From 4b00276e82db554c627a87eb91d2943ad846db8f Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Fri, 6 Nov 2015 18:44:29 +0100
Subject: [PATCH] =?UTF-8?q?Task=20#1215=20-=20Administrateur=20globaux=20p?=
 =?UTF-8?q?hpcompta=20n'a=20pas=20acc=C3=A8s=20=C3=A0=20tous=20les=20profi?=
 =?UTF-8?q?les=20#1215=20:=20security=20,=20filter=20the=20profiles=20,?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 include/class/class_follow_up.php         |  7 +++--
 include/class/class_user.php              | 38 +++++++++++++++++++++++
 include/template/action_display_short.php |  4 +--
 3 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/include/class/class_follow_up.php b/include/class/class_follow_up.php
index 92b9c488b..68f8c76ac 100644
--- a/include/class/class_follow_up.php
+++ b/include/class/class_follow_up.php
@@ -290,7 +290,7 @@ class Follow_Up
         // select profile
         $aAg_dest=$this->db->make_array("select  p_id as value, ".
                 "p_name as label ".
-                " from profile  where p_id in (select p_granted from user_sec_action_profile where ua_right='W' and p_id=".$g_user->get_profile().") order by 2");
+                " from profile  where p_id in ".$g_user->get_writable_profile()."order by 2");
 
         $ag_dest->value=$aAg_dest;
         $ag_dest->selected=$this->ag_dest;
@@ -1172,6 +1172,7 @@ class Follow_Up
      */
     static function display_search($cn, $inner=false)
     {
+        global $g_user;
         $a=(isset($_GET['action_query']))?$_GET['action_query']:"";
         $qcode=(isset($_GET['qcode']))?$_GET['qcode']:"";
 
@@ -1246,7 +1247,9 @@ class Follow_Up
         // select profile
         $aAg_dest=$cn->make_array("select  p_id as value, ".
                 "p_name as label ".
-                " from profile order by 2");
+                " from profile where p_id in ".
+                $g_user->get_readable_profile().
+                "order by 2");
         $aAg_dest[]=array('value'=>'-2', 'label'=>_('Tous les profiles'));
         $ag_dest=new ISelect();
         $ag_dest->name="ag_dest_query";
diff --git a/include/class/class_user.php b/include/class/class_user.php
index aaf412d45..124628d42 100644
--- a/include/class/class_user.php
+++ b/include/class/class_user.php
@@ -1102,6 +1102,44 @@ class User
 				lower(user_name)=lower($1)", array($this->login));
 		return $profile;
 	}
+        /**
+        * Compute the SQL string for the writable profile, 
+         * the subselect for p_id , example
+        * p_id in $g_user->get_writable_profile.
+        * The administrator can access all the profiles
+        * @return SQL string with the subselect for p_id 
+        */
+       function get_writable_profile() 
+       {
+           if ( $this->admin != 1)
+           {
+               $sql = " (select p_granted "
+                   . "     from user_sec_action_profile "
+                   . "     where ua_right='W' and p_id=".$this->get_profile().") ";
+           } else {
+               $sql = "(select p_id from profile)";
+           }
+           return $sql;
+       }
+        /**
+        * Compute the SQL string for the readable profile, 
+         * the subselect for p_id , example
+        * p_id in $g_user->get_readable_profile.
+        * The administrator can read all the profiles
+        * @return SQL string with the subselect for p_id 
+        */
+       function get_readable_profile() 
+       {
+           if ( $this->admin != 1)
+           {
+               $sql = " (select p_granted "
+                   . "     from user_sec_action_profile "
+                   . "     where ua_right in ('W','R') and p_id=".$this->get_profile().") ";
+           } else {
+               $sql = "(select p_id from profile)";
+           }
+           return $sql;
+       }
         /**
          * Check if the current user can add an action in the profile given
          * in parameter
diff --git a/include/template/action_display_short.php b/include/template/action_display_short.php
index 080f8f75e..f9dc76bc0 100644
--- a/include/template/action_display_short.php
+++ b/include/template/action_display_short.php
@@ -48,9 +48,7 @@ $profile->value=$cn->make_array("select  p_id as value, ".
                 " from profile  "
         . "where "
         . "p_id in "
-        . " (select p_granted "
-        . "     from user_sec_action_profile "
-        . "     where ua_right='W' and p_id=".$g_user->get_profile().") "
+        . $g_user->get_writable_profile()
         . "order by 2");
 
 // priority