Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-05 17:18:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '17.0' of git@github.com:Dolibarr/dolibarr.git into 18.0

Browse Source
This commit is contained in:
Laurent Destailleur
2025-11-24 16:10:29 +01:00
parent c8acd48e34 2935a245a3
commit b1a4520059
5 changed files with 29 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
htdocs/core/lib/security.lib.php
View File

@@ -446,6 +446,10 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '',
$tableandshare = 'paiementcharge';
$parentfortableentity = 'fk_charge@chargesociales';
}
if ($features == 'evaluation') {
$features = 'hrm';
$feature2 = 'evaluation';
}
//print $features.' - '.$tableandshare.' - '.$feature2.' - '.$dbt_select."\n";
@@ -903,7 +907,7 @@ function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tabl
$checkparentsoc = array('agenda', 'contact', 'contrat'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet', 'project'); // Test for project object
$checktask = array('projet_task', 'project_task'); // Test for task object
$checkhierarchy = array('expensereport', 'holiday'); // check permission among the hierarchy of user
$checkhierarchy = array('expensereport', 'holiday', 'hrm'); // check permission among the hierarchy of user
$checkuser = array('bookmark'); // check permission among the fk_user (must be myself or null)
$nocheck = array('barcode', 'stock'); // No test
@@ -1119,6 +1123,20 @@ function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tabl
return false;
}
}
if ($feature == 'hrm' && in_array('evaluation', $feature2)) {
$useridtocheck = $object->fk_user;
if ($user->hasRight('hrm', 'evaluation', 'readall')) {
// the user can view evaluations for anyone
return true;
}
if (!$user->hasRight('hrm', 'evaluation', 'read')) {
// the user can't view any evaluations
return false;
}
// the user can only their own evaluations or their subordinates'
return in_array($useridtocheck, $childids);
}
}
// For some object, we also have to check it is public or owned by user