diff --git a/SeedDMS_Core/Core/inc.ClassDocument.php b/SeedDMS_Core/Core/inc.ClassDocument.php index 349b911a3..864a0d913 100644 --- a/SeedDMS_Core/Core/inc.ClassDocument.php +++ b/SeedDMS_Core/Core/inc.ClassDocument.php @@ -3169,7 +3169,7 @@ class SeedDMS_Core_DocumentContent extends SeedDMS_Core_Object { /* {{{ */ if ($u->getID() == $owner->getID()) return M_READ; /* Read/Write access on the document will also grant access on the version */ - if($this->_document->getAccessMode($user) >= M_READWRITE) return M_READ; + if($this->_document->getAccessMode($u) >= M_READWRITE) return M_READ; /* At this point the current status is in the list of status without read access. * The only way to still gain read access is, if the user is involved in the diff --git a/inc/inc.ClassAccessOperation.php b/inc/inc.ClassAccessOperation.php index b350e8b69..cd6acdbca 100644 --- a/inc/inc.ClassAccessOperation.php +++ b/inc/inc.ClassAccessOperation.php @@ -348,20 +348,27 @@ class SeedDMS_AccessOperation { * Check for access permission on view * * If the parameter $view is an array then each element is considered the - * name of a view and true will be returned if one is accessible. + * name of a view and true will be returned if one of them is accessible. * Whether access is allowed also depends on the currently logged in user * stored in the view object. If the user is an admin the access * on a view must be explicitly disallowed. For regular users the access * must be explicitly allowed. * + * If advanced access control is turn off, this function will always return + * true for admins and false for other users. + * * @param mixed $view Instanz of view, name of view or array of view names - * @param string $get query parameters + * @param string $get query parameters possible containing the element 'action' * @return boolean true if access is allowed, false if access is disallowed * no specific access right is set, otherwise false */ function check_view_access($view, $get=array()) { /* {{{ */ - if(!$this->settings->_advancedAcl) - return true; + if(!$this->settings->_advancedAcl) { + if($this->user->isAdmin()) + return true; + else + return false; + } if(is_string($view)) { $scripts = array($view); } elseif(is_array($view)) { diff --git a/inc/inc.ClassViewCommon.php b/inc/inc.ClassViewCommon.php index c5d199a6b..42dab1cf2 100644 --- a/inc/inc.ClassViewCommon.php +++ b/inc/inc.ClassViewCommon.php @@ -171,10 +171,10 @@ class SeedDMS_View_Common { * Check if the access on the view with given name or the current view itself * may be accessed. * - * The function behaves differently for admins and other users. For admins - * a view must be explitly disallowed for this function to return false. - * For other users access on a view must be explicitly allow for the this - * function to return true. + * The function requires the parameter 'accessobject' to be available in the + * view, because it calls SeedDMS_AccessOperation::check_view_access() + * to check access rights. If the the optional $name is not set the + * current view is used. * * @param string|array $name name of view or list of view names * @return boolean true if access is allowed otherwise false diff --git a/views/bootstrap/class.AdminTools.php b/views/bootstrap/class.AdminTools.php index 8b92d3039..19a5619c2 100644 --- a/views/bootstrap/class.AdminTools.php +++ b/views/bootstrap/class.AdminTools.php @@ -47,33 +47,33 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style { ?>
-check_view_access('UsrMgr') || $user->isAdmin()) { ?> +check_view_access('UsrMgr')) { ?>
-check_view_access('GroupMgr') || $user->isAdmin()) { ?> +check_view_access('GroupMgr')) { ?>
-check_view_access('RoleMgr') || $user->isAdmin()) { ?> +check_view_access('RoleMgr')) { ?>
-check_view_access('BackupTools') || $user->isAdmin()) { ?> +check_view_access('BackupTools')) { ?>
check_view_access('LogManagement') || $user->isAdmin())) + if ($logfileenable && ($accessop->check_view_access('LogManagement'))) echo "
".getMLText("log_management")."
"; ?>
-check_view_access('DefaultKeywords') || $user->isAdmin()) { ?> +check_view_access('DefaultKeywords')) { ?>
-check_view_access('Categories') || $user->isAdmin()) { ?> +check_view_access('Categories')) { ?>
-check_view_access('AttributeMgr') || $user->isAdmin()) { ?> +check_view_access('AttributeMgr')) { ?>
@@ -81,13 +81,13 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style { if($this->params['workflowmode'] == 'advanced') { ?>
-check_view_access('WorkflowMgr') || $user->isAdmin()) { ?> +check_view_access('WorkflowMgr')) { ?>
-check_view_access('WorkflowStatesMgr') || $user->isAdmin()) { ?> +check_view_access('WorkflowStatesMgr')) { ?>
-check_view_access('WorkflowActionsMgr') || $user->isAdmin()) { ?> +check_view_access('WorkflowActionsMgr')) { ?>
@@ -96,13 +96,13 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style { if($enablefullsearch) { ?>
-check_view_access('Indexer') || $user->isAdmin()) { ?> +check_view_access('Indexer')) { ?>
-check_view_access('CreateIndex') || $user->isAdmin()) { ?> +check_view_access('CreateIndex')) { ?>
-check_view_access('IndexInfo') || $user->isAdmin()) { ?> +check_view_access('IndexInfo')) { ?>
@@ -110,27 +110,27 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style { } ?>
-check_view_access('Statistic') || $user->isAdmin()) { ?> +check_view_access('Statistic')) { ?>
-check_view_access('Charts') || $user->isAdmin()) { ?> +check_view_access('Charts')) { ?>
-check_view_access('ObjectCheck') || $user->isAdmin()) { ?> +check_view_access('ObjectCheck')) { ?>
-check_view_access('Timeline') || $user->isAdmin()) { ?> +check_view_access('Timeline')) { ?>
-check_view_access('Settings') || $user->isAdmin()) { ?> +check_view_access('Settings')) { ?>
-check_view_access('ExtensionMgr') || $user->isAdmin()) { ?> +check_view_access('ExtensionMgr')) { ?>
-check_view_access('Info') || $user->isAdmin()) { ?> +check_view_access('Info')) { ?>
diff --git a/views/bootstrap/class.AttributeMgr.php b/views/bootstrap/class.AttributeMgr.php index cd4a3b011..ac0a7fdbc 100644 --- a/views/bootstrap/class.AttributeMgr.php +++ b/views/bootstrap/class.AttributeMgr.php @@ -306,12 +306,16 @@ $(document).ready( function() { ?>
-
getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?> +
getID()."\"" : "") ?>>
+
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+
diff --git a/views/bootstrap/class.GroupMgr.php b/views/bootstrap/class.GroupMgr.php index 2438f17e7..7b1838e0e 100644 --- a/views/bootstrap/class.GroupMgr.php +++ b/views/bootstrap/class.GroupMgr.php @@ -257,6 +257,7 @@ $(document).ready( function() { function show() { /* {{{ */ $dms = $this->params['dms']; $user = $this->params['user']; + $accessop = $this->params['accessobject']; $selgroup = $this->params['selgroup']; $allUsers = $this->params['allusers']; $allGroups = $this->params['allgroups']; @@ -284,18 +285,22 @@ $(document).ready( function() { ?> -
getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?> +
getID()."\"" : "") ?>>
+
-
-
getID()."\"" : "") ?>>
-
+
+check_view_access($this, array('action'=>'form'))) { ?> +
getID()."\"" : "") ?>>
+ +
+ contentContainerEnd(); $this->contentEnd(); $this->htmlEndPage(); } /* }}} */ diff --git a/views/bootstrap/class.RoleMgr.php b/views/bootstrap/class.RoleMgr.php index 08beeb2e1..d19c6b8a1 100644 --- a/views/bootstrap/class.RoleMgr.php +++ b/views/bootstrap/class.RoleMgr.php @@ -205,14 +205,19 @@ $(document).ready( function() { ?> -
getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?> +
getID()."\"" : "") ?>>
+
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+
+ contentEnd(); diff --git a/views/bootstrap/class.UsrMgr.php b/views/bootstrap/class.UsrMgr.php index e241b0a37..337d6841f 100644 --- a/views/bootstrap/class.UsrMgr.php +++ b/views/bootstrap/class.UsrMgr.php @@ -520,14 +520,16 @@ $(document).ready( function() { ?> -check_view_access($this, array('action'=>'info')) || $user->isAdmin()) { ?> -
getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?> +
getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+