X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=WEB-INF%2Flib%2FttUser.class.php;h=86174547eeedc0104a37e27ee029e6cbb6fca22b;hb=7faef0e6d81444ad3ae10d1a2ce62fa753c80a9f;hp=e7fa3fa0b2af78ad831b69a855309a52d60c3f57;hpb=2ced7cd9d8dc6bb3225b9f2ec957cbfb1d7af285;p=timetracker.git diff --git a/WEB-INF/lib/ttUser.class.php b/WEB-INF/lib/ttUser.class.php index e7fa3fa0..86174547 100644 --- a/WEB-INF/lib/ttUser.class.php +++ b/WEB-INF/lib/ttUser.class.php @@ -41,7 +41,8 @@ class ttUser { var $behalf_id = null; // User id, on behalf of whom we are working. var $behalf_group_id = null; // Group id, on behalf of which we are working. var $behalf_name = null; // User name, on behalf of whom we are working. - var $behalf_group = null; // Group name, on behalf of which we are working. + var $group_name = null; // Group name. + var $behalf_group_name = null;// Group name, on behalf of which we are working. var $email = null; // User email. var $lang = null; // Language. var $decimal_mark = null; // Decimal separator. @@ -63,7 +64,6 @@ class ttUser { var $currency = null; // Currency. var $plugins = null; // Comma-separated list of enabled plugins. var $config = null; // Comma-separated list of miscellaneous config options. - var $group = null; // Group name. var $custom_logo = 0; // Whether to use a custom logo for group. var $lock_spec = null; // Cron specification for record locking. var $workday_minutes = 480; // Number of work minutes in a regular day. @@ -124,7 +124,7 @@ class ttUser { $this->bcc_email = $val['bcc_email']; $this->allow_ip = $val['allow_ip']; $this->password_complexity = $val['password_complexity']; - $this->group = $val['group_name']; + $this->group_name = $val['group_name']; $this->currency = $val['currency']; $this->plugins = $val['plugins']; $this->lock_spec = $val['lock_spec']; @@ -155,7 +155,7 @@ class ttUser { // Set "on behalf" id and name (group). if (isset($_SESSION['behalf_group_id'])) { $this->behalf_group_id = $_SESSION['behalf_group_id']; - $this->behalf_group = $_SESSION['behalf_group']; + $this->behalf_group_name = $_SESSION['behalf_group_name']; } } } @@ -192,10 +192,11 @@ class ttUser { $result = array(); $mdb2 = getConnection(); + $group_id = $this->behalf_group_id ? $this->behalf_group_id : $this->group_id; // Do a query with inner join to get assigned projects. $sql = "select p.id, p.name, p.description, p.tasks, upb.rate from tt_projects p inner join tt_user_project_binds upb on (upb.user_id = ".$this->getActiveUser()." and upb.project_id = p.id and upb.status = 1) - where p.group_id = $this->group_id and p.status = 1 order by p.name"; + where p.group_id = $group_id and p.status = 1 order by p.name"; $res = $mdb2->query($sql); if (!is_a($res, 'PEAR_Error')) { while ($val = $res->fetchRow()) { @@ -309,6 +310,7 @@ class ttUser { $skipClients = !isset($options['include_clients']); $includeSelf = isset($options['include_self']); + $group_id = isset($options['group_id']) ? $options['group_id'] : $this->group_id; $select_part = 'select u.id, u.name'; if (isset($options['include_login'])) $select_part .= ', u.login'; @@ -321,7 +323,7 @@ class ttUser { if (isset($options['max_rank']) || $skipClients || isset($options['include_role'])) $left_joins .= ' left join tt_roles r on (u.role_id = r.id)'; - $where_part = " where u.group_id = $this->group_id"; + $where_part = " where u.org_id = $this->org_id and u.group_id = $group_id"; if (isset($options['status'])) $where_part .= ' and u.status = '.(int)$options['status']; else @@ -371,10 +373,11 @@ class ttUser { $mdb2 = getConnection(); $selected_group_id = ($this->behalf_group_id ? $this->behalf_group_id : $this->group_id); + $selected_group_name = ($this->behalf_group_id ? $this->behalf_group_name : $this->group_name); // Start with parent group. - if ($selected_group_id != $this->org_id) { - // We are in one of the subgroups, and a parent exists. + if ($selected_group_id != $this->group_id) { + // We are in one of subgroups, and a parent exists. // Get parent group info. $sql = "select parent_id from tt_groups where org_id = $this->org_id and id = $selected_group_id"; $res = $mdb2->query($sql); @@ -394,7 +397,6 @@ class ttUser { } // Add current group. - $selected_group_name = ($this->behalf_group_id ? $this->behalf_group : $this->group); $groups[] = array('id'=>$selected_group_id,'name'=>$selected_group_name); // Add subgroups. @@ -408,6 +410,20 @@ class ttUser { return $groups; } + // getSubgroups obtains a list of immediate subgroups. + function getSubgroups() { + $mdb2 = getConnection(); + + $sql = "select id, name from tt_groups where org_id = $this->org_id and parent_id = ".$this->getActiveGroup();; + $res = $mdb2->query($sql); + if (!is_a($res, 'PEAR_Error')) { + while ($val = $res->fetchRow()) { + $groups[] = array('id'=>$val['id'],'name'=>$val['name']); + } + } + return $groups; + } + // getUser function is used to manage users in group and returns user details. // At the moment, the function is used for user edits and deletes. function getUser($user_id) { @@ -428,13 +444,32 @@ class ttUser { } // checkBehalfId checks whether behalf_id is appropriate. - // On behalf user must be active and have lower rank. + // On behalf user must be active and have lower rank if the user is from home group, + // otherwise: + // - subgroup must ve valid; + // - user should be a member of it. function checkBehalfId() { - $options = array('status'=>ACTIVE,'max_rank'=>$this->rank-1); - $users = $this->getUsers($options); - foreach($users as $one_user) { - if ($one_user['id'] == $this->behalf_id) - return true; + if (!$this->behalf_group_id) { + // Checking user from home group. + $options = array('status'=>ACTIVE,'max_rank'=>$this->rank-1); + $users = $this->getUsers($options); + foreach($users as $one_user) { + if ($one_user['id'] == $this->behalf_id) + return true; + } + } else { + // Checking user from a subgroup. + $group_id = $this->behalf_group_id; + if (!$this->isSubgroupValid($group_id)) + return false; + + // So far, so good. Check user now. + $options = array('group_id'=>$group_id,'status'=>ACTIVE,'max_rank'=>MAX_RANK); + $users = $this->getUsers($options); + foreach($users as $one_user) { + if ($one_user['id'] == $this->behalf_id) + return true; + } } return false; } @@ -445,8 +480,13 @@ class ttUser { // Needed for situations when user does not have do_own_something right. // Example: has view_charts but does not have view_own_charts. // In this case we still allow access to charts, but set behalf_id to someone else. + // Another example: working in a subgroup on behalf of someone else. function adjustBehalfId() { - $options = array('status'=>ACTIVE,'max_rank'=>$this->rank-1); + $group_id = $this->behalf_group_id ? $this->behalf_group_id : $this->group_id; + $rank = $this->getMaxRankForGroup($group_id); + + // Adjust to first found user in group. + $options = array('group_id'=>$group_id,'status'=>ACTIVE,'max_rank'=>$rank); $users = $this->getUsers($options); foreach($users as $one_user) { // Fake loop to access first element. @@ -558,4 +598,39 @@ class ttUser { return true; } + + // isSubgroupValid determines if a subgroup is valid for user. + // A subgroup is valid if: + // - user can manage_subgroups; + // - subgroup is either a direct child of user group, or "on the path" + // to it (grand-child, etc.). + function isSubgroupValid($subgroup_id) { + if (!$this->can('manage_subgroups')) return false; // User cannot manage subgroups. + + $current_group_id = $subgroup_id; + while ($parent_group_id = ttGroupHelper::getParentGroup($current_group_id)) { + if ($parent_group_id == $this->group_id) { + return true; // Found it. + } + $current_group_id = $parent_group_id; + } + return false; + } + + // getMaxRankForGroup determines effective user rank for a user in a given group. + // For home group it is the existing user rank (as per role) minus 1. + // For subgroups, if user can "manage_subgroups", it is MAX_RANK. + function getMaxRankForGroup($group_id) { + + $max_rank = 0; // Start safely. + if ($this->group_id == $group_id) { + $max_rank = $this->rank - 1; + return $max_rank; + } + + if ($this->isSubgroupValid($group_id)) + $max_rank = MAX_RANK; + + return $max_rank; + } }