Merged in bugfix/HOR-2631 (pull request #5378)

HOR-2631

Approved-by: Julio Cesar Laura Avendaño
Approved-by: Paula Quispe

workflow/engine/methods/cases/cases_Ajax.php

@@ -1019,20 +1019,23 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) {
 
         if (is_array( $aApplication )) {
             $response['exists'] = true;
+            $objCase = new \ProcessMaker\BusinessModel\Cases();
+            $aUserCanAccess = $objCase->userAuthorization(
+                $_SESSION['USER_LOGGED'],
+                $aApplication['PRO_UID'],
+                $aApplication['APP_UID'],
+                array('PM_ALLCASES'),
+                array('SUMMARY_FORM'=>'VIEW')
+            );
 
             //Check if the user is a supervisor to this Process
-            if(isset($_POST['actionFromList']) && $_POST['actionFromList']==='to_revise'){
+            if (isset($_POST['actionFromList']) && $_POST['actionFromList']==='to_revise') {
-                $oAppCache = new AppCacheView();
+                if (!$aUserCanAccess['supervisor']) {
-                $aProcesses = $oAppCache->getProUidSupervisor($_SESSION['USER_LOGGED']);
-                if(!in_array($aApplication['PRO_UID'], $aProcesses)){
                     $response['exists'] = false;
                     $response['message'] = G::LoadTranslation('ID_NO_PERMISSION_NO_PARTICIPATED');
                 }
             } else {//Check if the user participated in this case
-                $oParticipated = new ListParticipatedLast();
+                if (!$aUserCanAccess['participated'] && !$aUserCanAccess['rolesPermissions']['PM_ALLCASES'] && !$aUserCanAccess['objectPermissions']['SUMMARY_FORM']) {
-                $aParticipated = $oParticipated->loadList($_SESSION['USER_LOGGED'], array(), null, $aApplication['APP_UID']);
-                if(!sizeof($aParticipated)){
-                    //Check in the selfservice list
                     $response['exists'] = false;
                     $response['message'] = G::LoadTranslation('ID_NO_PERMISSION_NO_PARTICIPATED');
                 }

workflow/engine/methods/cases/cases_Resume.php

@@ -49,20 +49,24 @@ $G_ID_SUB_MENU_SELECTED = '_';
 
 /* Prepare page before to show */
 $oCase = new Cases();
-//$Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX'] );
+
 if (isset($_SESSION['ACTION']) && ($_SESSION['ACTION'] == 'jump')) {
     $Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX'], $_SESSION['ACTION']);
 } else {
     $Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX']);
 }
 
-//Check the participated
+//Check the authorization
-$participated = $oCase->userParticipatedInCase( $_GET['APP_UID'], $_SESSION['USER_LOGGED'] );
+$objCase = new \ProcessMaker\BusinessModel\Cases();
-//Check if is Supervisor
+$aUserCanAccess = $objCase->userAuthorization(
-$processUser = new ProcessUser();
+    $_SESSION['USER_LOGGED'],
-$userAccess = $processUser->validateUserAccess($Fields['PRO_UID'], $_SESSION['USER_LOGGED']);
+    $Fields['PRO_UID'],
+    $_GET['APP_UID'],
+    array('PM_ALLCASES'),
+    array('SUMMARY_FORM'=>'VIEW')
+);
 
-if ($RBAC->userCanAccess( 'PM_ALLCASES' ) < 0 && !$participated && !$userAccess) {
+if (!$aUserCanAccess['participated'] && !$aUserCanAccess['supervisor'] && !$aUserCanAccess['rolesPermissions']['PM_ALLCASES'] && !$aUserCanAccess['objectPermissions']['SUMMARY_FORM']) {
     $aMessage['MESSAGE'] = G::LoadTranslation( 'ID_NO_PERMISSION_NO_PARTICIPATED' );
     $G_PUBLISH = new Publisher();
     $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'login/showMessage', '', $aMessage );
@@ -133,25 +137,21 @@ if ($nTasksInParallel > 1) {
 $Fields['TAS_TITLE'] = $aTask['TAS_TITLE'];
 
 $objUser = new Users();
-
 $oHeadPublisher = & headPublisher::getSingleton();
 $oHeadPublisher->addScriptFile( '/jscore/cases/core/cases_Step.js' );
 $G_PUBLISH = new Publisher();
 $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume.xml', '', $Fields, '' );
-if($Fields['APP_STATUS'] != 'COMPLETED'){
+if ($Fields['APP_STATUS'] != 'COMPLETED') {
     $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task_Title.xml', '', $Fields, '' );
     $objDel = new AppDelegation();
-  $parallel = $objDel->LoadParallel ($Fields['APP_UID'],$_GET['DEL_INDEX']);
+    $parallel = $objDel->LoadParallel($Fields['APP_UID']);
     $FieldsPar = $Fields;
-  if(empty($parallel)){
+    foreach ($parallel as $row) {
-    $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $Fields, '' );
-  }else{
-    foreach($parallel as $row){
         $FieldsPar['TAS_UID'] = $row['TAS_UID'];
         $aTask = $objTask->load( $row['TAS_UID'] );
         $FieldsPar['TAS_TITLE'] = $aTask['TAS_TITLE'];
         $FieldsPar['USR_UID'] = $row['USR_UID'];
-      if(isset($row['USR_UID']) && !empty($row['USR_UID'])) {
+        if (isset($row['USR_UID']) && !empty($row['USR_UID'])) {
             $aUser = $objUser->loadDetails ($row['USR_UID']);
             $FieldsPar['CURRENT_USER'] = $aUser['USR_FULLNAME'];
         }
@@ -159,10 +159,8 @@ if($Fields['APP_STATUS'] != 'COMPLETED'){
         $FieldsPar['DEL_INIT_DATE']     = $row['DEL_INIT_DATE'];
         $FieldsPar['DEL_TASK_DUE_DATE'] = $row['DEL_TASK_DUE_DATE'];
         $FieldsPar['DEL_FINISH_DATE']   = $row['DEL_FINISH_DATE'];
-      $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $FieldsPar, '' );
+        $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $FieldsPar);
     }
-  }
-
 }
 
 G::RenderPage('publish', 'blank');

workflow/engine/src/ProcessMaker/BusinessModel/Cases.php

@@ -3252,4 +3252,49 @@ class Cases
             $result = $case->updateCase($applicationUid, $arrayApplicationData);
         }
     }
+
+    /**
+     * Get Permissions, Participate, Access
+     *
+     * @param string $usrUid
+     * @param string $proUid
+     * @param string $appUid
+     * @param array $rolesPermissions
+     * @param array $objectPermissions
+     * @return array Returns array with all access
+     */
+    public function userAuthorization($usrUid, $proUid, $appUid, $rolesPermissions = array(), $objectPermissions = array()) {
+        $arrayAccess = array();
+
+        //User has participated
+        $oParticipated = new \ListParticipatedLast();
+        $aParticipated = $oParticipated->loadList($usrUid, array(), null, $appUid);
+        $arrayAccess['participated'] = (count($aParticipated) == 0) ? false : true;
+
+        //User is supervisor
+        $supervisor = new \ProcessMaker\BusinessModel\ProcessSupervisor();
+        $isSupervisor = $supervisor->isUserProcessSupervisor($proUid, $usrUid);
+        $arrayAccess['supervisor'] = ($isSupervisor) ? true : false;
+
+        //Roles Permissions
+        if (count($rolesPermissions) > 0) {
+            global $RBAC;
+            foreach ($rolesPermissions as $value) {
+                $arrayAccess['rolesPermissions'][$value] = ($RBAC->userCanAccess($value) < 0) ? false : true;
+            }
+        }
+
+        //Object Permissions
+        if (count($objectPermissions) > 0) {
+            $oCase = new \Cases();
+            foreach ($objectPermissions as $key => $value) {
+                $resPermission = $oCase->getAllObjectsFrom($proUid, $appUid, '', $usrUid, $value);
+                if (isset($resPermission[$key])) {
+                    $arrayAccess['objectPermissions'][$key] = $resPermission[$key];
+                }
+            }
+        }
+
+        return $arrayAccess;
+    }
 }