Skip to content

Commit 030d2c3

Browse files
anukoanuko
committed
A bit more progress on refactoring access checks.
1 parent 4dcb88a commit 030d2c3

19 files changed

Lines changed: 77 additions & 31 deletions

‎WEB-INF/lib/ttTeamHelper.class.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ static function getUsersForSwap() {
143143
if (is_a($res, 'PEAR_Error'))
144144
return false;
145145
while ($val = $res->fetchRow()) {
146-
$isClient = in_array('track_own_time', explode(',', $val['rights'])) ? 0 : 1; // Clients do not have data entry right.
146+
$isClient = in_array('track_own_time', explode(',', $val['rights'])) ? 0 : 1; // Clients do not have track_own_time right.
147147
if ($isClient)
148148
continue; // Skip adding clients.
149149
$user_list[] = $val;

‎WEB-INF/templates/footer.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<br>
1313
<table cellspacing="0" cellpadding="4" width="100%" border="0">
1414
<tr>
15-
<td align="center">&nbsp;Anuko Time Tracker 1.17.69.4156 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
15+
<td align="center">&nbsp;Anuko Time Tracker 1.17.69.4157 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
1616
<a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
1717
<a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
1818
<a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>

‎WEB-INF/templates/user_edit.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ function handleClientControl() {
108108
{if $user->id == $user_id}
109109
<tr>
110110
<td align="right">{$i18n.form.users.role}:</td>
111-
<td>{$user->role_name} {if $user->can('swap_roles')}<a href="swap_roles.php">{$i18n.form.profile.swap_roles}</a>{/if}</td>
111+
<td>{$user->role_name} {if $can_swap}<a href="swap_roles.php">{$i18n.form.profile.swap_roles}</a>{/if}</td>
112112
</tr>
113113
{/if}
114114
<tr>

‎expense_delete.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@
4141
exit();
4242
}
4343

44-
45-
4644
$cl_id = $request->getParameter('id');
4745
$expense_item = ttExpenseHelper::getItem($cl_id, $user->getActiveUser());
4846

‎predefined_expense_add.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@
3030
import('form.Form');
3131
import('ttPredefinedExpenseHelper');
3232

33-
// Access check.
34-
if (!ttAccessAllowed('manage_advanced_settings') || !$user->isPluginEnabled('ex')) {
33+
// Access checks.
34+
if (!ttAccessAllowed('manage_advanced_settings')) {
3535
header('Location: access_denied.php');
3636
exit();
3737
}
38+
if (!$user->isPluginEnabled('ex')) {
39+
header('Location: feature_disabled.php');
40+
exit();
41+
}
3842

3943
if ($request->isPost()) {
4044
$cl_name = trim($request->getParameter('name'));

‎predefined_expense_delete.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@
3030
import('form.Form');
3131
import('ttPredefinedExpenseHelper');
3232

33-
// Access check.
34-
if (!ttAccessAllowed('manage_advanced_settings') || !$user->isPluginEnabled('ex')) {
33+
// Access checks.
34+
if (!ttAccessAllowed('manage_advanced_settings')) {
3535
header('Location: access_denied.php');
3636
exit();
3737
}
38+
if (!$user->isPluginEnabled('ex')) {
39+
header('Location: feature_disabled.php');
40+
exit();
41+
}
3842

3943
$cl_predefined_expense_id = (int)$request->getParameter('id');
4044
$predefined_expense = ttPredefinedExpenseHelper::get($cl_predefined_expense_id);

‎predefined_expense_edit.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@
3030
import('form.Form');
3131
import('ttPredefinedExpenseHelper');
3232

33-
// Access check.
34-
if (!ttAccessAllowed('manage_advanced_settings') || !$user->isPluginEnabled('ex')) {
33+
// Access checks.
34+
if (!ttAccessAllowed('manage_advanced_settings')) {
3535
header('Location: access_denied.php');
3636
exit();
3737
}
38+
if (!$user->isPluginEnabled('ex')) {
39+
header('Location: feature_disabled.php');
40+
exit();
41+
}
3842

3943
$predefined_expense_id = (int) $request->getParameter('id');
4044

‎predefined_expenses.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@
3030
import('form.Form');
3131
import('ttTeamHelper');
3232

33-
// Access check.
34-
if (!ttAccessAllowed('manage_advanced_settings') || !$user->isPluginEnabled('ex')) {
33+
// Access checks.
34+
if (!ttAccessAllowed('manage_advanced_settings')) {
3535
header('Location: access_denied.php');
3636
exit();
3737
}
38+
if (!$user->isPluginEnabled('ex')) {
39+
header('Location: feature_disabled.php');
40+
exit();
41+
}
3842

3943
$form = new Form('predefinedExpensesForm');
4044

‎project_add.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,15 @@
3131
import('ttProjectHelper');
3232
import('ttTeamHelper');
3333

34-
// Access check.
35-
if (!ttAccessAllowed('manage_projects') || (MODE_PROJECTS != $user->tracking_mode && MODE_PROJECTS_AND_TASKS != $user->tracking_mode)) {
34+
// Access checks.
35+
if (!ttAccessAllowed('manage_projects')) {
3636
header('Location: access_denied.php');
3737
exit();
3838
}
39+
if (MODE_PROJECTS != $user->tracking_mode && MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
40+
header('Location: feature_disabled.php');
41+
exit();
42+
}
3943

4044
$users = ttTeamHelper::getActiveUsers();
4145
foreach ($users as $user_item)

‎project_delete.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@
3030
import('form.Form');
3131
import('ttProjectHelper');
3232

33-
// Access check.
34-
if (!ttAccessAllowed('manage_projects') || (MODE_PROJECTS != $user->tracking_mode && MODE_PROJECTS_AND_TASKS != $user->tracking_mode)) {
33+
// Access checks.
34+
if (!ttAccessAllowed('manage_projects')) {
3535
header('Location: access_denied.php');
3636
exit();
3737
}
38+
if (MODE_PROJECTS != $user->tracking_mode && MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
39+
header('Location: feature_disabled.php');
40+
exit();
41+
}
3842

3943
$cl_project_id = (int)$request->getParameter('id');
4044
$project = ttProjectHelper::get($cl_project_id);

0 commit comments

Comments
 (0)