diff --git a/SeedDMS_Core/Core/inc.ClassDocument.php b/SeedDMS_Core/Core/inc.ClassDocument.php
index 349b911a3..864a0d913 100644
--- a/SeedDMS_Core/Core/inc.ClassDocument.php
+++ b/SeedDMS_Core/Core/inc.ClassDocument.php
@@ -3169,7 +3169,7 @@ class SeedDMS_Core_DocumentContent extends SeedDMS_Core_Object { /* {{{ */
if ($u->getID() == $owner->getID()) return M_READ;
/* Read/Write access on the document will also grant access on the version */
- if($this->_document->getAccessMode($user) >= M_READWRITE) return M_READ;
+ if($this->_document->getAccessMode($u) >= M_READWRITE) return M_READ;
/* At this point the current status is in the list of status without read access.
* The only way to still gain read access is, if the user is involved in the
diff --git a/inc/inc.ClassAccessOperation.php b/inc/inc.ClassAccessOperation.php
index b350e8b69..cd6acdbca 100644
--- a/inc/inc.ClassAccessOperation.php
+++ b/inc/inc.ClassAccessOperation.php
@@ -348,20 +348,27 @@ class SeedDMS_AccessOperation {
* Check for access permission on view
*
* If the parameter $view is an array then each element is considered the
- * name of a view and true will be returned if one is accessible.
+ * name of a view and true will be returned if one of them is accessible.
* Whether access is allowed also depends on the currently logged in user
* stored in the view object. If the user is an admin the access
* on a view must be explicitly disallowed. For regular users the access
* must be explicitly allowed.
*
+ * If advanced access control is turn off, this function will always return
+ * true for admins and false for other users.
+ *
* @param mixed $view Instanz of view, name of view or array of view names
- * @param string $get query parameters
+ * @param string $get query parameters possible containing the element 'action'
* @return boolean true if access is allowed, false if access is disallowed
* no specific access right is set, otherwise false
*/
function check_view_access($view, $get=array()) { /* {{{ */
- if(!$this->settings->_advancedAcl)
- return true;
+ if(!$this->settings->_advancedAcl) {
+ if($this->user->isAdmin())
+ return true;
+ else
+ return false;
+ }
if(is_string($view)) {
$scripts = array($view);
} elseif(is_array($view)) {
diff --git a/inc/inc.ClassViewCommon.php b/inc/inc.ClassViewCommon.php
index c5d199a6b..42dab1cf2 100644
--- a/inc/inc.ClassViewCommon.php
+++ b/inc/inc.ClassViewCommon.php
@@ -171,10 +171,10 @@ class SeedDMS_View_Common {
* Check if the access on the view with given name or the current view itself
* may be accessed.
*
- * The function behaves differently for admins and other users. For admins
- * a view must be explitly disallowed for this function to return false.
- * For other users access on a view must be explicitly allow for the this
- * function to return true.
+ * The function requires the parameter 'accessobject' to be available in the
+ * view, because it calls SeedDMS_AccessOperation::check_view_access()
+ * to check access rights. If the the optional $name is not set the
+ * current view is used.
*
* @param string|array $name name of view or list of view names
* @return boolean true if access is allowed otherwise false
diff --git a/views/bootstrap/class.AdminTools.php b/views/bootstrap/class.AdminTools.php
index 8b92d3039..19a5619c2 100644
--- a/views/bootstrap/class.AdminTools.php
+++ b/views/bootstrap/class.AdminTools.php
@@ -47,33 +47,33 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style {
?>
-check_view_access('UsrMgr') || $user->isAdmin()) { ?>
+check_view_access('UsrMgr')) { ?>
-check_view_access('GroupMgr') || $user->isAdmin()) { ?>
+check_view_access('GroupMgr')) { ?>
-check_view_access('RoleMgr') || $user->isAdmin()) { ?>
+check_view_access('RoleMgr')) { ?>
-check_view_access('BackupTools') || $user->isAdmin()) { ?>
+check_view_access('BackupTools')) { ?>
check_view_access('LogManagement') || $user->isAdmin()))
+ if ($logfileenable && ($accessop->check_view_access('LogManagement')))
echo "
".getMLText("log_management")."";
?>
-check_view_access('DefaultKeywords') || $user->isAdmin()) { ?>
+check_view_access('DefaultKeywords')) { ?>
-check_view_access('Categories') || $user->isAdmin()) { ?>
+check_view_access('Categories')) { ?>
-check_view_access('AttributeMgr') || $user->isAdmin()) { ?>
+check_view_access('AttributeMgr')) { ?>
@@ -81,13 +81,13 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style {
if($this->params['workflowmode'] == 'advanced') {
?>
-check_view_access('WorkflowMgr') || $user->isAdmin()) { ?>
+check_view_access('WorkflowMgr')) { ?>
-check_view_access('WorkflowStatesMgr') || $user->isAdmin()) { ?>
+check_view_access('WorkflowStatesMgr')) { ?>
-check_view_access('WorkflowActionsMgr') || $user->isAdmin()) { ?>
+check_view_access('WorkflowActionsMgr')) { ?>
@@ -96,13 +96,13 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style {
if($enablefullsearch) {
?>
-check_view_access('Indexer') || $user->isAdmin()) { ?>
+check_view_access('Indexer')) { ?>
-check_view_access('CreateIndex') || $user->isAdmin()) { ?>
+check_view_access('CreateIndex')) { ?>
-check_view_access('IndexInfo') || $user->isAdmin()) { ?>
+check_view_access('IndexInfo')) { ?>
@@ -110,27 +110,27 @@ class SeedDMS_View_AdminTools extends SeedDMS_Bootstrap_Style {
}
?>
-check_view_access('Statistic') || $user->isAdmin()) { ?>
+check_view_access('Statistic')) { ?>
-check_view_access('Charts') || $user->isAdmin()) { ?>
+check_view_access('Charts')) { ?>
-check_view_access('ObjectCheck') || $user->isAdmin()) { ?>
+check_view_access('ObjectCheck')) { ?>
-check_view_access('Timeline') || $user->isAdmin()) { ?>
+check_view_access('Timeline')) { ?>
-check_view_access('Settings') || $user->isAdmin()) { ?>
+check_view_access('Settings')) { ?>
-check_view_access('ExtensionMgr') || $user->isAdmin()) { ?>
+check_view_access('ExtensionMgr')) { ?>
-check_view_access('Info') || $user->isAdmin()) { ?>
+check_view_access('Info')) { ?>
diff --git a/views/bootstrap/class.AttributeMgr.php b/views/bootstrap/class.AttributeMgr.php
index cd4a3b011..ac0a7fdbc 100644
--- a/views/bootstrap/class.AttributeMgr.php
+++ b/views/bootstrap/class.AttributeMgr.php
@@ -306,12 +306,16 @@ $(document).ready( function() {
?>
-getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?>
+ getID()."\"" : "") ?>>
+
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+
diff --git a/views/bootstrap/class.GroupMgr.php b/views/bootstrap/class.GroupMgr.php
index 2438f17e7..7b1838e0e 100644
--- a/views/bootstrap/class.GroupMgr.php
+++ b/views/bootstrap/class.GroupMgr.php
@@ -257,6 +257,7 @@ $(document).ready( function() {
function show() { /* {{{ */
$dms = $this->params['dms'];
$user = $this->params['user'];
+ $accessop = $this->params['accessobject'];
$selgroup = $this->params['selgroup'];
$allUsers = $this->params['allusers'];
$allGroups = $this->params['allgroups'];
@@ -284,18 +285,22 @@ $(document).ready( function() {
?>
-getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?>
+ getID()."\"" : "") ?>>
+
-
-
getID()."\"" : "") ?>>
-
+
+check_view_access($this, array('action'=>'form'))) { ?>
+
getID()."\"" : "") ?>>
+
+
+
contentContainerEnd();
$this->contentEnd();
$this->htmlEndPage();
} /* }}} */
diff --git a/views/bootstrap/class.RoleMgr.php b/views/bootstrap/class.RoleMgr.php
index 08beeb2e1..d19c6b8a1 100644
--- a/views/bootstrap/class.RoleMgr.php
+++ b/views/bootstrap/class.RoleMgr.php
@@ -205,14 +205,19 @@ $(document).ready( function() {
?>
-getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?>
+ getID()."\"" : "") ?>>
+
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+
+
contentEnd();
diff --git a/views/bootstrap/class.UsrMgr.php b/views/bootstrap/class.UsrMgr.php
index e241b0a37..337d6841f 100644
--- a/views/bootstrap/class.UsrMgr.php
+++ b/views/bootstrap/class.UsrMgr.php
@@ -520,14 +520,16 @@ $(document).ready( function() {
?>
-check_view_access($this, array('action'=>'info')) || $user->isAdmin()) { ?>
-getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'info'))) { ?>
+ getID()."\"" : "") ?>>
+check_view_access($this, array('action'=>'form'))) { ?>
getID()."\"" : "") ?>>
+