lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

New: works on sharings between entities

Browse Source 
Fix: index or list just verify rights access
This commit is contained in:
Regis Houssin 2011-04-18 09:39:49 +00:00
parent 783c050df0
commit cd420e0029
3 changed files with 26 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
htdocs/lib/functions.lib.php
View File

@ -1919,13 +1919,21 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
// If dbtable not defined, we use same name for table than module name // If dbtable not defined, we use same name for table than module name
if (empty($dbtablename)) $dbtablename = $feature; if (empty($dbtablename)) $dbtablename = $feature;
// Sharings between entities
if ($conf->global->MAIN_MODULE_MULTICOMPANY)
{
dol_include_once('/multicompany/class/actions_multicompany.class.php');
$mc = new ActionsMulticompany($db);
$mc->getEntitySharing($dbtablename);
}
// Check permission for object with entity // Check permission for object with entity
if (in_array($feature,$check)) if (in_array($feature,$check))
{ {
$sql = "SELECT dbt.".$dbt_select; $sql = "SELECT dbt.".$dbt_select;
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.".$dbt_select." = ".$objectid; $sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
$sql.= " AND dbt.entity IN (0,".$conf->entity.")"; $sql.= " AND dbt.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
else if (in_array($feature,$checksoc)) else if (in_array($feature,$checksoc))
{ {
@ -1943,7 +1951,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql.= " WHERE sc.fk_soc = ".$objectid; $sql.= " WHERE sc.fk_soc = ".$objectid;
$sql.= " AND sc.fk_user = ".$user->id; $sql.= " AND sc.fk_user = ".$user->id;
$sql.= " AND sc.fk_soc = s.rowid"; $sql.= " AND sc.fk_soc = s.rowid";
$sql.= " AND s.entity = ".$conf->entity; $sql.= " AND s.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
// If multicompany and internal users with all permissions, check user is in correct entity // If multicompany and internal users with all permissions, check user is in correct entity
else if ($conf->global->MAIN_MODULE_MULTICOMPANY) else if ($conf->global->MAIN_MODULE_MULTICOMPANY)
@ -1951,7 +1959,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql = "SELECT s.rowid"; $sql = "SELECT s.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX."societe as s"; $sql.= " FROM ".MAIN_DB_PREFIX."societe as s";
$sql.= " WHERE s.rowid = ".$objectid; $sql.= " WHERE s.rowid = ".$objectid;
$sql.= " AND s.entity = ".$conf->entity; $sql.= " AND s.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
} }
else if (in_array($feature,$checkother)) else if (in_array($feature,$checkother))
@ -1972,7 +1980,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = '".$user->id."'"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = '".$user->id."'";
$sql.= " WHERE dbt.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user $sql.= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user
$sql.= " AND dbt.entity = ".$conf->entity; $sql.= " AND dbt.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
// If multicompany and internal users with all permissions, check user is in correct entity // If multicompany and internal users with all permissions, check user is in correct entity
else if ($conf->global->MAIN_MODULE_MULTICOMPANY) else if ($conf->global->MAIN_MODULE_MULTICOMPANY)
@ -1980,7 +1988,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql = "SELECT dbt.rowid"; $sql = "SELECT dbt.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND dbt.entity = ".$conf->entity; $sql.= " AND dbt.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
} }
else if (in_array($feature,$checkproject)) else if (in_array($feature,$checkproject))
@ -2014,7 +2022,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql.= " WHERE dbt.".$dbt_select." = ".$objectid; $sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
$sql.= " AND sc.fk_soc = dbt.".$dbt_keyfield; $sql.= " AND sc.fk_soc = dbt.".$dbt_keyfield;
$sql.= " AND dbt.".$dbt_keyfield." = s.rowid"; $sql.= " AND dbt.".$dbt_keyfield." = s.rowid";
$sql.= " AND s.entity = ".$conf->entity; $sql.= " AND s.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
$sql.= " AND sc.fk_user = ".$user->id; $sql.= " AND sc.fk_user = ".$user->id;
} }
// If multicompany and internal users with all permissions, check user is in correct entity // If multicompany and internal users with all permissions, check user is in correct entity
@ -2023,7 +2031,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
$sql = "SELECT dbt.".$dbt_select; $sql = "SELECT dbt.".$dbt_select;
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.".$dbt_select." = ".$objectid; $sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
$sql.= " AND dbt.entity = ".$conf->entity; $sql.= " AND dbt.entity IN (0,".($mc->share ? $mc->share : $conf->entity).")";
} }
} }

6
htdocs/product/index.php
View File

@ -33,9 +33,9 @@ if ($type =='' && !$user->rights->produit->lire) $type='1'; // Force global page
if ($type =='' && !$user->rights->service->lire) $type='0'; // Force global page on prpduct page only if ($type =='' && !$user->rights->service->lire) $type='0'; // Force global page on prpduct page only
// Security check // Security check
if ($type=='0') $result=restrictedArea($user,'produit',$id,'product','','',$fieldid); if ($type=='0') $result=restrictedArea($user,'produit');
else if ($type=='1') $result=restrictedArea($user,'service',$id,'service','','',$fieldid); else if ($type=='1') $result=restrictedArea($user,'service');
else $result=restrictedArea($user,'produit|service',$id,'service','','',$fieldid); else $result=restrictedArea($user,'produit|service');
$langs->load("products"); $langs->load("products");

12
htdocs/product/liste.php
View File

@ -69,16 +69,16 @@ if (! empty($canvas))
//$objcanvas->getCanvas('product','xxx',$canvas); //$objcanvas->getCanvas('product','xxx',$canvas);
// Security check // Security check
if ($type=='0') $result=$objcanvas->restrictedArea($user,'produit',$id,'product','','',$fieldid); if ($type=='0') $result=$objcanvas->restrictedArea($user,'produit');
else if ($type=='1') $result=$objcanvas->restrictedArea($user,'service',$id,'service','','',$fieldid); else if ($type=='1') $result=$objcanvas->restrictedArea($user,'service');
else $result=$objcanvas->restrictedArea($user,'produit|service',$id,'service','','',$fieldid); else $result=$objcanvas->restrictedArea($user,'produit|service');
} }
else else
{ {
// Security check // Security check
if ($type=='0') $result=restrictedArea($user,'produit',$id,'product','','',$fieldid); if ($type=='0') $result=restrictedArea($user,'produit');
else if ($type=='1') $result=restrictedArea($user,'service',$id,'service','','',$fieldid); else if ($type=='1') $result=restrictedArea($user,'service');
else $result=restrictedArea($user,'produit|service',$id,'service','','',$fieldid); else $result=restrictedArea($user,'produit|service');
} }
// Sharings between entities // Sharings between entities