diff --git a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php index cbe9b39f7..9200b566a 100644 --- a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php +++ b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php @@ -1161,16 +1161,18 @@ class ObjectFormManager extends FormManager $sObjectClass = get_class($this->oObject); try { + // modification flags + $bIsNew = $this->oObject->IsNew(); + $bWasModified = $this->oObject->IsModified(); + $bActivateTriggers = (!$bIsNew && $bWasModified); + // Forcing allowed writing on the object if necessary. This is used in some particular cases. - $bAllowWrite = ($sObjectClass === 'Person' && $this->oObject->GetKey() == UserRights::GetContactId()); + $bAllowWrite = $this->oContainer->get('security_helper')->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey()); if ($bAllowWrite) { $this->oObject->AllowWrite(true); } // Writing object to DB - $bIsNew = $this->oObject->IsNew(); - $bWasModified = $this->oObject->IsModified(); - $bActivateTriggers = (!$bIsNew && $bWasModified); try { $this->oObject->DBWrite(); diff --git a/datamodels/2.x/itop-portal-base/portal/src/Helper/SecurityHelper.php b/datamodels/2.x/itop-portal-base/portal/src/Helper/SecurityHelper.php index d741ba58e..18e4fd87f 100644 --- a/datamodels/2.x/itop-portal-base/portal/src/Helper/SecurityHelper.php +++ b/datamodels/2.x/itop-portal-base/portal/src/Helper/SecurityHelper.php @@ -103,6 +103,12 @@ class SecurityHelper return false; } + // Forcing allowed writing on the object if necessary. This is used in some particular cases. + $bObjectIsCurrentUser = ($sObjectClass === 'Person' && $this->oObject->GetKey() == UserRights::GetContactId()); + if(in_array($sAction , array(UR_ACTION_MODIFY, UR_ACTION_READ)) && $bObjectIsCurrentUser){ + return true; + } + // Checking the scopes layer // - Transforming scope action as there is only 2 values $sScopeAction = ($sAction === UR_ACTION_READ) ? UR_ACTION_READ : UR_ACTION_MODIFY;