* Code for program project product priv.

module/common/model.php

@@ -1554,6 +1554,8 @@ EOD;
             $inProgram = isset($this->lang->navGroup->$module) && $this->lang->navGroup->$module == 'program';
             if(!defined('IN_UPGRADE') and $inProgram)
             {
+                /* Check program priv. */
+                if(strpos(",{$this->app->user->view->programs},", ",{$this->session->program},") === false) $this->loadModel('program')->accessDenied();
                 $this->resetProgramPriv($module, $method);
                 if(!commonModel::hasPriv($module, $method)) $this->deny($module, $method, false);
             }

module/product/model.php

@@ -184,7 +184,7 @@ class productModel extends model
         if(!isset($products[$this->session->product]))
         {
             $this->session->set('product', key($products));
-            //if($productID) $this->accessDenied();
+            if($productID && strpos(",{$this->app->user->view->products},", ",{$this->session->product},") === false) $this->accessDenied();
         }
         if($this->cookie->preProductID != $productID)
         {

module/program/lang/zh-cn.php

@@ -43,7 +43,8 @@ $lang->program->privway         = '权限控制';
 
 $lang->program->manageGroupMember  = '维护分组用户';
 $lang->program->durationEstimation = '工作量估算';
-$lang->program->noProgram = '暂时没有项目';
+$lang->program->noProgram          = '暂时没有项目';
+$lang->program->accessDenied       = '您无权访问该项目！';
 
 $lang->program->unitList[''] = '';
 $lang->program->unitList['yuan']   = '元';

module/program/model.php

@@ -40,6 +40,24 @@ class programModel extends model
             ->fetchPairs();
     }
 
+    /**
+     * Show accessDenied response.
+     *
+     * @access private
+     * @return void
+     */
+    public function accessDenied()
+    {
+        echo(js::alert($this->lang->program->accessDenied));
+
+        if(!$this->server->http_referer) die(js::locate(helper::createLink('program', 'index')));
+
+        $loginLink = $this->config->requestType == 'GET' ? "?{$this->config->moduleVar}=user&{$this->config->methodVar}=login" : "user{$this->config->requestFix}login";
+        if(strpos($this->server->http_referer, $loginLink) !== false) die(js::locate(helper::createLink('program', 'index')));
+
+        die(js::locate('back'));
+    }
+
     public function create()
     {
         $this->lang->project->team = $this->lang->project->teamname;

module/project/model.php

@@ -258,7 +258,7 @@ class projectModel extends model
         if(!isset($projects[$this->session->project]))
         {
             $this->session->set('project', key($projects));
-            //if($projectID) $this->accessDenied();
+            if($projectID && strpos(",{$this->app->user->view->projects},", ",{$this->session->project},") === false) $this->accessDenied();
         }
         return $this->session->project;
     }