composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-24 11:08:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°4354 - Hide Administrator profile to non-admins

Browse Source
This commit is contained in:
denis.flaven@combodo.com
2021-10-06 15:34:17 +02:00
parent 9fbc631b07
commit bf4835eec0
7 changed files with 266 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
addons/userrights/userrightsprofile.class.inc.php
View File

@@ -34,7 +34,7 @@ class URP_Profiles extends UserRightsBaseClassGUI
{
$aParams = array
(
"category" => "addon/userrights,grant_by_profile",
"category" => "addon/userrights,grant_by_profile,silo",
"key_type" => "autoincrement",
"name_attcode" => "name",
"state_attcode" => "",
@@ -219,7 +219,7 @@ class URP_UserProfile extends UserRightsBaseClassGUI
{
$aParams = array
(
"category" => "addon/userrights,grant_by_profile",
"category" => "addon/userrights,grant_by_profile,silo",
"key_type" => "autoincrement",
"name_attcode" => array("userlogin", "profile"),
"state_attcode" => "",
@@ -610,30 +610,112 @@ class UserRightsProfile extends UserRightsAddOnAPI
{
$this->LoadCache();
$aObjectPermissions = $this->GetUserActionGrant($oUser, $sClass, UR_ACTION_READ);
if ($aObjectPermissions['permission'] == UR_ALLOWED_NO)
if (!static::IsAdministrator($oUser)) // Let us pass an administrator for testing without the need of setting up complex profile
{
return false;
$aObjectPermissions = $this->GetUserActionGrant($oUser, $sClass, UR_ACTION_READ);
if ($aObjectPermissions['permission'] == UR_ALLOWED_NO)
{
return false;
}
}
// Determine how to position the objects of this class
//
$oFilter = true;
$aConditions = array();
// Determine if this class is part of a silo and build the filter for it
$sAttCode = self::GetOwnerOrganizationAttCode($sClass);
if (is_null($sAttCode))
if (!is_null($sAttCode))
{
// No filtering for this object
return true;
$aUserOrgs = $this->GetUserOrgs($oUser, $sClass);
if (count($aUserOrgs) > 0)
{
$oFilter = $this->MakeSelectFilter($sClass, $aUserOrgs, $aSettings, $sAttCode);
}
// else: No org means 'any org'
}
// Position the user
//
$aUserOrgs = $this->GetUserOrgs($oUser, $sClass);
if (count($aUserOrgs) == 0)
// else: No silo for this class
// Specific conditions to hide, for non-administrators, the Administrator Users, the Administrator Profile and related links
// Note: when logged as an administrator, GetSelectFilter is completely bypassed.
if ($this->AdministratorsAreHidden())
{
// No org means 'any org'
return true;
if ($sClass == 'URP_Profiles')
{
$oExpression = new FieldExpression('id', $sClass);
$oScalarExpr = new ScalarExpression(1);
$aConditions[] = new BinaryExpression($oExpression, '!=', $oScalarExpr);
}
else if (($sClass == 'URP_UserProfile') || ($sClass == 'User') || (is_subclass_of($sClass, 'User')))
{
$aAdministrators = $this->GetAdministrators();
if (count($aAdministrators) > 0)
{
$sAttCode = ($sClass == 'URP_UserProfile') ? 'userid' : 'id';
$oExpression = new FieldExpression($sAttCode, $sClass);
$oListExpr = ListExpression::FromScalars($aAdministrators);
$aConditions[] = new BinaryExpression($oExpression, 'NOT IN', $oListExpr);
}
}
}
return $this->MakeSelectFilter($sClass, $aUserOrgs, $aSettings, $sAttCode);
// Handling of the added conditions
if (count($aConditions) > 0)
{
if($oFilter === true)
{
// No 'silo' filter, let's build a clean one
$oFilter = new DBObjectSearch($sClass);
}
// Add the conditions to the filter
foreach($aConditions as $oCondition)
{
$oFilter->AddConditionExpression($oCondition);
}
}
return $oFilter;
}
/**
* Retrieve (and memoize) the list of administrator accounts.
* Note that there should always be at least one administrator account
* @return number[]
*/
private function GetAdministrators()
{
static $aAdministrators = null;
if ($aAdministrators === null)
{
// Find all administrators
$aAdministrators = array();
$oAdministratorsFilter = new DBObjectSearch('User');
$oLnkFilter = new DBObjectSearch('URP_UserProfile');
$oExpression = new FieldExpression('profileid', 'URP_UserProfile');
$oScalarExpr = new ScalarExpression(1);
$oCondition = new BinaryExpression($oExpression, '=', $oScalarExpr);
$oLnkFilter->AddConditionExpression($oCondition);
$oAdministratorsFilter->AddCondition_ReferencedBy($oLnkFilter, 'userid');
$oAdministratorsFilter->AllowAllData(true); // Mandatory to prevent infinite recursion !!
$oSet = new DBObjectSet($oAdministratorsFilter);
$oSet->OptimizeColumnLoad(array('User' => array('login')));
while($oUser = $oSet->Fetch())
{
$aAdministrators[] = $oUser->GetKey();
}
}
return $aAdministrators;
}
/**
* Whether or not to hide the 'Administrator' profile and the administrator accounts
* @return boolean
*/
private function AdministratorsAreHidden()
{
return ((bool)MetaModel::GetConfig()->Get('security.hide_administrators'));
}