DataObjects/Core_notify_recur.php

[Pman.Core] / DataObjects / Person.php

diff --git a/DataObjects/Person.php b/DataObjects/Person.php
index c657128..ef4037e 100644 (file)
--- a/DataObjects/Person.php
+++ b/DataObjects/Person.php
@@ -386,6 +386,7 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
             
             
             $u = DB_DataObject::factory($this->tableName()); // allow extending this ...
+            $u->autoJoin();
             if ($u->get($a->id)) { /// && strlen($u->passwd)) {  // should work out the pid .. really..
                 return clone($u);
             }
@@ -494,15 +495,13 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
     {
         
         if (substr($this->passwd,0,1) == '$') {
-            var_dump( array( 'Cl145P3w34', crypt('Cl145P3w34','$1$jYcK{[ga$5B3BIarXb5bJ4IySu/Lrj1') , '$1$jYcK{[ga$5B3BIarXb5bJ4IySu/Lrj1'));
-            var_dump($val == 'Cl145P3w34');
             
-            var_dump( array( $val, crypt($val,$this->passwd) , $this->passwd));
             return crypt($val,$this->passwd) == $this->passwd ;
         }
         // old style md5 passwords...- cant be used with courier....
         return md5($val) == $this->passwd;
     }
+    
     function setPassword($value) 
     {
         $salt='';
@@ -889,6 +888,57 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
                     ");*/
         }
         
+        // project directory rules -- this may distrupt things.
+        $p = DB_DataObject::factory('ProjectDirectory');
+        // if project directories are set up, then we can apply project query rules..
+        if ($p->count()) {
+            $p->autoJoin();
+            $pids = $p->projects($au);
+            if (isset($q['query']['project_id'])) {   
+                $pid = (int)$q['query']['project_id'];
+                if (!in_array($pid, $pids)) {
+                    $roo->jerr("Project not in users valid projects");
+                }
+                $pids = array($pid);
+            }
+            // project roles..
+            //if (empty($q['_anyrole'])) {  // should be project_directry_role
+            //    $p->whereAdd("{$p->tableName()}.role != ''");
+            // }
+            if (!empty($q['query']['role'])) {  // should be project_directry_role
+                $role = $this->escape($q['query']['role']); 
+               
+                $p->whereAdd("{$p->tableName()}.role LIKE '%{$role}%'");
+                 
+            }
+            
+            if (!$roo->hasPerm('Core.Projects_All', 'S')) {
+                $peps = $p->people($pids);
+                $this->whereAddIn("{$tn}.id", $peps, 'int');
+            }
+        }    
+        
+        // fixme - this needs a more generic fix - it was from the mtrack_person code...
+        if (isset($q['query']['ticket_id'])) {  
+            // find out what state the ticket is in.
+            $t = DB_DataObject::Factory('mtrack_ticket');
+            $t->autoJoin();
+            $t->get($q['query']['ticket_id']);
+            
+            if (!$this->checkPerm('S', $au)) {
+                $roo->jerr("permssion denied to query state of ticket");
+            }
+            
+            $p = DB_DataObject::factory('ProjectDirectory');
+            $pids = array($t->project_id);
+           
+            $peps = $p->people($pids);
+            
+            $this->whereAddIn($this->tableName().'.id', $peps, 'int');
+            
+            //$this->whereAdd('join_prole != ''");
+            
+        }  
     }
     function setFromRoo($ar, $roo)
     {
@@ -951,10 +1001,18 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
         if ($au && $au->id == -1) {
             return true;
         }
+        // if not authenticated... do not allow in???
+        if (!$au ) {
+            return false;
+        }
         
         // determine if it's staff!!!
-         
-        if ($au->company()->comptype != 'OWNER') {
+        $owncomp = DB_DataObject::Factory('Companies');
+        $owncomp->get('comptype', 'OWNER');
+        $isStaff = ($au->company_id ==  $owncomp->id);
+       
+       
+        if (!$isStaff) {
             
             // - can not change company!!!
             if ($changes && 
@@ -970,17 +1028,19 @@ class Pman_Core_DataObjects_Person extends DB_DataObject
                 return false;
             }
             
+            
+            // mtrack had the idea that all 'S' should be allowed.. - but filtered later..
+            // ???? do we want this?
+            
             // edit self... - what about other staff members...
             
-            return $this->company_id == $au->company_id;
+            //return $this->company_id == $au->company_id;
         }
-         
+        
          
         // yes, only owner company can mess with this...
-        $owncomp = DB_DataObject::Factory('Companies');
-        $owncomp->get('comptype', 'OWNER');
         
-        $isStaff = ($this->company_id ==  $owncomp->id);
+        
         
     
         switch ($lvl) {