diff --git a/workflow/engine/methods/cases/cases_Ajax.php b/workflow/engine/methods/cases/cases_Ajax.php index 2fc375013..760cd964e 100644 --- a/workflow/engine/methods/cases/cases_Ajax.php +++ b/workflow/engine/methods/cases/cases_Ajax.php @@ -1019,20 +1019,23 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) { if (is_array( $aApplication )) { $response['exists'] = true; + $objCase = new \ProcessMaker\BusinessModel\Cases(); + $aUserCanAccess = $objCase->userAuthorization( + $_SESSION['USER_LOGGED'], + $aApplication['PRO_UID'], + $aApplication['APP_UID'], + array('PM_ALLCASES'), + array('SUMMARY_FORM'=>'VIEW') + ); //Check if the user is a supervisor to this Process - if(isset($_POST['actionFromList']) && $_POST['actionFromList']==='to_revise'){ - $oAppCache = new AppCacheView(); - $aProcesses = $oAppCache->getProUidSupervisor($_SESSION['USER_LOGGED']); - if(!in_array($aApplication['PRO_UID'], $aProcesses)){ + if (isset($_POST['actionFromList']) && $_POST['actionFromList']==='to_revise') { + if (!$aUserCanAccess['supervisor']) { $response['exists'] = false; $response['message'] = G::LoadTranslation('ID_NO_PERMISSION_NO_PARTICIPATED'); } } else {//Check if the user participated in this case - $oParticipated = new ListParticipatedLast(); - $aParticipated = $oParticipated->loadList($_SESSION['USER_LOGGED'], array(), null, $aApplication['APP_UID']); - if(!sizeof($aParticipated)){ - //Check in the selfservice list + if (!$aUserCanAccess['participated'] && !$aUserCanAccess['rolesPermissions']['PM_ALLCASES'] && !$aUserCanAccess['objectPermissions']['SUMMARY_FORM']) { $response['exists'] = false; $response['message'] = G::LoadTranslation('ID_NO_PERMISSION_NO_PARTICIPATED'); } diff --git a/workflow/engine/methods/cases/cases_Resume.php b/workflow/engine/methods/cases/cases_Resume.php index 883dc3a0b..931909d44 100644 --- a/workflow/engine/methods/cases/cases_Resume.php +++ b/workflow/engine/methods/cases/cases_Resume.php @@ -49,20 +49,34 @@ $G_ID_SUB_MENU_SELECTED = '_'; /* Prepare page before to show */ $oCase = new Cases(); -//$Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX'] ); +//Check the authorization +$objCase = new \ProcessMaker\BusinessModel\Cases(); +$aUserCanAccess = $objCase->userAuthorization( + $_SESSION['USER_LOGGED'], + $_SESSION['PROCESS'], + $_GET['APP_UID'], + array('PM_ALLCASES'), + array('SUMMARY_FORM' => 'VIEW') +); + if (isset($_SESSION['ACTION']) && ($_SESSION['ACTION'] == 'jump')) { $Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX'], $_SESSION['ACTION']); + $process = new Process(); + $processData = $process->load($Fields['PRO_UID']); + if (isset($processData['PRO_DYNAFORMS']['PROCESS']) && $processData['PRO_DYNAFORMS']['PROCESS'] != '' && + $aUserCanAccess['objectPermissions']['SUMMARY_FORM'] + ) { + $_REQUEST['APP_UID'] = $Fields['APP_UID']; + $_REQUEST['DEL_INDEX'] = $Fields['DEL_INDEX']; + $_REQUEST['DYN_UID'] = $processData['PRO_DYNAFORMS']['PROCESS']; + require_once(PATH_METHODS . 'cases' . PATH_SEP . 'summary.php'); + exit(); + } } else { $Fields = $oCase->loadCase( $_SESSION['APPLICATION'], $_SESSION['INDEX']); } -//Check the participated -$participated = $oCase->userParticipatedInCase( $_GET['APP_UID'], $_SESSION['USER_LOGGED'] ); -//Check if is Supervisor -$processUser = new ProcessUser(); -$userAccess = $processUser->validateUserAccess($Fields['PRO_UID'], $_SESSION['USER_LOGGED']); - -if ($RBAC->userCanAccess( 'PM_ALLCASES' ) < 0 && !$participated && !$userAccess) { +if (!$aUserCanAccess['participated'] && !$aUserCanAccess['supervisor'] && !$aUserCanAccess['rolesPermissions']['PM_ALLCASES'] && !$aUserCanAccess['objectPermissions']['SUMMARY_FORM']) { $aMessage['MESSAGE'] = G::LoadTranslation( 'ID_NO_PERMISSION_NO_PARTICIPATED' ); $G_PUBLISH = new Publisher(); $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'login/showMessage', '', $aMessage ); @@ -133,36 +147,30 @@ if ($nTasksInParallel > 1) { $Fields['TAS_TITLE'] = $aTask['TAS_TITLE']; $objUser = new Users(); - $oHeadPublisher = & headPublisher::getSingleton(); $oHeadPublisher->addScriptFile( '/jscore/cases/core/cases_Step.js' ); $G_PUBLISH = new Publisher(); $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume.xml', '', $Fields, '' ); -if($Fields['APP_STATUS'] != 'COMPLETED'){ - $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task_Title.xml', '', $Fields, '' ); - $objDel = new AppDelegation(); - $parallel = $objDel->LoadParallel ($Fields['APP_UID'],$_GET['DEL_INDEX']); - $FieldsPar = $Fields; - if(empty($parallel)){ - $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $Fields, '' ); - }else{ - foreach($parallel as $row){ - $FieldsPar['TAS_UID'] = $row['TAS_UID']; - $aTask = $objTask->load( $row['TAS_UID'] ); - $FieldsPar['TAS_TITLE'] = $aTask['TAS_TITLE']; - $FieldsPar['USR_UID'] = $row['USR_UID']; - if(isset($row['USR_UID']) && !empty($row['USR_UID'])) { - $aUser = $objUser->loadDetails ($row['USR_UID']); - $FieldsPar['CURRENT_USER'] = $aUser['USR_FULLNAME']; - } - $FieldsPar['DEL_DELEGATE_DATE'] = $row['DEL_DELEGATE_DATE']; - $FieldsPar['DEL_INIT_DATE'] = $row['DEL_INIT_DATE']; - $FieldsPar['DEL_TASK_DUE_DATE'] = $row['DEL_TASK_DUE_DATE']; - $FieldsPar['DEL_FINISH_DATE'] = $row['DEL_FINISH_DATE']; - $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $FieldsPar, '' ); +if ($Fields['APP_STATUS'] != 'COMPLETED') { + $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task_Title.xml', '', $Fields, '' ); + $objDel = new AppDelegation(); + $parallel = $objDel->LoadParallel($Fields['APP_UID']); + $FieldsPar = $Fields; + foreach ($parallel as $row) { + $FieldsPar['TAS_UID'] = $row['TAS_UID']; + $aTask = $objTask->load( $row['TAS_UID'] ); + $FieldsPar['TAS_TITLE'] = $aTask['TAS_TITLE']; + $FieldsPar['USR_UID'] = $row['USR_UID']; + if (isset($row['USR_UID']) && !empty($row['USR_UID'])) { + $aUser = $objUser->loadDetails ($row['USR_UID']); + $FieldsPar['CURRENT_USER'] = $aUser['USR_FULLNAME']; + } + $FieldsPar['DEL_DELEGATE_DATE'] = $row['DEL_DELEGATE_DATE']; + $FieldsPar['DEL_INIT_DATE'] = $row['DEL_INIT_DATE']; + $FieldsPar['DEL_TASK_DUE_DATE'] = $row['DEL_TASK_DUE_DATE']; + $FieldsPar['DEL_FINISH_DATE'] = $row['DEL_FINISH_DATE']; + $G_PUBLISH->AddContent( 'xmlform', 'xmlform', 'cases/cases_Resume_Current_Task.xml', '', $FieldsPar); } - } - } G::RenderPage('publish', 'blank'); diff --git a/workflow/engine/methods/cases/summary.php b/workflow/engine/methods/cases/summary.php index 1fe5fb028..02a6e383d 100644 --- a/workflow/engine/methods/cases/summary.php +++ b/workflow/engine/methods/cases/summary.php @@ -69,7 +69,6 @@ try { $result = DynaformPeer::doSelectRS($criteria); $result->setFetchmode(ResultSet::FETCHMODE_ASSOC); if ($result->next()) { - G::LoadClass('pmDynaform'); G::LoadClass('pmDynaform'); $FieldsPmDynaform = $applicationFields; $FieldsPmDynaform["CURRENT_DYNAFORM"] = $_REQUEST['DYN_UID']; diff --git a/workflow/engine/src/ProcessMaker/BusinessModel/Cases.php b/workflow/engine/src/ProcessMaker/BusinessModel/Cases.php index 55081fc76..93c38834f 100644 --- a/workflow/engine/src/ProcessMaker/BusinessModel/Cases.php +++ b/workflow/engine/src/ProcessMaker/BusinessModel/Cases.php @@ -3252,4 +3252,49 @@ class Cases $result = $case->updateCase($applicationUid, $arrayApplicationData); } } + + /** + * Get Permissions, Participate, Access + * + * @param string $usrUid + * @param string $proUid + * @param string $appUid + * @param array $rolesPermissions + * @param array $objectPermissions + * @return array Returns array with all access + */ + public function userAuthorization($usrUid, $proUid, $appUid, $rolesPermissions = array(), $objectPermissions = array()) { + $arrayAccess = array(); + + //User has participated + $oParticipated = new \ListParticipatedLast(); + $aParticipated = $oParticipated->loadList($usrUid, array(), null, $appUid); + $arrayAccess['participated'] = (count($aParticipated) == 0) ? false : true; + + //User is supervisor + $supervisor = new \ProcessMaker\BusinessModel\ProcessSupervisor(); + $isSupervisor = $supervisor->isUserProcessSupervisor($proUid, $usrUid); + $arrayAccess['supervisor'] = ($isSupervisor) ? true : false; + + //Roles Permissions + if (count($rolesPermissions) > 0) { + global $RBAC; + foreach ($rolesPermissions as $value) { + $arrayAccess['rolesPermissions'][$value] = ($RBAC->userCanAccess($value) < 0) ? false : true; + } + } + + //Object Permissions + if (count($objectPermissions) > 0) { + $oCase = new \Cases(); + foreach ($objectPermissions as $key => $value) { + $resPermission = $oCase->getAllObjectsFrom($proUid, $appUid, '', $usrUid, $value); + if (isset($resPermission[$key])) { + $arrayAccess['objectPermissions'][$key] = $resPermission[$key]; + } + } + } + + return $arrayAccess; + } }