gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-06 07:04:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

more access control

Browse Source
This commit is contained in:
Uwe Steinmann 2021-06-29 09:44:30 +02:00
parent bf23abad87
commit 03a394906e
3 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
op/op.EditDocument.php
View File

@ -31,6 +31,10 @@ include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$controller = Controller::factory($tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_controller_access($controller, $_POST)) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("access_denied"));
}
/* Check if the form data comes from a trusted request */
if(!checkFormKey('editdocument')) {

12
views/bootstrap/class.Bootstrap.php
View File

@ -741,20 +741,20 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
$menuitems = array();
if ($accessMode == M_READ && !$this->params['user']->isGuest()) {
if ($accessobject->check_view_access('FolderNotify'))
if ($accessobject->check_controller_access('FolderNotify'))
$menuitems['edit_folder_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>getMLText('edit_folder_notify'));
}
else if ($accessMode >= M_READWRITE) {
if ($accessobject->check_view_access('AddSubFolder'))
if ($accessobject->check_controller_access('AddSubFolder'))
$menuitems['add_subfolder'] = array('link'=>"../out/out.AddSubFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_subfolder'));
if ($accessobject->check_view_access('AddDocument'))
if ($accessobject->check_controller_access('AddDocument'))
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_document'));
if(0 && $this->params['enablelargefileupload'])
$menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_multiple_documents'));
if ($accessobject->check_view_access('EditFolder')) {
if ($accessobject->check_controller_access('EditFolder')) {
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
}
if ($accessobject->check_view_access('MoveFolder')) {
if ($accessobject->check_controller_access('MoveFolder')) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
}
@ -768,7 +768,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
if ($accessobject->check_view_access('FolderAccess'))
$menuitems['edit_folder_access'] = array('link'=>"../out/out.FolderAccess.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>getMLText('edit_folder_access'));
}
if ($accessobject->check_view_access('FolderNotify'))
if ($accessobject->check_controller_access('FolderNotify'))
$menuitems['edit_existing_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=". $folderID ."&showtree=". showtree(), 'label'=>getMLText('edit_existing_notify'));
}
if ($accessobject->check_view_access('Indexer') && $this->params['enablefullsearch']) {

12
views/bootstrap4/class.Bootstrap4.php
View File

@ -659,20 +659,20 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
$menuitems = array();
if ($accessMode == M_READ && !$this->params['user']->isGuest()) {
if ($accessobject->check_view_access('FolderNotify'))
if ($accessobject->check_controller_access('FolderNotify'))
$menuitems['edit_folder_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>getMLText('edit_folder_notify'));
}
else if ($accessMode >= M_READWRITE) {
if ($accessobject->check_view_access('AddSubFolder'))
if ($accessobject->check_controller_access('AddSubFolder'))
$menuitems['add_subfolder'] = array('link'=>"../out/out.AddSubFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_subfolder'));
if ($accessobject->check_view_access('AddDocument'))
if ($accessobject->check_controller_access('AddDocument'))
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_document'));
if(0 && $this->params['enablelargefileupload'])
$menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_multiple_documents'));
if ($accessobject->check_view_access('EditFolder')) {
if ($accessobject->check_controller_access('EditFolder')) {
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
}
if ($accessobject->check_view_access('MoveFolder')) {
if ($accessobject->check_controller_access('MoveFolder')) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
}
@ -686,7 +686,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
if ($accessobject->check_view_access('FolderAccess'))
$menuitems['edit_folder_access'] = array('link'=>"../out/out.FolderAccess.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>getMLText('edit_folder_access'));
}
if ($accessobject->check_view_access('FolderNotify'))
if ($accessobject->check_controller_access('FolderNotify'))
$menuitems['edit_existing_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=". $folderID ."&showtree=". showtree(), 'label'=>getMLText('edit_existing_notify'));
}
if ($this->params['user']->isAdmin() && $this->params['enablefullsearch']) {