diff --git a/module/doc/model.php b/module/doc/model.php index 3fc1aa95f0..98379c3793 100644 --- a/module/doc/model.php +++ b/module/doc/model.php @@ -889,8 +889,8 @@ class docModel extends model if(isset($extraDocLibs[$object->id])) return true; } - if($object->project) return strpos(",{$this->app->user->view->projects},", ",{$object->project},") !== false; - if($object->product) return strpos(",{$this->app->user->view->products},", ",{$object->product},") !== false; + if($object->project) return $this->loadModel('project')->checkPriv($object->project); + if($object->product) return $this->loadModel('product')->checkPriv($object->product); return false; } diff --git a/module/misc/view/links.html.php b/module/misc/view/links.html.php index 0c58149f95..98ba8f73a2 100755 --- a/module/misc/view/links.html.php +++ b/module/misc/view/links.html.php @@ -1,5 +1,6 @@ + misc->zentao->version = $zentaoVersion;?> \ No newline at end of file + diff --git a/module/product/model.php b/module/product/model.php index 29e98534b7..1252e7558c 100644 --- a/module/product/model.php +++ b/module/product/model.php @@ -216,6 +216,8 @@ class productModel extends model */ public function checkPriv($productID) { + if(empty($productID)) return false; + /* Is admin? */ if($this->app->user->admin) return true; return (strpos(",{$this->app->user->view->products},", ",{$productID},") !== false); diff --git a/module/project/model.php b/module/project/model.php index a30b8ff710..04d2450000 100644 --- a/module/project/model.php +++ b/module/project/model.php @@ -25,6 +25,8 @@ class projectModel extends model */ public function checkPriv($projectID) { + if(empty($projectID)) return false; + /* If is admin, return true. */ if($this->app->user->admin) return true; return (strpos(",{$this->app->user->view->projects},", ",{$projectID},") !== false); @@ -822,7 +824,7 @@ class projectModel extends model { if(!$project->product) { - if(strpos(",{$this->app->user->view->projects},", ",{$project->id},") !== false) $noProducts[] = $project; + if($this->checkPriv($project->id)) $noProducts[] = $project; unset($list[$id][$ID]); } } diff --git a/module/upgrade/model.php b/module/upgrade/model.php index b00c1448bb..934ca4e498 100644 --- a/module/upgrade/model.php +++ b/module/upgrade/model.php @@ -236,6 +236,7 @@ class upgradeModel extends model case '10_3_1': $this->execSQL($this->getUpgradeFile('10.3.1')); $this->removeCustomMenu(); + $this->initUserView(); } $this->deletePatch(); @@ -2429,4 +2430,18 @@ class upgradeModel extends model } return !dao::isError(); } + + /** + * Init user view. + * + * @access public + * @return bool + */ + public function initUserView() + { + $users = $this->dao->select('account')->from(TABLE_USER)->fetchAll(); + $this->loadModel('user'); + foreach($users as $user) $this->user->computeUserView($user->account, $force = true); + return true; + } } diff --git a/module/user/model.php b/module/user/model.php index 5c18327228..1e0c172e41 100644 --- a/module/user/model.php +++ b/module/user/model.php @@ -1340,6 +1340,8 @@ class userModel extends model $userView->projects = $grantProjects; } + $userView->products = trim($userView->products, ','); + $userView->projects = trim($userView->projects, ','); return $userView; }