composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-23 10:38:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°1248 - User Management: Check organization related to the current user

Browse Source 
SVN:trunk[5677]
This commit is contained in:
Eric Espié
2018-04-17 10:22:12 +00:00
parent f7817714a8
commit c3fbdc907c
5 changed files with 53 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
addons/userrights/userrightsprofile.class.inc.php
View File

@@ -437,11 +437,15 @@ class UserRightsProfile extends UserRightsAddOnAPI
/**
* Read and cache organizations allowed to the given user
*
* @param oUser
* @param sClass -not used here but can be used in overloads
*
* @param $oUser
* @param $sClass (not used here but can be used in overloads)
*
* @return array
* @throws \CoreException
* @throws \Exception
*/
protected function GetUserOrgs($oUser, $sClass)
public function GetUserOrgs($oUser, $sClass)
{
$iUser = $oUser->GetKey();
if (!array_key_exists($iUser, $this->m_aUserOrgs))
@@ -455,7 +459,6 @@ class UserRightsProfile extends UserRightsAddOnAPI
$oUserOrgSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData($sUserOrgQuery), array(), array('userid' => $iUser));
while ($aRow = $oUserOrgSet->FetchAssoc())
{
$oUserOrg = $aRow['UserOrg'];
$oOrg = $aRow['Org'];
$this->m_aUserOrgs[$iUser][] = $oOrg->GetKey();
}

13
addons/userrights/userrightsprofile.db.class.inc.php
View File

@@ -613,11 +613,15 @@ class UserRightsProfile extends UserRightsAddOnAPI
/**
* Read and cache organizations allowed to the given user
*
* @param oUser
* @param sClass -not used here but can be used in overloads
*
* @param $oUser
* @param $sClass (not used here but can be used in overloads)
*
* @return array
* @throws \CoreException
* @throws \Exception
*/
protected function GetUserOrgs($oUser, $sClass)
public function GetUserOrgs($oUser, $sClass)
{
$iUser = $oUser->GetKey();
if (!array_key_exists($iUser, $this->m_aUserOrgs))
@@ -631,7 +635,6 @@ class UserRightsProfile extends UserRightsAddOnAPI
$oUserOrgSet = new DBObjectSet(DBObjectSearch::FromOQL_AllData($sUserOrgQuery), array(), array('userid' => $iUser));
while ($aRow = $oUserOrgSet->FetchAssoc())
{
$oUserOrg = $aRow['UserOrg'];
$oOrg = $aRow['Org'];
$this->m_aUserOrgs[$iUser][] = $oOrg->GetKey();
}

36
core/userrights.class.inc.php
View File

@@ -256,8 +256,10 @@ abstract class User extends cmdbAbstractObject
}
/**
* Overload the standard behavior.
*/
* Overload the standard behavior.
*
* @throws \CoreException
*/
public function DoCheckToWrite()
{
parent::DoCheckToWrite();
@@ -290,9 +292,37 @@ abstract class User extends cmdbAbstractObject
// Only administrators can manage administrators
if (UserRights::IsAdministrator($this) && !UserRights::IsAdministrator())
{
$this->m_aCheckIssues[] = Dict::Format('UI:Login:Error:AccessRestricted');
}
// Check users with restricted organizations
if (!UserRights::IsAdministrator())
{
$oUser = UserRights::GetUserObject();
$oAddon = UserRights::GetModuleInstance();
if (method_exists($oAddon, 'GetUserOrgs'))
{
$aOrgs = $oAddon->GetUserOrgs($oUser, '');
if (count($aOrgs) > 0)
{
/** @var ORMLinkset $oSet */
$oSet = $this->Get('allowed_org_list');
if ($oSet->Count() == 0)
{
$this->m_aCheckIssues[] = Dict::Format('Class:User/Error:AtLeastOneOrganizationIsNeeded');
}
else
{
while ($oUserOrg = $oSet->Fetch())
{
if (!in_array($oUserOrg->Get('allowed_org_id'), $aOrgs))
{
$this->m_aCheckIssues[] = Dict::Format('Class:User/Error:OrganizationNotAllowed');
}
}
}
}
}
}
}
function GetGrantAsHtml($sClass, $iAction)

3
dictionaries/en.dictionary.itop.ui.php
View File

@@ -138,7 +138,8 @@ Dict::Add('EN US', 'English', 'English', array(
'Class:User/Error:LoginMustBeUnique' => 'Login must be unique - "%1s" is already being used.',
'Class:User/Error:AtLeastOneProfileIsNeeded' => 'At least one profile must be assigned to this user.',
'Class:User/Error:AtLeastOneOrganizationIsNeeded' => 'At least one organization must be assigned to this user.',
'Class:User/Error:OrganizationNotAllowed' => 'Organization not allowed.',
'Class:UserInternal' => 'User Internal',
'Class:UserInternal+' => 'User defined within iTop',
));

2
dictionaries/fr.dictionary.itop.ui.php
View File

@@ -162,6 +162,8 @@ Dict::Add('FR FR', 'French', 'Français', array(
'Class:User/Attribute:status/Value:disabled' => 'Désactivé',
'Class:User/Error:LoginMustBeUnique' => 'Le login doit être unique - "%1s" est déjà utilisé.',
'Class:User/Error:AtLeastOneProfileIsNeeded' => 'L\'utilisateur doit avoir au moins un profil.',
'Class:User/Error:AtLeastOneOrganizationIsNeeded' => 'L\'utilisateur doit avoir au moins une organisation.',
'Class:User/Error:OrganizationNotAllowed' => 'Organisation non autorisée.',
'Class:UserInternal' => 'Utilisateur interne',
'Class:UserInternal+' => 'Utilisateur défini dans iTop',
'Class:URP_Dimensions' => 'Dimension',