gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-06 07:04:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

check with SeedDMS_AccessOperation for allowed operation

Browse Source
This commit is contained in:
Uwe Steinmann 2017-08-02 06:47:48 +02:00
parent e0dcd86f5a
commit 76508cb52b
7 changed files with 22 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
out/out.EditAttributes.php
View File

@ -46,6 +46,9 @@ $folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->mayEditAttributes()) {
UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
}
$attrdefs = $dms->getAllAttributeDefinitions(array(SeedDMS_Core_AttributeDefinition::objtype_documentcontent, SeedDMS_Core_AttributeDefinition::objtype_all));

3
out/out.EditComment.php
View File

@ -51,6 +51,9 @@ $folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->mayEditComment()) {
UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
}
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

4
out/out.EditOnline.php
View File

@ -53,6 +53,7 @@ if(isset($_GET["version"])) {
$lc = $document->getLatestContent();
} else {
$version = 0;
$content = $document->getLatestContent();
$lc = $document->getLatestContent();
}
@ -74,6 +75,9 @@ if (!isset($settings->_editOnlineFileTypes) || !is_array($settings->_editOnlineF
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if(!$accessop->mayEditVersion($version)) {
UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
}
$folder = $document->getFolder();

10
out/out.OverrideContentStatus.php
View File

@ -50,17 +50,13 @@ if (!is_object($content)) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
}
$overallStatus = $content->getStatus();
// status change control
if ($overallStatus["status"] == S_REJECTED || $overallStatus["status"] == S_EXPIRED || $overallStatus["status"] == S_DRAFT_REV || $overallStatus["status"] == S_DRAFT_APP ) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_change_final_states"));
}
$folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->mayOverwriteStatus()) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_change_final_states"));
}
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

3
out/out.RemoveVersion.php
View File

@ -60,6 +60,9 @@ $folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->mayRemoveVersion()) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
}
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

10
out/out.SetReviewersApprovers.php
View File

@ -53,17 +53,13 @@ if(!$settings->_enableVersionModification) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_version_modification"));
}
// control for document state. Must correspond to check in
// SeedDMS_AccessOperation::maySetReviewersApprovers()
$overallStatus = $content->getStatus();
if ($overallStatus["status"]!=S_DRAFT_REV && $overallStatus["status"]!=S_DRAFT_APP) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_assign_invalid_state"));
}
$folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->maySetReviewersApprovers()) {
UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_assign_invalid_state"));
}
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

3
out/out.SetWorkflow.php
View File

@ -51,6 +51,9 @@ $folder = $document->getFolder();
/* Create object for checking access to certain operations */
$accessop = new SeedDMS_AccessOperation($document, $user, $settings);
if(!$accessop->maySetWorkflow()) {
UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
}
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));