From 3ad837214ca361fdaac5363d9e702d3d40d04b17 Mon Sep 17 00:00:00 2001 From: Nik Okuntseff Date: Wed, 20 Feb 2019 15:37:47 +0000 Subject: [PATCH] Fixed user edit to hide projects for client roles. --- WEB-INF/lib/ttTimesheetHelper.class.php | 24 +++++++++++++++++++++++ WEB-INF/templates/footer.tpl | 2 +- WEB-INF/templates/timesheets.tpl | 2 ++ WEB-INF/templates/user_edit.tpl | 23 +++++++++++++++++----- timesheets.php | 26 +++++++++++++++++++------ user_edit.php | 2 +- 6 files changed, 66 insertions(+), 13 deletions(-) diff --git a/WEB-INF/lib/ttTimesheetHelper.class.php b/WEB-INF/lib/ttTimesheetHelper.class.php index 1d43f152..3e44c8c3 100644 --- a/WEB-INF/lib/ttTimesheetHelper.class.php +++ b/WEB-INF/lib/ttTimesheetHelper.class.php @@ -209,4 +209,28 @@ class ttTimesheetHelper { $affected = $mdb2->exec($sql); return (!is_a($affected, 'PEAR_Error')); } + + // isUserValid function is used during access checks and determines whether user id, passed in post, is valid + // in current context. + static function isUserValid($user_id) { + // We have to cover several situations. + // + // 1) User is a client. + // 2) User with view_all_timesheets rights. + // 3) User with view_timesheets rights. + + global $user; + + // Step 1. + // A client must have view_client_timesheets and + // aser must be assigned to one of client projects. + if ($user->isClient()) { + if (!$user->can('view_client_timesheets')) + return false; + $valid_users = ttGroupHelper::getUsersForClient($user->client_id); + $v = 2; + } + + return true; + } } diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl index 252e3227..8b2787ff 100644 --- a/WEB-INF/templates/footer.tpl +++ b/WEB-INF/templates/footer.tpl @@ -12,7 +12,7 @@
-
 Anuko Time Tracker 1.18.37.4741 | Copyright © Anuko | +  Anuko Time Tracker 1.18.37.4742 | Copyright © Anuko | {$i18n.footer.credits} | {$i18n.footer.license} | {$i18n.footer.improve} diff --git a/WEB-INF/templates/timesheets.tpl b/WEB-INF/templates/timesheets.tpl index 45a67645..dc5c8155 100644 --- a/WEB-INF/templates/timesheets.tpl +++ b/WEB-INF/templates/timesheets.tpl @@ -4,7 +4,9 @@ {$forms.timesheetsForm.open} +{if $show_hint} +{/if} {if $user_dropdown} {/if} diff --git a/WEB-INF/templates/user_edit.tpl b/WEB-INF/templates/user_edit.tpl index 32947545..f9ec2334 100644 --- a/WEB-INF/templates/user_edit.tpl +++ b/WEB-INF/templates/user_edit.tpl @@ -51,20 +51,31 @@ function setRate(element) { } } -// handleClientControl - controls visibility of the client dropdown depending on the selected user role. -// We need to show it only when the "Client" user role is selected. +// handleClientControl - controls visibility of the client dropdown depending on the selected user role, +// also hides and unselects projects when "Client" user role is selected. function handleClientControl() { var selectedRoleId = document.getElementById("role").value; var clientControl = document.getElementById("client"); + var projectsControl = document.getElementById("projects_control"); + var len = roles.length; for (var i = 0; i < len; i++) { if (selectedRoleId == roles[i][0]) { var isClient = roles[i][1]; - if (isClient == 1) + if (isClient == 1) { clientControl.style.visibility = "visible"; - else { - clientControl.value = ''; + projectsControl.style.display = "none"; + + // Uncheck all project checkboxes. + var checkboxes = document.getElementsByName("projects[]"); + var j; + for (j = 0; j < checkboxes.length; j++) { + checkboxes[j].checked = false; + } + } else { + clientControl.value = ""; clientControl.style.visibility = "hidden"; + projectsControl.style.display = ""; } break; } @@ -125,10 +136,12 @@ function handleClientControl() { {/if} {if $show_projects} + + {/if} diff --git a/timesheets.php b/timesheets.php index 9dc0d2c8..82a83074 100644 --- a/timesheets.php +++ b/timesheets.php @@ -28,6 +28,7 @@ require_once('initialize.php'); import('form.Form'); +import('ttGroupHelper'); import('ttTimesheetHelper'); // Access checks. @@ -39,22 +40,34 @@ if (!$user->isPluginEnabled('ts')) { header('Location: feature_disabled.php'); exit(); } +if ($user->isClient()) { + $users_for_client = ttGroupHelper::getUsersForClient($user->client_id); + if (count($users_for_client) == 0) { + header('Location: access_denied.php'); // There are no users for client. + exit(); + } +} if ($request->isPost()) { $userChanged = $request->getParameter('user_changed'); - if ($userChanged && !($user->can('track_time') && $user->isUserValid($request->getParameter('user')))) { - header('Location: access_denied.php'); // Group changed, but no rght or wrong user id. + if ($userChanged && !(ttTimesheetHelper::isUserValid($request->getParameter('user')))) { + header('Location: access_denied.php'); // Wrong user id. exit(); } } // End of access checks. // Determine user for whom we display this page. +$notClient = !$user->isClient(); if ($request->isPost() && $userChanged) { $user_id = $request->getParameter('user'); } else { - $user_id = $user->getUser(); + if ($notClient) + $user_id = $user->getUser(); + else + $user_id = $users_for_client[0]['id']; // First found user for a client. } + $group_id = $user->getGroup(); // Elements of timesheetsForm. @@ -86,13 +99,14 @@ if ($user->can('view_timesheets') || $user->can('view_all_timesheets') || $user- // TODO: fix this for client access. $active_timesheets = ttTimesheetHelper::getActiveTimesheets($user_id); $inactive_timesheets = ttTimesheetHelper::getInactiveTimesheets($user_id); -$show_client = $user->isPluginEnabled('cl') && !$user->isClient(); +$show_client = $user->isPluginEnabled('cl') && $notClient; $smarty->assign('active_timesheets', $active_timesheets); $smarty->assign('inactive_timesheets', $inactive_timesheets); $smarty->assign('show_client', $show_client); -$smarty->assign('show_submit_status', !$user->isClient()); -$smarty->assign('show_approval_status', !$user->isClient()); +$smarty->assign('show_hint', $notClient); +$smarty->assign('show_submit_status', $notClient); +$smarty->assign('show_approval_status', $notClient); $smarty->assign('forms', array($form->getName()=>$form->toArray())); $smarty->assign('title', $i18n->get('title.timesheets')); $smarty->assign('content_page_name', 'timesheets.tpl'); diff --git a/user_edit.php b/user_edit.php index 582452d9..cda9ab2d 100644 --- a/user_edit.php +++ b/user_edit.php @@ -147,7 +147,7 @@ class RateCellRenderer extends DefaultCellRenderer { // Create projects table. $table = new Table('projects'); $table->setIAScript('setRate'); -$table->setTableOptions(array('width'=>'100%','cellspacing'=>'1','cellpadding'=>'3','border'=>'0')); +$table->setTableOptions(array('width'=>'300','cellspacing'=>'1','cellpadding'=>'3','border'=>'0')); $table->setRowOptions(array('valign'=>'top','class'=>'tableHeader')); $table->setData($projects); $table->setKeyField('id'); -- 2.20.1
{$i18n.form.timesheets.hint}
{$i18n.label.user}: {$forms.timesheetsForm.user.control}
 
{$i18n.label.projects}: {$forms.userForm.projects.control}
{$i18n.label.required_fields}