button" class="dpInvisibleButtons"'; $retstring.='<button id="'.$prefix.'Button" type="button" class="dpInvisibleButtons"';
$base=DOL_URL_ROOT.'/lib/'; $base=DOL_URL_ROOT.'/lib/';
$retstring.=' onClick="showDP(\''.$base.'\',\''.$prefix.'\',\''.$conf->format_date_short_java.'\');">'.img_object($langs->trans("SelectDate"),'calendar').'</button>'; $retstring.=' onClick="showDP(\''.$base.'\',\''.$prefix.'\',\''.$conf->format_date_short_java.'\');">'.img_object($langs->trans("SelectDate"),'calendar').'</button>';
}
$retstring.='<input type="hidden" id="'.$prefix.'day" name="'.$prefix.'day" value="'.$sday.'">'."\n"; $retstring.='<input type="hidden" id="'.$prefix.'day" name="'.$prefix.'day" value="'.$sday.'">'."\n";
$retstring.='<input type="hidden" id="'.$prefix.'month" name="'.$prefix.'month" value="'.$smonth.'">'."\n"; $retstring.='<input type="hidden" id="'.$prefix.'month" name="'.$prefix.'month" value="'.$smonth.'">'."\n";
@ -2489,7 +2494,7 @@ class Form
if (! $conf->use_javascript_ajax || ! $conf->use_popup_calendar) if (! $conf->use_javascript_ajax || ! $conf->use_popup_calendar)
{ {
// Jour // Jour
$retstring.='<select class="flat" name="'.$prefix.'day">'; $retstring.='<select'.($disabled?' disabled="true"':'').' class="flat" name="'.$prefix.'day">';
if ($empty || $set_time == -1) if ($empty || $set_time == -1)
{ {
@ -2511,7 +2516,7 @@ class Form
$retstring.="</select>"; $retstring.="</select>";
$retstring.='<select class="flat" name="'.$prefix.'month">'; $retstring.='<select'.($disabled?' disabled="true"':'').' class="flat" name="'.$prefix.'month">';
if ($empty || $set_time == -1) if ($empty || $set_time == -1)
{ {
$retstring.='<option value="0" selected="true">&nbsp;</option>'; $retstring.='<option value="0" selected="true">&nbsp;</option>';
@ -2529,11 +2534,11 @@ class Form
// Year // Year
if ($empty || $set_time == -1) if ($empty || $set_time == -1)
{ {
$retstring.='<input class="flat" type="text" size="3" maxlength="4" name="'.$prefix.'year" value="'.$syear.'">'; $retstring.='<input'.($disabled?' disabled="true"':'').' class="flat" type="text" size="3" maxlength="4" name="'.$prefix.'year" value="'.$syear.'">';
} }
else else
{ {
$retstring.='<select class="flat" name="'.$prefix.'year">'; $retstring.='<select'.($disabled?' disabled="true"':'').' class="flat" name="'.$prefix.'year">';
for ($year = $syear - 5; $year < $syear + 10 ; $year++) for ($year = $syear - 5; $year < $syear + 10 ; $year++)
{ {
@ -2559,7 +2564,7 @@ class Form
/* /*
* Affiche heure en select * Affiche heure en select
*/ */
$retstring.='<select class="flat" name="'.$prefix.'hour">'; $retstring.='<select'.($disabled?' disabled="true"':'').' class="flat" name="'.$prefix.'hour">';
if ($empty) $retstring.='<option value="-1">&nbsp;</option>'; if ($empty) $retstring.='<option value="-1">&nbsp;</option>';
for ($hour = 0; $hour < 24; $hour++) for ($hour = 0; $hour < 24; $hour++)
{ {
@ -2585,7 +2590,7 @@ class Form
/* /*
* Affiche min en select * Affiche min en select
*/ */
$retstring.='<select class="flat" name="'.$prefix.'min">'; $retstring.='<select'.($disabled?' disabled="true"':'').' class="flat" name="'.$prefix.'min">';
if ($empty) $retstring.='<option value="-1">&nbsp;</option>'; if ($empty) $retstring.='<option value="-1">&nbsp;</option>';
for ($min = 0; $min < 60 ; $min++) for ($min = 0; $min < 60 ; $min++)
{ {

2
htdocs/lib/project.lib.php
View File

@ -315,7 +315,7 @@ function PLinesb(&$inc, $parent, $lines, &$level, &$projectsrole)
if ($lines[$i]->public || ! empty($projectsrole[$lines[$i]->fk_project]) || $user->rights->projet->all->creer) $disabled=0; if ($lines[$i]->public || ! empty($projectsrole[$lines[$i]->fk_project]) || $user->rights->projet->all->creer) $disabled=0;
print '<td nowrap="nowrap">'; print '<td nowrap="nowrap">';
print $form->select_date('',$lines[$i]->id,'','','',"addtime"); print $form->select_date('',$lines[$i]->id,'','','',"addtime",1,0,1,$disabled);
print '&nbsp;&nbsp;&nbsp;'; print '&nbsp;&nbsp;&nbsp;';
print $form->select_duration($lines[$i]->id,'',$disabled); print $form->select_duration($lines[$i]->id,'',$disabled);
print '&nbsp;<input type="submit" class="button"'.($disabled?' disabled="true"':'').' value="'.$langs->trans("Add").'">'; print '&nbsp;<input type="submit" class="button"'.($disabled?' disabled="true"':'').' value="'.$langs->trans("Add").'">';

10
htdocs/projet/activity/index.php
View File

@ -33,11 +33,11 @@ require_once(DOL_DOCUMENT_ROOT."/lib/project.lib.php");
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
// Security check // Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//$result = restrictedArea($user, 'projet', $projectid);
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();
if ($user->societe_id > 0)
{
$socid = $user->societe_id;
}
$langs->load("projects"); $langs->load("projects");
@ -46,7 +46,7 @@ $langs->load("projects");
* View * View
*/ */
$now = gmmktime(); $now = dol_now();
$projectstatic=new Project($db); $projectstatic=new Project($db);

2
htdocs/projet/activity/list.php
View File

@ -40,7 +40,7 @@ $projectid=isset($_GET["id"])?$_GET["id"]:$_POST["projectid"];
// Security check // Security check
$socid=0; $socid=0;
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id > 0) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);
/* /*

27
htdocs/projet/class/project.class.php
View File

@ -693,12 +693,14 @@ class Project extends CommonObject
/** /**
* \brief Check permissions * \brief Check permissions
* @param user Object user to evaluate
* @param noprint 0=Print forbidden message if no permission, 1=Return -1 if no permission
*/ */
function restrictedProjectArea($user,$list=0) function restrictedProjectArea($user,$noprint=0)
{ {
// To verify role of users // To verify role of users
$userAccess = 0; $userAccess = 0;
if ((!empty($this->user_author_id) && $this->user_author_id == $user->id) || $user->rights->projet->all->lire) if ($user->rights->projet->all->lire)
{ {
$userAccess = 1; $userAccess = 1;
} }
@ -713,21 +715,28 @@ class Project extends CommonObject
$userRole = $this->liste_contact(4,$source); $userRole = $this->liste_contact(4,$source);
$num=sizeof($userRole); $num=sizeof($userRole);
$i = 0; $nblinks = 0;
while ($i < $num) while ($nblinks < $num)
{ {
if ($userRole[$i]['code'] == 'PROJECTLEADER' && $user->id == $userRole[$i]['id']) if (preg_match('/PROJECT/',$userRole[$nblinks]['code']) && $user->id == $userRole[$nblinks]['id'])
{ {
$userAccess++; $userAccess++;
} }
$i++; $nblinks++;
} }
} }
//if (empty($nblinks)) // If nobody has permission, we grant creator
//{
// if ((!empty($this->user_author_id) && $this->user_author_id == $user->id))
// {
// $userAccess = 1;
// }
//}
} }
if (!$userAccess && !$this->public) if (! $userAccess)
{ {
if (!$list) if (!$noprint)
{ {
accessforbidden('',0); accessforbidden('',0);
} }
@ -776,7 +785,7 @@ class Project extends CommonObject
if ($mode == 0) if ($mode == 0)
{ {
$sql.= " AND ( p.public = 1"; $sql.= " AND ( p.public = 1";
$sql.= " OR p.fk_user_creat = ".$user->id; //$sql.= " OR p.fk_user_creat = ".$user->id;
$sql.= " OR ( ec.element_id = p.rowid"; $sql.= " OR ( ec.element_id = p.rowid";
$sql.= " AND ctc.rowid = ec.fk_c_type_contact"; $sql.= " AND ctc.rowid = ec.fk_c_type_contact";
$sql.= " AND ctc.element = '".$this->element."'"; $sql.= " AND ctc.element = '".$this->element."'";

10
htdocs/projet/contact.php
View File

@ -34,15 +34,11 @@ $langs->load("companies");
$projectid = isset($_GET["id"])?$_GET["id"]:''; $projectid = isset($_GET["id"])?$_GET["id"]:'';
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
// Security check
$socid=0;
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

16
htdocs/projet/document.php
View File

@ -32,20 +32,14 @@ require_once(DOL_DOCUMENT_ROOT."/core/class/html.formfile.class.php");
$langs->load('projects'); $langs->load('projects');
$langs->load('other'); $langs->load('other');
$id=empty($_GET['id']) ? 0 : intVal($_GET['id']);
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
$socid=0;
$id = isset($_GET["id"])?$_GET["id"]:''; $id = isset($_GET["id"])?$_GET["id"]:'';
if ($user->societe_id) $socid=$user->societe_id;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
$result=restrictedArea($user,'projet',$id,''); $result=restrictedArea($user,'projet',$id,'');
// Get parameters // Get parameters

12
htdocs/projet/element.php
View File

@ -56,16 +56,12 @@ if ($projectid == '' && $ref == '')
exit; exit;
} }
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

12
htdocs/projet/fiche.php
View File

@ -47,16 +47,12 @@ if (! empty($_REQUEST['socid_id']))
if ($projectid == '' && $projectref == '' && ($_GET['action'] != "create" && $_POST['action'] != "add" && $_POST["action"] != "update" && !$_POST["cancel"])) accessforbidden(); if ($projectid == '' && $projectref == '' && ($_GET['action'] != "create" && $_POST['action'] != "add" && $_POST["action"] != "update" && !$_POST["cancel"])) accessforbidden();
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

12
htdocs/projet/ganttview.php
View File

@ -38,16 +38,12 @@ require_once(DOL_DOCUMENT_ROOT."/core/class/html.formother.class.php");
$projectid=isset($_REQUEST["id"])?$_REQUEST["id"]:$_POST["id"]; $projectid=isset($_REQUEST["id"])?$_REQUEST["id"]:$_POST["id"];
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);
$userAccess=0; $userAccess=0;

4
htdocs/projet/index.php
View File

@ -35,8 +35,8 @@ $langs->load("projects");
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
// Security check // Security check
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects $socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id; if ($user->societe_id > 0) $socid=$user->societe_id;
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();

4
htdocs/projet/liste.php
View File

@ -36,7 +36,9 @@ $socid = ( is_numeric($_GET["socid"]) ? $_GET["socid"] : 0 );
$title = $langs->trans("Projects"); $title = $langs->trans("Projects");
// Security check // Security check
if ($user->societe_id > 0) $socid = $user->societe_id; $socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
if ($socid > 0) if ($socid > 0)
{ {

12
htdocs/projet/note.php
View File

@ -31,16 +31,12 @@ $langs->load('projects');
$id = isset($_GET["id"])?$_GET["id"]:''; $id = isset($_GET["id"])?$_GET["id"]:'';
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $id); $result = restrictedArea($user, 'projet', $id);

3
htdocs/projet/tasks/contact.php
View File

@ -38,7 +38,8 @@ $langs->load("companies");
$taskid = isset($_GET["id"])?$_GET["id"]:''; $taskid = isset($_GET["id"])?$_GET["id"]:'';
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; $socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//$result = restrictedArea($user, 'projet', $taskid, 'projet_task'); //$result = restrictedArea($user, 'projet', $taskid, 'projet_task');
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();

11
htdocs/projet/tasks/document.php
View File

@ -30,19 +30,22 @@ require_once(DOL_DOCUMENT_ROOT.'/lib/project.lib.php');
require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php");
require_once(DOL_DOCUMENT_ROOT."/core/class/html.formfile.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/html.formfile.class.php");
if (!$user->rights->projet->lire) accessforbidden();
$langs->load('projects'); $langs->load('projects');
$langs->load('other'); $langs->load('other');
$id=empty($_GET['id']) ? 0 : intVal($_GET['id']);
$action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action']) : $_GET['action']; $action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action']) : $_GET['action'];
$mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
$id = isset($_GET["id"])?$_GET["id"]:'';
// Security check // Security check
$socid=0; $socid=0;
$id = isset($_GET["id"])?$_GET["id"]:''; if ($user->societe_id > 0) $socid = $user->societe_id;
if ($user->societe_id) $socid=$user->societe_id;
//$result=restrictedArea($user,'projet',$id,''); //$result=restrictedArea($user,'projet',$id,'');
if (!$user->rights->projet->lire) accessforbidden();
// Get parameters // Get parameters
$page=$_GET["page"]; $page=$_GET["page"];

18
htdocs/projet/tasks/fiche.php
View File

@ -32,20 +32,14 @@ require_once(DOL_DOCUMENT_ROOT."/lib/project.lib.php");
require_once(DOL_DOCUMENT_ROOT."/lib/date.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/date.lib.php");
require_once(DOL_DOCUMENT_ROOT."/core/class/html.formother.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/html.formother.class.php");
$projectid='';
$projectid=isset($_REQUEST["id"])?$_REQUEST["id"]:$_POST["id"];
// Security check
if (empty($user->rights->projet->all->lire))
{
$_GET["mode"]='mine';
$_POST["mode"]='mine';
$_REQUEST["mode"]='mine';
}
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
//if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); // Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//$result = restrictedArea($user, 'projet', $projectid);
if (!$user->rights->projet->lire) accessforbidden();
$userAccess=0; $userAccess=0;

8
htdocs/projet/tasks/index.php
View File

@ -35,8 +35,8 @@ $langs->load('projects');
// Security check // Security check
$socid=0; $socid=0;
if (!$user->rights->projet->lire) accessforbidden();
if ($user->societe_id > 0) $socid = $user->societe_id; if ($user->societe_id > 0) $socid = $user->societe_id;
if (!$user->rights->projet->lire) accessforbidden();
$sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"]; $sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"];
$sortorder = isset($_GET["sortorder"])?$_GET["sortorder"]:$_POST["sortorder"]; $sortorder = isset($_GET["sortorder"])?$_GET["sortorder"]:$_POST["sortorder"];
@ -44,13 +44,13 @@ $page = isset($_GET["page"])? $_GET["page"]:$_POST["page"];
$page = is_numeric($page) ? $page : 0; $page = is_numeric($page) ? $page : 0;
$page = $page == -1 ? 0 : $page; $page = $page == -1 ? 0 : $page;
$mine = $_REQUEST['mode']=='mine' ? 1 : 0;
/* /*
* View * View
*/ */
$mine = $_REQUEST['mode']=='mine' ? 1 : 0;
$title=$langs->trans("Activities"); $title=$langs->trans("Activities");
if ($mine) $title=$langs->trans("MyActivities"); if ($mine) $title=$langs->trans("MyActivities");
@ -78,6 +78,8 @@ else
} }
//$projectsListId = $project->getProjectsAuthorizedForUser($user,$mine,1);
// Get list of tasks in tasksarray and taskarrayfiltered // Get list of tasks in tasksarray and taskarrayfiltered
// We need all tasks (even not limited to a user because a task to user // We need all tasks (even not limited to a user because a task to user
// can have a parent that is not affected to him). // can have a parent that is not affected to him).

3
htdocs/projet/tasks/note.php
View File

@ -33,7 +33,8 @@ $langs->load('projects');
$id = isset($_GET["id"])?$_GET["id"]:''; $id = isset($_GET["id"])?$_GET["id"]:'';
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; $socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();
//$result = restrictedArea($user, 'projet', $id, '', 'task'); // TODO ameliorer la verification //$result = restrictedArea($user, 'projet', $id, '', 'task'); // TODO ameliorer la verification

4
htdocs/projet/tasks/task.php
View File

@ -34,8 +34,12 @@ require_once(DOL_DOCUMENT_ROOT."/core/class/html.formother.class.php");
$taskid = (isset($_GET["id"])?$_GET["id"]:(isset($_POST["id"])?$_POST["id"]:'')); $taskid = (isset($_GET["id"])?$_GET["id"]:(isset($_POST["id"])?$_POST["id"]:''));
$taskref = (isset($_GET["ref"])?$_GET["ref"]:''); $taskref = (isset($_GET["ref"])?$_GET["ref"]:'');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();
/* /*
* Actions * Actions
*/ */

4
htdocs/projet/tasks/time.php
View File

@ -33,8 +33,12 @@ require_once(DOL_DOCUMENT_ROOT."/lib/date.lib.php");
$langs->load('projects'); $langs->load('projects');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();
/* /*
* Actions * Actions
*/ */