gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-15 06:01:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add more access checks

Browse Source
This commit is contained in:
Uwe Steinmann 2016-08-12 18:08:30 +02:00
parent 224172f785
commit 74f9a0209b
8 changed files with 35 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
out/out.AddDocument.php
View File

@ -31,6 +31,9 @@ include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user)); $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings); $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("folder_title", array("foldername" => htmlspecialchars($folder->getName()))),getMLText("access_denied"));
}
if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) { if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id")); UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));

9
out/out.AddEvent.php
View File

@ -25,12 +25,17 @@ include("../inc/inc.DBInit.php");
include("../inc/inc.ClassUI.php"); include("../inc/inc.ClassUI.php");
include("../inc/inc.Authentication.php"); include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("edit_event"),getMLText("access_denied"));
}
if ($user->isGuest()) { if ($user->isGuest()) {
UI::exitError(getMLText("edit_event"),getMLText("access_denied")); UI::exitError(getMLText("edit_event"),getMLText("access_denied"));
} }
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
if($view) { if($view) {
$view($_GET); $view($_GET);
exit; exit;

12
out/out.AddFile.php
View File

@ -29,6 +29,13 @@ include("../inc/inc.ClassUI.php");
include("../inc/inc.ClassAccessOperation.php"); include("../inc/inc.ClassAccessOperation.php");
include("../inc/inc.Authentication.php"); include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
}
if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"]<1)) { if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"]<1)) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
} }
@ -45,11 +52,6 @@ if ($document->getAccessMode($user) < M_READWRITE) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied")); UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
} }
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
if($view) { if($view) {
$view->setParam('folder', $folder); $view->setParam('folder', $folder);
$view->setParam('document', $document); $view->setParam('document', $document);

3
out/out.AddSubFolder.php
View File

@ -31,6 +31,9 @@ include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user)); $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings); $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("folder_title", array("foldername" => '')),getMLText("access_denied"));
}
if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) { if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id")); UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));

12
out/out.AddToTransmittal.php
View File

@ -29,6 +29,13 @@ include("../inc/inc.ClassUI.php");
include("../inc/inc.ClassAccessOperation.php"); include("../inc/inc.ClassAccessOperation.php");
include("../inc/inc.Authentication.php"); include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("document_title", array("documentname" => '')),getMLText("access_denied"));
}
if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) { if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
} }
@ -54,11 +61,6 @@ if (!is_object($content)) {
$folder = $document->getFolder(); $folder = $document->getFolder();
$transmittals = $dms->getAllTransmittals($user); $transmittals = $dms->getAllTransmittals($user);
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
if($view) { if($view) {
$view->setParam('folder', $folder); $view->setParam('folder', $folder);
$view->setParam('document', $document); $view->setParam('document', $document);

1
out/out.Calendar.php
View File

@ -51,6 +51,7 @@ if($view) {
$view->setParam('month', $month); $view->setParam('month', $month);
$view->setParam('day', $day); $view->setParam('day', $day);
$view->setParam('firstdayofweek', $settings->_firstDayOfWeek); $view->setParam('firstdayofweek', $settings->_firstDayOfWeek);
$view->setParam('accessobject', $accessop);
$view($_GET); $view($_GET);
exit; exit;
} }

8
views/bootstrap/class.Bootstrap.php
View File

@ -525,8 +525,10 @@ $(document).ready(function () {
$menuitems['edit_folder_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>'edit_folder_notify'); $menuitems['edit_folder_notify'] = array('link'=>"../out/out.FolderNotify.php?folderid=".$folderID."&showtree=".showtree(), 'label'=>'edit_folder_notify');
} }
else if ($accessMode >= M_READWRITE) { else if ($accessMode >= M_READWRITE) {
$menuitems['add_subfolder'] = array('link'=>"../out/out.AddSubFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_subfolder'); if ($this->check_access('AddSubFolder'))
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_document'); $menuitems['add_subfolder'] = array('link'=>"../out/out.AddSubFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_subfolder');
if ($this->check_access('AddDocument'))
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_document');
if($this->params['enablelargefileupload']) if($this->params['enablelargefileupload'])
$menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_multiple_documents'); $menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'add_multiple_documents');
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'edit_folder_props'); $menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>'edit_folder_props');
@ -812,7 +814,7 @@ $(document).ready(function () {
echo "<li><a href=\"../out/out.Calendar.php?mode=w".$ds."\">".getMLText("week_view")."</a></li>\n"; echo "<li><a href=\"../out/out.Calendar.php?mode=w".$ds."\">".getMLText("week_view")."</a></li>\n";
echo "<li><a href=\"../out/out.Calendar.php?mode=m".$ds."\">".getMLText("month_view")."</a></li>\n"; echo "<li><a href=\"../out/out.Calendar.php?mode=m".$ds."\">".getMLText("month_view")."</a></li>\n";
echo "<li><a href=\"../out/out.Calendar.php?mode=y".$ds."\">".getMLText("year_view")."</a></li>\n"; echo "<li><a href=\"../out/out.Calendar.php?mode=y".$ds."\">".getMLText("year_view")."</a></li>\n";
if (!$this->params['user']->isGuest()) echo "<li><a href=\"../out/out.AddEvent.php\">".getMLText("add_event")."</a></li>\n"; if (!$this->params['user']->isGuest() && $this->check_access('AddEvent')) echo "<li><a href=\"../out/out.AddEvent.php\">".getMLText("add_event")."</a></li>\n";
echo "</ul>\n"; echo "</ul>\n";
echo "</div>\n"; echo "</div>\n";
return; return;

3
views/bootstrap/class.ViewDocument.php
View File

@ -584,7 +584,8 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
} }
*/ */
if($dms->getAllTransmittals($user)) { if($dms->getAllTransmittals($user)) {
print "<li>".$this->html_link('AddToTransmittal', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-list\"></i>".getMLText("add_to_transmittal"), false, true)."</li>"; if($this->check_access('AddToTransmittal'))
print "<li>".$this->html_link('AddToTransmittal', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-list\"></i>".getMLText("add_to_transmittal"), false, true)."</li>";
} }
if($accessop->mayEditComment($document)) { if($accessop->mayEditComment($document)) {
print "<li>".$this->html_link('EditComment', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-comment\"></i>".getMLText("edit_comment"), false, true)."</li>"; print "<li>".$this->html_link('EditComment', array('documentid'=>$documentid, 'version'=>$latestContent->getVersion()), array(), "<i class=\"icon-comment\"></i>".getMLText("edit_comment"), false, true)."</li>";