From 8e159a56e5db814ac44cd00036458f620efc0eca Mon Sep 17 00:00:00 2001
From: sgm0422 <976204163@qq.com>
Date: Wed, 1 Jul 2020 15:06:21 +0800
Subject: [PATCH] * Code for program project product priv.

---
 module/common/model.php       |  2 ++
 module/product/model.php      |  2 +-
 module/program/lang/zh-cn.php |  3 ++-
 module/program/model.php      | 18 ++++++++++++++++++
 module/project/model.php      |  2 +-
 5 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/module/common/model.php b/module/common/model.php
index ae3bacdddb..0103590ed1 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -1554,6 +1554,8 @@ EOD;
             $inProgram = isset($this->lang->navGroup->$module) && $this->lang->navGroup->$module == 'program';
             if(!defined('IN_UPGRADE') and $inProgram)
             {
+                /* Check program priv. */
+                if(strpos(",{$this->app->user->view->programs},", ",{$this->session->program},") === false) $this->loadModel('program')->accessDenied();
                 $this->resetProgramPriv($module, $method);
                 if(!commonModel::hasPriv($module, $method)) $this->deny($module, $method, false);
             }
diff --git a/module/product/model.php b/module/product/model.php
index 08df3ad29c..4178a35dfd 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -184,7 +184,7 @@ class productModel extends model
         if(!isset($products[$this->session->product]))
         {
             $this->session->set('product', key($products));
-            //if($productID) $this->accessDenied();
+            if($productID && strpos(",{$this->app->user->view->products},", ",{$this->session->product},") === false) $this->accessDenied();
         }
         if($this->cookie->preProductID != $productID)
         {
diff --git a/module/program/lang/zh-cn.php b/module/program/lang/zh-cn.php
index 0807b3c10a..26f265c58d 100644
--- a/module/program/lang/zh-cn.php
+++ b/module/program/lang/zh-cn.php
@@ -43,7 +43,8 @@ $lang->program->privway         = '权限控制';
 
 $lang->program->manageGroupMember  = '维护分组用户';
 $lang->program->durationEstimation = '工作量估算';
-$lang->program->noProgram = '暂时没有项目';
+$lang->program->noProgram          = '暂时没有项目';
+$lang->program->accessDenied       = '您无权访问该项目！';
 
 $lang->program->unitList[''] = '';
 $lang->program->unitList['yuan']   = '元';
diff --git a/module/program/model.php b/module/program/model.php
index 5f620c3303..1305a157ea 100644
--- a/module/program/model.php
+++ b/module/program/model.php
@@ -40,6 +40,24 @@ class programModel extends model
             ->fetchPairs();
     }
 
+    /**
+     * Show accessDenied response.
+     *
+     * @access private
+     * @return void
+     */
+    public function accessDenied()
+    {
+        echo(js::alert($this->lang->program->accessDenied));
+
+        if(!$this->server->http_referer) die(js::locate(helper::createLink('program', 'index')));
+
+        $loginLink = $this->config->requestType == 'GET' ? "?{$this->config->moduleVar}=user&{$this->config->methodVar}=login" : "user{$this->config->requestFix}login";
+        if(strpos($this->server->http_referer, $loginLink) !== false) die(js::locate(helper::createLink('program', 'index')));
+
+        die(js::locate('back'));
+    }
+
     public function create()
     {
         $this->lang->project->team = $this->lang->project->teamname;
diff --git a/module/project/model.php b/module/project/model.php
index fbbca7e099..c1c0469c74 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -258,7 +258,7 @@ class projectModel extends model
         if(!isset($projects[$this->session->project]))
         {
             $this->session->set('project', key($projects));
-            //if($projectID) $this->accessDenied();
+            if($projectID && strpos(",{$this->app->user->view->projects},", ",{$this->session->project},") === false) $this->accessDenied();
         }
         return $this->session->project;
     }