From ffed8a893f92299ca42256d054abcaa463e49762 Mon Sep 17 00:00:00 2001
From: liwenrui <liwenrui@easycorp.ltd>
Date: Wed, 2 Aug 2023 10:41:52 +0800
Subject: [PATCH] * check for priv prior to executing and auditing prompts.

---
 module/ai/model.php                | 3 ++-
 module/ai/view/promptmenu.html.php | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/module/ai/model.php b/module/ai/model.php
index a2931b897a..20757d255f 100644
--- a/module/ai/model.php
+++ b/module/ai/model.php
@@ -1112,7 +1112,8 @@ class aiModel extends model
         return $this->dao->select('*')->from(TABLE_PROMPT)
             ->where('deleted')->eq(0)
             ->andWhere('module')->eq($module)
-            ->andWhere('status', true)->eq('active')->orWhere('createdBy')->eq($this->app->user->account)->markRight(1)
+            ->beginIF(!common::hasPriv('ai', 'promptaudit'))->andWhere('status')->eq('active')->fi() // Only show active prompts to non-auditors.
+            ->beginIF(common::hasPriv('ai', 'promptaudit'))->andWhere('status', true)->eq('active')->orWhere('createdBy')->eq($this->app->user->account)->markRight(1)->fi()
             ->orderBy('id_desc')
             ->fetchAll();
     }
diff --git a/module/ai/view/promptmenu.html.php b/module/ai/view/promptmenu.html.php
index 2e916a30a7..d63a44163b 100644
--- a/module/ai/view/promptmenu.html.php
+++ b/module/ai/view/promptmenu.html.php
@@ -13,6 +13,7 @@
  * @link        https://www.zentao.net
  */
 ?>
+<?php if(commonModel::hasPriv('ai', 'executePrompt')):?>
 <?php
   $this->app->loadConfig('ai');
   $module = $this->app->getModuleName();
@@ -70,4 +71,4 @@
       });
     </script>
 
-<?php endif; endif;?>
+<?php endif; endif; endif;?>