From 389a1791d7c486ccdae0c3cb0558c3e34a0b757f Mon Sep 17 00:00:00 2001
From: Eric <eric.espie@combodo.com>
Date: Fri, 2 Nov 2018 16:01:56 +0100
Subject: [PATCH] =?UTF-8?q?N=C2=B0828=20-=20GetSelectFilter=20issue=20with?=
 =?UTF-8?q?=20DBUnionSearch?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 core/dbsearch.class.php      | 28 ++++++++++++++++++++++++++--
 core/dbunionsearch.class.php | 34 ++++++++++++++++++++++++++++++++--
 2 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/core/dbsearch.class.php b/core/dbsearch.class.php
index 4d2fa2c9f..e748ac1d5 100644
--- a/core/dbsearch.class.php
+++ b/core/dbsearch.class.php
@@ -674,11 +674,30 @@ abstract class DBSearch
 		return $sRes;
 	}
 
+	protected abstract function IsDataFiltered();
+	protected abstract function SetDataFiltered();
 
 	protected function GetSQLQuery($aOrderBy, $aArgs, $aAttToLoad, $aExtendedDataSpec, $iLimitCount, $iLimitStart, $bGetCount, $aGroupByExpr = null, $aSelectExpr = null)
 	{
-		$oSQLQuery = $this->GetSQLQueryStructure($aAttToLoad, $bGetCount, $aGroupByExpr, null, $aSelectExpr);
-		$oSQLQuery->SetSourceOQL($this->ToOQL());
+		$oSearch = $this;
+		if (!$this->IsAllDataAllowed() && !$this->IsDataFiltered())
+		{
+			$oVisibleObjects = UserRights::GetSelectFilter($this->GetClass(), $this->GetModifierProperties('UserRightsGetSelectFilter'));
+			if ($oVisibleObjects === false)
+			{
+				// Make sure this is a valid search object, saying NO for all
+				$oVisibleObjects = DBObjectSearch::FromEmptySet($this->GetClass());
+			}
+			if (is_object($oVisibleObjects))
+			{
+				$oVisibleObjects->AllowAllData();
+				$oSearch = $this->Intersect($oVisibleObjects);
+				/** @var DBSearch $oSearch */
+				$oSearch->SetDataFiltered();
+			}
+		}
+		$oSQLQuery = $oSearch->GetSQLQueryStructure($aAttToLoad, $bGetCount, $aGroupByExpr, null, $aSelectExpr);
+		$oSQLQuery->SetSourceOQL($oSearch->ToOQL());
 
 		// Join to an additional table, if required...
 		//
@@ -702,6 +721,11 @@ abstract class DBSearch
 		$aAttToLoad, $bGetCount, $aGroupByExpr = null, $aSelectedClasses = null, $aSelectExpr = null
 	);
 
+	/**
+	 * @return \Expression
+	 */
+	public abstract function GetCriteria();
+
 	////////////////////////////////////////////////////////////////////////////
 	//
 	// Cache/Trace/Log queries
diff --git a/core/dbunionsearch.class.php b/core/dbunionsearch.class.php
index f45ff7fab..2fe7f60b2 100644
--- a/core/dbunionsearch.class.php
+++ b/core/dbunionsearch.class.php
@@ -312,9 +312,9 @@ class DBUnionSearch extends DBSearch
 
 	/**
 	 * Specify a condition on external keys or link sets
-	 * @param sAttSpec Can be either an attribute code or extkey->[sAttSpec] or linkset->[sAttSpec] and so on, recursively
+	 * @param String sAttSpec Can be either an attribute code or extkey->[sAttSpec] or linkset->[sAttSpec] and so on, recursively
 	 *                 Example: infra_list->ci_id->location_id->country	 
-	 * @param value The value to match (can be an array => IN(val1, val2...)
+	 * @param Object value The value to match (can be an array => IN(val1, val2...)
 	 * @return void
 	 */
 	public function AddConditionAdvanced($sAttSpec, $value)
@@ -598,4 +598,34 @@ class DBUnionSearch extends DBSearch
 		if (self::$m_bDebugQuery) $oSQLQuery->DisplayHtml();
 		return $oSQLQuery;
 	}
+
+	/**
+	 * @return \Expression
+	 */
+	public function GetCriteria()
+	{
+		return new TrueExpression();
+	}
+
+	protected function IsDataFiltered()
+	{
+		$bIsAllDataFiltered = true;
+		foreach ($this->aSearches as $oSearch)
+		{
+			if (!$oSearch->IsDataFiltered())
+			{
+				$bIsAllDataFiltered = false;
+				break;
+			}
+		}
+		return $bIsAllDataFiltered;
+	}
+
+	protected function SetDataFiltered()
+	{
+		foreach ($this->aSearches as $oSearch)
+		{
+			$oSearch->SetDataFiltered();
+		}
+	}
 }