From 2d97663c5d61eff4cab7c958b36465bcd0ed302f Mon Sep 17 00:00:00 2001 From: sgm0422 <976204163@qq.com> Date: Thu, 11 Jun 2020 17:25:36 +0800 Subject: [PATCH] * Compute program priv. --- module/common/model.php | 42 +++++++++++++++++++++++++++--- module/group/lang/en.php | 1 + module/group/lang/zh-cn.php | 1 + module/group/model.php | 5 ++++ module/group/view/browse.html.php | 6 +---- module/group/view/create.html.php | 4 +++ module/program/config.php | 2 +- module/program/control.php | 6 +---- module/program/view/group.html.php | 5 ++-- module/user/model.php | 20 +++++++++++--- 10 files changed, 71 insertions(+), 21 deletions(-) diff --git a/module/common/model.php b/module/common/model.php index 3c37c116b4..bb524c8c04 100644 --- a/module/common/model.php +++ b/module/common/model.php @@ -1569,14 +1569,20 @@ EOD; public static function hasPriv($module, $method, $object = null) { global $app, $lang; + $module = strtolower($module); + $method = strtolower($method); /* Check is the super admin or not. */ if(!empty($app->user->admin) || strpos($app->company->admins, ",{$app->user->account},") !== false) return true; + + /* If is the program admin, have all program related privs. */ + $inProgram = isset($lang->navGroup->$module) && $lang->navGroup->$module == 'program'; + if(strpos(",{$app->user->rights['programs']},", ",{$app->session->program},") !== false && $inProgram) return true; + if($inProgram) self::resetProgramPriv($module, $method); + /* If not super admin, check the rights. */ - $rights = $app->user->rights['rights']; - $acls = $app->user->rights['acls']; - $module = strtolower($module); - $method = strtolower($method); + $rights = $app->user->rights['rights']; + $acls = $app->user->rights['acls']; if((($app->user->account != 'guest') or ($app->company->guest and $app->user->account == 'guest')) and $module == 'report' and $method == 'annualdata') return true; @@ -1600,6 +1606,34 @@ EOD; return false; } + /** + * Reset program priv. + * + * @param string $module + * @param string $method + * @static + * @access public + * @return void + */ + public static function resetProgramPriv($module, $method) + { + global $app, $lang, $dbh; + /* Get user program priv. */ + if(!$app->session->program) return; + $program = $dbh->query("SELECT * FROM " . TABLE_PROJECT . " WHERE `id` = '{$app->session->program}'")->fetch(); + $programRights = $dbh->query("SELECT t3.module, t3.method FROM " . TABLE_GROUP . " AS t1 LEFT JOIN " . TABLE_USERGROUP . " AS t2 ON t1.id = t2.group LEFT JOIN " . TABLE_GROUPPRIV . " AS t3 ON t2.group=t3.group WHERE t1.program = " . "'{$app->session->program}'" . ' AND t2.account = ' . "'{$app->user->account}'")->fetchAll(); + + /* Group priv by module. */ + $programRightGroup = array(); + foreach($programRights as $programRight) $programRightGroup[$programRight->module][$programRight->method] = 1; + + /* Reset priv by program privway. */ + $rights = $app->user->rights['rights']; + $acls = $app->user->rights['acls']; + if($program->privway == 'extend') $app->user->rights['rights'] = array_merge_recursive($programRightGroup, $rights); + if($program->privway == 'reset') $app->user->rights['rights'] = $programRightGroup; + } + /** * Check db priv. * diff --git a/module/group/lang/en.php b/module/group/lang/en.php index ce035c2f9f..faed4627b7 100644 --- a/module/group/lang/en.php +++ b/module/group/lang/en.php @@ -48,6 +48,7 @@ $lang->group->priv = 'Privilege Group'; $lang->group->option = 'Option'; $lang->group->inside = 'Group Users'; $lang->group->outside = 'Other Users'; +$lang->group->limited = 'Limited Users'; $lang->group->other = 'Others'; $lang->group->all = 'All Privileges'; diff --git a/module/group/lang/zh-cn.php b/module/group/lang/zh-cn.php index 0c69a30805..d7bd26752a 100644 --- a/module/group/lang/zh-cn.php +++ b/module/group/lang/zh-cn.php @@ -48,6 +48,7 @@ $lang->group->priv = '权限'; $lang->group->option = '选项'; $lang->group->inside = '组内用户'; $lang->group->outside = '组外用户'; +$lang->group->limited = '受限用户组'; $lang->group->other = '其他模块'; $lang->group->all = '所有权限'; diff --git a/module/group/model.php b/module/group/model.php index 546c5b53bf..64a4fbfc77 100644 --- a/module/group/model.php +++ b/module/group/model.php @@ -22,6 +22,11 @@ class groupModel extends model public function create() { $group = fixer::input('post')->get(); + if(isset($group->limited)) + { + unset($group->limited); + $group->role = 'limited'; + } return $this->dao->insert(TABLE_GROUP)->data($group)->batchCheck($this->config->group->create->requiredFields, 'notempty')->exec(); } diff --git a/module/group/view/browse.html.php b/module/group/view/browse.html.php index ed2a2b41c8..b40337ed70 100644 --- a/module/group/view/browse.html.php +++ b/module/group/view/browse.html.php @@ -51,15 +51,11 @@ id", $group, 'list', '', '', 'iframe', 'yes', "data-width='550'");?> id", $group, 'list', '', '', 'iframe', 'yes', "data-width='550'");?> role != 'limited') + if(common::hasPriv('group', 'delete')) { $deleteURL = $this->createLink('group', 'delete', "groupID=$group->id&confirm=yes"); echo html::a("javascript:ajaxDelete(\"$deleteURL\", \"groupList\", confirmDelete)", '', '', "title='{$lang->group->delete}' class='btn'"); } - else - { - echo ""; - } ?> id", $group, 'list', 'eye', '', 'disabled');?> diff --git a/module/group/view/create.html.php b/module/group/view/create.html.php index 3f621918b4..0880897593 100644 --- a/module/group/view/create.html.php +++ b/module/group/view/create.html.php @@ -25,6 +25,10 @@ group->desc;?> + + group->limited;?> + + diff --git a/module/program/config.php b/module/program/config.php index 4f6d57c49d..1001a01a03 100644 --- a/module/program/config.php +++ b/module/program/config.php @@ -13,5 +13,5 @@ $config->program->list = new stdclass(); $config->program->list->exportFields = 'id,name,code,type,category,status,begin,end,budget,PM,end,desc'; $config->program->priv = new stdclass(); -$config->program->priv->scrum = array('program', 'product', 'story', 'productplan', 'release', 'project', 'task', 'build', 'qa', 'bug', 'testcase', 'testsuite', 'testreport', 'caselib', 'doc', 'report', 'repo', 'svn', 'git', 'search', 'tree', 'file', 'jenkins', 'job', 'ci', 'branch'); +$config->program->priv->scrum = array('product', 'story', 'productplan', 'release', 'project', 'task', 'build', 'qa', 'bug', 'testcase', 'testsuite', 'testreport', 'caselib', 'doc', 'report', 'repo', 'svn', 'git', 'search', 'tree', 'file', 'jenkins', 'job', 'ci', 'branch'); $config->program->priv->cmmi = $config->program->priv->scrum + array('workestimation', 'durationestimation', 'budget', 'programplan', 'review', 'reviewissue', 'weekly', 'milestone', 'design', 'issue', 'risk', 'auditplan', 'nc', 'cm', 'pssp'); diff --git a/module/program/control.php b/module/program/control.php index ffd85cfd40..b3febe08d9 100644 --- a/module/program/control.php +++ b/module/program/control.php @@ -246,7 +246,7 @@ class program extends control $group = $this->group->getById($groupID); if($group->acl) $group->acl = json_decode($group->acl, true); - $this->view->title = $this->lang->company->common . $this->lang->colon . $group->name . $this->lang->colon . $this->lang->group->manageView; + $this->view->title = $group->name . $this->lang->colon . $this->lang->group->manageView; $this->view->position[] = $group->name; $this->view->position[] = $this->lang->group->manageView; @@ -254,10 +254,6 @@ class program extends control $this->view->products = $this->dao->select('*')->from(TABLE_PRODUCT)->where('deleted')->eq('0')->andWhere('program')->eq($group->program)->orderBy('order_desc')->fetchPairs('id', 'name'); $this->view->projects = $this->dao->select('*')->from(TABLE_PROJECT)->where('deleted')->eq('0')->andWhere('program')->eq($group->program)->orderBy('order_desc')->fetchPairs('id', 'name'); - $menugroup = array(); - foreach($this->lang->menugroup as $moduleName => $groupName) $menugroup[$groupName][$moduleName] = $moduleName; - $this->view->menugroup = $menugroup; - $this->display(); } diff --git a/module/program/view/group.html.php b/module/program/view/group.html.php index d294708930..82387964ae 100644 --- a/module/program/view/group.html.php +++ b/module/program/view/group.html.php @@ -42,12 +42,13 @@ group->managepriv = $lang->group->managePrivByGroup;?> - id", $group, 'list', 'eye');?> + role == 'limited' ? 'disabled' : '';?> + id", $group, 'list', 'eye', '', $disabled);?> id", $group, 'list', 'lock');?> group->managemember = $lang->group->manageMember;?> id", $group, 'list', 'persons', '', 'iframe', 'yes', "data-width='90%'");?> id", $group, 'list', 'edit', '', 'iframe', 'yes', "data-width='550'");?> - id", $group, 'list', 'copy', '', 'iframe', 'yes', "data-width='550'");?> + id", $group, 'list', 'copy', '', "iframe $disabled", 'yes', "data-width='550'");?> role != 'limited') { diff --git a/module/user/model.php b/module/user/model.php index 2c19e719c0..3448cd0be5 100644 --- a/module/user/model.php +++ b/module/user/model.php @@ -760,10 +760,12 @@ class userModel extends model $groups = $this->dao->select('t1.acl')->from(TABLE_GROUP)->alias('t1') ->leftJoin(TABLE_USERGROUP)->alias('t2')->on('t1.id=t2.group') ->where('t2.account')->eq($account) + ->andWhere('t1.program')->eq(0) ->andWhere('role')->ne('limited') ->fetchAll(); $acls = array(); $viewAllow = false; + $programAllow = false; $productAllow = false; $projectAllow = false; $actionAllow = false; @@ -772,6 +774,7 @@ class userModel extends model $acl = json_decode($group->acl, true); if(empty($group->acl)) { + $programAllow = true; $productAllow = true; $projectAllow = true; $viewAllow = true; @@ -779,6 +782,7 @@ class userModel extends model break; } + if(empty($acl['programs'])) $programAllow = true; if(empty($acl['products'])) $productAllow = true; if(empty($acl['projects'])) $projectAllow = true; if(empty($acl['views'])) $viewAllow = true; @@ -790,19 +794,23 @@ class userModel extends model } if(!empty($acl['views'])) $acls['views'] = array_merge($acls['views'], $acl['views']); + if(!empty($acl['programs'])) $acls['programs'] = !empty($acls['programs']) ? array_merge($acls['programs'], $acl['programs']) : $acl['programs']; if(!empty($acl['products'])) $acls['products'] = !empty($acls['products']) ? array_merge($acls['products'], $acl['products']) : $acl['products']; if(!empty($acl['projects'])) $acls['projects'] = !empty($acls['projects']) ? array_merge($acls['projects'], $acl['projects']) : $acl['projects']; if(!empty($acl['actions'])) $acls['actions'] = !empty($acls['actions']) ? ($acl['actions'] + $acls['actions']) : $acl['actions']; } + if($programAllow) $acls['programs'] = array(); if($productAllow) $acls['products'] = array(); if($projectAllow) $acls['projects'] = array(); if($viewAllow) $acls['views'] = array(); if($actionAllow) unset($acls['actions']); - $sql = $this->dao->select('module, method')->from(TABLE_USERGROUP)->alias('t1')->leftJoin(TABLE_GROUPPRIV)->alias('t2') - ->on('t1.group = t2.group') - ->where('t1.account')->eq($account); + $sql = $this->dao->select('module, method')->from(TABLE_GROUP)->alias('t1') + ->leftJoin(TABLE_USERGROUP)->alias('t2')->on('t1.id = t2.group') + ->leftJoin(TABLE_GROUPPRIV)->alias('t3')->on('t2.group = t3.group') + ->where('t2.account')->eq($account) + ->andWhere('t1.program')->eq(0); } $stmt = $sql->query(); @@ -811,7 +819,11 @@ class userModel extends model { $rights[strtolower($row['module'])][strtolower($row['method'])] = true; } - return array('rights' => $rights, 'acls' => $acls); + + /* Get can manage programs by user. */ + $pgmAdminGroupID = $this->dao->select('id')->from(TABLE_GROUP)->where('role')->eq('pgmadmin')->fetch('id'); + $canManagePrograms = $this->dao->select('program')->from(TABLE_USERGROUP)->where('`group`')->eq($pgmAdminGroupID)->andWhere('account')->eq($account)->fetch('program'); + return array('rights' => $rights, 'acls' => $acls, 'programs' => $canManagePrograms); } /**