diff --git a/module/file/control.php b/module/file/control.php
old mode 100644
new mode 100755
index aee24d9940..6ce27a6fc5
--- a/module/file/control.php
+++ b/module/file/control.php
@@ -127,6 +127,12 @@ class file extends control
return print("{$this->lang->file->fileNotFound}");
}
+ if(!$this->file->checkPriv($file))
+ {
+ echo(js::alert($this->lang->file->accessDenied));
+ return print(js::locate(helper::createLink('my', 'index')));
+ }
+
/* Judge the mode, down or open. */
$mode = 'down';
$fileTypes = 'txt|jpg|jpeg|gif|png|bmp|xml|html';
diff --git a/module/file/lang/de.php b/module/file/lang/de.php
old mode 100644
new mode 100755
index 6935145f6b..d157e6e28d
--- a/module/file/lang/de.php
+++ b/module/file/lang/de.php
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = 'Hinweis: Beim Upload von .jpg, .jpeg, .gif,
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: %s. Page %s of %s';
$lang->file->importSummary = "Import %s items You can %s items/page, so you have to import %s times.";
+$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "'%s' wurde nicht gefunden.";
$lang->file->errorCanNotWrite = "'%s' ist nicht beschreibbar. Bitte passen Sie die Berechtigungen an. Befehl sudo chmod -R 777 '%s' in Linux.";
diff --git a/module/file/lang/en.php b/module/file/lang/en.php
old mode 100644
new mode 100755
index 8667fc7e64..78495f78de
--- a/module/file/lang/en.php
+++ b/module/file/lang/en.php
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = 'Note: upload .jpg, .jpeg, .gif, or .png imag
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: %s. Page %s of %s';
$lang->file->importSummary = "Import %s items You can %s items/page, so you have to import %s times.";
+$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "'%s' is not found.";
$lang->file->errorCanNotWrite = "'%s' is not writable. Please change its permission. Enter sudo chmod -R 777 '%s' in Linux.";
diff --git a/module/file/lang/fr.php b/module/file/lang/fr.php
old mode 100644
new mode 100755
index 9389a7b93c..6b29ba71f9
--- a/module/file/lang/fr.php
+++ b/module/file/lang/fr.php
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = "Note : Chargez images au format .jpg, .jpeg,
$lang->file->saveAndNext = 'Enregistrer et poursuivre';
$lang->file->importPager = 'Total: %s. Page %s de %s';
$lang->file->importSummary = "Import %s items Vous pouvez avoir %s items/page, vous devez donc importer %s fois.";
+$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "'%s' non trouvé.";
$lang->file->errorCanNotWrite = "'%s' non inscriptible. Changez les permissions. Entrez la commande sudo chmod -R 777 '%s' sous Linux.";
diff --git a/module/file/lang/vi.php b/module/file/lang/vi.php
old mode 100644
new mode 100755
index aa3a9a3167..3a11441b1b
--- a/module/file/lang/vi.php
+++ b/module/file/lang/vi.php
@@ -51,6 +51,7 @@ $lang->file->uploadImagesExplain = 'Ghi chú: upload .jpg, .jpeg, .gif, or .png
$lang->file->saveAndNext = 'Save and Next';
$lang->file->importPager = 'Total: %s. Page %s of %s';
$lang->file->importSummary = "Import %s items You can %s items/page, so you have to import %s times.";
+$lang->file->accessDenied = 'Access denied to this file!';
$lang->file->errorNotExists = "'%s' không là found.";
$lang->file->errorCanNotWrite = "'%s' không thể ghi. Vui lòng change its permission. Enter sudo chmod -R 777 '%s' in Linux.";
diff --git a/module/file/lang/zh-cn.php b/module/file/lang/zh-cn.php
old mode 100644
new mode 100755
index 83351d0919..d44c794fd5
--- a/module/file/lang/zh-cn.php
+++ b/module/file/lang/zh-cn.php
@@ -56,6 +56,7 @@ $lang->file->uploadImagesExplain = '注：请上传"jpg, jpeg, gif, png"格式
$lang->file->saveAndNext = '保存并跳转下一页';
$lang->file->importPager = '共有%s条记录，当前第%s页，共有%s页';
$lang->file->importSummary = "本次导入共有%s条记录，每页导入%s条，需要导入%s次";
+$lang->file->accessDenied = '您无权下载该附件！';
$lang->file->errorNotExists = "文件夹 '%s' 不存在";
$lang->file->errorCanNotWrite = "文件夹 '%s' 不可写,请改变文件夹的权限。在linux中输入指令: sudo chmod -R 777 %s";
diff --git a/module/file/lang/zh-tw.php b/module/file/lang/zh-tw.php
old mode 100644
new mode 100755
diff --git a/module/file/model.php b/module/file/model.php
old mode 100644
new mode 100755
index 307368e266..b4d6fa25a6
--- a/module/file/model.php
+++ b/module/file/model.php
@@ -525,6 +525,58 @@ class fileModel extends model
}
}
+ /**
+ * Check file priv.
+ *
+ * @param int $file
+ * @access public
+ * @return bool
+ */
+ public function checkPriv($file)
+ {
+ if($this->app->user->admin) return true;
+
+ $objectType = $file->objectType;
+ $objectID = $file->objectID;
+
+ $projectObjects = array('design', 'issue', 'risk');
+ $productObjects = array('story', 'bug', 'testcase', 'productplan');
+ $executionObjects = array('task', 'build');
+
+ $table = $this->config->objectTables[$objectType];
+ if(!$table) return true;
+
+ if(in_array($objectType, $projectObjects))
+ {
+ $projectID = $this->dao->findByID($objectID)->from($table)->fetch('project');
+ }
+ elseif(in_array($objectType, $productObjects))
+ {
+ $productID = $this->dao->findByID($objectID)->from($table)->fetch('product');
+ }
+ elseif(in_array($objectType, $executionObjects))
+ {
+ $executionID = $this->dao->findByID($objectID)->from($table)->fetch('execution');
+ }
+ elseif($objectType == 'doc')
+ {
+ $doc = $this->dao->findById($objectID)->from(TABLE_DOC)->fetch();
+ return $this->loadModel('doc')->checkPrivDoc($doc);
+ }
+ elseif($objectType == 'feedback')
+ {
+ $productID = $this->dao->findById($objectID)->from(TABLE_FEEDBACK)->fetch();
+ $grantProducts = $this->loadModel('feedback')->getGrantProducts();
+ return in_array($productID, array_keys($grantProducts));
+ }
+
+ if(isset($projectID) and strpos(",{$this->app->user->view->projects},", ",$projectID,") === false) return false;
+ if(isset($productID) and strpos(",{$this->app->user->view->products},", ",$productID,") === false) return false;
+ if(isset($executionID) and strpos(",{$this->app->user->view->sprints},", ",$executionID,") === false) return false;
+
+ return true;
+ }
+
/**
* Compress image to config configured size.
*