projects
/
Pman.Core
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
e86359f
)
modify permissions on editing core_person - staff can edit any person if they have...
author
Alan
<alan@roojs.com>
Tue, 3 Jan 2023 03:13:43 +0000
(11:13 +0800)
committer
Alan
<alan@roojs.com>
Tue, 3 Jan 2023 03:13:43 +0000
(11:13 +0800)
DataObjects/Core_person.php
patch
|
blob
|
history
diff --git
a/DataObjects/Core_person.php
b/DataObjects/Core_person.php
index
fa876a0
..
5d23392
100644
(file)
--- a/
DataObjects/Core_person.php
+++ b/
DataObjects/Core_person.php
@@
-1375,10
+1375,18
@@
class Pman_Core_DataObjects_Core_person extends DB_DataObject
// determine if it's staff!!!
$owncomp = DB_DataObject::Factory('core_company');
$owncomp->get('comptype', 'OWNER');
// determine if it's staff!!!
$owncomp = DB_DataObject::Factory('core_company');
$owncomp->get('comptype', 'OWNER');
- $isStaff = ($au->company_id == $owncomp->id);
-
+ $editor_is_staff = ($au->company_id == $owncomp->id);
+
+ if (!$editor_is_staff) {
+ // non staff editing should not user roo/isPerm?
+ return false; // no permission if user is not staff!?
+
+ }
+
+ $this_is_staff = ($this->company_id == $owncomp->id);
- if (!$isStaff) {
+ /*
+ if (!$this_is_staff ) {
// - can not change company!!!
if ($changes &&
// - can not change company!!!
if ($changes &&
@@
-1402,7
+1410,7
@@
class Pman_Core_DataObjects_Core_person extends DB_DataObject
//return $this->company_id == $au->company_id;
}
//return $this->company_id == $au->company_id;
}
-
+ */
// yes, only owner company can mess with this...
// yes, only owner company can mess with this...
@@
-1413,11
+1421,13
@@
class Pman_Core_DataObjects_Core_person extends DB_DataObject
// extra case change passwod?
case 'P': //??? password
// standard perms -- for editing + if the user is dowing them selves..
// extra case change passwod?
case 'P': //??? password
// standard perms -- for editing + if the user is dowing them selves..
- $ret = $
isStaff
? $au->hasPerm("Core.Staff", "E") : $au->hasPerm("Core.Person", "E");
- return $ret || $au->id == $this->id;
+ $ret = $
this_is_staff
? $au->hasPerm("Core.Staff", "E") : $au->hasPerm("Core.Person", "E");
+ return $ret || $au->id == $this->id;
// can change own data?
default:
default:
- return $isStaff ? $au->hasPerm("Core.Staff", $lvl) : $au->hasPerm("Core.Person", $lvl);
+ return $this_is_staff ? $au->hasPerm("Core.Staff", $lvl) : $au->hasPerm("Core.Person", $lvl);
+
+
}
return false;
}
return false;