From 30e3940b80785871683e7f373bbf1dafb2b8724d Mon Sep 17 00:00:00 2001
From: zhujinyong <zhujinyong@easycorp.ltd>
Date: Tue, 12 Dec 2023 11:06:59 +0800
Subject: [PATCH] * Fix bug #41288, check access for testtask.

---
 module/testtask/control.php    | 39 +++++++++++++++++++++++++++++++---
 module/testtask/lang/en.php    |  1 +
 module/testtask/lang/zh-cn.php |  1 +
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/module/testtask/control.php b/module/testtask/control.php
index e9b93a151f..dd3e3a950f 100644
--- a/module/testtask/control.php
+++ b/module/testtask/control.php
@@ -295,6 +295,7 @@ class testtask extends control
             if(defined('RUN_MODE') && RUN_MODE == 'api') return $this->send(array('status' => 'fail', 'message' => '404 Not found'));
             return print(js::error($this->lang->notFound) . js::locate($this->createLink('qa', 'index')));
         }
+        $this->checkAccess($task);
 
         /* When the session changes, you need to query the related products again. */
         if($this->session->project != $task->project) $this->view->products = $this->products = $this->product->getProductPairsByProject($task->project);
@@ -444,6 +445,34 @@ class testtask extends control
         $this->display();
     }
 
+    /**
+     * Check access.
+     *
+     * @param  object $testtask
+     * @access private
+     * @return bool
+     */
+    private function checkAccess($testtask)
+    {
+        $canAccess = true;
+
+        $view = $this->app->user->view;
+
+        if(!$this->app->user->admin)
+        {
+            if($testtask->product   && strpos(",{$view->products},", ",$testtask->product,") === false)   $canAccess = false;
+            if($testtask->project   && strpos(",{$view->projects},", ",$testtask->project,") === false)   $canAccess = false;
+            if($testtask->execution && strpos(",{$view->sprints},",  ",$testtask->execution,") === false) $canAccess = false;
+        }
+
+        if($canAccess) return true;
+
+        echo(js::alert($this->lang->testtask->accessDenied));
+        echo js::locate(helper::createLink('testtask', 'browse'));
+
+        return false;
+    }
+
     /**
      * Browse cases of a test task.
      *
@@ -478,6 +507,8 @@ class testtask extends control
         $task = $this->testtask->getById($taskID);
         if(!$task) return print(js::error($this->lang->testtask->checkLinked) . js::locate('back'));
 
+        $this->checkAccess($task);
+
         $productID = $task->product;
         $product   = $this->product->getByID($productID);
         if(!isset($this->products[$productID])) $this->products[$productID] = $product->name;
@@ -605,6 +636,7 @@ class testtask extends control
         $this->view->charts = array();
 
         $task = $this->testtask->getById($taskID);
+        $this->checkAccess($task);
 
         if(!empty($_POST))
         {
@@ -1089,6 +1121,7 @@ class testtask extends control
         $product   = $this->product->getByID($productID);
 
         if(!isset($this->products[$productID])) $this->products[$productID] = $product->name;
+        $this->checkAccess($task);
 
         /* Save session. */
         if($this->app->tab == 'project')
@@ -1662,9 +1695,9 @@ class testtask extends control
     }
 
     /**
-     * AJAX: Get executionID by buildID. 
-     * 
-     * @param  int    $buildID 
+     * AJAX: Get executionID by buildID.
+     *
+     * @param  int    $buildID
      * @access public
      * @return int
      */
diff --git a/module/testtask/lang/en.php b/module/testtask/lang/en.php
index 19c48df28e..ba8cfc5889 100644
--- a/module/testtask/lang/en.php
+++ b/module/testtask/lang/en.php
@@ -156,6 +156,7 @@ $lang->testtask->titleOfAuto       = "%s automated testing";
 $lang->testtask->cannotBeParsed    = 'The content of the imported XML file is in the wrong format and cannot be parsed.';
 $lang->testtask->finishedDateLess  = 'Actual Finished Date cannot be <= Begin Date %s';
 $lang->testtask->finishedDateMore  = 'Actual Finished Date cannot be > Today';
+$lang->testtask->accessDenied      = 'You have no access to the testtask.';
 
 $lang->testtask->assignedToMe  = 'AssignedToMe';
 $lang->testtask->allCases      = 'All Cases';
diff --git a/module/testtask/lang/zh-cn.php b/module/testtask/lang/zh-cn.php
index a020a18c8b..3ec540514a 100644
--- a/module/testtask/lang/zh-cn.php
+++ b/module/testtask/lang/zh-cn.php
@@ -156,6 +156,7 @@ $lang->testtask->titleOfAuto       = "%s 自动化测试";
 $lang->testtask->cannotBeParsed    = '导入的XML文件内容格式错误，无法解析。';
 $lang->testtask->finishedDateLess  = '实际完成日期不能小于开始日期%s';
 $lang->testtask->finishedDateMore  = '实际完成日期不能大于今天';
+$lang->testtask->accessDenied      = '您无权访问该测试单';
 
 $lang->testtask->assignedToMe  = '指派给我';
 $lang->testtask->allCases      = '全部用例';