Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

Merge branch 'sgm_filepriv' into 'master'

Browse Source 
* Finish task #64212.

See merge request easycorp/zentaopms!4865
This commit is contained in:
王怡栋
2022-08-09 07:22:42 +00:00
parent 4dd5bb212a 5e2135766a
commit 0d2912cb84
8 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/file/control.php
Regular → Executable
+6
View File
@@ -127,6 +127,12 @@ class file extends control
return print("<html><head><meta charset='utf-8'></head><body>{$this->lang->file->fileNotFound}</body></html>");
}
if(!$this->file->checkPriv($file))
{
echo(js::alert($this->lang->file->accessDenied));
return print(js::locate(helper::createLink('my', 'index')));
}
/* Judge the mode, down or open. */
$mode = 'down';
$fileTypes = 'txt|jpg|jpeg|gif|png|bmp|xml|html';
module/file/lang/de.php
Regular → Executable
+1
View File
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = 'Hinweis: Beim Upload von .jpg, .jpeg, .gif,
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: <strong>%s</strong>. Page <strong>%s</strong> of <strong>%s</strong>';
$lang->file->importSummary = "Import <strong id='allCount'>%s</strong> items You can <strong>%s</strong> items/page, so you have to import <strong id='times'>%s</strong> times.";
$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "<span class='text-red'>'%s' wurde nicht gefunden.</span>";
$lang->file->errorCanNotWrite = "<span class='text-red'>'%s' ist nicht beschreibbar. Bitte passen Sie die Berechtigungen an. Befehl <span class='code'>sudo chmod -R 777 '%s'</span></span> in Linux.";
module/file/lang/en.php
Regular → Executable
+1
View File
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = 'Note: upload .jpg, .jpeg, .gif, or .png imag
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: <strong>%s</strong>. Page <strong>%s</strong> of <strong>%s</strong>';
$lang->file->importSummary = "Import <strong id='allCount'>%s</strong> items You can <strong>%s</strong> items/page, so you have to import <strong id='times'>%s</strong> times.";
$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "<span class='text-red'>'%s' is not found.</span>";
$lang->file->errorCanNotWrite = "<span class='text-red'>'%s' is not writable. Please change its permission. Enter <span class='code'>sudo chmod -R 777 '%s'</span></span> in Linux.";
module/file/lang/fr.php
Regular → Executable
+1
View File
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = "Note : Chargez images au format .jpg, .jpeg,
$lang->file->saveAndNext = 'Enregistrer et poursuivre';
$lang->file->importPager = 'Total: <strong>%s</strong>. Page <strong>%s</strong> de <strong>%s</strong>';
$lang->file->importSummary = "Import <strong id='allCount'>%s</strong> items Vous pouvez avoir <strong>%s</strong> items/page, vous devez donc importer <strong id='times'>%s</strong> fois.";
$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "<span class='text-red'>'%s' non trouvé.</span>";
$lang->file->errorCanNotWrite = "<span class='text-red'>'%s' non inscriptible. Changez les permissions. Entrez la commande <span class='code'>sudo chmod -R 777 '%s'</span></span> sous Linux.";
module/file/lang/vi.php
Regular → Executable
+1
View File
@@ -51,6 +51,7 @@ $lang->file->uploadImagesExplain = 'Ghi chú: upload .jpg, .jpeg, .gif, or .png
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: <strong>%s</strong>. Page <strong>%s</strong> of <strong>%s</strong>';
$lang->file->importSummary = "Import <strong id='allCount'>%s</strong> items You can <strong>%s</strong> items/page, so you have to import <strong id='times'>%s</strong> times.";
$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "<span class='text-red'>'%s' không là found.</span>";
$lang->file->errorCanNotWrite = "<span class='text-red'>'%s' không thể ghi. Vui lòng change its permission. Enter <span class='code'>sudo chmod -R 777 '%s'</span></span> in Linux.";
module/file/lang/zh-cn.php
Regular → Executable
+1
View File
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = '注：请上传"jpg, jpeg, gif, png"格式
$lang->file->saveAndNext = '保存并跳转下一页';
$lang->file->importPager = '共有<strong>%s</strong>条记录，当前第<strong>%s</strong>页，共有<strong>%s</strong>页';
$lang->file->importSummary = "本次导入共有<strong id='allCount'>%s</strong>条记录，每页导入%s条，需要导入<strong id='times'>%s</strong>次";
$lang->file->accessDenied = '您无权下载该附件！';
$lang->file->errorNotExists = "<span class='text-red'>文件夹 '%s' 不存在</span>";
$lang->file->errorCanNotWrite = "<span class='text-red'>文件夹 '%s' 不可写,请改变文件夹的权限。在linux中输入指令: <span class='code'>sudo chmod -R 777 %s</span></span>";
module/file/lang/zh-tw.php
Regular → Executable
View File
module/file/model.php
Regular → Executable
+52
View File
@@ -525,6 +525,58 @@ class fileModel extends model
}
}
/**
* Check file priv.
*
* @param int $file
* @access public
* @return bool
*/
public function checkPriv($file)
{
if($this->app->user->admin) return true;
$objectType = $file->objectType;
$objectID = $file->objectID;
$projectObjects = array('design', 'issue', 'risk');
$productObjects = array('story', 'bug', 'testcase', 'productplan');
$executionObjects = array('task', 'build');
$table = $this->config->objectTables[$objectType];
if(!$table) return true;
if(in_array($objectType, $projectObjects))
{
$projectID = $this->dao->findByID($objectID)->from($table)->fetch('project');
}
elseif(in_array($objectType, $productObjects))
{
$productID = $this->dao->findByID($objectID)->from($table)->fetch('product');
}
elseif(in_array($objectType, $executionObjects))
{
$executionID = $this->dao->findByID($objectID)->from($table)->fetch('execution');
}
elseif($objectType == 'doc')
{
$doc = $this->dao->findById($objectID)->from(TABLE_DOC)->fetch();
return $this->loadModel('doc')->checkPrivDoc($doc);
}
elseif($objectType == 'feedback')
{
$productID = $this->dao->findById($objectID)->from(TABLE_FEEDBACK)->fetch();
$grantProducts = $this->loadModel('feedback')->getGrantProducts();
return in_array($productID, array_keys($grantProducts));
}
if(isset($projectID) and strpos(",{$this->app->user->view->projects},", ",$projectID,") === false) return false;
if(isset($productID) and strpos(",{$this->app->user->view->products},", ",$productID,") === false) return false;
if(isset($executionID) and strpos(",{$this->app->user->view->sprints},", ",$executionID,") === false) return false;
return true;
}
/**
* Compress image to config configured size.
*