From cbcb09cb79ab1a09e373bf9f292189bc14cbeade Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Wed, 10 Jan 2018 16:22:02 +0100 Subject: [PATCH] =?UTF-8?q?Task=20#0001519:=20Assouplissement=20de=20la=20?= =?UTF-8?q?s=C3=A9curit=C3=A9=20:=20Administrateur=20acc=C3=A8s=20=C3=A0?= =?UTF-8?q?=20tout,=20ajout=20d'utilisateur=20par=20d=C3=A9faut=20securit?= =?UTF-8?q?=C3=A9=20d=C3=A9sactiv=C3=A9e?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- include/ajax/ajax_admin.php | 7 ++++ include/ajax/ajax_user_security.php | 4 +-- include/class/user.class.php | 6 ++-- include/param_sec.inc.php | 52 ++++++++++++++++++++--------- 4 files changed, 48 insertions(+), 21 deletions(-) diff --git a/include/ajax/ajax_admin.php b/include/ajax/ajax_admin.php index c9e488f06..47ffdc01d 100644 --- a/include/ajax/ajax_admin.php +++ b/include/ajax/ajax_admin.php @@ -47,6 +47,13 @@ if ($op=='folder_add') // operation $dossier_id=$http->get("p_dossier", "number"); // get variable $user=new User($cn, $user_id); $user->set_folder_access($dossier_id, true); + $dossiercn=new Database($dossier_id); + // By default new user has the profile 1 (admin) and ledger's security + // + action's security are disabled + $user=new User($dossiercn,$user_id); + $user->set_status_security_action(0); + $user->set_status_security_ledger(0); + $user->save_profile(1); $dossier=new Dossier($dossier_id); $dossier->load(); $content="".h($dossier->dos_name)."".h($dossier->dos_description)."". diff --git a/include/ajax/ajax_user_security.php b/include/ajax/ajax_user_security.php index d1517c831..6deddf0b9 100644 --- a/include/ajax/ajax_user_security.php +++ b/include/ajax/ajax_user_security.php @@ -237,7 +237,7 @@ if ($op=="user_sec_ledger") $sec_ledger->add_json_param("gDossier", $n_dossier_id); $sec_ledger->add_json_param("user_id", $user_id); $sec_ledger->add_json_param("op", "user_sec_ledger"); - if ($sec_user->get_status_security_ledger()==1) + if ($sec_user->get_status_security_ledger()==1||$sec_user->Admin()==1) { $sec_user->set_status_security_ledger(0); echo $sec_ledger->get_iconoff(); @@ -261,7 +261,7 @@ if ($op=="user_sec_action") $sec_action->add_json_param("gDossier", $n_dossier_id); $sec_action->add_json_param("user_id", $user_id); $sec_action->add_json_param("op", "user_sec_action"); - if ($sec_user->get_status_security_action()==1) + if ($sec_user->get_status_security_action()==1||$sec_user->Admin()==1) { $sec_user->set_status_security_action(0); echo $sec_action->get_iconoff(); diff --git a/include/class/user.class.php b/include/class/user.class.php index 79329e34d..3d5e43b9d 100644 --- a/include/class/user.class.php +++ b/include/class/user.class.php @@ -124,7 +124,7 @@ class User $this->last_name = $row['use_name']; $this->name = $row['use_name']; $this->active = $row['use_active']; - $this->login = $row['use_login']; + $this->login =strtolower($row['use_login']); $this->admin = $row['use_admin']; $this->password = $row['use_pass']; $this->email=$row['use_email']; @@ -1359,7 +1359,7 @@ class User [$this->login]); $flag=($p_value==1)?"Y":"N"; if ( $exist == 0) { - $this->db->exec_sql("insert into user_active_security (us_login,us_ledger,us_action) values ($1,$2,$3",[$this->login,$flag,'Y']); + $this->db->exec_sql("insert into user_active_security (us_login,us_ledger,us_action) values ($1,$2,$3)",[$this->login,$flag,'Y']); } else { $this->db->exec_sql("update user_active_security set us_ledger=$1 where us_login = $2",[$flag,$this->login]); } @@ -1388,7 +1388,7 @@ class User [$this->login]); $flag=($p_value==1)?"Y":"N"; if ( $exist == 0) { - $this->db->exec_sql("insert into user_active_security (us_login,us_action,us_ledger) values ($1,$2,$3",[$this->login,$flag,'Y']); + $this->db->exec_sql("insert into user_active_security (us_login,us_action,us_ledger) values ($1,$2,$3)",[$this->login,$flag,'Y']); } else { $this->db->exec_sql("update user_active_security set us_action=$1 where us_login = $2",[$flag,$this->login]); } diff --git a/include/param_sec.inc.php b/include/param_sec.inc.php index b41b73c4d..96264c297 100644 --- a/include/param_sec.inc.php +++ b/include/param_sec.inc.php @@ -207,7 +207,7 @@ if ( $action == "view" ) $i_profile->id=uniqid("profile"); $i_profile->value=$cn->make_array("select p_id,p_name from profile order by p_name"); - + $i_profile->selected=$sec_User->get_profile(); $ie_profile=new Inplace_Edit($i_profile); @@ -230,13 +230,22 @@ if ( $action == "view" ) echo "

"; echo _("Sécurité sur les journaux")." "; $status_sec_ledger=$sec_User->get_status_security_ledger(); - $sec_ledger=new Inplace_Switch("sec_ledger", $status_sec_ledger); - $sec_ledger->set_callback("ajax_misc.php"); - $sec_ledger->add_json_param("gDossier", $n_dossier_id); - $sec_ledger->add_json_param("user_id", $user_id); - $sec_ledger->add_json_param("op", "user_sec_ledger"); - $sec_ledger->set_jscript(" if ( $('security_ledger_tbl').visible() ) { $('security_ledger_tbl').hide();} else { $('security_ledger_tbl').show();}"); - echo $sec_ledger->input(); + //-- + // Administrator can always access all the ledgers + if ( $sec_User->admin==1) { + echo '

'; + echo _("Les administrateurs NOALYSS ont toujours accès à tout"); + $status_sec_ledger=0; + $sec_User->set_status_security_ledger(0); + } else { + $sec_ledger=new Inplace_Switch("sec_ledger", $status_sec_ledger); + $sec_ledger->set_callback("ajax_misc.php"); + $sec_ledger->add_json_param("gDossier", $n_dossier_id); + $sec_ledger->add_json_param("user_id", $user_id); + $sec_ledger->add_json_param("op", "user_sec_ledger"); + $sec_ledger->set_jscript(" if ( $('security_ledger_tbl').visible() || {$sec_User->Admin()}==1) { $('security_ledger_tbl').hide();} else { $('security_ledger_tbl').show();}"); + echo $sec_ledger->input(); + } echo "

"; //------------------------------------------------------------------------ // Access by ledgers, needed if the security on ledger is enable @@ -287,15 +296,26 @@ if ( $action == "view" ) //------------------------------------------------------------------------- echo "

"; echo _("Sécurité sur les actions")." "; - $status_sec_action=$sec_User->get_status_security_action(); - $sec_action=new Inplace_Switch("sec_action", $status_sec_action); - $sec_action->set_callback("ajax_misc.php"); - $sec_action->add_json_param("gDossier", $n_dossier_id); - $sec_action->add_json_param("user_id", $user_id); - $sec_action->add_json_param("op", "user_sec_action"); - $sec_action->set_jscript(" if ( $('security_action_tbl').visible() ) { $('security_action_tbl').hide();} else { $('security_action_tbl').show();}"); - echo $sec_action->input(); + // Administrator always have all action + if ( $sec_User->admin==1) { + echo '

'; + echo _("Les administrateurs NOALYSS ont toujours accès à tout"); + $status_sec_action=0; + $sec_User->set_status_security_action(0); + } else { + + $status_sec_action=$sec_User->get_status_security_action(); + $sec_action=new Inplace_Switch("sec_action", $status_sec_action); + $sec_action->set_callback("ajax_misc.php"); + $sec_action->add_json_param("gDossier", $n_dossier_id); + $sec_action->add_json_param("user_id", $user_id); + $sec_action->add_json_param("op", "user_sec_action"); + $sec_action->set_jscript(" if ( $('security_action_tbl').visible() ) { $('security_action_tbl').hide();} else { $('security_action_tbl').show();}"); + echo $sec_action->input(); + } echo "

"; + + include(NOALYSS_TEMPLATE.'/security_list_action.php'); echo ''; echo HtmlInput::button('Imprime',_('imprime'),"onclick=\"window.open('export.php?".$sHref."');\"");