blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-06-01 12:19:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Gruppenmanagement: added checks so only Gruppenmanager can edit groups

Browse Source
This commit is contained in:
Alexei Karpenko
2024-12-10 12:03:58 +01:00
parent 07ee3e1f4e
commit cc99d2b378
3 changed files with 77 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/person/Gruppenmanagement.php
+42
View File
@@ -29,6 +29,7 @@ class Gruppenmanagement extends Auth_Controller
$this->load->model('person/benutzer_model', 'BenutzerModel');
$this->load->model('ressource/mitarbeiter_model', 'MitarbeiterModel');
$this->load->model('person/benutzergruppe_model', 'BenutzergruppeModel');
$this->load->model('person/gruppe_manager_model', 'GruppemanagerModel');
$this->load->model('system/Log_model', 'LogModel');
$this->load->library('WidgetLib');
@@ -117,6 +118,27 @@ class Gruppenmanagement extends Auth_Controller
$result = error('Uid missing');
else
{
$this->GruppemanagerModel->addSelect('1');
$isManagerRes = $this->GruppemanagerModel->loadWhere(
array(
'uid' => $this->_uid,
'gruppe_kurzbz' => $gruppe_kurzbz
)
);
if (isError($isManagerRes))
{
$this->outputJsonError(getError($isManagerRes));
return;
}
if (!hasData($isManagerRes))
{
$this->outputJsonError($this->p->t('gruppenmanagement', 'nichtZumEditierenDerGruppeBerechtigt'));
return;
}
$this->BenutzergruppeModel->addSelect('1');
$benutzerExistsRes = $this->BenutzergruppeModel->loadWhere(
array(
'uid' => $uid,
@@ -170,6 +192,26 @@ class Gruppenmanagement extends Auth_Controller
$result = error('Uid missing');
else
{
$this->GruppemanagerModel->addSelect('1');
$isManagerRes = $this->GruppemanagerModel->loadWhere(
array(
'uid' => $this->_uid,
'gruppe_kurzbz' => $gruppe_kurzbz
)
);
if (isError($isManagerRes))
{
$this->outputJsonError(getError($isManagerRes));
return;
}
if (!hasData($isManagerRes))
{
$this->outputJsonError($this->p->t('gruppenmanagement', 'nichtZumEditierenDerGruppeBerechtigt'));
return;
}
$result = $this->BenutzergruppeModel->delete(
array(
'uid' => $uid,
application/models/person/Gruppe_manager_model.php
+14
View File
@@ -0,0 +1,14 @@
<?php
class Gruppe_manager_model extends DB_Model
{
/**
* Constructor
*/
public function __construct()
{
parent::__construct();
$this->dbTable = 'public.tbl_gruppe_manager';
$this->pk = 'gruppe_manager_id';
}
}
system/phrasesupdate.php
+21 -1
View File
@@ -37196,8 +37196,28 @@ array(
'insertvon' => 'system'
)
)
)
),
// CIS4 phrases from legacy code end
array(
'app' => 'core',
'category' => 'gruppenmanagement',
'phrase' => 'nichtZumEditierenDerGruppeBerechtigt',
'insertvon' => 'system',
'phrases' => array(
array(
'sprache' => 'German',
'text' => "Nicht zum Editieren der Gruppe berechtigt",
'description' => '',
'insertvon' => 'system'
),
array(
'sprache' => 'English',
'text' => "No authorization for editing the group",
'description' => '',
'insertvon' => 'system'
)
)
)
);