admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

0000575: Sécurité: limiter dépot

Browse source
This commit is contained in:
Dany De Bontridder 2012-06-13 19:48:49 +00:00
parent 821f5e93e3
commit ffb3d3bf06
6 changed files with 205 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/ajax_get_profile.php
View file

@ -82,6 +82,9 @@ Effacer ce profil';
echo $add_one;
echo "<h2>Action gestion accessible</h2>";
$profile_menu->available_profile($p_id);
echo "<h2>Dépôt de stock accessible</h2>";
$profile_menu->available_repository($p_id);
}
?>

29
include/class_profile_menu.php
View file

@ -208,6 +208,10 @@ class Profile_Menu
$gDossier = Dossier::id();
$this->sub_menu($ret, $p_id);
}
/**
* Show the available profile for the profile $p_id, it concerns only the action of management (action-gestion)
* @param $p_id is the profile p_id
*/
function available_profile($p_id)
{
$array=$this->cn->get_array("
@ -228,7 +232,30 @@ class Profile_Menu
);
require_once 'template/user_sec_profile.php';
}
/**
* Show the available repository for the profile $p_id
* @param $p_id is the profile p_id
*/
function available_repository($p_id)
{
$array=$this->cn->get_array("
select p.r_id,p.r_name,s.ur_id,s.ur_right
from stock_repository as p
join user_sec_repository as s on (s.r_id=p.r_id)
where s.p_id=$1
union
select p2.r_id, p2.r_name,null,'X'
from stock_repository as p2
where
p2.r_id not in (select r_id from user_sec_repository where p_id = $1) order by r_name;
",array($p_id));
$aright_value=array(
array('value'=>'R','label'=>_('Lecture')),
array('value'=>'W','label'=>_('Ecriture')),
array('value'=>'X','label'=>_('Aucun accès'))
);
require_once 'template/user_sec_repository.php';
}
}
//end class
?>

64
include/class_stock_sql.php Normal file
View file

@ -0,0 +1,64 @@
<?php
/*
* This file is part of PhpCompta.
*
* PhpCompta is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PhpCompta is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with PhpCompta; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/* $Revision$ */
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
/**
* @file
* @brief
*
*/
require_once 'class_phpcompta_sql.php';
class Stock_Sql extends PhpCompta_Sql {
function __construct($p_id=-1)
{
$this->table = "public.stock_repository";
$this->primary_key = "r_id";
$this->name=array(
"id"=>"r_id",
"name"=>"r_name",
"adress"=>"r_adress",
"city"=>"r_city",
"country"=>"r_country",
"phone"=>"r_phone"
);
$this->type = array(
"r_id"=>"numeric",
"r_name"=>"text",
"r_adress"=>"text",
"r_city"=>"text",
"r_country"=>"text",
"r_phone"=>"text"
);
$this->default = array(
"r_id" => "auto",
);
global $cn;
parent::__construct($cn,$p_id);
}
}
?>

35
include/profile.inc.php
View file

@ -58,6 +58,41 @@ if (isset($_POST['change_profile']))
}
}
//**********************************************
// Save avail. profiles
//**********************************************
if (isset($_POST['change_stock']))
{
extract($_POST);
try
{
for ($e = 0; $e < count($right); $e++)
{
if ($right[$e] == 'X' && $ur_id[$e]=='')
continue;
if ($right[$e] == 'X' && $ur_id[$e]!='')
{
$cn->exec_sql("delete from user_sec_repository where p_id=$1 and r_id=$2", array($p_id, $ar_id[$e]));
continue;
}
if ($ur_id[$e] == "")
{
$cn->exec_sql("insert into user_sec_repository (p_id,r_id,ur_right) values($1,$2,$3)", array($p_id, $ar_id[$e], $right[$e]));
continue;
}
if ($ur_id[$e] != '')
{
$cn->exec_sql("update user_sec_repository set ur_right=$3 where p_id=$1 and r_id=$2 ", array($p_id, $ar_id[$e], $right[$e]));
continue;
}
}
}
catch (Exception $exc)
{
echo $exc->getTraceAsString();
throw $exc;
}
}
//**********************************************
// Save_name
// *********************************************

53
include/template/user_sec_repository.php Normal file
View file

@ -0,0 +1,53 @@
<?php
/*
* This file is part of PhpCompta.
*
* PhpCompta is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PhpCompta is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with PhpCompta; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/* $Revision$ */
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
/**
* @file
* @brief show the available profiles for action-management
*
*/
?>
<form method="POST" class="print">
<?=HtmlInput::hidden("p_id", $p_id);?>
<table>
<tr>
<th><?=_("Dépot")?></th>
<th><?=_("Accès")?></th>
</tr>
<? for ($i=0;$i<count($array);$i++): ?>
<tr>
<td>
<?=$array[$i]['r_name']?>
<?=HtmlInput::hidden('ur_id[]',$array[$i]['ur_id'])?>
<?=HtmlInput::hidden('ar_id[]',$array[$i]['r_id'])?>
</td>
<td>
<?
$isel=new ISelect("right[]");
$isel->value=$aright_value;
$isel->selected=$array[$i]['ur_right'];
echo $isel->input();?>
</td>
</tr>
<?endfor;?>
</table>
<?=HtmlInput::submit("change_stock", "Sauver")?>

23
sql/upgrade.sql
View file

@ -240,4 +240,25 @@ COMMENT ON COLUMN stock_repository.r_country IS 'country of the stock';
COMMENT ON COLUMN stock_repository.r_city IS 'City of the stock';
COMMENT ON COLUMN stock_repository.r_phone IS 'Phone number';
insert into stock_repository(r_name) values ('Dépôt par défaut');
insert into stock_repository(r_name) values ('Dépôt par défaut');
CREATE TABLE user_sec_repository
(
ur_id bigserial NOT NULL, -- pk
p_id bigint, -- fk to profile
r_id bigint,
ur_right character(1), -- Type of right : R for readonly W for write
CONSTRAINT user_sec_repository_pkey PRIMARY KEY (ur_id ),
CONSTRAINT user_sec_repository_p_id_fkey FOREIGN KEY (p_id)
REFERENCES profile (p_id) MATCH SIMPLE
ON UPDATE CASCADE ON DELETE CASCADE,
CONSTRAINT user_sec_repository_r_id_fkey FOREIGN KEY (r_id)
REFERENCES stock_repository (r_id) MATCH SIMPLE
ON UPDATE CASCADE ON DELETE CASCADE,
CONSTRAINT user_sec_profile_ur_right_check CHECK (ur_right = ANY (ARRAY['R'::bpchar, 'W'::bpchar]))
);
COMMENT ON TABLE user_sec_repository IS 'Available profile for user';
COMMENT ON COLUMN user_sec_repository.ur_id IS 'pk';
COMMENT ON COLUMN user_sec_repository.p_id IS 'fk to profile';
COMMENT ON COLUMN user_sec_repository.r_id IS 'fk to stock_repository';
COMMENT ON COLUMN user_sec_repository.ur_right IS 'Type of right : R for readonly W for write';