DataObjects/Core_watch.php

[Pman.Core] / DataObjects / Person.php

diff --git a/DataObjects/Person.php b/DataObjects/Person.php
index 3202a50..870139d 100644 (file)
--- a/DataObjects/Person.php
+++ b/DataObjects/Person.php
@@ -253,6 +253,10 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
     //   ---------------- authentication / passwords and keys stuff  ----------------
     function isAuth()
     {
+        
+        @session_start();
+       
+        
         $db = $this->getDatabaseConnection();
         // we combine db + project names,
         // otherwise if projects use different 'auth' objects
@@ -266,13 +270,13 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
             // in session...
             $a = unserialize($_SESSION[get_class($this)][$sesPrefix .'-auth']);
             
+            
             $u = DB_DataObject::factory($this->tableName());
             if ($a->id && $u->get($a->id)) { //&& strlen($u->passwd)) {
               
                 return $u->verifyAuth();
                 
-   
-                return true;
+    
             }
             
             unset($_SESSION[get_class($this)][$sesPrefix .'-auth']);
@@ -374,13 +378,15 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
         $ff= HTML_FlexyFramework::get();
         $sesPrefix = $ff->appNameShort .'-' .get_class($this) .'-'.$db->dsn['database'] ;
         
+        
         //var_dump(array(get_class($this),$sesPrefix .'-auth'));
        
         if (!empty($_SESSION[get_class($this)][$sesPrefix .'-auth'])) {
             $a = unserialize($_SESSION[get_class($this)][$sesPrefix .'-auth']);
             
-            print_r($a);
+            
             $u = DB_DataObject::factory($this->tableName()); // allow extending this ...
+            $u->autoJoin();
             if ($u->get($a->id)) { /// && strlen($u->passwd)) {  // should work out the pid .. really..
                 return clone($u);
             }
@@ -489,11 +495,13 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
     {
         
         if (substr($this->passwd,0,1) == '$') {
+            
             return crypt($val,$this->passwd) == $this->passwd ;
         }
         // old style md5 passwords...- cant be used with courier....
         return md5($val) == $this->passwd;
     }
+    
     function setPassword($value) 
     {
         $salt='';
@@ -838,7 +846,7 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
         
         if(!empty($q['query']['name'])){
             $this->whereAdd("
-                Person.name LIKE '%{$this->escape($q['query']['name'])}%'
+                {$this->tableName()}.name LIKE '%{$this->escape($q['query']['name'])}%'
             ");
         }
         
@@ -880,6 +888,57 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
                     ");*/
         }
         
+        // project directory rules -- this may distrupt things.
+        $p = DB_DataObject::factory('ProjectDirectory');
+        // if project directories are set up, then we can apply project query rules..
+        if ($p->count()) {
+            $p->autoJoin();
+            $pids = $p->projects($au);
+            if (isset($q['query']['project_id'])) {   
+                $pid = (int)$q['query']['project_id'];
+                if (!in_array($pid, $pids)) {
+                    $roo->jerr("Project not in users valid projects");
+                }
+                $pids = array($pid);
+            }
+            // project roles..
+            //if (empty($q['_anyrole'])) {  // should be project_directry_role
+            //    $p->whereAdd("{$p->tableName()}.role != ''");
+            // }
+            if (!empty($q['query']['role'])) {  // should be project_directry_role
+                $role = $this->escape($q['query']['role']); 
+               
+                $p->whereAdd("{$p->tableName()}.role LIKE '%{$role}%'");
+                 
+            }
+            
+            if (!$roo->hasPerm('Core.Projects_All', 'S')) {
+                $peps = $p->people($pids);
+                $this->whereAddIn("{$tn}.id", $peps, 'int');
+            }
+        }    
+        
+        // fixme - this needs a more generic fix - it was from the mtrack_person code...
+        if (isset($q['query']['ticket_id'])) {  
+            // find out what state the ticket is in.
+            $t = DB_DataObject::Factory('mtrack_ticket');
+            $t->autoJoin();
+            $t->get($q['query']['ticket_id']);
+            
+            if (!$this->checkPerm('S', $au)) {
+                $roo->jerr("permssion denied to query state of ticket");
+            }
+            
+            $p = DB_DataObject::factory('ProjectDirectory');
+            $pids = array($t->project_id);
+           
+            $peps = $p->people($pids);
+            
+            $this->whereAddIn($this->tableName().'.id', $peps, 'int');
+            
+            //$this->whereAdd('join_prole != ''");
+            
+        }  
     }
     function setFromRoo($ar, $roo)
     {
@@ -942,10 +1001,18 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
         if ($au && $au->id == -1) {
             return true;
         }
+        // if not authenticated... do not allow in???
+        if (!$au ) {
+            return false;
+        }
         
         // determine if it's staff!!!
-         
-        if ($au->company()->comptype != 'OWNER') {
+        $owncomp = DB_DataObject::Factory('Companies');
+        $owncomp->get('comptype', 'OWNER');
+        $isStaff = ($au->company_id ==  $owncomp->id);
+       
+       
+        if (!$isStaff) {
             
             // - can not change company!!!
             if ($changes && 
@@ -961,17 +1028,19 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
                 return false;
             }
             
+            
+            // mtrack had the idea that all 'S' should be allowed.. - but filtered later..
+            // ???? do we want this?
+            
             // edit self... - what about other staff members...
             
-            return $this->company_id == $au->company_id;
+            //return $this->company_id == $au->company_id;
         }
-         
+        
          
         // yes, only owner company can mess with this...
-        $owncomp = DB_DataObject::Factory('Companies');
-        $owncomp->get('comptype', 'OWNER');
         
-        $isStaff = ($this->company_id ==  $owncomp->id);
+        
         
     
         switch ($lvl) {