login & rights > Bug (done?)

Viewing projects on the Person page / #5746

MoveBookmark

Summary

v0.085 - refactor query filters
done?
Jul 25, 2007
100%
Jul 25, 2007 / jd
May 9, 2008 / cody-somerville
View previous 4 versions
 

Attached files

No files uploaded

Issue report

Minor
Always
If the user has right to "Edit project teams" (RIGHT_PROJECT_ASSIGN) but doesn't have right to "View anything" (RIGHT_VIEWALL), then on the page of any Person he will see the list all projects this Person is assigned to.
Such user can see only project he is assigned to.
I've fixed it like this:

from db\class_person.inc.php

    public function getProjects($f_order_by=NULL, $f_status_min=STATUS_UPCOMING, $f_status_max= STATUS_COMPLETED)
    {
        ...
        ### all projects ###
        if($auth->cur_user->user_rights & RIGHT_PROJECT_ASSIGN) {
        ...
changed to:

from db\class_person.inc.php

    public function getProjects($f_order_by=NULL, $f_status_min=STATUS_UPCOMING, $f_status_max= STATUS_COMPLETED)
    {
        ...
        ### all projects ###
        if ( ($auth->cur_user->user_rights & RIGHT_PROJECT_ASSIGN) &&
             ($auth->cur_user->user_rights & RIGHT_VIEWALL) ) {
        ...
 

4 Comments

jd

Jul 25, 2007
View comment
Actually, I'm confused a little about using this condition here: 
$auth->cur_user->user_rights & RIGHT_PROJECT_ASSIGN
May be this solution will be more logical:

from dbclass_person.inc.php

    public function getProjects($f_order_by=NULL, $f_status_min=STATUS_UPCOMING, $f_status_max= STATUS_COMPLETED)
    {
        ...
        ### all projects ###
        if ($auth->cur_user->user_rights & RIGHT_VIEWALL) {
        ...

pixtur

Aug 9, 2007
sounds reasonable.
I changed the code, as you suggested. I am not sure, why I used the old check, but it was obviously not a good idea.

stefan

Aug 17, 2007
version 2
same behaviour in personViewTasks and personViewEfforts
I am not sure, if its right or not, but a persons tasks and efforts in serveral projects are viewable by all other persons who assigned to different projects.

Ok, i try to show it

project A
  • developer : stefan
  • client : client A
project B
  • developer : stefan
  • client : client B
Log in as client B
click to persons -> stefan

Now i can view the tasks and efforts of stefan in project A as well.

But there is a different to the issue above, i can't reproduce it on personViewProjects. As client B i can view only the project B.

notiz:
  • The clients have the profile client and just the right to log in.
  • Version is 0.8

vrom

Aug 19, 2007
View comment
I can confirm about showing all tasks on personViewTasks and all efforts on personViewEfforts.

Seems to be important to fix this

 
 

Comment / Update