From e4a272478d75232471efa9d5d860c754439bdea9 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:44:51 +0000 Subject: [PATCH 01/10] * [task#144514,doing,0.5h] Disabled edit button in view page. --- lib/zin/wg/docapp/js/v1.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/zin/wg/docapp/js/v1.js b/lib/zin/wg/docapp/js/v1.js index 05b96d2a51..646f421ec8 100644 --- a/lib/zin/wg/docapp/js/v1.js +++ b/lib/zin/wg/docapp/js/v1.js @@ -891,7 +891,7 @@ const actionsMap = const isToolbar = info.ui === 'toolbar'; const actions = [ isToolbar ? {hint: docApp.fullscreen ? lang.exitFullscreen : lang.enterFullscreen, icon: docApp.fullscreen ? 'fullscreen-exit' : 'fullscreen', command: 'toggleFullscreen'} : null, - canEditDoc ? {icon: 'edit', type: 'ghost text-primary', hint: lang.edit, rounded: 'lg', command: 'startEditDoc'} : null, + canEditDoc ? {icon: 'edit', type: doc.editable ? 'ghost text-primary' : 'ghost text-gray', hint: doc.editable ? lang.edit : lang.needEditable, rounded: 'lg', command: doc.editable ? 'startEditDoc' : null} : null, (isToolbar && docApp.props.showDocOutline !== false) ? {hint: lang.docOutline, icon: 'list-box', command: 'toggleViewSideTab/outline'} : null, (isToolbar && docApp.props.showDocHistory !== false) ? {hint: lang.history, icon: 'history', command: 'toggleViewSideTab/history'} : null, moreItems.length ? {icon: 'icon-ellipsis-v', type: 'dropdown', rounded: 'lg', placement: 'bottom-end', caret: false, items: moreItems} : null, From 2b178b48aec2450266bd0064c447a07317000ea7 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:50:13 +0000 Subject: [PATCH 02/10] * [task#144514,doing, 0.1h] Check createTemplate priviledge when visit editTemplate. --- module/common/model.php | 1 + 1 file changed, 1 insertion(+) diff --git a/module/common/model.php b/module/common/model.php index 3f6e308ac7..18c833ff94 100644 --- a/module/common/model.php +++ b/module/common/model.php @@ -1195,6 +1195,7 @@ eof; if($module == 'product' and $method == 'browse' and !empty($this->app->params['storyType']) and $this->app->params['storyType'] != 'story') $method = $this->app->params['storyType']; if($module == 'productplan' && ($method == 'story' || $method == 'bug')) $method = 'view'; + if($module == 'doc' && $method == 'editTemplate') $method = 'createTemplate'; $openMethods = array( 'user' => array('deny', 'logout'), From 58a201c305c20191239d98d4a81b32b98166798a Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:50:57 +0000 Subject: [PATCH 03/10] * [task#144514,doing,0.5h] User with editTemplate priviledge can edit open templates. --- module/doc/model.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/module/doc/model.php b/module/doc/model.php index 38dc0d61cb..955036fe48 100644 --- a/module/doc/model.php +++ b/module/doc/model.php @@ -871,13 +871,14 @@ class docModel extends model $doc->editable = false; $isOpen = $doc->acl == 'open'; - $isAuthorOrAdmin = $doc->acl == 'private' && ($doc->addedBy == $currentAccount || ($this->app->user->admin && $spaceType !== 'mine')); + $isAuthorOrAdmin = $doc->addedBy == $currentAccount || ($this->app->user->admin && $spaceType !== 'mine'); $isInReadUsers = strpos(",$doc->readUsers,", ",$currentAccount,") !== false; $isInEditUsers = strpos(",$doc->users,", ",$currentAccount,") !== false; if($isOpen || $isAuthorOrAdmin || $isInReadUsers || $isInEditUsers) { $doc->editable = $isOpen || $isAuthorOrAdmin || $isInEditUsers; $doc->readable = $isOpen || $isAuthorOrAdmin || $isInReadUsers || $doc->editable; + if($spaceType == 'template') $doc->editable = ($isOpen && common::hasPriv('doc', 'editTemplate')) || $isAuthorOrAdmin || $isInEditUsers; } elseif(!empty($doc->groups) || !empty($doc->readGroups)) { From 6030f320538ae7c0ece0979448cefd8d35e66ead Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:54:11 +0000 Subject: [PATCH 04/10] * [task#144514,doing,0.5h] Author and users whith editTemplate priviledge can edit templates. --- module/doc/ui/templatehome.html.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/doc/ui/templatehome.html.php b/module/doc/ui/templatehome.html.php index 72f4b6596c..809ff118fb 100644 --- a/module/doc/ui/templatehome.html.php +++ b/module/doc/ui/templatehome.html.php @@ -32,7 +32,7 @@ $buildScopeCards = function($templates) use ($lang, $allTemplates) $deleteLink = createLink('doc', 'deleteTemplate', "templateID=$template->id"); $actions = array(); - if(hasPriv('doc', 'editTemplate')) $actions[] = array('icon' => 'edit', 'text' => $this->lang->docTemplate->edit, 'url' => $editLink); + if($template->addedBy == $this->app->user->account || hasPriv('doc', 'editTemplate')) $actions[] = array('icon' => 'edit', 'text' => $this->lang->docTemplate->edit, 'url' => $editLink); if(hasPriv('doc', 'deleteTemplate')) $actions[] = array('icon' => 'trash', 'text' => $this->lang->docTemplate->delete, 'url' => $deleteLink, 'data-confirm' => $hasChildren ? $this->lang->docTemplate->confirmDeleteTemplateWithSub : $this->lang->docTemplate->confirmDelete); $cardItems[] = div From 0bdf1c2ae264f1ae8fd38a3c9e27f6e6917ea48a Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:55:11 +0000 Subject: [PATCH 05/10] * [task#144514,doing,0.1h] Users with createTemplate has editTemplate priviledge. --- module/doc/ui/templatelist.html.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/doc/ui/templatelist.html.php b/module/doc/ui/templatelist.html.php index af81afcc9e..6fe55a5a1f 100644 --- a/module/doc/ui/templatelist.html.php +++ b/module/doc/ui/templatelist.html.php @@ -18,7 +18,7 @@ $data['modules'] = $this->doc->getTemplateModules(); $privs = array(); $privs['create'] = hasPriv('doc', 'createTemplate'); -$privs['edit'] = hasPriv('doc', 'editTemplate'); +$privs['edit'] = hasPriv('doc', 'createTemplate'); $privs['delete'] = hasPriv('doc', 'deleteTemplate'); $privs['view'] = hasPriv('doc', 'viewTemplate'); $privs['addModule'] = hasPriv('doc', 'addTemplateType'); From 3e9ce80a87b57f0ca15787fd476d0f6de53aa385 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 05:56:47 +0000 Subject: [PATCH 06/10] * [task#144514,done,0.1h] CreateTemplate priviledge do not depend on editTemplate priviledge. --- module/group/packagemanager.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/group/packagemanager.php b/module/group/packagemanager.php index 9ac126b090..96f3c9a691 100644 --- a/module/group/packagemanager.php +++ b/module/group/packagemanager.php @@ -2960,7 +2960,7 @@ $config->group->package->manageDoctemplate = new stdclass(); $config->group->package->manageDoctemplate->order = 15; $config->group->package->manageDoctemplate->subset = 'doctemplate'; $config->group->package->manageDoctemplate->privs = array(); -$config->group->package->manageDoctemplate->privs['doc-createTemplate'] = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate', 'doc-editTemplate'), 'recommend' => array()); +$config->group->package->manageDoctemplate->privs['doc-createTemplate'] = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array()); $config->group->package->manageDoctemplate->privs['doc-editTemplate'] = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array('doc-createTemplate', 'doc-moveTemplate')); $config->group->package->manageDoctemplate->privs['doc-moveTemplate'] = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array('doc-createTemplate', 'doc-editTemplate')); $config->group->package->manageDoctemplate->privs['doc-addTemplateType'] = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-editTemplateType'), 'recommend' => array('doc-deleteTemplateType')); From 7221aa9bed491a15378856e8c497fbde24faddf6 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 06:37:13 +0000 Subject: [PATCH 07/10] * [task#144514,done,0.5h] Add setDocPriv test. --- module/doc/test/lib/doc.unittest.class.php | 19 +++++ module/doc/test/model/setdocpriv.php | 90 ++++++++++++++++++++++ 2 files changed, 109 insertions(+) create mode 100755 module/doc/test/model/setdocpriv.php diff --git a/module/doc/test/lib/doc.unittest.class.php b/module/doc/test/lib/doc.unittest.class.php index ca3312c335..a29fd8ea6f 100644 --- a/module/doc/test/lib/doc.unittest.class.php +++ b/module/doc/test/lib/doc.unittest.class.php @@ -1808,4 +1808,23 @@ class docTest { return $this->objectModel->copyTemplate($templateIdList); } + + /** + * 设置文档的权限。 + * Set document priviledge test. + * + * @param object $doc + * @param string $spaceType + * @access public + * @return object + */ + public function setDocPrivTest(object $doc, string $spaceType = 'mine'): object + { + $doc = $this->objectModel->setDocPriv($doc, $spaceType); + + $doc->readable = $doc->readable ? '1' : '0'; + $doc->editable = $doc->editable ? '1' : '0'; + + return $doc; + } } diff --git a/module/doc/test/model/setdocpriv.php b/module/doc/test/model/setdocpriv.php new file mode 100755 index 0000000000..9b50ab4147 --- /dev/null +++ b/module/doc/test/model/setdocpriv.php @@ -0,0 +1,90 @@ +#!/usr/bin/env php +copyTemplate(); +timeout=0 +cid=1 + +- 超级管理员可以查看和编辑自己的文档 + - 属性readable @1 + - 属性editable @1 +- 超级管理员可以查看和编辑其他用户的公共文档 + - 属性readable @1 + - 属性editable @1 +- 作者可以查看和编辑自己的私有文档 + - 属性readable @1 + - 属性editable @1 +- 用户不可以查看和编辑别人的私有文档 + - 属性readable @0 + - 属性editable @0 +- 用户不能编辑不在编辑白名单列表中的别人的私有文档 + - 属性readable @1 + - 属性editable @0 +- 用户可以查看和编辑自己在编辑白名单列表中的别人的私有文档 + - 属性readable @1 + - 属性editable @1 + +*/ + +include dirname(__FILE__, 5) . '/test/lib/init.php'; +include dirname(__FILE__, 2) . '/lib/doc.unittest.class.php'; + +su('admin'); + +$doc = new stdclass(); +$doc->acl = 'open'; +$doc->addedBy = 'admin'; +$doc->readUsers = 'admin'; +$doc->users = 'admin'; +$doc->groups = ''; +$doc->readGroups = '1,2'; + +$docTester = new docTest(); +r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1'); // 超级管理员可以查看和编辑自己的文档 + +$doc->acl = 'open'; +$doc->addedBy = 'user1'; +$doc->readUsers = ''; +$doc->users = ''; +$doc->groups = ''; +$doc->readGroups = ''; + +r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1'); // 超级管理员可以查看和编辑其他用户的公共文档 + +su('user1'); + +$doc->acl = 'private'; +$doc->addedBy = 'user1'; +$doc->readUsers = ''; +$doc->users = ''; +$doc->groups = ''; +$doc->readGroups = ''; + +r($docTester->setDocPrivTest($doc, 'mine')) && p('readable,editable') && e('1,1'); // 作者可以查看和编辑自己的私有文档 + +$doc->acl = 'private'; +$doc->addedBy = 'user2'; +$doc->readUsers = ''; +$doc->users = ''; +$doc->groups = ''; +$doc->readGroups = ''; + +r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('0,0'); // 用户不可以查看和编辑别人的私有文档 + +$doc->addedBy = 'user2'; +$doc->readUsers = 'user1'; +$doc->users = ''; +$doc->groups = ''; +$doc->readGroups = ''; + +r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,0'); // 用户不能编辑不在编辑白名单列表中的别人的私有文档 + +$doc->addedBy = 'user2'; +$doc->readUsers = ''; +$doc->users = 'user1'; +$doc->groups = ''; +$doc->readGroups = ''; + +r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1'); // 用户可以查看和编辑自己在编辑白名单列表中的别人的私有文档 \ No newline at end of file From 576c79e63d6b1d25672a3a679cc0da697a23071b Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 06:46:27 +0000 Subject: [PATCH 08/10] * [task#144514,done,0.5h] Add test items. --- module/common/test/model/checkpriv.php | 48 ++++++++++++++++++++++++-- 1 file changed, 46 insertions(+), 2 deletions(-) diff --git a/module/common/test/model/checkpriv.php b/module/common/test/model/checkpriv.php index 18f6b5b203..4aaff9fb84 100755 --- a/module/common/test/model/checkpriv.php +++ b/module/common/test/model/checkpriv.php @@ -10,8 +10,11 @@ title=测试 commonModel::checkPriv(); timeout=0 cid=1 -- 用户没有权限时，返回跳转的URL @{"load":"-checkpriv.php?m=user&f=deny&module=user&method=create"}没有权限 +- 用户没有权限时，返回跳转的URL @{"load":"user-deny-user-create.html"}没有权限 +- 用户没有权限时，返回跳转的URL @{"load":"user-deny-productplan-view.html"}没有权限 - 用户有权限时，返回TRUE @1 +- 不需要判断权限的，返回TRUE @1 +- 用户正在修改密码时，跳转到修改密码页面 @0 */ @@ -36,6 +39,20 @@ catch (Exception $e) r($result) && p() && e('{"load":"user-deny-user-create.html"}没有权限'); // 用户没有权限时，返回跳转的URL +$app->moduleName = 'productplan'; +$app->methodName = 'bug'; + +try +{ + $result = $tester->loadModel('common')->checkPriv(); +} +catch (Exception $e) +{ + $result = '没有权限'; +} + +r($result) && p() && e('{"load":"user-deny-productplan-view.html"}没有权限'); // 用户没有权限时，返回跳转的URL + $app->moduleName = 'user'; $app->methodName = 'login'; @@ -50,4 +67,31 @@ catch (Exception $e) r($result) && p() && e('1'); // 用户有权限时，返回TRUE -unset($_SERVER['HTTP_X_REQUESTED_WITH']); +$app->moduleName = 'block'; +$app->methodName = 'dashboard'; + +try +{ + $result = $tester->loadModel('common')->checkPriv(); +} +catch (Exception $e) +{ + $result = '没有权限'; +} + +r($result) && p() && e('1'); // 不需要判断权限的，返回TRUE + +$app->user->modifyPassword = true; + +try +{ + $result = $tester->loadModel('common')->checkPriv(); +} +catch (Exception $e) +{ + $result = '没有权限'; +} + +r($result) && p() && e('0'); // 用户正在修改密码时，跳转到修改密码页面 + +unset($_SERVER['HTTP_X_REQUESTED_WITH']); \ No newline at end of file From ee599e94514b67a5b57e8f60810bf9e415206c89 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 06:53:00 +0000 Subject: [PATCH 09/10] * [task#144514,done,0.1h] Generate user data. --- module/doc/test/model/setdocpriv.php | 1 + 1 file changed, 1 insertion(+) diff --git a/module/doc/test/model/setdocpriv.php b/module/doc/test/model/setdocpriv.php index 9b50ab4147..bfd59664c2 100755 --- a/module/doc/test/model/setdocpriv.php +++ b/module/doc/test/model/setdocpriv.php @@ -31,6 +31,7 @@ cid=1 include dirname(__FILE__, 5) . '/test/lib/init.php'; include dirname(__FILE__, 2) . '/lib/doc.unittest.class.php'; +zenData('user')->gen(5); su('admin'); $doc = new stdclass(); From 5e2d3af396fd1d780c1a7438d3df38686aa0cf57 Mon Sep 17 00:00:00 2001 From: daitingting Date: Tue, 10 Jun 2025 07:01:05 +0000 Subject: [PATCH 10/10] * [task#144514,done,0.5h] Adjust checkpriv test. --- module/common/test/model/checkpriv.php | 31 ++++++++++++++------------ 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/module/common/test/model/checkpriv.php b/module/common/test/model/checkpriv.php index 4aaff9fb84..dd12173ccc 100755 --- a/module/common/test/model/checkpriv.php +++ b/module/common/test/model/checkpriv.php @@ -12,9 +12,9 @@ cid=1 - 用户没有权限时，返回跳转的URL @{"load":"user-deny-user-create.html"}没有权限 - 用户没有权限时，返回跳转的URL @{"load":"user-deny-productplan-view.html"}没有权限 +- 判断工作流方法的权限，用户没有权限时，返回跳转的URL @{"load":"user-deny-flowModule-flowMethod.html"}没有权限 - 用户有权限时，返回TRUE @1 - 不需要判断权限的，返回TRUE @1 -- 用户正在修改密码时，跳转到修改密码页面 @0 */ @@ -53,6 +53,22 @@ catch (Exception $e) r($result) && p() && e('{"load":"user-deny-productplan-view.html"}没有权限'); // 用户没有权限时，返回跳转的URL +$app->isFlow = true; +$app->rawModule = 'flowModule'; +$app->rawMethod = 'flowMethod'; + +try +{ + $result = $tester->loadModel('common')->checkPriv(); +} +catch (Exception $e) +{ + $result = '没有权限'; +} + +r($result) && p() && e('{"load":"user-deny-flowModule-flowMethod.html"}没有权限'); // 判断工作流方法的权限，用户没有权限时，返回跳转的URL + +$app->isFlow = false; $app->moduleName = 'user'; $app->methodName = 'login'; @@ -81,17 +97,4 @@ catch (Exception $e) r($result) && p() && e('1'); // 不需要判断权限的，返回TRUE -$app->user->modifyPassword = true; - -try -{ - $result = $tester->loadModel('common')->checkPriv(); -} -catch (Exception $e) -{ - $result = '没有权限'; -} - -r($result) && p() && e('0'); // 用户正在修改密码时，跳转到修改密码页面 - unset($_SERVER['HTTP_X_REQUESTED_WITH']); \ No newline at end of file