admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Task #0001519: Assouplissement de la sécurité : Administrateur accès à tout, ajout d'utilisateur par défaut securité désactivée

Browse source
This commit is contained in:
Dany De Bontridder 2018-01-10 16:22:02 +01:00
parent c1ad9f84f9
commit cbcb09cb79
4 changed files with 48 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

7
include/ajax/ajax_admin.php
View file

@ -47,6 +47,13 @@ if ($op=='folder_add') // operation
$dossier_id=$http->get("p_dossier", "number"); // get variable
$user=new User($cn, $user_id);
$user->set_folder_access($dossier_id, true);
$dossiercn=new Database($dossier_id);
// By default new user has the profile 1 (admin) and ledger's security
// + action's security are disabled
$user=new User($dossiercn,$user_id);
$user->set_status_security_action(0);
$user->set_status_security_ledger(0);
$user->save_profile(1);
$dossier=new Dossier($dossier_id);
$dossier->load();
$content="<td>".h($dossier->dos_name)."</td><td>".h($dossier->dos_description)."</td>".

4
include/ajax/ajax_user_security.php
View file

@ -237,7 +237,7 @@ if ($op=="user_sec_ledger")
$sec_ledger->add_json_param("gDossier", $n_dossier_id);
$sec_ledger->add_json_param("user_id", $user_id);
$sec_ledger->add_json_param("op", "user_sec_ledger");
if ($sec_user->get_status_security_ledger()==1)
if ($sec_user->get_status_security_ledger()==1||$sec_user->Admin()==1)
{
$sec_user->set_status_security_ledger(0);
echo $sec_ledger->get_iconoff();
@ -261,7 +261,7 @@ if ($op=="user_sec_action")
$sec_action->add_json_param("gDossier", $n_dossier_id);
$sec_action->add_json_param("user_id", $user_id);
$sec_action->add_json_param("op", "user_sec_action");
if ($sec_user->get_status_security_action()==1)
if ($sec_user->get_status_security_action()==1||$sec_user->Admin()==1)
{
$sec_user->set_status_security_action(0);
echo $sec_action->get_iconoff();

6
include/class/user.class.php
View file

@ -124,7 +124,7 @@ class User
$this->last_name = $row['use_name'];
$this->name = $row['use_name'];
$this->active = $row['use_active'];
$this->login = $row['use_login'];
$this->login =strtolower($row['use_login']);
$this->admin = $row['use_admin'];
$this->password = $row['use_pass'];
$this->email=$row['use_email'];
@ -1359,7 +1359,7 @@ class User
[$this->login]);
$flag=($p_value==1)?"Y":"N";
if ( $exist == 0) {
$this->db->exec_sql("insert into user_active_security (us_login,us_ledger,us_action) values ($1,$2,$3",[$this->login,$flag,'Y']);
$this->db->exec_sql("insert into user_active_security (us_login,us_ledger,us_action) values ($1,$2,$3)",[$this->login,$flag,'Y']);
} else {
$this->db->exec_sql("update user_active_security set us_ledger=$1 where us_login = $2",[$flag,$this->login]);
}
@ -1388,7 +1388,7 @@ class User
[$this->login]);
$flag=($p_value==1)?"Y":"N";
if ( $exist == 0) {
$this->db->exec_sql("insert into user_active_security (us_login,us_action,us_ledger) values ($1,$2,$3",[$this->login,$flag,'Y']);
$this->db->exec_sql("insert into user_active_security (us_login,us_action,us_ledger) values ($1,$2,$3)",[$this->login,$flag,'Y']);
} else {
$this->db->exec_sql("update user_active_security set us_action=$1 where us_login = $2",[$flag,$this->login]);
}

52
include/param_sec.inc.php
View file

@ -207,7 +207,7 @@ if ( $action == "view" )
$i_profile->id=uniqid("profile");
$i_profile->value=$cn->make_array("select p_id,p_name from profile
order by p_name");
$i_profile->selected=$sec_User->get_profile();
$ie_profile=new Inplace_Edit($i_profile);
@ -230,13 +230,22 @@ if ( $action == "view" )
echo "<p>";
echo _("Sécurité sur les journaux")." ";
$status_sec_ledger=$sec_User->get_status_security_ledger();
$sec_ledger=new Inplace_Switch("sec_ledger", $status_sec_ledger);
$sec_ledger->set_callback("ajax_misc.php");
$sec_ledger->add_json_param("gDossier", $n_dossier_id);
$sec_ledger->add_json_param("user_id", $user_id);
$sec_ledger->add_json_param("op", "user_sec_ledger");
$sec_ledger->set_jscript(" if ( $('security_ledger_tbl').visible() ) { $('security_ledger_tbl').hide();} else { $('security_ledger_tbl').show();}");
echo $sec_ledger->input();
//--
// Administrator can always access all the ledgers
if ( $sec_User->admin==1) {
echo '<p>';
echo _("Les administrateurs NOALYSS ont toujours accès à tout");
$status_sec_ledger=0;
$sec_User->set_status_security_ledger(0);
} else {
$sec_ledger=new Inplace_Switch("sec_ledger", $status_sec_ledger);
$sec_ledger->set_callback("ajax_misc.php");
$sec_ledger->add_json_param("gDossier", $n_dossier_id);
$sec_ledger->add_json_param("user_id", $user_id);
$sec_ledger->add_json_param("op", "user_sec_ledger");
$sec_ledger->set_jscript(" if ( $('security_ledger_tbl').visible() || {$sec_User->Admin()}==1) { $('security_ledger_tbl').hide();} else { $('security_ledger_tbl').show();}");
echo $sec_ledger->input();
}
echo "</p>";
//------------------------------------------------------------------------
// Access by ledgers, needed if the security on ledger is enable
@ -287,15 +296,26 @@ if ( $action == "view" )
//-------------------------------------------------------------------------
echo "<p>";
echo _("Sécurité sur les actions")." ";
$status_sec_action=$sec_User->get_status_security_action();
$sec_action=new Inplace_Switch("sec_action", $status_sec_action);
$sec_action->set_callback("ajax_misc.php");
$sec_action->add_json_param("gDossier", $n_dossier_id);
$sec_action->add_json_param("user_id", $user_id);
$sec_action->add_json_param("op", "user_sec_action");
$sec_action->set_jscript(" if ( $('security_action_tbl').visible() ) { $('security_action_tbl').hide();} else { $('security_action_tbl').show();}");
echo $sec_action->input();
// Administrator always have all action
if ( $sec_User->admin==1) {
echo '<p>';
echo _("Les administrateurs NOALYSS ont toujours accès à tout");
$status_sec_action=0;
$sec_User->set_status_security_action(0);
} else {
$status_sec_action=$sec_User->get_status_security_action();
$sec_action=new Inplace_Switch("sec_action", $status_sec_action);
$sec_action->set_callback("ajax_misc.php");
$sec_action->add_json_param("gDossier", $n_dossier_id);
$sec_action->add_json_param("user_id", $user_id);
$sec_action->add_json_param("op", "user_sec_action");
$sec_action->set_jscript(" if ( $('security_action_tbl').visible() ) { $('security_action_tbl').hide();} else { $('security_action_tbl').show();}");
echo $sec_action->input();
}
echo "</p>";
include(NOALYSS_TEMPLATE.'/security_list_action.php');
echo '</fieldset>';
echo HtmlInput::button('Imprime',_('imprime'),"onclick=\"window.open('export.php?".$sHref."');\"");