gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-06 15:14:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add access control for EditComment and EditAttributes

Browse Source
This commit is contained in:
Uwe Steinmann 2021-06-22 11:33:54 +02:00
parent d1b967e9f3
commit ea5efd75d7
4 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
op/op.EditAttributes.php
View File

@ -34,6 +34,11 @@ if(!checkFormKey('editattributes')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_controller_access('EditAttributes', $_POST)) {
UI::exitError(getMLText("folder_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("access_denied"));
}
if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
}

5
op/op.EditComment.php
View File

@ -34,6 +34,11 @@ if(!checkFormKey('editcomment')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_controller_access('EditComment', $_POST)) {
UI::exitError(getMLText("folder_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("access_denied"));
}
if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
}

3
out/out.EditAttributes.php
View File

@ -34,6 +34,9 @@ require_once("inc/inc.Authentication.php");
$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
$accessop = new SeedDMS_AccessOperation($dms, $user, $settings);
if (!$accessop->check_view_access($view, $_GET)) {
UI::exitError(getMLText("admin_tools"),getMLText("access_denied"), false, $isajax);
}
if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));

14
views/bootstrap/class.ViewDocument.php
View File

@ -656,12 +656,14 @@ $(document).ready( function() {
if($accessobject->check_view_access('AddToTransmittal'))
$items[] = array('link'=>"out.AddToTransmittal.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'list', 'label'=>'add_to_transmittal');
}
if($accessobject->mayEditComment($latestContent->getDocument())) {
$items[] = array('link'=>"out.EditComment.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'comment', 'label'=>'edit_comment');
}
if($accessobject->mayEditAttributes($latestContent->getDocument())) {
$items[] = array('link'=>"out.EditAttributes.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'edit', 'label'=>'edit_attributes');
}
if($accessobject->check_view_access('EditComment'))
if($accessobject->mayEditComment($latestContent->getDocument())) {
$items[] = array('link'=>"out.EditComment.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'comment', 'label'=>'edit_comment');
}
if($accessobject->check_view_access('EditAttributes'))
if($accessobject->mayEditAttributes($latestContent->getDocument())) {
$items[] = array('link'=>"out.EditAttributes.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'edit', 'label'=>'edit_attributes');
}
if(!$islatest)
$items[] = array('link'=>"out.DocumentVersionDetail.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'info', 'label'=>'details');