#170 visible condition fix

This commit is contained in:
Karel Picman 2017-04-10 18:08:57 +02:00
parent d5a64cbbe3
commit 3d7a6a2ec1
17 changed files with 35 additions and 9 deletions

View File

@ -38,6 +38,7 @@ class DmsfController < ApplicationController
helper :dmsf_folder_permissions
def permissions
Rails.logger.info ">>> #{DmsfFolder.visible.where(:project_id => @project.id).to_sql}"
render_403 unless DmsfFolder.permissions(@folder)
true
end
@ -53,8 +54,6 @@ class DmsfController < ApplicationController
end
def show
s = DmsfFolder.visible.where(:project_id => 1995).to_sql
Rails.logger.info s
# also try to lookup folder by title if this is API call
find_folder_by_title if [:xml, :json].include? request.format.to_sym
get_display_params

View File

@ -7,12 +7,13 @@ module DmsfFolderPermissionsHelper
content = check_box_tag('permissions[user_ids][]', user.id, true, :id => nil) + user.name
s << content_tag(:label, content, :id => "user_permission_ids_#{user.id}", :class => 'inline')
end
s << '<br/>' if users.any?
end
s.html_safe
end
def render_principals_for_new_folder_permissions(users)
principals_check_box_tags 'user[user_ids][]', users
principals_check_box_tags 'user_ids[]', users
end
end

View File

@ -52,11 +52,11 @@ class DmsfFolder < ActiveRecord::Base
scope :visible, -> { joins(:project).joins(
"LEFT JOIN #{DmsfFolderPermission.table_name} ON #{DmsfFolder.table_name}.id = #{DmsfFolderPermission.table_name}.dmsf_folder_id").where(
:deleted => STATUS_ACTIVE).where(DmsfFolder.visible_condition)
:deleted => STATUS_ACTIVE).where(DmsfFolder.visible_condition).distinct
}
scope :deleted, -> { joins(:project).joins(
"LEFT JOIN #{DmsfFolderPermission.table_name} ON #{DmsfFolder.table_name}.id = #{DmsfFolderPermission.table_name}.dmsf_folder_id").where(
:deleted => STATUS_DELETED).where(DmsfFolder.visible_condition)
:deleted => STATUS_DELETED).where(DmsfFolder.visible_condition).distinct
}
acts_as_customizable
@ -84,17 +84,17 @@ class DmsfFolder < ActiveRecord::Base
before_create :default_values
def self.visible_condition
sql = '1=1'
Project.allowed_to_condition(User.current, :view_dmsf_folders) do |role, user|
if user.id && user.logged?
sql = %{
%{
(#{DmsfFolderPermission.table_name}.object_id IS NULL) OR
(#{DmsfFolderPermission.table_name}.object_id = #{role.id} AND #{DmsfFolderPermission.table_name}.object_type = 'Role') OR
(#{DmsfFolderPermission.table_name}.object_id = #{user.id} AND #{DmsfFolderPermission.table_name}.object_type = 'User')
}
else
'0=1'
end
end
sql
end
def self.permissions(folder)

View File

@ -92,7 +92,7 @@
<%= users_checkboxes(@users) %>
</span>
<span class="search_for_watchers">
<%= link_to l(:label_user_search),
<%= link_to l(:label_user_search_add),
new_dmsf_folder_permissions_path(:project_id => @project, :dmsf_folder_id => @folder),
:remote => true,
:method => 'get' %>

View File

@ -364,3 +364,5 @@ cs:
label_act_as_attachable: Jako příloha
note_dmsf_act_as_attachable: Umožní přikládat dokumenty k objektům např. úkolům.
label_user_search_add: Vyhledej uživatele pro přidání

View File

@ -361,3 +361,5 @@ de:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ en:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ es:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ fr:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ it: # Italian strings thx 2 Matteo Arceci!
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ ja:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ pl:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ pt-BR:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ ru:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ sl:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ zh-TW:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add

View File

@ -364,3 +364,5 @@ zh:
label_act_as_attachable: Act as attachable
note_dmsf_act_as_attachable: Allows to attach documents to objects e.g. issues.
label_user_search_add: Search for user to add