fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG 8408 Acceso a Documentos por usuarios sin permiso... SOLVED

Browse Source 
- Not validated the permission PM_FOLDERS_VIEW.
- the user must have this permit and may only view documents in the processes that participate, and for see all with the permission PM_ALLCASES.
This commit is contained in:
Marco Antonio Nina
2012-07-19 12:28:56 -04:00
parent 42b0ef4a58
commit 0823fa907d
3 changed files with 34 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
workflow/engine/classes/model/AppFolder.php
View File

@@ -203,7 +203,7 @@ if($limit != 0){
return $folderArray;
}
function getFolderContent($folderID, $docIdFilter = array(), $keyword = NULL, $searchType = NULL, $limit=0, $start=0) {
function getFolderContent($folderID, $docIdFilter = array(), $keyword = NULL, $searchType = NULL, $limit=0, $start=0, $user=null) {
require_once ("classes/model/AppDocument.php");
require_once ("classes/model/InputDocument.php");
require_once ("classes/model/OutputDocument.php");
@@ -229,6 +229,28 @@ if($limit != 0){
$oCriteria->add ( AppDocumentPeer::APP_DOC_TAGS, "%" . $keyword . "%", CRITERIA::LIKE );
}
if ($user != null) {
require_once ("classes/model/AppDelegation.php");
$criteria = new Criteria ();
$criteria->addSelectColumn (AppDelegationPeer::APP_UID);
$criteria->setDistinct();
$criteria->add (AppDelegationPeer::USR_UID, $user);
$criteria->addJoin(AppDocumentPeer::APP_UID, AppDelegationPeer::APP_UID);
$criteria->addJoin(AppDocumentPeer::DEL_INDEX, AppDelegationPeer::DEL_INDEX);
$rs2 = AppDocumentPeer::doSelectRS($criteria);
$rs2->setFetchmode(ResultSet::FETCHMODE_ASSOC);
//$rs->next();
$data = array();
while ($rs2->next()) {
$row = $rs2->getRow();
$data[] = $row['APP_UID'];
}
$oCriteria->add ( AppDocumentPeer::APP_UID, $data, CRITERIA::IN );
}
$oCase->verifyTable ();
@@ -246,7 +268,6 @@ if($limit != 0){
$rs = AppDocumentPeer::doSelectRS ( $oCriteria );
$rs->setFetchmode ( ResultSet::FETCHMODE_ASSOC );
$rs->next ();
$filesResult = array ();

4
workflow/engine/menus/cases.php
View File

@@ -58,7 +58,9 @@ if ( $RBAC->userCanAccess('PM_REASSIGNCASE') == 1 ) {
$G_TMP_MENU->AddIdRawOption('CASES_TO_REASSIGN', 'casesListExtJs?action=to_reassign', G::LoadTranslation('ID_TO_REASSIGN'), 'reassing.png' );
}
$G_TMP_MENU->AddIdRawOption('CASES_FOLDERS', 'casesStartPage?action=documents', G::LoadTranslation('ID_FOLDERS'), 'folderV2.gif','','blockHeaderNoChild' );
if ($RBAC->userCanAccess('PM_FOLDERS_VIEW') == 1) {
$G_TMP_MENU->AddIdRawOption('CASES_FOLDERS', 'casesStartPage?action=documents', G::LoadTranslation('ID_FOLDERS'), 'folderV2.gif','','blockHeaderNoChild' );
}

13
workflow/engine/methods/appFolder/appFolderAjax.php
View File

@@ -120,7 +120,9 @@ function expandNode(){
$totalDocuments=0;
if(($_POST['sendWhat']=="dirs")||($_POST['sendWhat']=="both")){
$folderListObj = $oPMFolder->getFolderList ( $_POST ['node'] != 'root' ? $_POST ['node'] == 'NA' ? "" : $_POST ['node'] : $rootFolder, $limit, $start );
$folderListObj = $oPMFolder->getFolderList ( $_POST ['node'] != 'root' ? $_POST ['node'] == 'NA' ? "" : $_POST ['node'] : $rootFolder, $limit, $start);
//G::pr($folderListObj);
$folderList=$folderListObj['folders'];
$totalFolders=$folderListObj['totalFoldersCount'];
@@ -128,14 +130,15 @@ function expandNode(){
// G::pr($folderListObj);
}
if(($_POST['sendWhat']=="files")||($_POST['sendWhat']=="both")){
$folderContentObj = $oPMFolder->getFolderContent ( $_POST ['node'] != 'root' ? $_POST ['node'] == 'NA' ? "" : $_POST ['node'] : $rootFolder, array(), NULL, NULL, $limit, $start );
if (($_POST['sendWhat'] == "files")||($_POST['sendWhat'] == "both")) {
global $RBAC;
$user = ($RBAC->userCanAccess('PM_ALLCASES') == 1)? '' : $_SESSION['USER_LOGGED'];
$folderContentObj = $oPMFolder->getFolderContent ( $_POST ['node'] != 'root' ? $_POST ['node'] == 'NA' ? "" : $_POST ['node'] : $rootFolder, array(), NULL, NULL, $limit, $start, $user);
//G::pr($folderContentObj);
$folderContent=$folderContentObj['documents'];
$totalDocuments=$folderContentObj['totalDocumentsCount'];
$totalItems+=count($folderContent);
//G::pr($folderContent);
//G::pr($folderContent);
}
// G::pr($folderList);
//var_dump(isset($folderList));