diff --git a/op/op.ReviewDocument.php b/op/op.ReviewDocument.php index 644aacfb3..e04ebdb7b 100644 --- a/op/op.ReviewDocument.php +++ b/op/op.ReviewDocument.php @@ -26,6 +26,7 @@ include("../inc/inc.Init.php"); include("../inc/inc.Extension.php"); include("../inc/inc.ClassEmail.php"); include("../inc/inc.DBInit.php"); +include("../inc/inc.ClassAccessOperation.php"); include("../inc/inc.Authentication.php"); include("../inc/inc.ClassUI.php"); @@ -66,8 +67,11 @@ if ($latestContent->getVersion()!=$version) { UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("invalid_version")); } -// verify if document has expired -if ($document->hasExpired()){ +/* Create object for checking access to certain operations */ +$accessop = new SeedDMS_AccessOperation($document, $user, $settings); + +// verify if document may be reviewed +if ($accessop->mayReview()){ UI::exitError(getMLText("document_title", array("documentname" => $document->getName())),getMLText("access_denied")); } diff --git a/out/out.ReviewDocument.php b/out/out.ReviewDocument.php index 7580f2ac3..298b89a79 100644 --- a/out/out.ReviewDocument.php +++ b/out/out.ReviewDocument.php @@ -58,8 +58,12 @@ $latestContent = $document->getLatestContent(); if ($latestContent->getVersion()!=$version) { UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("invalid_version")); } -// verify if document has expired -if ($document->hasExpired()){ + +/* Create object for checking access to certain operations */ +$accessop = new SeedDMS_AccessOperation($document, $user, $settings); + +// verify if document may be reviewed +if ($accessop->mayReview()){ UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("access_denied")); } @@ -68,9 +72,6 @@ if(!$reviews) { UI::exitError(getMLText("document_title", array("documentname" => htmlspecialchars($document->getName()))),getMLText("no_action")); } -/* Create object for checking access to certain operations */ -$accessop = new SeedDMS_AccessOperation($document, $user, $settings); - $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME'])); $view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user, 'folder'=>$folder, 'document'=>$document, 'version'=>$content)); if($view) {