lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '12.0' of git@github.com:Dolibarr/dolibarr.git into 13.0

Browse Source 
Conflicts:
	htdocs/user/class/api_users.class.php
This commit is contained in:
Laurent Destailleur 2021-05-17 19:29:03 +02:00
commit d3ece31969
1 changed files with 43 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
htdocs/user/class/api_users.class.php
View File

@ -73,9 +73,9 @@ class Users extends DolibarrApi
$obj_ret = array(); $obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->user->lire) { if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, "You are not allowed to read list of users"); throw new RestException(401, "You are not allowed to read list of users");
} }
// case of external user, $societe param is ignored and replaced by user's socid // case of external user, $societe param is ignored and replaced by user's socid
//$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe; //$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe;
@ -150,9 +150,10 @@ class Users extends DolibarrApi
*/ */
public function get($id, $includepermissions = 0) public function get($id, $includepermissions = 0)
{ {
//if (!DolibarrApiAccess::$user->rights->user->user->lire) { if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401);
//} }
if ($id == 0) { if ($id == 0) {
$result = $this->useraccount->initAsSpecimen(); $result = $this->useraccount->initAsSpecimen();
} else { } else {
@ -187,9 +188,9 @@ class Users extends DolibarrApi
*/ */
public function getByLogin($login, $includepermissions = 0) public function getByLogin($login, $includepermissions = 0)
{ {
//if (!DolibarrApiAccess::$user->rights->user->user->lire) { if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401, 'Not allowed');
//} }
$result = $this->useraccount->fetch('', $login); $result = $this->useraccount->fetch('', $login);
if (!$result) { if (!$result) {
@ -221,9 +222,9 @@ class Users extends DolibarrApi
*/ */
public function getByEmail($email, $includepermissions = 0) public function getByEmail($email, $includepermissions = 0)
{ {
//if (!DolibarrApiAccess::$user->rights->user->user->lire) { if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401, 'Not allowed');
//} }
$result = $this->useraccount->fetch('', '', '', 0, -1, $email); $result = $this->useraccount->fetch('', '', '', 0, -1, $email);
if (!$result) { if (!$result) {
@ -254,6 +255,10 @@ class Users extends DolibarrApi
*/ */
public function getInfo($includepermissions = 0) public function getInfo($includepermissions = 0)
{ {
if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, 'Not allowed');
}
$apiUser = DolibarrApiAccess::$user; $apiUser = DolibarrApiAccess::$user;
$result = $this->useraccount->fetch($apiUser->id); $result = $this->useraccount->fetch($apiUser->id);
@ -289,9 +294,10 @@ class Users extends DolibarrApi
public function post($request_data = null) public function post($request_data = null)
{ {
// check user authorization // check user authorization
//if(! DolibarrApiAccess::$user->rights->user->creer) { if (empty(DolibarrApiAccess::$user->rights->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
// throw new RestException(401, "User creation not allowed"); throw new RestException(401, "User creation not allowed");
//} }
// check mandatory fields // check mandatory fields
/*if (!isset($request_data["login"])) /*if (!isset($request_data["login"]))
throw new RestException(400, "login field missing"); throw new RestException(400, "login field missing");
@ -322,11 +328,11 @@ class Users extends DolibarrApi
* @throws RestException 404 Not found * @throws RestException 404 Not found
* @throws RestException 500 System error * @throws RestException 500 System error
*/ */
public function put($id, $request_data = null) public function put($id, $request_data = null)
{ {
//if (!DolibarrApiAccess::$user->rights->user->user->creer) { if (empty(DolibarrApiAccess::$user->rights->user->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401);
//} }
$result = $this->useraccount->fetch($id); $result = $this->useraccount->fetch($id);
if (!$result) { if (!$result) {
@ -378,7 +384,7 @@ class Users extends DolibarrApi
{ {
$obj_ret = array(); $obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->user->lire) { if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(403); throw new RestException(403);
} }
@ -413,9 +419,9 @@ class Users extends DolibarrApi
global $conf; global $conf;
//if (!DolibarrApiAccess::$user->rights->user->user->supprimer) { if (empty(DolibarrApiAccess::$user->rights->user->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401);
//} }
$result = $this->useraccount->fetch($id); $result = $this->useraccount->fetch($id);
if (!$result) { if (!$result) {
throw new RestException(404, 'User not found'); throw new RestException(404, 'User not found');
@ -462,9 +468,10 @@ class Users extends DolibarrApi
$obj_ret = array(); $obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->group_advance->read) { if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) ||
throw new RestException(401, "You are not allowed to read list of groups"); !empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->group_advance->read) && empty(DolibarrApiAccess::$user->admin)) {
} throw new RestException(401, "You are not allowed to read groups");
}
// case of external user, $societe param is ignored and replaced by user's socid // case of external user, $societe param is ignored and replaced by user's socid
//$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe; //$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe;
@ -532,9 +539,10 @@ class Users extends DolibarrApi
{ {
global $db, $conf; global $db, $conf;
if (!DolibarrApiAccess::$user->rights->user->group_advance->read) { if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) ||
throw new RestException(401, "You are not allowed to read groups"); !empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->group_advance->read) && empty(DolibarrApiAccess::$user->admin)) {
} throw new RestException(401, "You are not allowed to read groups");
}
$group_static = new UserGroup($this->db); $group_static = new UserGroup($this->db);
$result = $group_static->fetch($group, '', $load_members); $result = $group_static->fetch($group, '', $load_members);
@ -552,11 +560,11 @@ class Users extends DolibarrApi
* @param int $id Account ID * @param int $id Account ID
* @return array * @return array
*/ */
public function delete($id) public function delete($id)
{ {
//if (!DolibarrApiAccess::$user->rights->user->user->supprimer) { if (empty(DolibarrApiAccess::$user->rights->user->user->supprimer) && empty(DolibarrApiAccess::$user->admin)) {
//throw new RestException(401); throw new RestException(401);
//} }
$result = $this->useraccount->fetch($id); $result = $this->useraccount->fetch($id);
if (!$result) { if (!$result) {
throw new RestException(404, 'User not found'); throw new RestException(404, 'User not found');