admin/Facilitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FSN#38224: Iets scherpere autorisatie controle bij res-bezoekers opslaan.

Browse Source 
svn path=/Website/trunk/; revision=34057
This commit is contained in:
Maykel Geerdink
2017-05-30 09:32:17 +00:00
parent 98a736e265
commit ece6aba100
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
APPL/BEZ/bez.inc
View File

@@ -95,7 +95,7 @@ bez =
+ " POWER(2,"
+ " (fac.getweekdaynum(TRUNC(" + bez_afspraak_begin.toSQL(true) + ")) - 1))) ="
+ " POWER(2, (fac.getweekdaynum(TRUNC (" + bez_afspraak_begin.toSQL(true) + ")) - 1))"
+ " AND d.res_discipline_key = " + S("vis_parking_key")
+ " AND d.res_discipline_key = " + S("vis_parking_key")
+ " AND ( d.res_deel_vervaldatum IS NULL "
+ " OR d.res_deel_vervaldatum > " + bez_afspraak_begin.toSQL(true) + " ) ) park"
+ " GROUP BY park.alg_type"
@@ -389,6 +389,9 @@ bez =
if (!bresult.canWritePaf && bresult.nrPAF > 0)
bresult.canChange = false;
bresult.canWriteAny = bresult.canWrite("WEB_BEZFOF") || bresult.canWrite("WEB_BEZBOF") || bresult.canWrite("WEB_BEZUSE");
bresult.canResWriteAny = false;
// Bij extern ingevoerde reserveringen mogen we de bezoekers niet veranderen.
if (rsv_ruimte_key > 0)
{
@@ -404,11 +407,17 @@ bez =
var res_ruimte_extern_id = !oRs.Eof && oRs("res_ruimte_extern_id").Value;
oRs.Close();
bresult.canChange = !res_ruimte_extern_id; // Als extern dan niet te wijzigen.
var authparamsRES = user.checkAutorisation(["WEB_RESUSE", "WEB_RESFOF", "WEB_RESBOF"], true);
bresult.canResWriteAny = authparamsRES.ALGwritelevel < 9 || authparamsRES.PRSwritelevel < 9 ||
user.isCollega(contact_key) || user.isCollega(host_key);
// Als je bezoekers bij een reservering wilt aanpassen heb je ook enige RES rechten nodig.
bresult.canWriteAny = bresult.canWriteAny && bresult.canResWriteAny;
}
bresult.canWriteAny = bresult.canWrite("WEB_BEZFOF") || bresult.canWrite("WEB_BEZBOF") || bresult.canWrite("WEB_BEZUSE");
bresult.canWriteFOF = bresult.canWrite("WEB_BEZFOF");
bresult.canWriteBOF = bresult.canWrite("WEB_BEZBOF");
bresult.canWriteFOF = bresult.canWrite("WEB_BEZFOF");
bresult.canWriteBOF = bresult.canWrite("WEB_BEZBOF");
bresult.canReadAny = bresult.canRead("WEB_BEZFOF") || bresult.canRead("WEB_BEZBOF") || bresult.canRead("WEB_BEZUSE");
bresult.canReadFOF = bresult.canRead("WEB_BEZFOF");

2
APPL/BEZ/bez_edit_bezoekers.asp
View File

@@ -97,7 +97,7 @@ if (afspraak_key == -1)
}
var this_bez = bez.func_enabled_afspraak(afspraak_key);
user.auth_required_or_abort(this_bez.canReadAny);
user.auth_required_or_abort(this_bez.canWriteAny);
var fronto = urole == "fo"; // DEPRECATED
var backo = urole == "bo";

2
APPL/BEZ/bez_edit_bezoekers_save.asp
View File

@@ -39,7 +39,7 @@ if (afspraak_key == -1)
afspraak_key = oRs("bez_afspraak_key").value;
}
var this_bez = bez.func_enabled_afspraak(afspraak_key);
user.auth_required_or_abort(this_bez.canReadAny);
user.auth_required_or_abort(this_bez.canWriteAny);
var beztrack = [];
var result = saveBezoekers(afspraak_key, rsv_ruimte_key, { urole: urole });