* Copyright (C) 2002-2003 Jean-Louis Bergamo * Copyright (C) 2004-2020 Laurent Destailleur * Copyright (C) 2004 Eric Seigne * Copyright (C) 2005-2017 Regis Houssin * Copyright (C) 2020 Tobias Sekan * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /** * \file htdocs/user/group/perms.php * \brief Page to set permissions of a user group record */ if (!defined('CSRFCHECK_WITH_TOKEN')) { define('CSRFCHECK_WITH_TOKEN', '1'); // Force use of CSRF protection with tokens even for GET } // Load Dolibarr environment require '../../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/user/class/usergroup.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/usergroups.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; // Load translation files required by page $langs->loadLangs(array('users', 'admin')); $id = GETPOSTINT('id'); $action = GETPOST('action', 'aZ09'); $confirm = GETPOST('confirm', 'alpha'); $module = GETPOST('module', 'alpha'); $rights = GETPOSTINT('rights'); $contextpage = GETPOST('contextpage', 'aZ') ? GETPOST('contextpage', 'aZ') : 'groupperms'; // To manage different context of search if (!isset($id) || empty($id)) { accessforbidden(); } // Define if user can read permissions $permissiontoread = ($user->admin || $user->hasRight("user", "user", "read")); // Define if user can modify group permissions $permissiontoedit = ($user->admin || $user->hasRight("user", "user", "write")); // Advanced permissions $advancedpermsactive = false; if (getDolGlobalString('MAIN_USE_ADVANCED_PERMS')) { $advancedpermsactive = true; $permissiontoread = ($user->admin || ($user->hasRight("user", "group_advance", "read") && $user->hasRight("user", "group_advance", "readperms"))); $permissiontoedit = ($user->admin || $user->hasRight("user", "group_advance", "write")); } // Security check $socid = 0; if (isset($user->socid) && $user->socid > 0) { $socid = $user->socid; } //$result = restrictedArea($user, 'user', $id, 'usergroup', ''); if (!$permissiontoread) { accessforbidden(); } $object = new UserGroup($db); $object->fetch($id); $object->loadRights(); $entity = $conf->entity; // Initialize a technical object to manage hooks of page. Note that conf->hooks_modules contains an array of hook context $hookmanager->initHooks(array('groupperms', 'globalcard')); /* * Actions */ $parameters = array('socid' => $socid); $reshook = $hookmanager->executeHooks('doActions', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks if ($reshook < 0) { setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); } if (empty($reshook)) { if ($action == 'addrights' && $permissiontoedit) { $editgroup = new UserGroup($db); $result = $editgroup->fetch($object->id); if ($result > 0) { $result = $editgroup->addrights($rights, $module, '', $entity); if ($result < 0) { setEventMessages($editgroup->error, $editgroup->errors, 'errors'); } } else { dol_print_error($db); } $user->clearrights(); $user->loadRights(); } if ($action == 'delrights' && $permissiontoedit) { $editgroup = new UserGroup($db); $result = $editgroup->fetch($id); if ($result > 0) { $result = $editgroup->delrights($rights, $module, '', $entity); if ($result < 0) { setEventMessages($editgroup->error, $editgroup->errors, 'errors'); } } else { dol_print_error($db); } $user->clearrights(); $user->loadRights(); } } /* * View */ $form = new Form($db); $title = $object->name." - ".$langs->trans('Permissions'); $help_url = ''; llxHeader('', $title, $help_url, '', 0, 0, '', '', '', 'mod-user page-group_perms'); if ($object->id > 0) { $head = group_prepare_head($object); $title = $langs->trans("Group"); print dol_get_fiche_head($head, 'rights', $title, -1, 'group'); // Charge les modules soumis a permissions $modules = array(); $modulesdir = dolGetModulesDirs(); $db->begin(); foreach ($modulesdir as $dir) { $handle = @opendir(dol_osencode($dir)); if (is_resource($handle)) { while (($file = readdir($handle)) !== false) { if (is_readable($dir.$file) && substr($file, 0, 3) == 'mod' && substr($file, dol_strlen($file) - 10) == '.class.php') { $modName = substr($file, 0, dol_strlen($file) - 10); if ($modName) { include_once $dir.$file; $objMod = new $modName($db); // Load all lang files of module if (isset($objMod->langfiles) && is_array($objMod->langfiles)) { foreach ($objMod->langfiles as $domain) { $langs->load($domain); } } // Load all permissions if ($objMod->rights_class) { $ret = $objMod->insert_permissions(0, $entity); $modules[$objMod->rights_class] = $objMod; } } } } } } $db->commit(); // Read permissions of group $permsgroupbyentity = array(); $sql = "SELECT DISTINCT r.id, r.libelle, r.module, gr.entity"; $sql .= " FROM ".MAIN_DB_PREFIX."rights_def as r,"; $sql .= " ".MAIN_DB_PREFIX."usergroup_rights as gr"; $sql .= " WHERE gr.fk_id = r.id"; $sql .= " AND gr.entity = ".((int) $entity); $sql .= " AND gr.fk_usergroup = ".((int) $object->id); dol_syslog("get user perms", LOG_DEBUG); $result = $db->query($sql); if ($result) { $num = $db->num_rows($result); $i = 0; while ($i < $num) { $obj = $db->fetch_object($result); if (!isset($permsgroupbyentity[$obj->entity])) { $permsgroupbyentity[$obj->entity] = array(); } array_push($permsgroupbyentity[$obj->entity], $obj->id); $i++; } $db->free($result); } else { dol_print_error($db); } /* * Part to add/remove permissions */ $linkback = ''.$langs->trans("BackToList").''; dol_banner_tab($object, 'id', $linkback, $user->hasRight("user", "user", "read") || $user->admin); print '
'; print '
'; print ''; // Name (already in dol_banner, we keep it to have the GlobalGroup picto, but we should move it in dol_banner) if (!empty($conf->mutlicompany->enabled)) { print ''; print '\n"; } // Multicompany if (isModEnabled('multicompany') && is_object($mc) && !getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE') && $conf->entity == 1 && $user->admin && !$user->entity) { $mc->getInfo($object->entity); print "".''; print '\n"; } unset($object->fields['nom']); // Name already displayed in banner // Common attributes $keyforbreak = ''; include DOL_DOCUMENT_ROOT.'/core/tpl/commonfields_view.tpl.php'; // Other attributes include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_view.tpl.php'; print '
'.$langs->trans("Name").''.dol_escape_htmltag($object->name); if (empty($object->entity)) { print img_picto($langs->trans("GlobalGroup"), 'redstar'); } print "
'.$langs->trans("Entity").''.dol_escape_htmltag($mc->label); print "
'; print '
'; print '
'; print '
'; if ($user->admin) { print info_admin($langs->trans("WarningOnlyPermissionOfActivatedModules")); } $parameters = array(); $reshook = $hookmanager->executeHooks('insertExtraHeader', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks if ($reshook < 0) { setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); } print "\n"; print '
'; print ''; print ''; print ''; if ($permissiontoedit) { print ''; } else { print ''; } print ''; //print ''; print ''; print ''; print ''."\n"; $sql = "SELECT r.id, r.libelle as label, r.module, r.perms, r.subperms, r.module_position, r.bydefault"; $sql .= " FROM ".MAIN_DB_PREFIX."rights_def as r"; $sql .= " WHERE r.libelle NOT LIKE 'tou%'"; // On ignore droits "tous" $sql .= " AND r.entity = ".((int) $entity); if (!getDolGlobalString('MAIN_USE_ADVANCED_PERMS')) { $sql .= " AND r.perms NOT LIKE '%_advance'"; // Hide advanced perms if option is disable } $sql .= " ORDER BY r.family_position, r.module_position, r.module, r.id"; $result = $db->query($sql); if ($result) { $num = $db->num_rows($result); $i = 0; $j = 0; $oldmod = ''; $cookietohidegroup = (empty($_COOKIE["DOLUSER_PERMS_HIDE_GRP"]) ? '' : preg_replace('/^,/', '', $_COOKIE["DOLUSER_PERMS_HIDE_GRP"])); $cookietohidegrouparray = explode(',', $cookietohidegroup); while ($i < $num) { $obj = $db->fetch_object($result); // If line is for a module that does not exist anymore (absent of includes/module), we ignore it if (empty($modules[$obj->module])) { $i++; continue; } $objMod = $modules[$obj->module]; if (GETPOSTISSET('forbreakperms_'.$obj->module)) { $ishidden = GETPOSTINT('forbreakperms_'.$obj->module); } elseif (in_array($j, $cookietohidegrouparray)) { // If j is among list of hidden group $ishidden = 1; } else { $ishidden = 0; } $isexpanded = ! $ishidden; // Break found, it's a new module to catch if (isset($obj->module) && ($oldmod != $obj->module)) { $oldmod = $obj->module; $j++; if (GETPOSTISSET('forbreakperms_'.$obj->module)) { $ishidden = GETPOSTINT('forbreakperms_'.$obj->module); } elseif (in_array($j, $cookietohidegrouparray)) { // If j is among list of hidden group $ishidden = 1; } else { $ishidden = 0; } $isexpanded = ! $ishidden; // Break detected, we get objMod $objMod = $modules[$obj->module]; $picto = ($objMod->picto ? $objMod->picto : 'generic'); // Show break line print ''; // Picto and label of module print ''; // Permission and tick (2 columns) if ($permissiontoedit) { print ''; print ''; } else { print ''; print ''; } // Description of permission (2 columns) print ''; print ''; //Add picto + / - when open en closed print ''."\n"; } print ''."\n"; print ''; // Picto and label of module print ''; // Permission and tick (2 columns) if (!empty($permsgroupbyentity[$entity]) && is_array($permsgroupbyentity[$entity])) { if (in_array($obj->id, $permsgroupbyentity[$entity])) { // Own permission by group if ($permissiontoedit) { print ''; } print ''; } else { // Do not own permission if ($permissiontoedit) { print ''; } print ''; } } else { // Do not own permission if ($permissiontoedit) { print ''; } else { print ''; } print ''; } // Description of permission (2 columns) $permlabel = (getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && ($langs->trans("PermissionAdvanced".$obj->id) != "PermissionAdvanced".$obj->id) ? $langs->trans("PermissionAdvanced".$obj->id) : (($langs->trans("Permission".$obj->id) != "Permission".$obj->id) ? $langs->trans("Permission".$obj->id) : $langs->trans($obj->label))); print ''; // Permission id if ($user->admin) { print ''; } else { print ''; } print ''."\n"; $i++; } } print '
'.$langs->trans("Module").''; print ''.$langs->trans("All").""; print '/'; print ''.$langs->trans("None").""; print ''.$langs->trans("Permissions").''; print ''.img_picto('', 'folder-open', 'class="paddingright"').''.$langs->trans("ExpandAll").''; print ' | '; print ''.img_picto('', 'folder', 'class="paddingright"').''.$langs->trans("UndoExpandAll").''; print '
'; print img_object('', $picto, 'class="pictoobjectwidth paddingright"').' '.$objMod->getName(); print ''; print ''; print ''; print ''; print ''; print ''; print ''; print '
'; print '
'; print ''; print ''; print ''; $parameters = array(); $reshook = $hookmanager->executeHooks('insertExtraFooter', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks if ($reshook < 0) { setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); } print dol_get_fiche_end(); } // End of page llxFooter(); $db->close();