Merge branch dev/task-145691 of zentao/zentaopms (#9869)

module/action/tao.php

@@ -956,6 +956,7 @@ class actionTao extends actionModel
             if($todo && $todo->private == 1 && $todo->account != $this->app->user->account) return false;
         }
 
+        if($action->objectType == 'docTemplate' && !common::hasPriv('docTempalte', 'view')) return false;
         if($action->objectType == 'mr' && (empty($action->objectName) || $action->action == 'deleted')) return false;
         if($action->objectType == 'stakeholder' && $action->project == 0) return false;
         if($action->objectType == 'chartgroup') return false;

module/action/test/lib/action.unittest.class.php

@@ -919,4 +919,20 @@ class actionTest
         $content   = str_replace("\n", '', $content);
         return $content;
     }
+
+    /**
+     * 测试操作是否可点击。
+     * Test check action clickable.
+     *
+     * @param  object $action
+     * @param  array  $deptUser
+     * @param  string $moduleName
+     * @param  string $methodName
+     * @access public
+     * @return bool
+     */
+    public function checkActionClickableTest(object $action, array $deptUser, string $moduleName, string $methodName): bool
+    {
+        return $this->objectModel->checkActionClickable($action, $deptUser, $moduleName, $methodName);
+    }
 }

module/action/test/tao/checkactionclickable.php

@@ -0,0 +1,67 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+/**
+
+title=测试 actionTao->fetchBaseInfo().
+timeout=0
+cid=1
+
+- 测试模块名和方法名为空时，返回false @0
+- 测试没有没有权限时，返回false @0
+- 测试操作用户数据，该用户不属于当前用户的部门用户，并且当前用户不是管理员，返回false @0
+- 测试用户的登录操作，不需要打印链接，返回false @0
+- 测试合并请求的删除操作，不需要打印链接，返回false @0
+- 测试产品相关操作，打印产品详情，返回true @1
+
+*/
+
+include dirname(__FILE__, 5) . '/test/lib/init.php';
+include dirname(__FILE__, 2) . '/lib/action.unittest.class.php';
+
+zenData('user')->gen(10);
+
+su('user1');
+
+$actionTest = new actionTest();
+
+$action = new stdclass();
+
+$deptUsers = array();
+
+$moduleName = '';
+$methodName = 'view';
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('0'); //测试模块名和方法名为空时，返回false
+
+$moduleName = 'user';
+$methodName = 'create';
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('0'); //测试没有没有权限时，返回false
+
+$moduleName = 'user';
+$methodName = 'view';
+$action->objectType = 'user';
+$action->objectID   = 1;
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('0'); //测试操作用户数据，该用户不属于当前用户的部门用户，并且当前用户不是管理员，返回false
+
+$action->objectType = 'user';
+$action->action     = 'login';
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('0'); //测试用户的登录操作，不需要打印链接，返回false
+
+$moduleName = 'mr';
+$action->objectType = 'mr';
+$action->action     = 'deleted';
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('0'); //测试合并请求的删除操作，不需要打印链接，返回false
+
+su('admin');
+
+$moduleName = 'product';
+$action->objectType = 'product';
+$action->action     = 'edit';
+
+r($actionTest->checkActionClickableTest($action, $deptUsers, $moduleName, $methodName)) && p() && e('1'); //测试产品相关操作，打印产品详情，返回true