';
+ echo '
';
- // Add hidden tag
- echo '';
- echo '
';
-
- }
-
-
- }
+ echo '
';
+ echo '
';
+ echo '
';
+ echo '
';
+ echo $supl_hidden;
+ echo '';
+ echo '
';
- $act=new Follow_Up($cn);
- $act->ag_id=$ag_id;
- $act->suppress=1;
- echo $act->get();
-// $act->ag_comment=Decode($act->ag_comment);
- echo '';
- echo '
';
+if ($sub_action == 'detail')
+{
+ echo '';
+ $act = new Follow_Up($cn);
+ $act->ag_id = $ag_id;
- }
+ echo $act->get();
+ if ($g_user->can_write_action($ag_id) == true)
+ {
+ echo '';
+ }
+ else if ($g_user->can_read_action($ag_id) == true)
+ {
+ echo $act->Display('READ', false, $base, $retour);
+ }
+ else
+ {
+ echo h2info(_("Ce document n'est pas accessible"));
+ exit();
+ }
+
+
+ echo '
';
+}
//-------------------------------------------------------------------------------
// Delete an action
-if ( $sub_action == 'delete' )
- {
- // confirmed
- $cn->start();
- $act=new Follow_Up($cn);
- $act->ag_id=$_REQUEST['ag_id'];
- $act->get();
- $act->remove();
- $sub_action="list";
- $cn->commit();
- Follow_Up::ShowActionList($cn,$base);
- if ( isset( $act->ag_ref) )
- echo hb(_('Action ').$act->ag_ref._(' effacée'));
- exit();
- }
+if ($sub_action == 'delete')
+{
+ // confirmed
+ $cn->start();
+ $act = new Follow_Up($cn);
+ $act->ag_id = $_REQUEST['ag_id'];
+ $act->get();
+ if ($g_user->can_write_action($_REQUEST['ag_id'])==true) $act->remove();
+ $sub_action = "list";
+ $cn->commit();
+ Follow_Up::ShowActionList($cn, $base);
+ if (isset($act->ag_ref))
+ echo hb(_('Action ') . $act->ag_ref . _(' effacée'));
+ exit();
+}
//--------------------------------------------------------------------------------
// Show a list of the action
-if ( $sub_action == "list" )
- {
- Follow_Up::ShowActionList($cn,$base);
+if ($sub_action == "list")
+{
+ Follow_Up::ShowActionList($cn, $base);
// Add a button to export to Csv
echo '';
- // Add hidden tag
- echo '
';
$i++;
$tr = ($i % 2 == 0) ? 'even' : 'odd';
if ($row['ag_priority'] < 2)
@@ -1143,7 +1166,6 @@ class Follow_Up
" from profile order by 2");
$ag_dest = new ISelect();
$ag_dest->name = "ag_dest_query";
- $aAg_dest[] = array('value' => 0, 'label' => 'Public');
$ag_dest->value = $aAg_dest;
$ag_dest->selected = (isset($_GET["ag_dest_query"])) ? $_GET["ag_dest_query"] : 0;
$str_ag_dest = $ag_dest->input();
@@ -1230,7 +1252,9 @@ class Follow_Up
$query .= ' and f_id_dest=0 ';
if (!isset($all_action))
{
- $query .=" and (ag_owner='" . $_SESSION['g_user'] . "' or ag_dest in (select p_id from profile_user where user_name='" . $_SESSION['g_user'] . "') or ag_dest is null )";
+ $query .=" and (ag_owner='" . $_SESSION['g_user'] . "' or ".self::sql_security_filter($cn, "R")." )";
+ } else {
+ $query .= "and ".self::sql_security_filter($cn,'R');
}
if (isset($date_start) && isDate($date_start) != null)
{
diff --git a/include/class_html_input.php b/include/class_html_input.php
index bba6a2d53..99f0b15fe 100755
--- a/include/class_html_input.php
+++ b/include/class_html_input.php
@@ -533,9 +533,9 @@ class HtmlInput
*@see HtmlInput::request_to_string
*@return html string with the string data
*/
- static function get_to_string($array)
+ static function get_to_string($array,$start="?")
{
- $r=self::array_to_string($array,$_GET );
+ $r=self::array_to_string($array,$_GET ,$start);
return $r;
}
diff --git a/include/class_profile_menu.php b/include/class_profile_menu.php
index 5866eb1f2..06463e387 100644
--- a/include/class_profile_menu.php
+++ b/include/class_profile_menu.php
@@ -208,7 +208,26 @@ class Profile_Menu
$gDossier = Dossier::id();
$this->sub_menu($ret, $p_id);
}
-
+ function available_profile($p_id)
+ {
+ $array=$this->cn->get_array("
+ select p.p_id,p.p_name,s.p_granted,s.ua_id,s.ua_right
+ from profile as p
+ join user_sec_action_profile as s on (s.p_granted=p.p_id)
+ where s.p_id=$1
+ union
+ select p2.p_id, p2.p_name,null,null,'X'
+ from profile as p2
+ where
+ p2.p_id not in (select p_granted from user_sec_action_profile where p_id = $1) order by p_name;
+ ",array($p_id));
+ $aright_value=array(
+ array('value'=>'R','label'=>_('Lecture')),
+ array('value'=>'W','label'=>_('Ecriture')),
+ array('value'=>'X','label'=>_('Aucun accès'))
+ );
+ require_once 'template/user_sec_profile.php';
+ }
}
//end class
diff --git a/include/class_user.php b/include/class_user.php
index c82b74aa6..26860dc15 100644
--- a/include/class_user.php
+++ b/include/class_user.php
@@ -32,7 +32,6 @@ require_once("constant.php");
require_once("user_common.php");
require_once('class_dossier.php');
require_once('ac_common.php');
-
class User
{
@@ -964,7 +963,7 @@ class User
natural join ac_dossier
join priv_user on ( priv_jnt=jnt_id)
where use_active=1
- and use_login= $1
+ and use_login= $1
and priv_priv != 'X' and ( dos_name ~* $2 or dos_description ~* $2 )
order by dos_name", array($this->login,$p_filter));
}
@@ -1007,7 +1006,7 @@ class User
$_SERVER['REQUEST_URI'],
$action));
}
- }
+ }
function save_profile($p_id)
{
$count=$this->db->get_value("select count(*) from profile_user where user_name=$1", array($this->login));
@@ -1029,6 +1028,22 @@ class User
user_name=$1",array($this->login));
return $profile;
}
+ function can_write_action( $dtoc)
+ {
+ $profile=$this->get_profile();
+ $r=$this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
+ (select p_granted from user_sec_action_profile where ua_right='W' and p_id=$2) ",array($dtoc,$profile));
+ if ( $r == 0 ) return false;
+ return true;
+ }
+ function can_read_action($dtoc)
+ {
+ $profile=$this->get_profile();
+ $r=$this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and (ag_dest in
+ (select p_granted from user_sec_action_profile where p_id=$2) or ag_owner=$3)",array($dtoc,$profile,$this->login));
+ if ( $r == 0 ) return false;
+ return true;
+ }
}
diff --git a/include/profile.inc.php b/include/profile.inc.php
index 6f849783a..8bca1dafe 100644
--- a/include/profile.inc.php
+++ b/include/profile.inc.php
@@ -22,90 +22,128 @@
require_once 'class_profile_sql.php';
global $cn;
+//**********************************************
+// Save avail. profiles
+//**********************************************
+if (isset($_POST['change_profile']))
+{
+ extract($_POST);
+ try
+ {
+ for ($e = 0; $e < count($right); $e++)
+ {
+ if ($right[$e] == 'X' && $ua_id[$e]=='')
+ continue;
+ if ($right[$e] == 'X' && $ua_id[$e]!='')
+ {
+ $cn->exec_sql("delete from user_sec_action_profile where p_id=$1 and p_granted=$2", array($p_id, $ap_id[$e]));
+ continue;
+ }
+ if ($ua_id[$e] == "")
+ {
+ $cn->exec_sql("insert into user_sec_action_profile (p_id,p_granted,ua_right) values($1,$2,$3)", array($p_id, $ap_id[$e], $right[$e]));
+ continue;
+ }
+ if ($ua_id[$e] != '')
+ {
+ $cn->exec_sql("update user_sec_action_profile set ua_right=$3 where p_id=$1 and p_granted=$2 ", array($p_id, $ap_id[$e], $right[$e]));
+ continue;
+ }
+ }
+ }
+ catch (Exception $exc)
+ {
+ echo $exc->getTraceAsString();
+ throw $exc;
+ }
+}
//**********************************************
// Save_name
// *********************************************
-if ( isset($_POST['save_name']))
+if (isset($_POST['save_name']))
{
- extract ($_POST);
- try{
- if (strlen(trim($p_name))==0) throw new Exception("Nom ne peut être vide");
- if (isNumber($p_id)==0) throw new Exception("profile Invalide");
- $wc=(isset($with_calc))?1:0;
- $wd=(isset($with_direct_form))?1:0;
- $p_desc=(strlen(trim($p_desc))==0)?null:trim($p_desc);
+ extract($_POST);
+ try
+ {
+ if (strlen(trim($p_name)) == 0)
+ throw new Exception("Nom ne peut être vide");
+ if (isNumber($p_id) == 0)
+ throw new Exception("profile Invalide");
+ $wc = (isset($with_calc)) ? 1 : 0;
+ $wd = (isset($with_direct_form)) ? 1 : 0;
+ $p_desc = (strlen(trim($p_desc)) == 0) ? null : trim($p_desc);
if ($p_id != -1)
{
$cn->exec_sql("update profile set p_name=$1,p_desc=$2,
- with_calc=$3, with_direct_form=$4 where p_id=$5",array($p_name,
- $p_desc,$wc,$wd,$p_id));
+ with_calc=$3, with_direct_form=$4 where p_id=$5", array($p_name,
+ $p_desc, $wc, $wd, $p_id));
}
else
{
- $p_id=$cn->get_value ("insert into profile (p_name,
+ $p_id = $cn->get_value("insert into profile (p_name,
p_desc,with_calc,with_direct_form) values
- ($1,$2,$3,$4) returning p_id",array(
- $p_name,$p_desc,$wc,$wd
- ));
+ ($1,$2,$3,$4) returning p_id", array(
+ $p_name, $p_desc, $wc, $wd
+ ));
}
}
catch (Exception $e)
{
alert($e->getMessage());
}
-
}
//************************************
// Clone
//************************************
-if ( isset($_POST['clone']))
+if (isset($_POST['clone']))
{
- extract ($_POST);
+ extract($_POST);
try
{
$cn->start();
- $new_id=$cn->get_value("insert into profile(p_name,p_desc,with_calc,
+ $new_id = $cn->get_value("insert into profile(p_name,p_desc,with_calc,
with_direct_form)
select 'copie de '||p_name,p_desc,with_calc,
- with_direct_form from profile where p_id=$1 returning p_id",array($p_id));
+ with_direct_form from profile where p_id=$1 returning p_id", array($p_id));
$cn->exec_sql("
insert into profile_menu (p_id,me_code,me_code_dep,p_order,p_type_display,pm_default)
select $1,me_code,me_code_dep,p_order,p_type_display,pm_default from profile_menu
where p_id=$2
- ",array($new_id,$p_id));
+ ", array($new_id, $p_id));
$cn->commit();
- $p_id=$new_id;
-
+ $p_id = $new_id;
}
catch (Exception $exc)
{
echo alert($exc->getMessage());
$cn->rollback();
}
-
}
//************************************
// Delete
//************************************
-if ( isset($_POST['delete_profil']))
+if (isset($_POST['delete_profil']))
{
- extract ($_POST);
+ extract($_POST);
try
{
$cn->start();
- if ( $p_id==1 ) { throw new Exception('On ne peut effacer le profil par défaut');}
- $new_id=$cn->get_value("delete from profile
- where p_id=$1 ",array($p_id));
+ if ($p_id == 1)
+ {
+ throw new Exception('On ne peut effacer le profil par défaut');
+ }
+ $new_id = $cn->get_value("delete from profile
+ where p_id=$1 ", array($p_id));
$cn->commit();
}
catch (Exception $exc)
{
- echo alert($exc->getMessage());;
+ echo alert($exc->getMessage());
+ ;
$cn->rollback();
}
-
}
//************************************
// Modify the menu or delete it
@@ -113,18 +151,16 @@ if ( isset($_POST['delete_profil']))
if (isset($_POST['mod']))
{
extract($_POST);
- if (isset($delete) || isset ($del_dep))
+ if (isset($delete) || isset($del_dep))
{
try
{
$cn->start();
- if ( isset ($del_dep))
- {
- $cn->exec_sql("delete from profile_menu where pm_id in (select * from get_menu_dependency($1))",
- array($pm_id));
- }
- $cn->exec_sql("delete from profile_menu where pm_id=$1",
- array($pm_id));
+ if (isset($del_dep))
+ {
+ $cn->exec_sql("delete from profile_menu where pm_id in (select * from get_menu_dependency($1))", array($pm_id));
+ }
+ $cn->exec_sql("delete from profile_menu where pm_id=$1", array($pm_id));
$cn->commit();
}
catch (Exception $exc)
@@ -132,11 +168,11 @@ if (isset($_POST['mod']))
echo $exc->getMessage();
$cn->rollback();
}
- }
+ }
else
try
{
- /**
+ /**
* Printing cannot be a menu and do not depend of anything
*/
$menu_type = $cn->get_value("select me_type from menu_ref
@@ -173,9 +209,9 @@ if (isset($_POST['mod']))
//****************************************************
// Add a menu, module, submenu,plugin...
//****************************************************
-if ( isset ($_POST['add_menu']))
+if (isset($_POST['add_menu']))
{
- extract ($_POST);
+ extract($_POST);
try
{
$cn->start();
@@ -183,47 +219,44 @@ if ( isset ($_POST['add_menu']))
/**
* Printing cannot be a menu and do not depend of anything
*/
- $menu_type=$cn->get_value("select me_type from menu_ref
- where me_code=$1",array($me_code));
+ $menu_type = $cn->get_value("select me_type from menu_ref
+ where me_code=$1", array($me_code));
- if ($menu_type=='PR')
+ if ($menu_type == 'PR')
{
- $p_type='P';
- $me_code_dep=-1;
+ $p_type = 'P';
+ $me_code_dep = -1;
}
// Module never depends of anything
- if ($p_type=='M')
+ if ($p_type == 'M')
{
- $me_code_dep=-1;
+ $me_code_dep = -1;
}
/**
* Check for infinite loop
*/
- $inf=$cn->get_value("select count(*) from profile_menu
- where p_id=$1 and me_code_dep=$2 and me_code=$3",
- array($p_id,$me_code,$me_code_dep));
- if ( $inf > 0 ) throw new Exception("Boucle infinie");
- /**
+ $inf = $cn->get_value("select count(*) from profile_menu
+ where p_id=$1 and me_code_dep=$2 and me_code=$3", array($p_id, $me_code, $me_code_dep));
+ if ($inf > 0)
+ throw new Exception("Boucle infinie");
+ /**
* if me_code_dep == -1, it means it is null
*/
- $me_code_dep=($me_code_dep==-1)?null:$me_code_dep;
+ $me_code_dep = ($me_code_dep == -1) ? null : $me_code_dep;
- $pm_default=(isset($pm_default))?1:0;
+ $pm_default = (isset($pm_default)) ? 1 : 0;
$cn->exec_sql("
insert into profile_menu (me_code,me_code_dep,p_id,p_order,pm_default,p_type_display)
values ($1,$2,$3,$4,$5,$6)
- ",array($me_code,$me_code_dep,$p_id,$p_order,$pm_default,$p_type));
+ ", array($me_code, $me_code_dep, $p_id, $p_order, $pm_default, $p_type));
$cn->commit();
-
}
catch (Exception $exc)
{
alert($exc->getMessage());
}
-
-
}
echo '';
@@ -240,7 +273,7 @@ $ord = (isset($_REQUEST['ord'])) ? $_REQUEST['ord'] : 'na';
$order = $table->get_sql_order($ord);
$menu = new Profile_sql($cn);
-$ret = $menu->seek($order);
+$ret = $menu->seek("where p_id > 0 ".$order);
echo '
';
echo '
@@ -147,17 +147,25 @@
Effacer';
- echo '
'.$operation[$o]['str_date']." ".HtmlInput::detail_op($operation[$o]['jr_id'],$operation[$o]['jr_internal'])." ".h($operation[$o]['jr_comment'])." "
- .$js.' ';
+ if ( $p_view != 'READ')
+ {
+ $rmOperation=sprintf("javascript:if ( confirm('"._('Voulez-vous effacer cette opération ')."')==true ) {remove_operation('%s','%s');}",
+ dossier::id(),
+ $operation[$o]['ago_id']);
+ $js= '
Effacer ';
+ echo '
'.$operation[$o]['str_date']." ".HtmlInput::detail_op($operation[$o]['jr_id'],$operation[$o]['jr_internal'])." ".h($operation[$o]['jr_comment'])." "
+ .$js.' ';
+ }
+ else
+ {
+ echo '
'.$operation[$o]['str_date']." ".HtmlInput::detail_op($operation[$o]['jr_id'],$operation[$o]['jr_internal'])." ".h($operation[$o]['jr_comment'])." "
+ .' ';
+ }
}
?>
- input()?>
+ input()?>
@@ -201,7 +217,9 @@ function small(p_id_textarea){
}
-
+
+Document créé le ag_timestamp ?> par ag_owner?>
+
input();
@@ -213,14 +231,25 @@ function small(p_id_textarea){
$style_enl='style="display:inline"';$style_small='style="display:none"';
for( $c=0;$cEffacer';
- echo 'n°'.$acomment[$c]['agc_id'].'('.h($acomment[$c]['tech_user'])." ".smaller_date($acomment[$c]['str_agc_date']).')'.$js.
- ''
- ;
+ if ( $p_view != 'READ')
+ {
+ $rmComment=sprintf("javascript:if ( confirm('"._('Voulez-vous effacer ce commentaire ')."')==true ) {remove_comment('%s','%s');}",
+ dossier::id(),
+ $acomment[$c]['agc_id']);
+ $js= '';
+ echo 'n°'.$acomment[$c]['agc_id'].'('.h($acomment[$c]['tech_user'])." ".smaller_date($acomment[$c]['str_agc_date']).')'.$js.
+ ''
+ ;
+ }
+ else
+ {
+ echo 'n°'.$acomment[$c]['agc_id'].'('.h($acomment[$c]['tech_user'])." ".smaller_date($acomment[$c]['str_agc_date']).')'.
+ ''
+ ;
+
+ }
}
echo $desc->input();
?>
@@ -292,14 +321,19 @@ function toggleShowDetail() {
+
+