diff --git a/op/op.ReviewDocument.php b/op/op.ReviewDocument.php index 66db124f3..c0afc95b8 100644 --- a/op/op.ReviewDocument.php +++ b/op/op.ReviewDocument.php @@ -24,6 +24,7 @@ include("../inc/inc.ClassEmail.php"); include("../inc/inc.DBInit.php"); include("../inc/inc.Language.php"); include("../inc/inc.ClassUI.php"); +include("../inc/inc.ClassAccessOperation.php"); include("../inc/inc.Authentication.php"); /* Check if the form data comes for a trusted request */ @@ -63,8 +64,11 @@ if ($latestContent->getVersion()!=$version) { UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version")); } -// verify if document has expired -if ($document->hasExpired()){ +/* Create object for checking access to certain operations */ +$accessop = new SeedDMS_AccessOperation($document, $user, $settings); + +// verify if document may be reviewed +if ($accessop->mayReview()){ UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied")); } diff --git a/out/out.ReviewDocument.php b/out/out.ReviewDocument.php index 9f1e1e7d7..ac80d12a7 100644 --- a/out/out.ReviewDocument.php +++ b/out/out.ReviewDocument.php @@ -56,8 +56,12 @@ $latestContent = $document->getLatestContent(); if ($latestContent->getVersion()!=$version) { UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version")); } -// verify if document has expired -if ($document->hasExpired()){ + +/* Create object for checking access to certain operations */ +$accessop = new SeedDMS_AccessOperation($document, $user, $settings); + +// verify if document may be reviewed +if ($accessop->mayReview()){ UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied")); } @@ -66,9 +70,6 @@ if(!$reviews) { UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_action")); } -/* Create object for checking access to certain operations */ -$accessop = new SeedDMS_AccessOperation($document, $user, $settings); - $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user, 'folder'=>$folder, 'document'=>$document, 'version'=>$content)); if($view) {