gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-11 09:35:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add access check for EditFolder, MoveFolder, put logo in header

Browse Source
This commit is contained in:
Uwe Steinmann 2021-06-22 09:47:16 +02:00
parent bfcad700af
commit 79e926324a
4 changed files with 36 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
op/op.EditFolder.php
View File

@ -31,6 +31,10 @@ include("../inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$controller = Controller::factory($tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_controller_access($controller, $_POST)) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("access_denied"));
}
/* Check if the form data comes from a trusted request */
if(!checkFormKey('editfolder')) {

5
op/op.MoveFolder.php
View File

@ -33,6 +33,11 @@ if(!checkFormKey('movefolder', 'GET')) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_controller_access('MoveFolder', $_POST)) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("access_denied"));
}
if (!isset($_GET["folderid"]) || !is_numeric($_GET["folderid"]) || intval($_GET["folderid"])<1) {
UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))),getMLText("invalid_folder_id"));
}

20
views/bootstrap/class.Bootstrap.php
View File

@ -752,9 +752,13 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_document'));
if(0 && $this->params['enablelargefileupload'])
$menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_multiple_documents'));
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
if ($accessobject->check_view_access('EditFolder')) {
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
}
if ($accessobject->check_view_access('MoveFolder')) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
}
if ($accessMode == M_ALL) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
@ -3237,10 +3241,12 @@ $('body').on('click', '[id^=\"table-row-folder\"] td:nth-child(2)', function(ev)
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-remove"></i></span>';
}
}
if($subFolderAccessMode >= M_READWRITE) {
$content .= '<a class_="btn btn-mini" href="../out/out.EditFolder.php?folderid='.$subFolder->getID().'" title="'.getMLText("edit_folder_props").'"><i class="fa fa-edit"></i></a>';
} else {
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-edit"></i></span>';
if ($accessop->check_view_access('EditFolder')) {
if($subFolderAccessMode >= M_READWRITE) {
$content .= '<a class_="btn btn-mini" href="../out/out.EditFolder.php?folderid='.$subFolder->getID().'" title="'.getMLText("edit_folder_props").'"><i class="fa fa-edit"></i></a>';
} else {
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-edit"></i></span>';
}
}
if($subFolderAccessMode >= M_READWRITE) {
$content .= $this->printAccessButton($subFolder, true);

22
views/bootstrap4/class.Bootstrap4.php
View File

@ -297,7 +297,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
function globalBanner() { /* {{{ */
echo "<nav class=\"navbar navbar-expand-lg navbar-dark bg-dark fixed-top\">\n";
echo " <a class=\"navbar-brand\" href=\"../out/out.ViewFolder.php\">".(strlen($this->params['sitename'])>0 ? $this->params['sitename'] : "SeedDMS")."</a>\n";
echo " <a class=\"navbar-brand\" href=\"../out/out.ViewFolder.php\">".(!empty($this->extraheader['logo']) ? '<img src="'.$this->extraheader['logo'].'">' : '<img src="../views/bootstrap4/images/seeddms-logo.svg">')." <span class=\"d-none d-md-inline-block ml-4\">".(strlen($this->params['sitename'])>0 ? $this->params['sitename'] : "SeedDMS")."</span></a>\n";
echo "</nav>\n";
} /* }}} */
@ -669,9 +669,13 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
$menuitems['add_document'] = array('link'=>"../out/out.AddDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_document'));
if(0 && $this->params['enablelargefileupload'])
$menuitems['add_multiple_documents'] = array('link'=>"../out/out.AddMultiDocument.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('add_multiple_documents'));
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
if ($accessobject->check_view_access('EditFolder')) {
$menuitems['edit_folder_props'] = array('link'=>"../out/out.EditFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('edit_folder_props'));
}
if ($accessobject->check_view_access('MoveFolder')) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
$menuitems['move_folder'] = array('link'=>"../out/out.MoveFolder.php?folderid=". $folderID ."&showtree=".showtree(), 'label'=>getMLText('move_folder'));
}
if ($accessMode == M_ALL) {
if ($folderID != $this->params['rootfolderid'] && $folder->getParent())
@ -3233,10 +3237,12 @@ $('body').on('click', '[id^=\"table-row-folder\"] td:nth-child(2)', function(ev)
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-remove"></i></span>';
}
}
if($subFolderAccessMode >= M_READWRITE) {
$content .= '<a class_="btn btn-mini" href="../out/out.EditFolder.php?folderid='.$subFolder->getID().'" title="'.getMLText("edit_folder_props").'"><i class="fa fa-edit"></i></a>';
} else {
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-edit"></i></span>';
if ($accessop->check_view_access('EditFolder')) {
if($subFolderAccessMode >= M_READWRITE) {
$content .= '<a class_="btn btn-mini" href="../out/out.EditFolder.php?folderid='.$subFolder->getID().'" title="'.getMLText("edit_folder_props").'"><i class="fa fa-edit"></i></a>';
} else {
$content .= '<span style="padding: 2px; color: #CCC;"><i class="fa fa-edit"></i></span>';
}
}
if($subFolderAccessMode >= M_READWRITE) {
$content .= $this->printAccessButton($subFolder, true);