lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX better method to check user rights AND usergroup rights !

Browse Source
This commit is contained in:
Regis Houssin 2020-02-18 08:35:51 +01:00
parent a5de331410
commit f6f0d9d4a2
1 changed files with 16 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
htdocs/fourn/commande/index.php
View File

@ -251,8 +251,6 @@ if (! empty($conf->multicompany->enabled) && ! empty($conf->global->MULTICOMPANY
} }
$sql.= " u.rowid, u.lastname, u.firstname, u.email"; $sql.= " u.rowid, u.lastname, u.firstname, u.email";
$sql.= " FROM ".MAIN_DB_PREFIX."user as u"; $sql.= " FROM ".MAIN_DB_PREFIX."user as u";
$sql.= ",".MAIN_DB_PREFIX."user_rights as ur";
$sql.= ",".MAIN_DB_PREFIX."rights_def as rd";
if (! empty($conf->multicompany->enabled) && ! empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) if (! empty($conf->multicompany->enabled) && ! empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE))
{ {
$sql.= ",".MAIN_DB_PREFIX."usergroup_user as ug"; $sql.= ",".MAIN_DB_PREFIX."usergroup_user as ug";
@ -263,13 +261,7 @@ if (! empty($conf->multicompany->enabled) && ! empty($conf->global->MULTICOMPANY
else else
{ {
$sql.= " WHERE (u.entity IN (".getEntity('user').")"; $sql.= " WHERE (u.entity IN (".getEntity('user').")";
$sql.= " AND ur.entity = ".$conf->entity.")";
} }
$sql.= " AND u.rowid = ur.fk_user";
$sql.= " AND ur.fk_id = rd.id";
$sql.= " AND module = 'fournisseur'";
$sql.= " AND perms = 'commande'";
$sql.= " AND subperms = 'approuver'";
$resql = $db->query($sql); $resql = $db->query($sql);
if ($resql) if ($resql)
@ -285,15 +277,22 @@ if ($resql)
{ {
$obj = $db->fetch_object($resql); $obj = $db->fetch_object($resql);
$userstatic = new User($db);
$userstatic->id = $obj->rowid;
$userstatic->getrights('fournisseur');
if (! empty($userstatic->rights->fournisseur->commande->approuver))
{
print '<tr class="oddeven">'; print '<tr class="oddeven">';
print '<td>'; print '<td>';
$userstatic->id=$obj->rowid;
$userstatic->lastname = $obj->lastname; $userstatic->lastname = $obj->lastname;
$userstatic->firstname = $obj->firstname; $userstatic->firstname = $obj->firstname;
$userstatic->email = $obj->email; $userstatic->email = $obj->email;
print $userstatic->getNomUrl(1); print $userstatic->getNomUrl(1);
print '</td>'; print '</td>';
print "</tr>\n"; print "</tr>\n";
}
$i++; $i++;
} }
print "</table><br>"; print "</table><br>";