Debug permission on supplier order.

Fix #huntr58ddbd8a-0faf-4b3f-aec9-5850bb19ab67
This commit is contained in:
Laurent Destailleur 2021-11-20 15:41:31 +01:00
parent 001507f54e
commit 63cd06394f
8 changed files with 101 additions and 47 deletions

View File

@ -2149,7 +2149,8 @@ function print_left_eldy_menu($db, $menu_array_before, $menu_array_after, &$tabM
// Not enabled but visible (so greyed), except if parent was not enabled.
print '<div class="menu_contenu'.$cssmenu.'">';
print $tabstring;
print '<span class="vsmenudisabled vsmenudisabledmargin">'.$menu_array[$i]['titre'].'</span><br></div>'."\n";
print '<span class="vsmenudisabled vsmenudisabledmargin">'.$menu_array[$i]['titre'].'</span><br>';
print '</div>'."\n";
}
}

View File

@ -2295,7 +2295,14 @@ class CommandeFournisseur extends CommonOrder
dol_syslog(get_class($this)."::Livraison");
if ($user->rights->fournisseur->commande->receptionner) {
$usercanreceive = 0;
if (empty($conf->reception->enabled)) {
$usercanreceive = $user->rights->fournisseur->commande->receptionner;
} else {
$usercanreceive = $user->rights->reception->creer;
}
if ($usercanreceive) {
// Define the new status
if ($type == 'par') {
$statut = self::STATUS_RECEIVED_PARTIALLY;

View File

@ -90,7 +90,6 @@ $datelivraison = dol_mktime(GETPOST('liv_hour', 'int'), GETPOST('liv_min', 'int'
if ($user->socid) {
$socid = $user->socid;
}
$result = restrictedArea($user, 'fournisseur', $id, 'commande_fournisseur', 'commande');
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
$hookmanager->initHooks(array('ordersuppliercard', 'globalcard'));
@ -124,6 +123,8 @@ if ($id > 0 || !empty($ref)) {
}
}
$result = restrictedArea($user, 'fournisseur', $id, 'commande_fournisseur', 'commande');
// Common permissions
$usercanread = ($user->rights->fournisseur->commande->lire || $user->rights->supplier_order->lire);
$usercancreate = ($user->rights->fournisseur->commande->creer || $user->rights->supplier_order->creer);
@ -136,7 +137,11 @@ $usercanvalidate = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($us
$usercanapprove = $user->rights->fournisseur->commande->approuver;
$usercanapprovesecond = $user->rights->fournisseur->commande->approve2;
$usercanorder = $user->rights->fournisseur->commande->commander;
$usercanreceived = $user->rights->fournisseur->commande->receptionner;
if (empty($conf->reception->enabled)) {
$usercanreceive = $user->rights->fournisseur->commande->receptionner;
} else {
$usercanreceive = $user->rights->reception->creer;
}
// Permissions for includes
$permissionnote = $usercancreate; // Used by the include of actions_setnotes.inc.php

View File

@ -62,11 +62,6 @@ $confirm = GETPOST('confirm', 'alpha');
if ($user->socid) {
$socid = $user->socid;
}
$result = restrictedArea($user, 'fournisseur', $id, 'commande_fournisseur', 'commande');
if (empty($conf->stock->enabled)) {
accessforbidden();
}
$hookmanager->initHooks(array('ordersupplierdispatch'));
@ -89,6 +84,21 @@ if ($id > 0 || !empty($ref)) {
}
}
if (empty($conf->reception->enabled)) {
$permissiontoreceive = $user->rights->fournisseur->commande->receptionner;
$permissiontocontrol = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande_advance->check)));
} else {
$permissiontoreceive = $user->rights->reception->creer;
$permissiontocontrol = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->creer)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->reception_advance->validate)));
}
// $id is id of a purchase order.
$result = restrictedArea($user, 'fournisseur', $id, 'commande_fournisseur', 'commande');
if (empty($conf->stock->enabled)) {
accessforbidden();
}
/*
* Actions
@ -100,7 +110,7 @@ if ($reshook < 0) {
setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');
}
if ($action == 'checkdispatchline' && !((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande_advance->check)))) {
if ($action == 'checkdispatchline' && $permissiontocontrol) {
$error = 0;
$supplierorderdispatch = new CommandeFournisseurDispatch($db);
@ -137,7 +147,7 @@ if ($action == 'checkdispatchline' && !((empty($conf->global->MAIN_USE_ADVANCED_
}
}
if ($action == 'uncheckdispatchline' && !((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande_advance->check)))) {
if ($action == 'uncheckdispatchline' && $permissiontocontrol) {
$error = 0;
$supplierorderdispatch = new CommandeFournisseurDispatch($db);
@ -173,7 +183,7 @@ if ($action == 'uncheckdispatchline' && !((empty($conf->global->MAIN_USE_ADVANCE
}
}
if ($action == 'denydispatchline' && !((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande_advance->check)))) {
if ($action == 'denydispatchline' && $permissiontocontrol) {
$error = 0;
$supplierorderdispatch = new CommandeFournisseurDispatch($db);
@ -209,7 +219,7 @@ if ($action == 'denydispatchline' && !((empty($conf->global->MAIN_USE_ADVANCED_P
}
}
if ($action == 'dispatch' && $user->rights->fournisseur->commande->receptionner) {
if ($action == 'dispatch' && $permissiontoreceive) {
$error = 0;
$db->begin();
@ -387,7 +397,7 @@ if ($action == 'dispatch' && $user->rights->fournisseur->commande->receptionner)
}
// Remove a dispatched line
if ($action == 'confirm_deleteline' && $confirm == 'yes' && $user->rights->fournisseur->commande->receptionner) {
if ($action == 'confirm_deleteline' && $confirm == 'yes' && $permissiontoreceive) {
$db->begin();
$supplierorderdispatch = new CommandeFournisseurDispatch($db);
@ -430,7 +440,7 @@ if ($action == 'confirm_deleteline' && $confirm == 'yes' && $user->rights->fourn
}
// Update a dispatched line
if ($action == 'updateline' && $user->rights->fournisseur->commande->receptionner) {
if ($action == 'updateline' && $permissiontoreceive) {
$db->begin();
$error = 0;
@ -751,9 +761,9 @@ if ($id > 0 || !empty($ref)) {
// Select warehouse to force it everywhere
if (count($listwarehouses) > 1) {
print '<br>'.$langs->trans("ForceTo").' '.$form->selectarray('fk_default_warehouse', $listwarehouses, $fk_default_warehouse, 1, 0, 0, '', 0, 0, $disabled, '', 'minwidth100 maxwidth300', 1);
print '<br><span class="opacitymedium">'.$langs->trans("ForceTo").'</span> '.$form->selectarray('fk_default_warehouse', $listwarehouses, $fk_default_warehouse, 1, 0, 0, '', 0, 0, $disabled, '', 'minwidth100 maxwidth300', 1);
} elseif (count($listwarehouses) == 1) {
print '<br>'.$langs->trans("ForceTo").' '.$form->selectarray('fk_default_warehouse', $listwarehouses, $fk_default_warehouse, 0, 0, 0, '', 0, 0, $disabled, '', 'minwidth100 maxwidth300', 1);
print '<br><span class="opacitymedium">'.$langs->trans("ForceTo").'</span> '.$form->selectarray('fk_default_warehouse', $listwarehouses, $fk_default_warehouse, 0, 0, 0, '', 0, 0, $disabled, '', 'minwidth100 maxwidth300', 1);
}
print '</td>';
@ -1055,10 +1065,19 @@ if ($id > 0 || !empty($ref)) {
$dispatchBt = empty($conf->reception->enabled) ? $langs->trans("Receive") : $langs->trans("CreateReception");
print '<br><input type="submit" class="button" name="dispatch" value="'.dol_escape_htmltag($dispatchBt).'"';
print '<br>';
print '<input type="submit" class="button" name="dispatch" value="'.dol_escape_htmltag($dispatchBt).'"';
$disabled = 0;
if (!$permissiontoreceive) {
$disabled = 1;
}
if (count($listwarehouses) <= 0) {
$disabled = 1;
}
if ($disabled) {
print ' disabled';
}
print '>';
}
print '</div>';
@ -1257,7 +1276,7 @@ if ($id > 0 || !empty($ref)) {
// Add button to check/uncheck disaptching
print '<td class="center">';
if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->fournisseur->commande_advance->check))) {
if (!$permissiontocontrol) {
if (empty($objp->status)) {
print '<a class="button buttonRefused" href="#">'.$langs->trans("Approve").'</a>';
print '<a class="button buttonRefused" href="#">'.$langs->trans("Deny").'</a>';

View File

@ -112,9 +112,6 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be includ
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
$hookmanager->initHooks(array('receptioncard', 'globalcard'));
$permissiondellink = $user->rights->reception->creer; // Used by the include of actions_dellink.inc.php
//var_dump($object->lines[0]->detail_batch);
$date_delivery = dol_mktime(GETPOST('date_deliveryhour', 'int'), GETPOST('date_deliverymin', 'int'), 0, GETPOST('date_deliverymonth', 'int'), GETPOST('date_deliveryday', 'int'), GETPOST('date_deliveryyear', 'int'));
if ($id > 0 || !empty($ref)) {
@ -142,9 +139,10 @@ if ($user->socid) {
$socid = $user->socid;
}
if ($origin == 'reception') {
if (!empty($conf->reception->enabled) || $origin == 'reception' || empty($origin)) {
$result = restrictedArea($user, 'reception', $id);
} else {
// We do not use the reception module, so we test permission on the supplier orders
if ($origin == 'supplierorder' || $origin == 'order_supplier') {
$result = restrictedArea($user, 'fournisseur', $origin_id, 'commande_fournisseur', 'commande');
} elseif (empty($user->rights->{$origin}->lire) && empty($user->rights->{$origin}->read)) {
@ -152,6 +150,20 @@ if ($origin == 'reception') {
}
}
if (!empty($conf->reception->enabled)) {
$permissiontoread = $user->rights->reception->lire;
$permissiontoadd = $user->rights->reception->creer;
$permissiondellink = $user->rights->reception->creer; // Used by the include of actions_dellink.inc.php
$permissiontovalidate = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->creer)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->reception_advance->validate)));
$permissiontodelete = $user->rights->reception->supprimer;
} else {
$permissiontoread = $user->rights->fournisseur->commande->receptionner;
$permissiontoadd = $user->rights->fournisseur->commande->receptionner;
$permissiondellink = $user->rights->fournisseur->commande->receptionner; // Used by the include of actions_dellink.inc.php
$permissiontovalidate = ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande->receptionner)) || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->fournisseur->commande_advance->check)));
$permissiontodelete = $user->rights->fournisseur->commande->receptionner;
}
/*
* Actions
@ -171,12 +183,12 @@ if (empty($reshook)) {
include DOL_DOCUMENT_ROOT.'/core/actions_dellink.inc.php'; // Must be include, not include_once
// Reopen
if ($action == 'reopen' && $user->rights->reception->creer) {
if ($action == 'reopen' && $permissiontoadd) {
$result = $object->reOpen();
}
// Confirm back to draft status
if ($action == 'modif' && $user->rights->reception->creer) {
if ($action == 'modif' && $permissiontoadd) {
$result = $object->setDraft($user);
if ($result >= 0) {
// Define output language
@ -201,11 +213,11 @@ if (empty($reshook)) {
}
// Set incoterm
if ($action == 'set_incoterms' && !empty($conf->incoterm->enabled)) {
if ($action == 'set_incoterms' && !empty($conf->incoterm->enabled) && $permissiontoadd) {
$result = $object->setIncoterms(GETPOST('incoterm_id', 'int'), GETPOST('location_incoterms', 'alpha'));
}
if ($action == 'setref_supplier') {
if ($action == 'setref_supplier' && $permissiontoadd) {
if ($result < 0) {
setEventMessages($object->error, $object->errors, 'errors');
}
@ -220,7 +232,7 @@ if (empty($reshook)) {
}
}
if ($action == 'update_extras') {
if ($action == 'update_extras' && $permissiontoadd) {
$object->oldcopy = dol_clone($object);
// Fill array 'array_options' with data from update form
@ -244,7 +256,7 @@ if (empty($reshook)) {
}
// Create reception
if ($action == 'add' && $user->rights->reception->creer) {
if ($action == 'add' && $permissiontoadd) {
$error = 0;
$predef = '';
@ -405,10 +417,7 @@ if (empty($reshook)) {
$_GET["commande_id"] = GETPOST('commande_id', 'int');
$action = 'create';
}
} elseif ($action == 'confirm_valid' && $confirm == 'yes' &&
((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->creer))
|| (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->reception->reception_advance->validate)))
) {
} elseif ($action == 'confirm_valid' && $confirm == 'yes' && $permissiontovalidate) {
$object->fetch_thirdparty();
$result = $object->valid($user);
@ -440,7 +449,7 @@ if (empty($reshook)) {
}
}
}
} elseif ($action == 'confirm_delete' && $confirm == 'yes' && $user->rights->reception->supprimer) {
} elseif ($action == 'confirm_delete' && $confirm == 'yes' && $permissiontodelete) {
$result = $object->delete($user);
if ($result > 0) {
header("Location: ".DOL_URL_ROOT.'/reception/index.php');
@ -455,7 +464,7 @@ if (empty($reshook)) {
if ($result < 0) {
setEventMessages($object->error, $object->errors, 'errors');
}*/
} elseif ($action == 'setdate_livraison' && $user->rights->reception->creer) {
} elseif ($action == 'setdate_livraison' && $permissiontoadd) {
//print "x ".$_POST['liv_month'].", ".$_POST['liv_day'].", ".$_POST['liv_year'];
$datedelivery = dol_mktime(GETPOST('liv_hour', 'int'), GETPOST('liv_min', 'int'), 0, GETPOST('liv_month', 'int'), GETPOST('liv_day', 'int'), GETPOST('liv_year', 'int'));
@ -506,7 +515,7 @@ if (empty($reshook)) {
}
$action = "";
} elseif ($action == 'builddoc') {
} elseif ($action == 'builddoc' && $permissiontoread) {
// Build document
// En get ou en post
// Save last template used to generate document
@ -532,7 +541,7 @@ if (empty($reshook)) {
setEventMessages($object->error, $object->errors, 'errors');
$action = '';
}
} elseif ($action == 'remove_file') {
} elseif ($action == 'remove_file' && $permissiontoadd) {
// Delete file in doc form
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
@ -550,13 +559,13 @@ if (empty($reshook)) {
header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id);
exit();
}
} elseif ($action == 'classifyclosed') {
} elseif ($action == 'classifyclosed' && $permissiontoread) {
$result = $object->setClosed();
if ($result >= 0) {
header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id);
exit();
}
} elseif ($action == 'deleteline' && !empty($line_id)) {
} elseif ($action == 'deleteline' && !empty($line_id) && $permissiontoread) {
// delete a line
$lines = $object->lines;
$line = new CommandeFournisseurDispatch($db);
@ -579,7 +588,7 @@ if (empty($reshook)) {
} else {
setEventMessages($line->error, $line->errors, 'errors');
}
} elseif ($action == 'updateline' && $user->rights->reception->creer && GETPOST('save')) {
} elseif ($action == 'updateline' && GETPOST('save') && $permissiontoadd) {
// Update a line
// Clean parameters
$qty = 0;
@ -666,11 +675,11 @@ if (empty($reshook)) {
$object->generateDocument($object->model_pdf, $outputlangs, $hidedetails, $hidedesc, $hideref);
}
} else {
header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // Pour reaffichage de la fiche en cours d'edition
header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // To reshow the record we edit
exit();
}
} elseif ($action == 'updateline' && $user->rights->reception->creer && GETPOST('cancel', 'alpha') == $langs->trans("Cancel")) {
header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // Pour reaffichage de la fiche en cours d'edition
} elseif ($action == 'updateline' && $permissiontoadd && GETPOST('cancel', 'alpha') == $langs->trans("Cancel")) {
header('Location: '.$_SERVER['PHP_SELF'].'?id='.$object->id); // To reshow the record we edit
exit();
}

View File

@ -2881,12 +2881,12 @@ a.vsmenu:link, a.vsmenu:visited, a.vsmenu:hover, a.vsmenu:active, span.vsmenu {
color: #202020;
margin: 1px 1px 1px 6px;
}
font.vsmenudisabled { font-family: <?php print $fontlist ?>; text-align: <?php print $left; ?>; color: #aaa; }
span.vsmenudisabled, font.vsmenudisabled { font-family: <?php print $fontlist ?>; text-align: <?php print $left; ?>; color: #aaa; }
a.vsmenu:link, a.vsmenu:visited {
color: var(--colortextbackvmenu);
white-space: nowrap;
}
font.vsmenudisabledmargin { margin: 1px 1px 1px 6px; }
span.vsmenudisabledmargin, font.vsmenudisabledmargin { margin: 1px 1px 1px 6px; }
li a.vsmenudisabled, li.vsmenudisabled { color: #aaa !important; }
a.help:link, a.help:visited, a.help:hover, a.help:active, span.help { text-align: <?php print $left; ?>; color: #aaa; text-decoration: none; }

View File

@ -2928,9 +2928,9 @@ span.vmenudisabled, font.vmenudisabled { font-size:<?php print $fontsize ?>px;
a.vmenu:link, a.vmenu:visited { color: #<?php echo $colortextbackvmenu; ?>; }
a.vsmenu:link, a.vsmenu:visited, a.vsmenu:hover, a.vsmenu:active, span.vsmenu { font-size:<?php print $fontsize ?>px; font-family: <?php print $fontlist ?>; text-align: <?php print $left; ?>; font-weight: normal; color: #202020; margin: 1px 1px 1px 8px; }
font.vsmenudisabled { font-size:<?php print $fontsize ?>px; font-family: <?php print $fontlist ?>; text-align: <?php print $left; ?>; font-weight: normal; color: #aaa; }
span.vsmenudisabled, font.vsmenudisabled { font-size:<?php print $fontsize ?>px; font-family: <?php print $fontlist ?>; text-align: <?php print $left; ?>; font-weight: normal; color: #aaa; }
a.vsmenu:link, a.vsmenu:visited { color: #<?php echo $colortextbackvmenu; ?>; white-space: nowrap; }
font.vsmenudisabledmargin { margin: 1px 1px 1px 8px; }
span.vsmenudisabledmargin, font.vsmenudisabledmargin { margin: 1px 1px 1px 8px; }
a.help:link, a.help:visited, a.help:hover, a.help:active, span.help { text-align: <?php print $left; ?>; font-weight: normal; color: #999; text-decoration: none; }

View File

@ -317,6 +317,19 @@ if ($result) {
continue;
}
// Special cases
if (!empty($conf->reception->enabled)) {
// The 2 permission in fournisseur modules has been replaced by permissions into reception module
if ($obj->module == 'fournisseur' && $obj->perms == 'commande' && $obj->subperms == 'receptionner') {
$i++;
continue;
}
if ($obj->module == 'fournisseur' && $obj->perms == 'commande_advance' && $obj->subperms == 'check') {
$i++;
continue;
}
}
$objMod = $modules[$obj->module];
// Save field module_position in database if value is wrong