From 06f2ec6e5723ccaa26d4f751ebd5035b3b8c5036 Mon Sep 17 00:00:00 2001
From: hufangzhou <hufangzhou@easycorp.ltd>
Date: Tue, 11 Jun 2024 14:09:04 +0800
Subject: [PATCH] * [bug#49351,done,1h] The articles in the document template
 do not check permissions.

---
 module/doc/control.php                 | 3 +--
 module/doc/model.php                   | 4 ++--
 module/doc/test/model/checkprivdoc.php | 5 ++++-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/module/doc/control.php b/module/doc/control.php
index 4995c68b43..32ea0ac5d1 100755
--- a/module/doc/control.php
+++ b/module/doc/control.php
@@ -682,8 +682,7 @@ class doc extends control
 
         $lib = $this->doc->getLibByID((int)$doc->lib);
         if(!empty($lib) && $lib->deleted == '1') $appendLib = $doc->lib;
-        if($this->app->tab == 'doc' && $lib->type == 'execution') $appendLib = $doc->lib;
-
+        if($this->app->tab == 'doc' && !empty($lib) && $lib->type == 'execution') $appendLib = $doc->lib;
 
         $objectType = isset($lib->type) ? $lib->type : 'custom';
         $objectID   = zget($doc, $objectType, 0);
diff --git a/module/doc/model.php b/module/doc/model.php
index 8a0ed94b3c..a0f9a5d1d5 100644
--- a/module/doc/model.php
+++ b/module/doc/model.php
@@ -1217,7 +1217,7 @@ class docModel extends model
         if(!isset($doc->lib)) return false;
 
         /* Asset document don't check privilege. */
-        if(isset($doc->assetLibType) && $doc->assetLibType) return true;
+        if((isset($doc->assetLibType) && $doc->assetLibType) || $doc->type == 'article') return true;
 
         /* My document are accessible only to the creator. */
         if($doc->status == 'draft' && $doc->addedBy != $this->app->user->account) return false;
@@ -1443,7 +1443,7 @@ class docModel extends model
             ->groupBy('root')
             ->fetchPairs();
 
-        $docs = $this->dao->select("`id`,`addedBy`,`lib`,`acl`,`users`,`groups`,`status`")->from(TABLE_DOC)
+        $docs = $this->dao->select("`id`,`addedBy`,`type`,`lib`,`acl`,`users`,`groups`,`status`")->from(TABLE_DOC)
             ->where('lib')->in($idList)
             ->andWhere('deleted')->eq(0)
             ->andWhere('module')->eq(0)
diff --git a/module/doc/test/model/checkprivdoc.php b/module/doc/test/model/checkprivdoc.php
index cef5d76ea9..3818865503 100755
--- a/module/doc/test/model/checkprivdoc.php
+++ b/module/doc/test/model/checkprivdoc.php
@@ -28,13 +28,14 @@ $docTable = zenData('doc')->loadYaml('doc');
 $docTable->assetLibType->range('practice,component,[]{18}');
 $docTable->users->range('user1');
 $docTable->addedBy->range('admin{5},user1,admin{14}');
+$docTable->type->range('text{19},article');
 $docTable->gen(20);
 
 zenData('doclib')->loadYaml('doclib')->gen(20);
 zenData('user')->gen(5);
 
 $users  = array('admin', 'user1');
-$docIds = array(0, 1, 3, 6, 12, 14);
+$docIds = array(0, 1, 3, 6, 12, 14, 20);
 
 $docTester = new docTest();
 
@@ -45,6 +46,7 @@ r($docTester->checkPrivDocTest($users[0], $docIds[2])) && p() && e('1'); // 检
 r($docTester->checkPrivDocTest($users[0], $docIds[3])) && p() && e('0'); // 检查管理员对于非他创建的草稿文档权限
 r($docTester->checkPrivDocTest($users[0], $docIds[4])) && p() && e('1'); // 检查管理员对于有权限查看文档库下的文档权限
 r($docTester->checkPrivDocTest($users[0], $docIds[5])) && p() && e('1'); // 检查管理员对于自定义文档的权限
+r($docTester->checkPrivDocTest($users[0], $docIds[6])) && p() && e('1'); // 检查管理员对于文档模板权限
 
 /* Check user1 privilege. */
 r($docTester->checkPrivDocTest($users[1], $docIds[0])) && p() && e('0'); // 检查普通用户user1对于没有libID文档权限
@@ -53,3 +55,4 @@ r($docTester->checkPrivDocTest($users[1], $docIds[2])) && p() && e('0'); // 检
 r($docTester->checkPrivDocTest($users[1], $docIds[3])) && p() && e('0'); // 检查普通用户user1对于非他创建的草稿文档权限
 r($docTester->checkPrivDocTest($users[1], $docIds[4])) && p() && e('0'); // 检查普通用户user1对于有权限查看文档库下的文档权限
 r($docTester->checkPrivDocTest($users[1], $docIds[5])) && p() && e('0'); // 检查普通用户user1对于自定义文档的权限
+r($docTester->checkPrivDocTest($users[1], $docIds[6])) && p() && e('1'); // 检查普通用户对于文档模板权限