fernando/luos
1
0
Fork 0
Code Releases Activity

HOR-2820

Browse Source
This commit is contained in:
Paula Quispe
2017-03-09 19:52:33 -04:00
parent 1221e36bc0
commit 8daa371ca7
2 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
workflow/engine/classes/model/AppDocument.php
View File

@@ -598,5 +598,45 @@ class AppDocument extends BaseAppDocument
}
return false;
}
/**
* Check if the user $userCanDownload can download the Output Document
*
* The user that generate the output document can download the same output document file
* A participated user or a supervisor must have the process permission "view" to be able to download the output document
* @param string $userGenerateDocument
* @param string $userCanDownload
* @param string $proUid
* @param string $appUid
* @param string $sAppDocUid
* @return boolean
*/
public function canDownloadOutput($userGenerateDocument, $userCanDownload, $proUid, $appUid, $sAppDocUid)
{
//Check if the user Logged was generate the document
if ($userGenerateDocument !== $userCanDownload) {
$oCase = new Cases();
$resPermission = $oCase->getAllObjectsFrom($proUid, $appUid, '', $userCanDownload, 'VIEW');
$objCase = new \ProcessMaker\BusinessModel\Cases();
$aUserCanAccess = $objCase->userAuthorization(
$userCanDownload,
$proUid,
$appUid,
array(),
array('OUTPUT_DOCUMENTS'=>'VIEW')
);
//If the user was not participated can not download
if (!$aUserCanAccess['participated']) {
return false;
}
//If the user does not have the process permission can not download
if (!in_array($sAppDocUid, $aUserCanAccess['objectPermissions']['OUTPUT_DOCUMENTS'])) {
return false;
}
}
return true;
}
}

20
workflow/engine/methods/cases/cases_ShowOutputDocument.php
View File

@@ -50,9 +50,21 @@ $sAppDocUid = $oAppDocument->getAppDocUid();
$sDocUid = $oAppDocument->Fields['DOC_UID'];
$oOutputDocument = new OutputDocument();
$oOutputDocument->Fields = $oOutputDocument->getByUid( $sDocUid );
$oOutputDocument->Fields = $oOutputDocument->getByUid($sDocUid);
$download = $oOutputDocument->Fields['OUT_DOC_OPEN_TYPE'];
//Check if the user can be download the Output Document
if (!$oAppDocument->canDownloadOutput(
$oAppDocument->Fields['USR_UID'],
$_SESSION['USER_LOGGED'],
$oOutputDocument->Fields['PRO_UID'],
$oAppDocument->Fields['APP_UID'],
$sAppDocUid)
) {
G::header('Location: /errors/error403.php');
die();
}
$info = pathinfo( $oAppDocument->getAppDocFilename() );
if (! isset( $_GET['ext'] )) {
$ext = $info['extension'];
@@ -83,7 +95,7 @@ if (file_exists( $realPath )) {
$realPath = $realPath2;
}
if (! $sw_file_exists) {
if (!$sw_file_exists) {
$oPluginRegistry = & PMPluginRegistry::getSingleton();
if ($oPluginRegistry->existsTrigger( PM_UPLOAD_DOCUMENT )) {
@@ -137,10 +149,6 @@ if (! $sw_file_exists) {
if (!$downloadStatus) {
G::streamFile( $realPath, $download, $nameFile); //download
}
//die($realPath);
//G::streamFile( $realPath, $download, $info['basename'] . $ver . '.' . $ext );
}
}
//G::streamFile ( $realPath, true);