From 3c88cd091a8704ce7b1b925ceac2974eac0ab122 Mon Sep 17 00:00:00 2001 From: Paula Quispe Date: Fri, 10 Mar 2017 10:59:49 -0400 Subject: [PATCH] HOR-2830 --- workflow/engine/classes/class.system.php | 3 +- .../methods/cases/cases_ShowDocument.php | 17 +++--- .../cases/cases_ShowOutputDocument.php | 60 ++++++++++--------- workflow/public_html/sysGeneric.php | 2 + 4 files changed, 45 insertions(+), 37 deletions(-) diff --git a/workflow/engine/classes/class.system.php b/workflow/engine/classes/class.system.php index f6d98dea6..3140770e3 100644 --- a/workflow/engine/classes/class.system.php +++ b/workflow/engine/classes/class.system.php @@ -79,7 +79,8 @@ class System 'server_hostname_requests_frontend' => '', 'load_headers_ie' => 0, 'redirect_to_mobile' => 0, - 'disable_php_upload_execution' => 0 + 'disable_php_upload_execution' => 0, + 'disable_download_documents_session_validation' => 0 ); /** diff --git a/workflow/engine/methods/cases/cases_ShowDocument.php b/workflow/engine/methods/cases/cases_ShowDocument.php index 31b3cf906..502610d57 100644 --- a/workflow/engine/methods/cases/cases_ShowDocument.php +++ b/workflow/engine/methods/cases/cases_ShowDocument.php @@ -26,8 +26,6 @@ * * @author David Callizaya */ - -require_once ("classes/model/AppDocumentPeer.php"); if (isset($_REQUEST['actionAjax']) && $_REQUEST['actionAjax'] == "verifySession" ) { if (!isset($_SESSION['USER_LOGGED'])) { if ((isset( $_POST['request'] )) && ($_POST['request'] == true)) { @@ -47,14 +45,17 @@ if (isset($_REQUEST['actionAjax']) && $_REQUEST['actionAjax'] == "verifySession" die(); } } -//v = Version -//a = Case UID - +require_once ("classes/model/AppDocumentPeer.php"); $oAppDocument = new AppDocument(); -if (!$oAppDocument->canDownloadInput($_SESSION['USER_LOGGED'], $_GET['a'], $_GET['v'])) { - G::header('Location: /errors/error403.php'); - die(); +//Check if the user can be download the input Document +//Send the parameter v = Version +//Send the parameter a = Case UID +if (defined('DISABLE_DOWNLOAD_DOCUMENTS_SESSION_VALIDATION') && DISABLE_DOWNLOAD_DOCUMENTS_SESSION_VALIDATION == 0) { + if (!$oAppDocument->canDownloadInput($_SESSION['USER_LOGGED'], $_GET['a'], $_GET['v'])) { + G::header('Location: /errors/error403.php'); + die(); + } } if (! isset( $_GET['v'] )) { diff --git a/workflow/engine/methods/cases/cases_ShowOutputDocument.php b/workflow/engine/methods/cases/cases_ShowOutputDocument.php index 3e575060b..6cbdb836d 100644 --- a/workflow/engine/methods/cases/cases_ShowOutputDocument.php +++ b/workflow/engine/methods/cases/cases_ShowOutputDocument.php @@ -1,23 +1,4 @@ message = G::LoadTranslation('ID_LOGIN_AGAIN'); - $response->lostSession = true; - print G::json_encode( $response ); - die(); - } else { - G::SendMessageText( G::LoadTranslation('ID_LOGIN_TO_SEE_OUTPUTDOCS'), "WARNING" ); - G::header("location: " . "/"); - die(); - } - } else { - $response = new stdclass(); - print G::json_encode( $response ); - die(); - } -} /** * cases_ShowOutputDocument.php * @@ -46,6 +27,26 @@ if (isset($_REQUEST['actionAjax']) && $_REQUEST['actionAjax'] == "verifySession" * @author David Callizaya */ +if (isset($_REQUEST['actionAjax']) && $_REQUEST['actionAjax'] == "verifySession" ) { + if (!isset($_SESSION['USER_LOGGED'])) { + if ((isset( $_POST['request'] )) && ($_POST['request'] == true)) { + $response = new stdclass(); + $response->message = G::LoadTranslation('ID_LOGIN_AGAIN'); + $response->lostSession = true; + print G::json_encode( $response ); + die(); + } else { + G::SendMessageText( G::LoadTranslation('ID_LOGIN_TO_SEE_OUTPUTDOCS'), "WARNING" ); + G::header("location: " . "/"); + die(); + } + } else { + $response = new stdclass(); + print G::json_encode( $response ); + die(); + } +} + require_once ("classes/model/AppDocumentPeer.php"); require_once ("classes/model/OutputDocumentPeer.php"); @@ -60,17 +61,20 @@ $oOutputDocument->Fields = $oOutputDocument->getByUid($sDocUid); $download = $oOutputDocument->Fields['OUT_DOC_OPEN_TYPE']; //Check if the user can be download the Output Document -if (!$oAppDocument->canDownloadOutput( - $oAppDocument->Fields['USR_UID'], - $_SESSION['USER_LOGGED'], - $oOutputDocument->Fields['PRO_UID'], - $oAppDocument->Fields['APP_UID'], - $sAppDocUid) -) { - G::header('Location: /errors/error403.php'); - die(); +if (defined('DISABLE_DOWNLOAD_DOCUMENTS_SESSION_VALIDATION') && DISABLE_DOWNLOAD_DOCUMENTS_SESSION_VALIDATION == 0) { + if (!$oAppDocument->canDownloadOutput( + $oAppDocument->Fields['USR_UID'], + $_SESSION['USER_LOGGED'], + $oOutputDocument->Fields['PRO_UID'], + $oAppDocument->Fields['APP_UID'], + $sAppDocUid) + ) { + G::header('Location: /errors/error403.php'); + die(); + } } + $info = pathinfo( $oAppDocument->getAppDocFilename() ); if (! isset( $_GET['ext'] )) { $ext = $info['extension']; diff --git a/workflow/public_html/sysGeneric.php b/workflow/public_html/sysGeneric.php index 6b0cec7be..28609084f 100644 --- a/workflow/public_html/sysGeneric.php +++ b/workflow/public_html/sysGeneric.php @@ -338,6 +338,7 @@ define('LOAD_HEADERS_IE', $config['load_headers_ie']); define('LEAVE_CASE_WARNING', $config['leave_case_warning']); define('REDIRECT_TO_MOBILE', $config['redirect_to_mobile']); define('DISABLE_PHP_UPLOAD_EXECUTION', $config['disable_php_upload_execution']); +define('DISABLE_DOWNLOAD_DOCUMENTS_SESSION_VALIDATION', $config['disable_download_documents_session_validation']); // IIS Compatibility, SERVER_ADDR doesn't exist on that env, so we need to define it. $_SERVER['SERVER_ADDR'] = isset( $_SERVER['SERVER_ADDR'] ) ? $_SERVER['SERVER_ADDR'] : $_SERVER['SERVER_NAME']; @@ -950,6 +951,7 @@ if (! defined( 'EXECUTE_BY_CRON' )) { $noLoginFiles[] = 'ajaxListener'; $noLoginFiles[] = 'cases_Step'; $noLoginFiles[] = 'cases_ShowOutputDocument'; + $noLoginFiles[] = 'cases_ShowDocument'; $noLoginFiles[] = 'cases_CatchExecute'; $noLoginFiles[] = 'cases_SaveData'; $noLoginFiles[] = 'cases_Derivate';