X-Git-Url: http://wagnertech.de/gitweb/gitweb.cgi/mfinanz.git/blobdiff_plain/404521c296db1a111009e774d6519f0565512bef..ae4cec429306e2f1372d9cbd7a2ac40ecb977869:/SL/Controller/TimeRecording.pm?ds=inline

diff --git a/SL/Controller/TimeRecording.pm b/SL/Controller/TimeRecording.pm
index 28cd68bfd..e3e2aabbc 100644
--- a/SL/Controller/TimeRecording.pm
+++ b/SL/Controller/TimeRecording.pm
@@ -18,12 +18,13 @@ use SL::ReportGenerator;
 use Rose::Object::MakeMethods::Generic
 (
 # scalar                  => [ qw() ],
- 'scalar --get_set_init' => [ qw(time_recording models all_time_recording_types all_employees can_view_all) ],
+ 'scalar --get_set_init' => [ qw(time_recording models all_employees can_view_all can_edit_all) ],
 );
 
 
 # safety
 __PACKAGE__->run_before('check_auth');
+__PACKAGE__->run_before('check_auth_edit', only => [ qw(edit save delete) ]);
 
 #
 # actions
@@ -33,7 +34,6 @@ my %sort_columns = (
   start_time   => t8('Start'),
   end_time     => t8('End'),
   customer     => t8('Customer'),
-  type         => t8('Type'),
   project      => t8('Project'),
   description  => t8('Description'),
   staff_member => t8('Mitarbeiter'),
@@ -120,9 +120,12 @@ sub init_time_recording {
     }
   }
 
-  $attributes{employee_id}     = SL::DB::Manager::Employee->current->id;
+  # do not overwright staff member if you do not have the right
+  delete $attributes{staff_member_id} if !$_[0]->can_edit_all;
   $attributes{staff_member_id} = SL::DB::Manager::Employee->current->id if $is_new;
 
+  $attributes{employee_id}     = SL::DB::Manager::Employee->current->id;
+
   $time_recording->assign_attributes(%attributes);
 
   return $time_recording;
@@ -132,6 +135,10 @@ sub init_can_view_all {
   $::auth->assert('time_recording_show_all', 1) || $::auth->assert('time_recording_edit_all', 1)
 }
 
+sub init_can_edit_all {
+  $::auth->assert('time_recording_edit_all', 1)
+}
+
 sub init_models {
   my ($self) = @_;
 
@@ -143,14 +150,10 @@ sub init_models {
     sorted         => \%sort_columns,
     disable_plugin => 'paginated',
     query          => \@where,
-    with_objects   => [ 'customer', 'type', 'project', 'staff_member', 'employee' ],
+    with_objects   => [ 'customer', 'project', 'staff_member', 'employee' ],
   );
 }
 
-sub init_all_time_recording_types {
-  SL::DB::Manager::TimeRecordingType->get_all_sorted(query => [obsolete => 0]);
-}
-
 sub init_all_employees {
   SL::DB::Manager::Employee->get_all_sorted(query => [ deleted => 0 ]);
 }
@@ -159,13 +162,21 @@ sub check_auth {
   $::auth->assert('time_recording');
 }
 
+sub check_auth_edit {
+  my ($self) = @_;
+
+  if (!$self->can_edit_all && ($self->time_recording->staff_member_id != SL::DB::Manager::Employee->current->id)) {
+    $::form->error(t8('You do not have permission to access this entry.'));
+  }
+}
+
 sub prepare_report {
   my ($self) = @_;
 
   my $report      = SL::ReportGenerator->new(\%::myconfig, $::form);
   $self->{report} = $report;
 
-  my @columns  = qw(start_time end_time customer type project description staff_member duration);
+  my @columns  = qw(start_time end_time customer project description staff_member duration);
 
   my %column_defs = (
     start_time   => { text => t8('Start'),        sub => sub { $_[0]->start_time_as_timestamp },
@@ -173,7 +184,6 @@ sub prepare_report {
     end_time     => { text => t8('End'),          sub => sub { $_[0]->end_time_as_timestamp },
                       obj_link => sub { $self->url_for(action => 'edit', 'id' => $_[0]->id, callback => $self->models->get_callback) }  },
     customer     => { text => t8('Customer'),     sub => sub { $_[0]->customer->displayable_name } },
-    type         => { text => t8('Type'),         sub => sub { $_[0]->type && $_[0]->type->abbreviation } },
     project      => { text => t8('Project'),      sub => sub { $_[0]->project && $_[0]->project->displayable_name } },
     description  => { text => t8('Description'),  sub => sub { $_[0]->description_as_stripped_html },
                       raw_data => sub { $_[0]->description_as_restricted_html }, # raw_data only used for html(?)
@@ -198,7 +208,7 @@ sub prepare_report {
   $report->set_options_from_form;
 
   $self->models->disable_plugin('paginated') if $report->{options}{output_format} =~ /^(pdf|csv)$/i;
-  #$self->models->add_additional_url_params();
+  $self->models->add_additional_url_params(filter => $::form->{filter});
   $self->models->finalize;
   $self->models->set_report_generator_sort_options(report => $report, sortable_columns => [keys %sort_columns]);