Merge branch 'sprint/165_wangyidong' into 'sprint/165'

* finish task #42846.

See merge request easycorp/zentaopms!41

framework/base/router.class.php

@@ -898,7 +898,7 @@ class baseRouter
      */
     public function setOpenApp()
     {
-        if(isset($_COOKIE['tab']) and $_COOKIE['tab'])
+        if(isset($_COOKIE['tab']) and $_COOKIE['tab'] and preg_match('/^\w+$/', $_COOKIE['tab']))
         {
             $this->tab = $_COOKIE['tab'];
         }

module/common/model.php

@@ -708,7 +708,7 @@ class commonModel extends model
         }
 
         /* Fix bug 14574. */
-        if(array_slice($items, -1)[0] == 'divider') array_pop($items);
+        if(end($items) == 'divider') array_pop($items);
 
         return $items;
     }
@@ -1921,18 +1921,6 @@ EOD;
         if(isset($this->app->user))
         {
             $this->app->user = $this->session->user;
-
-            $inProject = (isset($this->lang->navGroup->$module) && $this->lang->navGroup->$module == 'project');
-            if(!defined('IN_UPGRADE') and $inProject)
-            {
-                /* Check program priv. */
-                $viewProjects = trim($this->app->user->view->projects, ',');
-                $accessDenied = ($this->session->project and $viewProjects and strpos(",{$viewProjects},", ",{$this->session->project},") === false);
-                if($accessDenied and !$this->app->user->admin) $this->loadModel('project')->accessDenied();
-                $this->resetProgramPriv($module, $method);
-                if(!commonModel::hasPriv($module, $method)) $this->deny($module, $method, false);
-            }
-
             if(!commonModel::hasPriv($module, $method)) $this->deny($module, $method);
         }
         else
@@ -2001,20 +1989,19 @@ EOD;
     }
 
     /**
-     * Reset program priv.
+     * Reset project priv.
      *
-     * @param  string $module
-     * @param  string $method
-     * @static
+     * @param  int    $projectID
      * @access public
      * @return void
      */
-    public function resetProgramPriv($module, $method)
+    public function resetProjectPriv($projectID = 0)
     {
         /* Get user program priv. */
-        if(!$this->app->session->project) return;
+        if(empty($projectID) and $this->session->project) $projectID = $this->session->project;
+        if(empty($projectID)) return;
 
-        $program = $this->dao->findByID($this->app->session->project)->from(TABLE_PROJECT)->fetch();
+        $program = $this->dao->findByID($projectID)->from(TABLE_PROJECT)->fetch();
         if(empty($program)) return;
 
         $programRights = $this->dao->select('t3.module, t3.method')->from(TABLE_GROUP)->alias('t1')
@@ -2030,18 +2017,30 @@ EOD;
         foreach($programRights as $programRight) $programRightGroup[$programRight->module][$programRight->method] = 1;
 
         /* Reset priv by program privway. */
-        $this->app->user->rights = $this->loadModel('user')->authorize($this->app->user->account);
         $rights = $this->app->user->rights['rights'];
+        $this->app->user  = clone $_SESSION['user'];
+
         if($program->auth == 'extend') $this->app->user->rights['rights'] = array_merge_recursive($programRightGroup, $rights);
         if($program->auth == 'reset')
         {
+            $recomputedRights = $this->loadModel('user')->authorize($this->app->user->account);
+            $recomputedRights = $recomputedRights['rights'];
+
             /* If priv way is reset, unset common program priv, and cover by program priv. */
             foreach($rights as $moduleKey => $methods)
             {
                 if(in_array($moduleKey, $this->config->programPriv->waterfall)) unset($rights[$moduleKey]);
             }
 
-            $this->app->user->rights['rights'] = array_merge($rights, $programRightGroup);
+            $recomputedRights = array_merge($rights, $programRightGroup);
+
+            /* Set base priv for project. */
+            $projectRights = zget($this->app->user->rights['rights'], 'project', array());
+            if(isset($projectRights['browse']) and !isset($recomputedRights['project']['browse'])) $recomputedRights['project']['browse'] = 1;
+            if(isset($projectRights['kanban']) and !isset($recomputedRights['project']['kanban'])) $recomputedRights['project']['kanban'] = 1;
+            if(isset($projectRights['index'])  and !isset($recomputedRights['project']['index']))  $recomputedRights['project']['index']  = 1;
+
+            $this->app->user->rights['rights'] = $recomputedRights;
         }
     }
 

module/compile/model.php

@@ -144,8 +144,9 @@ class compileModel extends model
             $this->dao->update(TABLE_COMPILE)->set('tag')->eq($lastTag)->where('id')->eq($compile->id)->exec();
         }
 
-        if($job->engine == 'gitlab')  $compile = $this->loadModel('job')->execGitlabPipeline($job, $compileID);
-        if($job->engine == 'jenkins') $compile = $this->job->execJenkinsPipeline($job, $repo, $compile->id);
+        $this->loadModel('job');
+        if($job->engine == 'gitlab')  $compile = $this->job->execGitlabPipeline($job, $compileID);
+        if($job->engine == 'jenkins') $compile = $this->job->execJenkinsPipeline($job, $repo, $compileID);
 
         $this->dao->update(TABLE_COMPILE)->data($compile)->where('id')->eq($compileID)->exec();
         $this->dao->update(TABLE_JOB)

module/execution/model.php

@@ -1234,10 +1234,24 @@ class executionModel extends model
             $executions = $executionList;
         }
 
+        $projects = array();
+        if(empty($projectID))
+        {
+            $projects = $this->dao->select('t1.id,t1.name')->from(TABLE_PROJECT)->alias('t1')
+                ->leftJoin(TABLE_EXECUTION)->alias('t2')->on('t1.id=t2.project')
+                ->where('t2.id')->in(array_keys($executions))
+                ->fetchPairs('id', 'name');
+        }
+
         if($pairs)
         {
             $executionPairs = array();
-            foreach($executions as $execution) $executionPairs[$execution->id] = $execution->name;
+            foreach($executions as $execution)
+            {
+                $executionPairs[$execution->id] = '';
+                if(isset($projects[$execution->project])) $executionPairs[$execution->id] .= $projects[$execution->project] . ' / ';
+                $executionPairs[$execution->id] .= $execution->name;
+            }
             $executions = $executionPairs;
         }
 

module/project/model.php

@@ -126,6 +126,12 @@ class projectModel extends model
             if($projectID && strpos(",{$this->app->user->view->projects},", ",{$this->session->project},") === false) $this->accessDenied();
         }
 
+        /* Reset program priv. */
+        $moduleName = $this->app->getModuleName();
+        $methodName = $this->app->getMethodName();
+        $this->loadModel('common')->resetProjectPriv($this->session->project);
+        if(!commonModel::hasPriv($moduleName, $methodName)) $this->common->deny($moduleName, $methodName, false);
+
         return $this->session->project;
     }
 

module/search/control.php

@@ -70,7 +70,24 @@ class search extends control
     public function buildQuery()
     {
         $this->search->buildQuery();
-        die(js::locate($this->post->actionURL, 'parent'));
+
+        $actionURL = $this->post->actionURL;
+        $parsedURL = parse_url($actionURL);
+        if(isset($parsedURL['host'])) die();
+        if($this->config->requestType != 'GET')
+        {
+            $path = $parsedURL['path'];
+            $path = str_replace($this->config->webRoot, '', $path);
+            if(strpos($path, '.') !== false) $path = substr($path, 0, strpos($path, '.'));
+            if(preg_match("/^\w+{$this->config->requestFix}\w+/", $path) == 0) die();
+        }
+        else
+        {
+            $query = $parsedURL['query'];
+            if(preg_match("/^{$this->config->moduleVar}=\w+\&{$this->config->methodVar}=\w+/", $query) == 0) die();
+        }
+
+        die(js::locate($actionURL, 'parent'));
     }
 
     /**