Merge branch 'seeddms-5.1.x' into seeddms-6.0.x

CHANGELOG

@@ -188,6 +188,11 @@
 - remove empty lines at end of view/bootstrap/class.*.php files (Closes #329)
 - make sure contentDir ends with DIRECTORY_SEPARATOR (Closes #323)
 - minor improvements of installation
+- better checking in out/*.php for allowed operation (e.g. EditOnline,
+  RemoveVersion, SetReviewersApprovers, ...)
+- SetReviewersApprovers checks for mandatory reviewers/approvers
+- reviewers/approvers can only be modified by users with unrestricted access
+  and as long as no reviewer/approver has reviewed/approved the document
 
 --------------------------------------------------------------------------------
                      Changes in version 4.3.35

inc/inc.ClassAccessOperation.php

@@ -62,14 +62,16 @@ class SeedDMS_AccessOperation {
 	 * document may delete versions. The admin may even delete a version
 	 * even if is disallowed in the settings.
 	 */
-	function mayEditVersion($document) { /* {{{ */
+	function mayEditVersion($document, $vno=0) { /* {{{ */
 		if(get_class($document) == $this->dms->getClassname('document')) {
-			if($latestContent = $document->getLatestContent()) {
+			if($vno)
-				if (!isset($this->settings->_editOnlineFileTypes) || !is_array($this->settings->_editOnlineFileTypes) || !in_array(strtolower($latestContent->getFileType()), $this->settings->_editOnlineFileTypes))
+				$version = $document->getContentByVersion($vno);
-					return false;
+			else
-				if ($document->getAccessMode($this->user) == M_ALL || $this->user->isAdmin()) {
+				$version = $document->getLatestContent();
-					return true;
+			if (!isset($this->settings->_editOnlineFileTypes) || !is_array($this->settings->_editOnlineFileTypes) || !in_array(strtolower($version->getFileType()), $this->settings->_editOnlineFileTypes))
-				}
+				return false;
+			if ($document->getAccessMode($this->user) == M_ALL || $this->user->isAdmin()) {
+				return true;
 			}
 		}
 		return false;
@@ -121,15 +123,28 @@ class SeedDMS_AccessOperation {
 	 *
 	 * This check can only be done for documents. Overwriting the document
 	 * reviewers/approvers is only allowed if version modification is turned on
-	 * in the settings and the document is in 'draft review' status.  The
+	 * in the settings and the document has not been reviewed/approved by any
-	 * admin may even set reviewers/approvers if is disallowed in the
+	 * user/group already.
+	 * The admin may even set reviewers/approvers if is disallowed in the
 	 * settings.
 	 */
 	function maySetReviewersApprovers($document) { /* {{{ */
 		if(get_class($document) == $this->dms->getClassname('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
-				if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && ($status['status']==S_DRAFT || $status["status"]==S_DRAFT_REV || $status["status"]==S_DRAFT_APP && $this->settings->_workflowMode == 'traditional_only_approval')) {
+				$reviewstatus = $latestContent->getReviewStatus();
+				$hasreview = false;
+				foreach($reviewstatus as $r) {
+					if($r['status'] == 1 || $r['status'] == -1)
+						$hasreview = true;
+				}
+				$approvalstatus = $latestContent->getApprovalStatus();
+				$hasapproval = false;
+				foreach($approvalstatus as $r) {
+					if($r['status'] == 1 || $r['status'] == -1)
+						$hasapproval = true;
+				}
+				if ((($this->settings->_enableVersionModification && ($this->obj->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && (($status["status"]==S_DRAFT_REV && !$hasreview) || ($status["status"]==S_DRAFT_APP && !$hasreview && !$hasapproval))) {
 					return true;
 				}
 			}

op/op.SetReviewersApprovers.php

@@ -62,6 +62,7 @@ if ($overallStatus["status"]==S_REJECTED || $overallStatus["status"]==S_OBSOLETE
 }
 
 $folder = $document->getFolder();
+$owner = $document->getOwner();
 
 // Retrieve a list of all users and groups that have review / approve
 // privileges.
@@ -118,6 +119,18 @@ if (isset($_POST["grpIndReviewers"])) {
 	}
 }
 $pGrpRev = (isset($_POST["grpReviewers"]) ? array_values(array_unique($_POST["grpReviewers"])) : array());
+if($user->getID() != $owner->getID()) {
+	$res=$owner->getMandatoryReviewers();
+	if($user->isAdmin())
+		$res = array();
+} else
+	$res=$user->getMandatoryReviewers();
+foreach ($res as $r) {
+	if(!in_array($r['reviewerUserID'], $pIndRev))
+		$pIndRev[] = $r['reviewerUserID'];
+	if(!in_array($r['reviewerGroupID'], $pGrpRev))
+		$pGrpRev[] = $r['reviewerGroupID'];
+}
 foreach ($pIndRev as $p) {
 	if (is_numeric($p)) {
 		if (isset($accessIndex["i"][$p])) {
@@ -350,6 +363,18 @@ if (isset($_POST["grpIndApprovers"])) {
 	}
 }
 $pGrpApp = (isset($_POST["grpApprovers"]) ? array_values(array_unique($_POST["grpApprovers"])) : array());
+if($user->getID() != $owner->getID()) {
+	$res=$owner->getMandatoryApprovers();
+	if($user->isAdmin())
+		$res = array();
+} else
+	$res=$user->getMandatoryApprovers();
+foreach ($res as $r) {
+	if(!in_array($r['approverUserID'], $pIndApp))
+		$pIndApp[] = $r['approverUserID'];
+	if(!in_array($r['approverGroupID'], $pGrpApp))
+		$pGrpApp[] = $r['approverGroupID'];
+}
 foreach ($pIndApp as $p) {
 	if (is_numeric($p)) {
 		if (isset($accessIndex["i"][$p])) {

out/out.EditAttributes.php

@@ -48,6 +48,9 @@ $folder = $document->getFolder();
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->mayEditAttributes($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+}
 
 $attrdefs = $dms->getAllAttributeDefinitions(array(SeedDMS_Core_AttributeDefinition::objtype_documentcontent, SeedDMS_Core_AttributeDefinition::objtype_all));
 

out/out.EditComment.php

@@ -53,6 +53,9 @@ $folder = $document->getFolder();
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->mayEditComment($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+}
 
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

out/out.EditOnline.php

@@ -58,6 +58,7 @@ if(isset($_GET["version"])) {
 	$lc = $document->getLatestContent();
 
 }	else {
+	$version = 0;
 	$content = $document->getLatestContent();
 	$lc = $document->getLatestContent();
 }
@@ -77,6 +78,12 @@ if (!isset($settings->_editOnlineFileTypes) || !is_array($settings->_editOnlineF
 }
  */
 
+/* Create object for checking access to certain operations */
+$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->mayEditVersion($document, $version)) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+}
+
 $folder = $document->getFolder();
 
 if($view) {

out/out.OverrideContentStatus.php

@@ -52,17 +52,13 @@ if (!is_object($content)) {
 	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
-$overallStatus = $content->getStatus();
-
-// status change control
-if ($overallStatus["status"] == S_REJECTED || $overallStatus["status"] == S_EXPIRED || $overallStatus["status"] == S_DRAFT_REV || $overallStatus["status"] == S_DRAFT_APP ) {
-	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_change_final_states"));
-}
-
 $folder = $document->getFolder();
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->mayOverwriteStatus($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_change_final_states"));
+}
 
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

out/out.RemoveVersion.php

@@ -62,6 +62,9 @@ $folder = $document->getFolder();
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->mayRemoveVersion($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied"));
+}
 
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

out/out.SetReviewersApprovers.php

@@ -51,18 +51,14 @@ if (!is_object($content)) {
 	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version"));
 }
 
-if(!$settings->_enableVersionModification) {
+$folder = $document->getFolder();
-	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_version_modification"));
-}
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
-if (!$accessop->maySetReviewersApprovers($document)) {
+if(!$accessop->maySetReviewersApprovers($document)) {
-	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("cannot_assign_invalid_state"));
+	UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_version_modification"));
 }
 
-$folder = $document->getFolder();
-
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
 if($view) {

out/out.SetWorkflow.php

@@ -53,6 +53,9 @@ $folder = $document->getFolder();
 
 /* Create object for checking access to certain operations */
 $accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
+if(!$accessop->maySetWorkflow($document)) {
+	UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied"));
+}
 
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));

views/bootstrap/class.Help.php

@@ -39,17 +39,46 @@ class SeedDMS_View_Help extends SeedDMS_Bootstrap_Style {
 		$this->htmlStartPage(getMLText("help"));
 		$this->globalNavigation();
 		$this->contentStart();
-		$this->pageNavigation(getMLText("help").": ".getMLText('help_'.strtolower($context), array(), $context), "");
+//		$this->pageNavigation(getMLText("help").": ".getMLText('help_'.strtolower($context), array(), $context), "");
-
+?>
-		$this->contentContainerStart('help');
+<div class="row-fluid">
+<div class="span4">
+	<legend>Table of contents</legend>
+<?php
+		$d = dir("../languages/".$this->params['session']->getLanguage()."/help");
+		echo "<ul>";
+		while (false !== ($entry = $d->read())) {
+			if($entry != '..' && $entry != '.') {
+				$path_parts = pathinfo($dir."/".$entry);
+				if($path_parts['extension'] == 'html' || $path_parts['extension'] == 'md') {
+					echo "<li><a href=\"../out/out.Help.php?context=".$path_parts['filename']."\">".getMLText('help_'.$path_parts['filename'], array(), $path_parts['filename'])."</a></li>";
+				}
+			}
+		}
+		echo "</ul>";
+?>
+</div>
+<div class="span8">
+<legend><?php printMLText('help_'.strtolower($context), array(), $context); ?></legend>
+<?php
 
 		$helpfile = "../languages/".$this->params['session']->getLanguage()."/help/".$context.".html";
 		if(file_exists($helpfile))
 			readfile($helpfile);
-		else
+		else {
+			$helpfile = "../languages/".$this->params['session']->getLanguage()."/help/".$context.".md";
+			if(file_exists($helpfile)) {
+				require_once('parsedown/Parsedown.php');
+				$Parsedown = new Parsedown();
+				echo $Parsedown->text(file_get_contents($helpfile));
+			} else
 			readfile("../languages/".$this->params['session']->getLanguage()."/help.htm");
+		}
 
-		$this->contentContainerEnd();
+?>
+</div>
+</div>
+<?php
 		$this->contentEnd();
 		$this->htmlEndPage();
 	} /* }}} */

views/bootstrap/class.SetReviewersApprovers.php

@@ -43,6 +43,7 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 		$enableselfrevapp = $this->params['enableselfrevapp'];
 
 		$overallStatus = $content->getStatus();
+		$owner = $document->getOwner();
 
 		$this->htmlStartPage(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))));
 		$this->globalNavigation($folder);
@@ -92,7 +93,12 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
   <select class="chzn-select span9" name="indReviewers[]" multiple="multiple" data-placeholder="<?php printMLText('select_ind_reviewers'); ?>" data-no_results_text="<?php printMLText('unknown_owner'); ?>">
 <?php
 
-		$res=$user->getMandatoryReviewers();
+		if($user->getID() != $owner->getID()) {
+			$res=$owner->getMandatoryReviewers();
+			if($user->isAdmin())
+				$res = array();
+		} else
+			$res=$user->getMandatoryReviewers();
 		foreach ($docAccess["users"] as $usr) {
 			$mandatory=false;
 			foreach ($res as $r) if ($r['reviewerUserID']==$usr->getID()) $mandatory=true;
@@ -100,7 +106,7 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			if ($mandatory){
 
 				print "<option value=\"".$usr->getID()."\" disabled=\"disabled\">". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())." &lt;".$usr->getEmail()."&gt;</option>";
-				print "<input id='revInd".$usr->getID()."' type='hidden' name='indReviewers[]' value='". $usr->getID() ."'>";
+//				print "<input id='revInd".$usr->getID()."' type='hidden' name='indReviewers[]' value='". $usr->getID() ."'>";
 
 			} elseif (isset($reviewIndex["i"][$usr->getID()])) {
 
@@ -134,6 +140,24 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 ?>
   </select>
 
+<?php
+			/* List all mandatory reviewers */
+			if($res) {
+				$tmp = array();
+				foreach ($res as $r) {
+					if($r['reviewerUserID'] > 0) {
+						$u = $dms->getUser($r['reviewerUserID']);
+						$tmp[] =  htmlspecialchars($u->getFullName().' ('.$u->getLogin().')');
+					}
+				}
+				if($tmp) {
+					echo '<div class="mandatories"><span>'.getMLText('mandatory_reviewers').':</span> ';
+					echo implode(', ', $tmp);
+					echo "</div>\n";
+				}
+			}
+?>
+
   <div class="cbSelectTitle"><?php printMLText("groups")?>:</div>
   <select class="chzn-select span9" name="grpReviewers[]" multiple="multiple" data-placeholder="<?php printMLText('select_grp_reviewers'); ?>" data-no_results_text="<?php printMLText('unknown_group'); ?>">
 <?php
@@ -145,7 +169,7 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			if ($mandatory){
 
 				print "<option value=\"".$group->getID()."\" disabled='disabled'>".htmlspecialchars($group->getName())."</option>";
-				print "<input id='revGrp".$group->getID()."' type='hidden' name='grpReviewers[]' value='". $group->getID() ."' />";
+//				print "<input id='revGrp".$group->getID()."' type='hidden' name='grpReviewers[]' value='". $group->getID() ."' />";
 
 			} elseif (isset($reviewIndex["g"][$group->getID()])) {
 
@@ -165,8 +189,25 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			}
 		}
 ?>
-  </select>
+	</select>
-<?php } ?>
+<?php
+			/* List all mandatory groups of reviewers */
+			if($res) {
+				$tmp = array();
+				foreach ($res as $r) {
+					if($r['reviewerGroupID'] > 0) {
+						$u = $dms->getGroup($r['reviewerGroupID']);
+						$tmp[] =  htmlspecialchars($u->getName());
+					}
+				}
+				if($tmp) {
+					echo '<div class="mandatories"><span>'.getMLText('mandatory_reviewergroups').':</span> ';
+					echo implode(', ', $tmp);
+					echo "</div>\n";
+				}
+			}
+		}
+?>
 
 <?php $this->contentSubHeading(getMLText("update_approvers"));?>
 
@@ -174,8 +215,12 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
   <select class="chzn-select span9" name="indApprovers[]" multiple="multiple" data-placeholder="<?php printMLText('select_ind_approvers'); ?>" data-no_results_text="<?php printMLText('unknown_owner'); ?>">
 <?php
 
-		$res=$user->getMandatoryApprovers();
+		if($user->getID() != $owner->getID()) {
-
+			$res=$owner->getMandatoryApprovers();
+			if($user->isAdmin())
+				$res = array();
+		} else
+			$res=$user->getMandatoryApprovers();
 		foreach ($docAccess["users"] as $usr) {
 
 			$mandatory=false;
@@ -184,7 +229,7 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			if ($mandatory){
 			
 				print "<option value='". $usr->getID() ."' disabled='disabled'>". htmlspecialchars($usr->getLogin() . " - ". $usr->getFullName())." &lt;".$usr->getEmail()."&gt;</option>";
-				print "<input id='appInd".$usr->getID()."' type='hidden' name='indApprovers[]' value='". $usr->getID() ."'>";
+//				print "<input id='appInd".$usr->getID()."' type='hidden' name='indApprovers[]' value='". $usr->getID() ."'>";
 
 			} elseif (isset($approvalIndex["i"][$usr->getID()])) {
 			
@@ -206,7 +251,24 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			}
 		}
 ?>
-  </select>
+	</select>
+<?php
+		if($res) {
+			$tmp = array();
+			foreach ($res as $r) {
+				if($r['approverUserID'] > 0) {
+					$u = $dms->getUser($r['approverUserID']);
+					$tmp[] =  htmlspecialchars($u->getFullName().' ('.$u->getLogin().')');
+				}
+			}
+			if($tmp) {
+				echo '<div class="mandatories"><span>'.getMLText('mandatory_approvers').':</span> ';
+				echo implode(', ', $tmp);
+				echo "</div>\n";
+			}
+		}
+?>
+  <div class="cbSelectTitle"><?php printMLText("groups")?>:</div>
 
   <div class="cbSelectTitle"><?php printMLText("indivіduals_in_groups")?>:</div>
   <select class="chzn-select span9" name="grpIndApprovers[]" multiple="multiple" data-placeholder="<?php printMLText('select_grp_ind_approvers'); ?>" data-no_results_text="<?php printMLText('unknown_owner'); ?>">
@@ -230,7 +292,7 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			if ($mandatory){
 
 				print "<option type='checkbox' checked='checked' disabled='disabled'>".htmlspecialchars($group->getName())."</option>";
-				print "<input id='appGrp".$group->getID()."' type='hidden' name='grpApprovers[]' value='". $group->getID() ."'>";
+//				print "<input id='appGrp".$group->getID()."' type='hidden' name='grpApprovers[]' value='". $group->getID() ."'>";
 
 			} elseif (isset($approvalIndex["g"][$group->getID()])) {
 
@@ -251,8 +313,24 @@ class SeedDMS_View_SetReviewersApprovers extends SeedDMS_Bootstrap_Style {
 			}
 		}
 ?>
-  </select>
+	</select>
-
+<?php
+		/* List all mandatory groups of approvers */
+		if($res) {
+			$tmp = array();
+			foreach ($res as $r) {
+				if($r['approverGroupID'] > 0) {
+					$u = $dms->getGroup($r['approverGroupID']);
+					$tmp[] =  htmlspecialchars($u->getName());
+				}
+			}
+			if($tmp) {
+				echo '<div class="mandatories"><span>'.getMLText('mandatory_approvergroups').':</span> ';
+				echo implode(', ', $tmp);
+				echo "</div>\n";
+			}
+		}
+?>
 <p>
 <input type='hidden' name='documentid' value='<?php echo $document->getID() ?>'/>
 <input type='hidden' name='version' value='<?php echo $content->getVersion() ?>'/>