From 3f0aeaf173137b4da9d2f187f81e282e65dc3bb5 Mon Sep 17 00:00:00 2001
From: wangyidong <wyd621@163.com>
Date: Tue, 6 Jul 2021 13:34:44 +0800
Subject: [PATCH]  * finish task #39793.

---
 db/update15.0.3.sql        | 1 +
 module/execution/model.php | 8 +++++++-
 module/user/model.php      | 3 +--
 3 files changed, 9 insertions(+), 3 deletions(-)
 create mode 100644 db/update15.0.3.sql

diff --git a/db/update15.0.3.sql b/db/update15.0.3.sql
new file mode 100644
index 0000000000..4942e2cafa
--- /dev/null
+++ b/db/update15.0.3.sql
@@ -0,0 +1 @@
+UPDATE `zt_block` SET `source`='execution' WHERE `source`='project' and `block`='overview';
diff --git a/module/execution/model.php b/module/execution/model.php
index b9454ddf2e..69961cf559 100644
--- a/module/execution/model.php
+++ b/module/execution/model.php
@@ -958,6 +958,7 @@ class executionModel extends model
             ->beginIF($projectID && $this->config->systemMode == 'new')->andWhere('project')->eq($projectID)->fi()
             ->beginIF($type != 'all' && $this->config->systemMode == 'new')->andWhere('type')->eq($type)->fi()
             ->beginIF(strpos($mode, 'withdelete') === false)->andWhere('deleted')->eq(0)->fi()
+            ->beginIF(!$this->app->user->admin)->andWhere('project')->in($this->app->user->view->projects)->fi()
             ->beginIF(!$this->app->user->admin and strpos($mode, 'all') === false)->andWhere('id')->in($this->app->user->view->sprints)->fi()
             ->orderBy($orderBy)
             ->fetchAll();
@@ -1021,6 +1022,7 @@ class executionModel extends model
                 ->beginIF($status == 'undone')->andWhere('t2.status')->notIN('done,closed')->fi()
                 ->beginIF($branch)->andWhere('t1.branch')->eq($branch)->fi()
                 ->beginIF($status != 'all' and $status != 'undone')->andWhere('status')->in($status)->fi()
+                ->beginIF(!$this->app->user->admin)->andWhere('t2.project')->in($this->app->user->view->projects)->fi()
                 ->beginIF(!$this->app->user->admin)->andWhere('t2.id')->in($this->app->user->view->sprints)->fi()
                 ->orderBy('order_desc')
                 ->beginIF($limit)->limit($limit)->fi()
@@ -1035,6 +1037,7 @@ class executionModel extends model
                 ->beginIF($projectID)->andWhere('project')->eq($projectID)->fi()
                 ->beginIF($status == 'undone')->andWhere('status')->notIN('done,closed')->fi()
                 ->beginIF($status != 'all' and $status != 'undone')->andWhere('status')->in($status)->fi()
+                ->beginIF(!$this->app->user->admin)->andWhere('project')->in($this->app->user->view->projects)->fi()
                 ->beginIF(!$this->app->user->admin)->andWhere('id')->in($this->app->user->view->sprints)->fi()
                 ->orderBy('order_desc')
                 ->beginIF($limit)->limit($limit)->fi()
@@ -1063,6 +1066,7 @@ class executionModel extends model
                 ->where('t1.product')->eq($productID)
                 ->andWhere('t2.deleted')->eq(0)
                 ->beginIF($branch)->andWhere('t1.branch')->eq($branch)->fi()
+                ->beginIF(!$this->app->user->admin)->andWhere('t2.project')->in($this->app->user->view->projects)->fi()
                 ->beginIF(!$this->app->user->admin)->andWhere('t2.id')->in($this->app->user->view->sprints)->fi()
                 ->andWhere('t2.openedBy', true)->eq($this->app->user->account)
                 ->orWhere('t3.account')->eq($this->app->user->account)
@@ -1078,6 +1082,7 @@ class executionModel extends model
             return $this->dao->select('t1.*, IF(INSTR(" done,closed", t1.status) < 2, 0, 1) AS isDone')->from(TABLE_EXECUTION)->alias('t1')
                 ->leftJoin(TABLE_TEAM)->alias('t2')->on('t2.root=t1.id')
                 ->where('t1.deleted')->eq(0)
+                ->beginIF(!$this->app->user->admin)->andWhere('t1.project')->in($this->app->user->view->projects)->fi()
                 ->beginIF(!$this->app->user->admin)->andWhere('t1.id')->in($this->app->user->view->sprints)->fi()
                 ->andWhere('t1.openedBy', true)->eq($this->app->user->account)
                 ->orWhere('t2.account')->eq($this->app->user->account)
@@ -1372,9 +1377,10 @@ class executionModel extends model
      */
     public function getProductGroupList()
     {
-        $list = $this->dao->select('t1.id, t1.name,t1.status, t2.product')->from(TABLE_EXECUTION)->alias('t1')
+        $list = $this->dao->select('t1.id,t1.name,t1.status,t2.product')->from(TABLE_EXECUTION)->alias('t1')
             ->leftJoin(TABLE_PROJECTPRODUCT)->alias('t2')->on('t1.id = t2.project')
             ->where('t1.deleted')->eq(0)
+            ->beginIF(!$this->app->user->admin)->andWhere('t1.project')->in($this->app->user->view->projects)->fi()
             ->beginIF(!$this->app->user->admin)->andWhere('t1.id')->in($this->app->user->view->sprints)->fi()
             ->fetchGroup('product');
 
diff --git a/module/user/model.php b/module/user/model.php
index a2102e7e82..1bc2a643ab 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -2151,9 +2151,8 @@ class userModel extends model
                 $stakeholders = zget($stakeholderGroup, $sprint->project, array());
                 $teams        = zget($teamGroups, $sprint->id, array());
                 $whiteList    = zget($whiteListGroup, $sprint->id, array());
-                $parentTeams  = zget($teamGroups, $sprint->project, array());
 
-                $hasPriv = $this->checkSprintPriv($sprint, $account, $stakeholders, array_merge($teams, $parentTeams), $whiteList);
+                $hasPriv = $this->checkSprintPriv($sprint, $account, $stakeholders, $teams, $whiteList);
                 if($hasPriv and strpos(",{$view},", ",{$sprintID},") === false)  $view .= ",{$sprintID}";
                 if(!$hasPriv and strpos(",{$view},", ",{$sprintID},") !== false) $view  = trim(str_replace(",{$sprintID},", ',', ",{$view},"), ',');
             }