lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Fix a lot of permissions on project module

Browse Source
This commit is contained in:
Laurent Destailleur 2010-05-28 23:26:08 +00:00
parent 810f87dc54
commit d4e693af3b
14 changed files with 66 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/fourn/commande/fiche.php
View File

@ -914,7 +914,7 @@ if ($id > 0 || ! empty($ref))
print '<table class="nobordernopadding" width="100%"><tr><td>'; print '<table class="nobordernopadding" width="100%"><tr><td>';
print $langs->trans('Project'); print $langs->trans('Project');
print '</td>'; print '</td>';
if ($_GET['action'] != 'classer' && $commande->brouillon) print '<td align="right"><a href="'.$_SERVER['PHP_SELF'].'?action=classer&amp;id='.$commande->id.'">'.img_edit($langs->trans('SetProject')).'</a></td>'; if ($_GET['action'] != 'classer') print '<td align="right"><a href="'.$_SERVER['PHP_SELF'].'?action=classer&amp;id='.$commande->id.'">'.img_edit($langs->trans('SetProject')).'</a></td>';
print '</tr></table>'; print '</tr></table>';
print '</td><td colspan="2">'; print '</td><td colspan="2">';
if ($_GET['action'] == 'classer') if ($_GET['action'] == 'classer')

18
htdocs/includes/menus/barre_left/eldy.lib.php
View File

@ -712,23 +712,27 @@ function print_left_eldy_menu($db,$menu_array)
{ {
$langs->load("projects"); $langs->load("projects");
// Project affected to user
$newmenu->add(DOL_URL_ROOT."/projet/index.php?leftmenu=projects&mode=mine", $langs->trans("MyProjects"), 0, $user->rights->projet->lire); $newmenu->add(DOL_URL_ROOT."/projet/index.php?leftmenu=projects&mode=mine", $langs->trans("MyProjects"), 0, $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/fiche.php?leftmenu=projects&action=create&mode=mine", $langs->trans("NewProject"), 1, $user->rights->projet->creer); $newmenu->add(DOL_URL_ROOT."/projet/fiche.php?leftmenu=projects&action=create&mode=mine", $langs->trans("NewProject"), 1, $user->rights->projet->creer);
$newmenu->add(DOL_URL_ROOT."/projet/liste.php?leftmenu=projects&mode=mine", $langs->trans("List"), 1, $user->rights->projet->lire); $newmenu->add(DOL_URL_ROOT."/projet/liste.php?leftmenu=projects&mode=mine", $langs->trans("List"), 1, $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/index.php?leftmenu=projects", $langs->trans("Projects"), 0, $user->rights->projet->lire && $user->rights->projet->all->lire); // All project i have permission on
$newmenu->add(DOL_URL_ROOT."/projet/fiche.php?leftmenu=projects&action=create", $langs->trans("NewProject"), 1, $user->rights->projet->creer && $user->rights->projet->all->creer); $newmenu->add(DOL_URL_ROOT."/projet/index.php?leftmenu=projects", $langs->trans("Projects"), 0, $user->rights->projet->lire && $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/liste.php?leftmenu=projects", $langs->trans("List"), 1, $user->rights->projet->lire && $user->rights->projet->all->lire); $newmenu->add(DOL_URL_ROOT."/projet/fiche.php?leftmenu=projects&action=create", $langs->trans("NewProject"), 1, $user->rights->projet->creer && $user->rights->projet->creer);
$newmenu->add(DOL_URL_ROOT."/projet/liste.php?leftmenu=projects", $langs->trans("List"), 1, $user->rights->projet->lire && $user->rights->projet->lire);
// Project affected to user
$newmenu->add(DOL_URL_ROOT."/projet/activity/index.php?mode=mine", $langs->trans("MyActivities"), 0, $user->rights->projet->lire); $newmenu->add(DOL_URL_ROOT."/projet/activity/index.php?mode=mine", $langs->trans("MyActivities"), 0, $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/tasks/fiche.php?action=create&mode=mine", $langs->trans("NewTask"), 1, $user->rights->projet->creer); $newmenu->add(DOL_URL_ROOT."/projet/tasks/fiche.php?action=create&mode=mine", $langs->trans("NewTask"), 1, $user->rights->projet->creer);
$newmenu->add(DOL_URL_ROOT."/projet/tasks/index.php?mode=mine", $langs->trans("List"), 1, $user->rights->projet->lire); $newmenu->add(DOL_URL_ROOT."/projet/tasks/index.php?mode=mine", $langs->trans("List"), 1, $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/activity/list.php?mode=mine", $langs->trans("NewTimeSpent"), 1, $user->rights->projet->creer); $newmenu->add(DOL_URL_ROOT."/projet/activity/list.php?mode=mine", $langs->trans("NewTimeSpent"), 1, $user->rights->projet->creer);
$newmenu->add(DOL_URL_ROOT."/projet/activity/index.php", $langs->trans("Activities"), 0, $user->rights->projet->lire && $user->rights->projet->all->lire); // All project i have permission on
$newmenu->add(DOL_URL_ROOT."/projet/tasks/fiche.php?action=create", $langs->trans("NewTask"), 1, $user->rights->projet->creer && $user->rights->projet->all->creer); $newmenu->add(DOL_URL_ROOT."/projet/activity/index.php", $langs->trans("Activities"), 0, $user->rights->projet->lire && $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/tasks/index.php", $langs->trans("List"), 1, $user->rights->projet->lire && $user->rights->projet->all->lire); $newmenu->add(DOL_URL_ROOT."/projet/tasks/fiche.php?action=create", $langs->trans("NewTask"), 1, $user->rights->projet->creer && $user->rights->projet->creer);
$newmenu->add(DOL_URL_ROOT."/projet/activity/list.php", $langs->trans("NewTimeSpent"), 1, $user->rights->projet->creer && $user->rights->projet->all->creer); $newmenu->add(DOL_URL_ROOT."/projet/tasks/index.php", $langs->trans("List"), 1, $user->rights->projet->lire && $user->rights->projet->lire);
$newmenu->add(DOL_URL_ROOT."/projet/activity/list.php", $langs->trans("NewTimeSpent"), 1, $user->rights->projet->creer && $user->rights->projet->creer);
} }
} }

16
htdocs/lib/project.lib.php
View File

@ -165,20 +165,28 @@ function task_prepare_head($object)
/** /**
* \brief Show a combo list with projects qualified for a third party) * \brief Show a combo list with projects qualified for a third party
* \param socid Id third party (-1=all, 0=projects not linked to a third party, id=projects not linked or linked to third party id) * \param socid Id third party (-1=all, 0=only projects not linked to a third party, id=projects not linked or linked to third party id)
* \param selected Id project preselected * \param selected Id project preselected
* \param htmlname Nom de la zone html * \param htmlname Nom de la zone html
* \return int Nbre de projet si ok, <0 si ko * \return int Nbre of project if OK, <0 if KO
*/ */
function select_projects($socid=-1, $selected='', $htmlname='projectid') function select_projects($socid=-1, $selected='', $htmlname='projectid')
{ {
global $db,$user,$conf,$langs; global $db,$user,$conf,$langs;
$projectstatic=new Project($db);
$projectsListId = '';
if (empty($user->rights->projet->all->lire))
{
$projectsListId = $projectstatic->getProjectsAuthorizedForUser($user,0,1);
}
// On recherche les projets // On recherche les projets
$sql = 'SELECT p.rowid, p.ref, p.title, p.fk_soc, p.fk_statut, p.public'; $sql = 'SELECT p.rowid, p.ref, p.title, p.fk_soc, p.fk_statut, p.public';
$sql.= ' FROM '.MAIN_DB_PREFIX .'projet as p'; $sql.= ' FROM '.MAIN_DB_PREFIX .'projet as p';
$sql.= " WHERE p.entity = ".$conf->entity; $sql.= " WHERE p.entity = ".$conf->entity;
if ($projectsListId) $sql.= " AND p.rowid in (".$projectsListId.")";
if ($socid == 0) $sql.= " AND (p.fk_soc=0 OR p.fk_soc IS NULL)"; if ($socid == 0) $sql.= " AND (p.fk_soc=0 OR p.fk_soc IS NULL)";
if ($socid > 0) $sql.= " AND (p.fk_soc=".$socid." OR p.fk_soc='0' OR p.fk_soc IS NULL)"; if ($socid > 0) $sql.= " AND (p.fk_soc=".$socid." OR p.fk_soc='0' OR p.fk_soc IS NULL)";
$sql.= " ORDER BY p.title ASC"; $sql.= " ORDER BY p.title ASC";
@ -211,6 +219,8 @@ function select_projects($socid=-1, $selected='', $htmlname='projectid')
print ' disabled="true"'; print ' disabled="true"';
$labeltoshow.=' - '.$langs->trans("Draft"); $labeltoshow.=' - '.$langs->trans("Draft");
} }
//if ($obj->public) $labeltoshow.=' ('.$langs->trans("Public").')';
//else $labeltoshow.=' ('.$langs->trans("Private").')';
print '>'.$labeltoshow.'</option>'; print '>'.$labeltoshow.'</option>';
} }
$i++; $i++;

18
htdocs/projet/class/project.class.php
View File

@ -742,12 +742,14 @@ class Project extends CommonObject
} }
/** /**
* Return array of projects authorized for a user * Return array of projects affected to a user, authorized to a user, or all projects
* *
* @param unknown_type $user * @param user User object
* @return unknown * @param mode 0=All project I have permission on, 1=Affected to me only, 2=Will return list of all projects
* @param list 0=Return array,1=Return string list
* @return array or string
*/ */
function getProjectsAuthorizedForUser($user,$mine=0,$list=0) function getProjectsAuthorizedForUser($user,$mode=0,$list=0)
{ {
global $conf; global $conf;
@ -760,14 +762,18 @@ class Project extends CommonObject
$sql.= ", ".MAIN_DB_PREFIX."c_type_contact as ctc"; $sql.= ", ".MAIN_DB_PREFIX."c_type_contact as ctc";
$sql.= " WHERE p.entity = ".$conf->entity; $sql.= " WHERE p.entity = ".$conf->entity;
if ($mine) if ($mode == 2)
{
// No filter. Use this if user has permission to see all project
}
if ($mode == 1)
{ {
$sql.= " AND ec.element_id = p.rowid"; $sql.= " AND ec.element_id = p.rowid";
$sql.= " AND ctc.rowid = ec.fk_c_type_contact"; $sql.= " AND ctc.rowid = ec.fk_c_type_contact";
$sql.= " AND ctc.element = '".$this->element."'"; $sql.= " AND ctc.element = '".$this->element."'";
$sql.= " AND ec.fk_socpeople = ".$user->id; $sql.= " AND ec.fk_socpeople = ".$user->id;
} }
else if ($mode == 0)
{ {
$sql.= " AND ( p.public = 1"; $sql.= " AND ( p.public = 1";
$sql.= " OR p.fk_user_creat = ".$user->id; $sql.= " OR p.fk_user_creat = ".$user->id;

2
htdocs/projet/contact.php
View File

@ -42,7 +42,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

2
htdocs/projet/document.php
View File

@ -42,7 +42,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
$socid=0; $socid=0;
$id = isset($_GET["id"])?$_GET["id"]:''; $id = isset($_GET["id"])?$_GET["id"]:'';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;

2
htdocs/projet/element.php
View File

@ -64,7 +64,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

2
htdocs/projet/fiche.php
View File

@ -55,7 +55,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

2
htdocs/projet/ganttview.php
View File

@ -46,7 +46,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

3
htdocs/projet/index.php
View File

@ -35,7 +35,7 @@ $langs->load("projects");
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
// Security check // Security check
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id > 0) $socid = $user->societe_id; if ($user->societe_id > 0) $socid = $user->societe_id;
if (!$user->rights->projet->lire) accessforbidden(); if (!$user->rights->projet->lire) accessforbidden();
@ -57,6 +57,7 @@ if ($mine) $text=$langs->trans("MyProjects");
print_fiche_titre($text); print_fiche_titre($text);
// Show description of content
if ($mine) print $langs->trans("MyProjectsDesc").'<br><br>'; if ($mine) print $langs->trans("MyProjectsDesc").'<br><br>';
else else
{ {

8
htdocs/projet/liste.php
View File

@ -107,6 +107,14 @@ if ($resql)
if ($mine) $text=$langs->trans('MyProjects'); if ($mine) $text=$langs->trans('MyProjects');
print_barre_liste($text, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorder, "", $num); print_barre_liste($text, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorder, "", $num);
// Show description of content
if ($mine) print $langs->trans("MyProjectsDesc").'<br><br>';
else
{
if ($user->rights->projet->all->lire && ! $socid) print $langs->trans("ProjectsDesc").'<br><br>';
else print $langs->trans("ProjectsPublicDesc").'<br><br>';
}
print '<table class="noborder" width="100%">'; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print_liste_field_titre($langs->trans("Ref"),$_SERVER["PHP_SELF"],"p.ref","","","",$sortfield,$sortorder); print_liste_field_titre($langs->trans("Ref"),$_SERVER["PHP_SELF"],"p.ref","","","",$sortfield,$sortorder);

2
htdocs/projet/note.php
View File

@ -39,7 +39,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $id); $result = restrictedArea($user, 'projet', $id);

2
htdocs/projet/tasks/fiche.php
View File

@ -43,7 +43,7 @@ if (empty($user->rights->projet->all->lire))
$_REQUEST["mode"]='mine'; $_REQUEST["mode"]='mine';
} }
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
if (! $user->rights->projet->all->lire) $mine=1; // Special for projects //if (! $user->rights->projet->all->lire) $mine=1; // Special for projects
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);

14
htdocs/projet/tasks/index.php
View File

@ -48,10 +48,11 @@ $page = $page == -1 ? 0 : $page;
/* /*
* View * View
*/ */
$mine = $_REQUEST['mode']=='mine' ? 1 : 0; $mine = $_REQUEST['mode']=='mine' ? 1 : 0;
$title=$langs->trans("Tasks"); $title=$langs->trans("Activities");
if ($mine) $title=$langs->trans("MyTasks"); if ($mine) $title=$langs->trans("MyActivities");
llxHeader("",$title,"Projet"); llxHeader("",$title,"Projet");
@ -68,6 +69,15 @@ if ($_GET["id"])
print_barre_liste($title, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorder, "", $num); print_barre_liste($title, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorder, "", $num);
// Show description of content
if ($mine) print $langs->trans("MyProjectsDesc").'<br><br>';
else
{
if ($user->rights->projet->all->lire && ! $socid) print $langs->trans("ProjectsDesc").'<br><br>';
else print $langs->trans("ProjectsPublicDesc").'<br><br>';
}
// Get list of tasks in tasksarray and taskarrayfiltered // Get list of tasks in tasksarray and taskarrayfiltered
// We need all tasks (even not limited to a user because a task to user // We need all tasks (even not limited to a user because a task to user
// can have a parent that is not affected to him). // can have a parent that is not affected to him).