Forum GLPI-Project

alonefox

Member

Registered: 2009-03-29

Posts: 3

Missing entity restriction on user form

GLPI 0.80.4.
The restriction profile "normal" set as Administration->User = READ
For test I use only profile "normal".
I have two test users: User1, User2. Three entity entityA, ...B, ...C (NO Root Entity)
The restriction User1: entityA, entityB is profile "normal"
The restriction User2: entityB, entityC is profile "normal"

When I have one the ticket, which saw two users.
When the user user1 open the form user (user.form.php) user2, sees all objects and restriction the user user1, even for the entity entityC!
But I think, user1 may see ONLY restrictions user2 for entityB and objects user2 for entityB
Please make bug in bug list.
---
Может перевод кривой... Теперь по русски (близко к тексту)
В настройках безопасности в профиле normal установлено (закладка Администрирование/Настройка) Пользователи: ЧТЕНИЕ.
Созданы два тестовых пользователя user1 (в организациях  A, B) и user2 (организации B, C)
Пользователем user1 через заявку захожу на форму пользователя user2 (user.form.php) и могу просматривать ВСЕ права (профиль + организация) и обйекты.

--- glpi_test/inc/profile_user.class.php        2011-09-27 12:42:45.000000000 +0400
+++ glpi_80/inc/profile_user.class.php  2011-10-12 11:52:44.000000000 +0400
@@ -148,9 +148,13 @@
 
       if ($DB->numrows($result) >0) {
          while ($data = $DB->fetch_array($result)) {
+            if (!in_array($data["entities_id"], $_SESSION['glpiactiveentities']) && ($data["entities_id"]!=0)) {
+               continue;
+            };
             echo "<tr class='tab_bg_1'>";
             echo "<td width='10'>";
 
+
             if ($canedit && in_array($data["entities_id"], $_SESSION['glpiactiveentities'])) {
                echo "<input type='checkbox' name='item[".$data["linkID"]."]' value='1'>";
             } else {
diff -uwr glpi_test/inc/user.class.php glpi_80/inc/user.class.php
--- glpi_test/inc/user.class.php        2011-09-27 12:42:45.000000000 +0400
+++ glpi_80/inc/user.class.php  2011-10-12 13:07:30.000000000 +0400
@@ -2289,6 +2289,9 @@
                   if ($data["users_id"] == $ID) {
                      $linktype = $LANG['common'][34];
                   }
+                  if (!in_array($data["entities_id"], $_SESSION['glpiactiveentities']) && ($data["entities_id"]!=0)) {
+                     continue;
+                  }
                   echo "<tr class='tab_bg_1'><td class='center'>$type_name</td>";
                   echo "<td class='center'>".Dropdown::getDropdownName("glpi_entities",
                                                                        $data["entities_id"])."</td>";
@@ -2356,6 +2359,9 @@
                      if (isset($groups[$data["groups_id"]])) {
                         $linktype = $LANG['common'][35]." ".$groups[$data["groups_id"]];
                      }
+                     if (!in_array($data["entities_id"], $_SESSION['glpiactiveentities']) && ($data["entities_id"]!=0)) {
+                        continue;
+                     }
                      echo "<tr class='tab_bg_1'><td class='center'>$type_name</td>";
                      echo "<td class='center'>".Dropdown::getDropdownName("glpi_entities",
                                                                           $data["entities_id"]);

Last edited by alonefox (2011-10-12 11:59:11)

yllen

GLPI-DEV

From: Sillery (51)

Registered: 2008-01-14

Posts: 15,278

Re: Missing entity restriction on user form

When your user enters in GLPI.
First, he must chooses the profile and only after the entites

---

CentOS 6.5 - CentOS 7.x
PHP 5.6 - PHP 7.x - MySQL 5.6  - MariaDB 10.2 + APC + oOPcache
GLPI from 0.72 to dev version
Certifiée ITIL (ITV2F, ITILF, ITILOSA)