From 9f942f06eb7aa9fbd1decc4ebdbbe517c846ffce Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 13 Jun 2006 22:50:36 +0000 Subject: [PATCH] Fix: Si on a droit de modifier mot de passe on ne doit pas pour autant avoir droit de modifier autre info --- htdocs/user/fiche.php | 141 ++++++++++++++++++++++++++++-------------- 1 file changed, 94 insertions(+), 47 deletions(-) diff --git a/htdocs/user/fiche.php b/htdocs/user/fiche.php index b606c4079cd..d7b3339cbbd 100644 --- a/htdocs/user/fiche.php +++ b/htdocs/user/fiche.php @@ -34,18 +34,24 @@ require("./pre.inc.php"); require_once(DOL_DOCUMENT_ROOT."/contact.class.php"); -// Defini si peux lire/modifier utilisateurs et permisssions +// Defini si peux lire/modifier permisssions +$canadduser=($user->admin || $user->rights->user->user->creer); $canreadperms=($user->admin || $user->rights->user->user->lire); $caneditperms=($user->admin || $user->rights->user->user->creer); $candisableperms=($user->admin || $user->rights->user->user->supprimer); -$caneditselfperms=($user->rights->user->self->supprimer); - -if ($user->id <> $_GET["id"]) +// Defini si peux lire/modifier fiche ou mot de passe +if ($_GET["id"]) { - if (! $canreadperms) - { - accessforbidden(); - } + $caneditfield=( (($user->id == $_GET["id"]) && $user->rights->user->self->creer) + || (($user->id != $_GET["id"]) && $user->rights->user->user->creer) ); + + $caneditpassword=( (($user->id == $_GET["id"]) && $user->rights->user->self->password) + || (($user->id != $_GET["id"]) && $user->rights->user->user->password) ); +} + +if ($user->id <> $_GET["id"] && ! $canreadperms) +{ + accessforbidden(); } $langs->load("users"); @@ -97,7 +103,7 @@ if ($_POST["action"] == 'confirm_delete' && $_POST["confirm"] == "yes") } // Action ajout user -if ($_POST["action"] == 'add' && $caneditperms) +if ($_POST["action"] == 'add' && $canadduser) { $message=""; if (! $_POST["nom"]) { @@ -111,7 +117,7 @@ if ($_POST["action"] == 'add' && $caneditperms) if (! $message) { - $edituser = new User($db,0); + $edituser = new User($db); $edituser->nom = trim($_POST["nom"]); $edituser->prenom = trim($_POST["prenom"]); @@ -154,7 +160,7 @@ if ($_POST["action"] == 'add' && $caneditperms) } // Action ajout groupe utilisateur -if ($_POST["action"] == 'addgroup' && $caneditperms) +if ($_POST["action"] == 'addgroup' && $caneditfield) { if ($_POST["group"]) { @@ -166,7 +172,7 @@ if ($_POST["action"] == 'addgroup' && $caneditperms) } } -if ($_GET["action"] == 'removegroup' && $caneditperms) +if ($_GET["action"] == 'removegroup' && $caneditfield) { if ($_GET["group"]) { @@ -178,7 +184,7 @@ if ($_GET["action"] == 'removegroup' && $caneditperms) } } -if ($_POST["action"] == 'update' && ($caneditperms || $caneditselfperms)) +if ($_POST["action"] == 'update' && $caneditfield) { $message=""; @@ -187,17 +193,17 @@ if ($_POST["action"] == 'update' && ($caneditperms || $caneditselfperms)) $edituser = new User($db, $_GET["id"]); $edituser->fetch(); - $edituser->nom = $_POST["nom"]; - $edituser->prenom = $_POST["prenom"]; - $edituser->login = $_POST["login"]; - $edituser->pass = $_POST["pass"]; - $edituser->admin = $_POST["admin"]; - $edituser->office_phone = $_POST["office_phone"]; - $edituser->office_fax = $_POST["office_fax"]; - $edituser->user_mobile = $_POST["user_mobile"]; - $edituser->email = $_POST["email"]; - $edituser->note = $_POST["note"]; - $edituser->webcal_login = $_POST["webcal_login"]; + $edituser->nom = trim($_POST["nom"]); + $edituser->prenom = trim($_POST["prenom"]); + $edituser->login = trim($_POST["login"]); + $edituser->pass = trim($_POST["pass"]); + $edituser->admin = trim($_POST["admin"]); + $edituser->office_phone = trim($_POST["office_phone"]); + $edituser->office_fax = trim($_POST["office_fax"]); + $edituser->user_mobile = trim($_POST["user_mobile"]); + $edituser->email = trim($_POST["email"]); + $edituser->note = trim($_POST["note"]); + $edituser->webcal_login = trim($_POST["webcal_login"]); $ret=$edituser->update(); if ($ret < 0) @@ -250,7 +256,11 @@ if ($_POST["action"] == 'update' && ($caneditperms || $caneditselfperms)) // Action modif mot de passe if ((($_POST["action"] == 'confirm_password' && $_POST["confirm"] == 'yes') +<<<<<<< fiche.php + || $_GET["action"] == 'confirm_passwordsend') && $caneditpassword) +======= || $_GET["action"] == 'confirm_passwordsend') && ($caneditperms || $caneditpassword)) +>>>>>>> 1.91 { $edituser = new User($db, $_GET["id"]); $edituser->fetch(); @@ -373,12 +383,9 @@ else if ($_GET["id"]) { - $fuser = new User($db, $_GET["id"]); - $fuser->fetch(); - $fuser->getrights(); - - $caneditpassword=( (($user->id == $fuser->id) && $user->rights->user->self->password) - || (($user->id != $fuser->id) && $user->rights->user->user->password) ); + $fuser = new User($db, $_GET["id"]); + $fuser->fetch(); + /* * Affichage onglets @@ -577,15 +584,21 @@ else if ($message) { print $message; } + /* * Barre d'actions */ + print '
'; - if ($caneditperms || (($user->id == $fuser->id) && $caneditselfperms)) + if ($caneditfield) { print ''.$langs->trans("Edit").''; } + elseif ($caneditpassword) + { + print ''.$langs->trans("EditPassword").''; + } // Si on a un gestionnaire de generation de mot de passe actif if ($conf->global->USER_PASSWORD_GENERATED != 'none') @@ -663,6 +676,8 @@ else print ''; print ''."\n"; print ''."\n"; + + print '
'; } /* @@ -681,8 +696,6 @@ else $num = $db->num_rows($result); $i = 0; - print '
'; - print ''; print ''; print ''; @@ -703,7 +716,6 @@ else if ($caneditperms) { - print 'rowid.'">'; print img_delete($langs->trans("RemoveFromGroup")); } @@ -742,7 +754,10 @@ else $rowspan=12; print ''; - print ''; + print ''; print ''; print "".''; - print ''; + print ''; // Login print "".''; @@ -837,29 +861,52 @@ else // Tel, fax, portable print "".''; - print ''; + print ''; print "".''; - print ''; + print ''; print "".''; - print ''; + print ''; print "".''; - print ''; + print ''; print "".'"; + if ($caneditfield) + { + print ''; + } + else + { + print nl2br($fuser->note); + } + print ''; // Autres caractéristiques issus des autres modules if ($conf->webcal->enabled) - { + { $langs->load("other"); print "".''; - print ''; - } + print ''; + } print ''; print '
'.$langs->trans("Group").'
'.$langs->trans("Lastname").''; + if ($caneditfield) print ''; + else print $fuser->nom; + print ''; if (file_exists($conf->users->dir_output."/".$fuser->id.".jpg")) { @@ -752,11 +767,20 @@ else { print ''; } - print '

'.$langs->trans("PhotoFile").'
'; + if ($caneditfield) + { + print '

'; + print '
'.$langs->trans("PhotoFile").'
'; + print ''; + print '
'; + } print '
'.$langs->trans("Firstname").'
'; + if ($caneditfield) print ''; + else print $fuser->prenom; + print '
'.$langs->trans("Login").'
'.$langs->trans("Phone").'
'; + if ($caneditfield) print ''; + else print $fuser->office_phone; + print '
'.$langs->trans("Fax").'
'; + if ($caneditfield) print ''; + else print $fuser->office_fax; + print '
'.$langs->trans("Mobile").'
'; + if ($caneditfield) print ''; + else print $fuser->user_mobile; + print '
'.$langs->trans("EMail").'
'; + if ($caneditfield) print ''; + else print $fuser->email; + print '
'.$langs->trans("Note").''; - print '
'.$langs->trans("LoginWebcal").'
'; + if ($caneditfield) print ''; + else print $fuser->webcal_login; + print '
';