diff --git a/html/admin_repo.php b/html/admin_repo.php
index 2141a5ecf..e2fa57718 100644
--- a/html/admin_repo.php
+++ b/html/admin_repo.php
@@ -52,6 +52,7 @@ define('ALLOWED',true);
check(true);
-$g_user->check_dossier($gDossier, true);
+//
+// If database id == 0 then we are not connected to a folder
+// but to the administration
+//
if ($gDossier<>0) {
+ $cn = new Database($gDossier);
$g_parameter=new Own($cn);
+ $g_user = new User($cn);
+ $g_user->check(true);
+ $g_user->check_dossier($gDossier, true);
+}
+else
+{
+ // connect to repository
+ $cn=new Database();
+ $g_user = new User($cn);
+ $g_user->check(true);
}
$html = var_export($_REQUEST, true);
@@ -673,6 +684,22 @@ EOF;
*/
require_once 'ajax_account_update.php';
break;
+ // From admin, revoke the access to a folder from an
+ // user
+ case 'folder_remove':
+ require_once 'ajax_admin.php';
+ break;
+ // From admin, display a list of folder to which the user has
+ // no access
+ case 'folder_display':
+ require_once 'ajax_admin.php';
+ break;
+ // From admin, grant the access to a folder to an
+ // user
+ case 'folder_add':
+ require_once 'ajax_admin.php';
+ break;
+
default:
var_dump($_GET);
}
diff --git a/html/js/admin.js b/html/js/admin.js
new file mode 100644
index 000000000..80b01e5c6
--- /dev/null
+++ b/html/js/admin.js
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2015 Dany De Bontridder
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/**
+ * Display the forbidden folders if the request comes from a form
+ * with an input text (id:database_filter_input) then this text is
+ * used as a filter
+ * @param {type} p_user : the user id
+ * @returns nothing
+ */
+function folder_display(p_user)
+{
+ /**
+ * If form exist and there is something
+ *
+ */
+ var p_filter = "";
+ if ($('database_filter_input')) {
+ console.log($('database_filter_input').value);
+ p_filter = $('database_filter_input').value;
+ }
+ /*
+ * Ajax request to display the folder
+ */
+ new Ajax.Request('ajax_misc.php', {
+ method: "get",
+ parameters: {"p_user": p_user, "op": "folder_display", "p_filter": p_filter, 'gDossier': 0},
+ onSuccess: function (p_xml) {
+ // table id = database_list
+ var folder = {};
+ var create = false;
+ if (!$('folder_list_div')) {
+ folder = create_div({'id': 'folder_list_div', 'cssclass': "inner_box", 'style': 'width:90%,right:5%;top:100px;display:block'});
+ create = true;
+ }
+ folder = $('folder_list_div');
+ // Analyze XML answer
+ var answer = p_xml.responseXML;
+ var a = answer.getElementsByTagName('status');
+ var html = answer.getElementsByTagName('content');
+ if (a.length == 0) {
+ var rec = req.responseText;
+ alert('erreur :' + rec);
+ }
+
+ var content = getNodeText(html[0]);
+ // fill up the div
+ folder.innerHTML = unescape_xml(content);
+
+ // show it
+ folder.show();
+ $('database_filter_input').focus();
+ }
+ });
+}
+/**
+ * Remove the grant for an user to the given database id
+ * @param {integer} p_user use_id id of the user
+ * @param {integer} p_dossier id of the database
+ * @returns nothing
+ */
+function folder_remove(p_user,p_dossier )
+{
+ if ( ! confirm('Confirmer')) return;
+ waiting_box();
+ new Ajax.Request('ajax_misc.php', {
+ method: "get",
+ parameters: {"p_user": p_user, 'p_dossier': p_dossier, "op": "folder_remove", 'gDossier': 0},
+ onSuccess: function (p_xml) {
+ // table id = database_list
+ $('row'+p_dossier).hide();
+ remove_waiting_box();
+ }
+ });
+}
+
+/**
+ * Grant the access to a folder for a given user and add a row in the table
+ * (id : database_list)
+ * @param {integer} p_user use_id id of the user
+ * @param {integer} p_dossier id of the database
+ * @returns {undefined}
+ */
+function folder_add(p_user, p_dossier)
+{
+ waiting_box();
+ new Ajax.Request('ajax_misc.php', {
+ method: "get",
+ parameters: {"p_user": p_user, 'p_dossier': p_dossier, "op": "folder_add", 'gDossier': 0},
+ onSuccess: function (p_xml) {
+ // table id = database_list
+ // Analyze XML answer
+ var answer = p_xml.responseXML;
+ var a = answer.getElementsByTagName('status');
+ var html = answer.getElementsByTagName('content');
+ if (a.length == 0) {
+ var rec = req.responseText;
+ alert('erreur :' + rec);
+ }
+
+ var content = getNodeText(html[0]);
+ var nb = $('database_list').rows.length + 1;
+ var row = new Element('tr', {'id': 'row' + p_dossier});
+ if (nb % 2 == 0) {
+ row.addClassName('odd');
+ } else {
+ row.addClassName('even');
+ }
+ row.innerHTML = unescape_xml(content);
+ $('database_list').appendChild(row);
+ $('row_db_'+p_dossier).hide();
+ remove_waiting_box();
+ }
+ });
+
+}
\ No newline at end of file
diff --git a/include/class_dossier.php b/include/class_dossier.php
index 7229fcfc8..81559a14d 100644
--- a/include/class_dossier.php
+++ b/include/class_dossier.php
@@ -53,51 +53,60 @@ class Dossier
return $_REQUEST['gDossier'];
}
- /**!
+ /**
* @brief Show the folder where user have access.
- * @param p_type string : all for all dossiers lim for only the
- * dossier where we've got rights
+ * @param p_type string
+ - A for all dossiers
+ - R for accessible folders
+ - X forbidden folders
+ * @param p_login is the user name
+ * @param p_text is a part of the name where are looking for
* @return nothing
*
*/
- function show_dossier($p_type,$p_first=0,$p_max=0,$p_Num=0)
+ static function show_dossier($p_type,$p_login="",$p_text="",$limit=0)
{
- $l_user=$_SESSION['g_user'];
- if ( $p_max == 0 )
+ $cn=new Database();
+ $str_limit=($limit==0)?'':' limit '.$limit;
+ if ( $p_type == "A")
{
- $l_step="";
+ $l_sql="select *, 'W' as priv_priv from ac_dossier where dos_name ~* $2 or dos_description ~* $2 ORDER BY dos_name $str_limit ";
+ $a_row=$cn->get_array($l_sql,$p_text);
+ return $a_row;
}
- else
- {
- $l_step="LIMIT $p_max OFFSET $p_first";
- }
-
- if ( $p_type == "all")
- {
- $l_sql="select *, 'W' as priv_priv from ac_dossier ORDER BY dos_name ";
- $p_Num=$this->cn->count_sql($l_sql);
- }
- else
+ else if ($p_type == "R")
{
$l_sql="select * from jnt_use_dos
natural join ac_dossier
natural join ac_users
where
- use_login='".sql_string($l_user)."'
- order by dos_name ";
- $p_Num=$this->cn->count_sql($l_sql);
- }
- $l_sql=$l_sql.$l_step;
- $p_res=$this->cn->exec_sql($l_sql);
+ use_login=$1
+ and ( dos_name ~* $2 or dos_description ~* $2)
+
+ order by dos_name
+ $str_limit
+ ";
+
+ $a_row=$cn->get_array($l_sql,array($p_login,$p_text));
+ return $a_row;
-
- $Max=$this->cn->size();
- if ( $Max == 0 ) return null;
- for ( $i=0;$i<$Max; $i++)
+ }
+ else if ($p_type == 'X')
{
- $row[]=$this->cn->fetch($i);
+ $l_sql=' select * from ac_dossier where dos_id not in
+ (select dos_id from jnt_use_dos where use_id=$1)
+ and ( dos_name ~* $2 or dos_description ~* $2)
+ order by dos_name '.$str_limit;
+ $a_row=$cn->get_array($l_sql,array($p_login,$p_text));
+ return $a_row;
+
}
- return $row;
+ else
+ {
+ throw new Exception (_("Erreur paramètre"));
+ }
+
+
}
/*!
diff --git a/include/class_user.php b/include/class_user.php
index 87343b776..2e9f4088f 100644
--- a/include/class_user.php
+++ b/include/class_user.php
@@ -195,7 +195,7 @@ class User
* \return the priv_priv
* - X no access
* - R has access (normal user)
- * - L Local Admin
+
*
*/
@@ -204,11 +204,10 @@ class User
if ($p_dossier == 0)
$p_dossier = dossier::id();
- if ($this->is_local_admin($p_dossier) == 1 || $this->admin == 1)
- return 'L';
+ if ($this->admin == 1) return 'R';
$cn = new Database();
- $sql = "select 1 from jnt_use_dos where use_id=$1 and dos_id=$2";
+ $sql = "select 'R' from jnt_use_dos where use_id=$1 and dos_id=$2";
$res = $cn->get_value($sql, array($this->id, $p_dossier));
@@ -219,23 +218,32 @@ class User
/**
* \brief save the access of a folder
* \param $db_id the dossier id
- * \param $priv the priv. to set
+ * \param $priv boolean, true then it is granted, false it is removed
*/
function set_folder_access($db_id, $priv)
- {
+ {
- $cn = new Database();
- $jnt = $cn->get_value("select jnt_id from jnt_use_dos where dos_id=$1 and use_id=$2", array($db_id, $this->id));
+ $cn=new Database();
+ if ($priv)
+ {
+ // the access is granted
+ $jnt=$cn->get_value("select jnt_id from jnt_use_dos where dos_id=$1 and use_id=$2", array($db_id, $this->id));
- if ($cn->size() == 0)
- {
+ if ($cn->size()==0)
+ {
- $Res = $cn->exec_sql("insert into jnt_use_dos(dos_id,use_id) values($1,$2)", array($db_id, $this->id));
- $jnt = $cn->get_value("select jnt_id from jnt_use_dos where dos_id=$1 and use_id=$2", array($db_id, $this->id));
- }
+ $Res=$cn->exec_sql("insert into jnt_use_dos(dos_id,use_id) values($1,$2)", array($db_id, $this->id));
+ }
+ }
+ else
+ {
+ // Access is revoked
+ $cn->exec_sql('delete from jnt_use_dos where use_id = $1 and dos_id = $2 ', array($this->id, $db_id));
+ }
}
- /**
+
+ /**
* \brief check that a user is valid and the access to the folder
* \param $p_ledger the ledger to check
* \return the priv_priv
@@ -711,10 +719,10 @@ class User
}
/**
- * !\brief Check if the user can print (in menu_ref p_type_display=p)
+ *@brief Check if the user can print (in menu_ref p_type_display=p)
* otherwise warn and exit
- * \param $p_action requested action
- * \return nothing the program exits automatically
+ * @param $p_action requested action
+ * @return nothing the program exits automatically
*/
function check_print($p_action)
{
@@ -722,8 +730,7 @@ class User
$this->audit('AUDIT', $p_action);
if ($this->Admin() == 1)
return 1;
- if ($this->is_local_admin(dossier::id()) == 1)
- return 1;
+
$res = $cn->get_value("select count(*) from profile_menu
join profile_user using (p_id)
where user_name=$1 and me_code=$2 ", array($this->login, $p_action));
diff --git a/include/template/folder_display.php b/include/template/folder_display.php
new file mode 100644
index 000000000..fa52a85a0
--- /dev/null
+++ b/include/template/folder_display.php
@@ -0,0 +1,67 @@
+
+*
+* This program is free software; you can redistribute it and/or
+* modify it under the terms of the GNU General Public License
+* as published by the Free Software Foundation; either version 2
+* of the License, or (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program; if not, write to the Free Software
+* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+ *
+ */
+
+
+/**
+ * @file
+ * @brief display the folders the user has no access and permit to add them
+ * thanks ajax call.
+ *
+ * The received parameter are
+ * - $a_dossier, the result of Dossier::show_dossier
+ * - $user_id id of the user
+ *
+ */
+echo js_include('admin.js');
+if ( count($a_dossier) == 0 )
+{
+ echo '
'._('Aucun dossier à afficher').'
';
+ return;
+}
+?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/include/user_detail.inc.php b/include/user_detail.inc.php
index 93a29b85a..b3f3b5644 100644
--- a/include/user_detail.inc.php
+++ b/include/user_detail.inc.php
@@ -69,8 +69,11 @@ if (isset($_POST['SAVE']))
}
$UserChange->save();
+ /**
+ * replace by ajax see ajax_admin.php
+ * foreach ($_POST as $name => $elem)
// Update Priv on Folder
- foreach ($_POST as $name => $elem)
+
{
if (substr_count($name, 'PRIV') != 0)
{
@@ -93,6 +96,8 @@ if (isset($_POST['SAVE']))
}
}
}
+ *
+ */
}
}
else
@@ -103,7 +108,7 @@ else
$Res = $cn->exec_sql("delete from jnt_use_dos where use_id=$1", array($uid));
$Res = $cn->exec_sql("delete from ac_users where use_id=$1", array($uid));
- echo "
User " . h($_POST['fname']) . " " . h($_POST['lname']) . " est effacé