From 7661d43327964bfd2000a4bf1defe9cc723c9530 Mon Sep 17 00:00:00 2001 From: Kevin Papst Date: Tue, 13 Jul 2021 06:21:31 +0200 Subject: [PATCH] improve permission checks for report access (#2658) --- .../Reporting/ProjectDetailsController.php | 5 +-- src/Reporting/ReportingService.php | 8 ++-- templates/reporting/project_details.html.twig | 41 +++++++++++-------- 3 files changed, 31 insertions(+), 23 deletions(-) diff --git a/src/Controller/Reporting/ProjectDetailsController.php b/src/Controller/Reporting/ProjectDetailsController.php index 0c544651..8eb932dd 100644 --- a/src/Controller/Reporting/ProjectDetailsController.php +++ b/src/Controller/Reporting/ProjectDetailsController.php @@ -14,7 +14,6 @@ use App\Entity\Project; use App\Project\ProjectStatisticService; use App\Reporting\ProjectDetails\ProjectDetailsForm; use App\Reporting\ProjectDetails\ProjectDetailsQuery; -use App\Utils\LocaleSettings; use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\Routing\Annotation\Route; @@ -23,9 +22,9 @@ final class ProjectDetailsController extends AbstractController { /** * @Route(path="/reporting/project_details", name="report_project_details", methods={"GET"}) - * @Security("is_granted('view_reporting') and is_granted('details_project')") + * @Security("is_granted('view_reporting') and (is_granted('details_project') or is_granted('details_teamlead_project') or is_granted('details_team_project'))") */ - public function __invoke(Request $request, ProjectStatisticService $service, LocaleSettings $localeSettings) + public function __invoke(Request $request, ProjectStatisticService $service) { $dateFactory = $this->getDateTimeFactory(); $user = $this->getUser(); diff --git a/src/Reporting/ReportingService.php b/src/Reporting/ReportingService.php index 27362442..548b4836 100644 --- a/src/Reporting/ReportingService.php +++ b/src/Reporting/ReportingService.php @@ -51,9 +51,11 @@ final class ReportingService } if ($this->security->isGranted('budget_project')) { $event->addReport(new Report('project_view', 'report_project_view', 'report_project_view', 'project')); - if ($this->security->isGranted('details_project')) { - $event->addReport(new Report('project_details', 'report_project_details', 'report_project_details', 'project')); - } + } + if ($this->security->isGranted('details_project') || $this->security->isGranted('details_teamlead_project') || $this->security->isGranted('details_team_project')) { + $event->addReport(new Report('project_details', 'report_project_details', 'report_project_details', 'project')); + } + if ($this->security->isGranted('budget_project')) { $event->addReport(new Report('inactive_projects', 'report_project_inactive', 'report_inactive_project', 'project')); } diff --git a/templates/reporting/project_details.html.twig b/templates/reporting/project_details.html.twig index 522f29e5..d0d6f831 100644 --- a/templates/reporting/project_details.html.twig +++ b/templates/reporting/project_details.html.twig @@ -8,6 +8,7 @@ {% set tableId = 'project-details-form' %} {% set view_revenue_tab = project_details is not null and is_granted('budget', project_details.project) %} {% set view_revenue_user = project_details is not null and is_granted('view_rate_other_timesheet') %} +{% set see_users = is_granted('view_other_timesheet') or is_granted('view_other_reporting') %} {% block stylesheets %} {{ parent() }} @@ -78,17 +79,17 @@ {% endif %} {% if hasData %} - {{ _self.project_details(project_view, project_details, view_revenue_tab, view_revenue_user) }} + {{ _self.project_details(project_view, project_details, view_revenue_tab, view_revenue_user, see_users) }} {% set currency = project_view.project.customer.currency %} {%- for yearStat in project_details.years|reverse %} {% set year = yearStat.year %} - {{ _self.duration_stat(year, year, year, month_names(), yearStat, project_details.getYearActivities(year), project_details.userYears(year), currency, view_revenue_tab) }} + {{ _self.duration_stat(year, year, year, month_names(), yearStat, project_details.getYearActivities(year), project_details.userYears(year), currency, view_revenue_tab, see_users) }} {% endfor %} {% endif %} {% endblock %} -{% macro duration_stat(id, title, year, labels, yearStat, activities, users, currency, view_revenue_tab) %} +{% macro duration_stat(id, title, year, labels, yearStat, activities, users, currency, view_revenue_tab, see_users) %} {% set rates = [] %} {% set durations = [] %} {% set chartPrefix = 'chart' ~ id %} @@ -106,7 +107,9 @@
{% endmacro %} @@ -239,7 +244,7 @@ entry = ProjectViewModel project_details = ProjectDetailsModel #} -{% macro project_details(entry, project_details, view_revenue_tab, view_revenue_user) %} +{% macro project_details(entry, project_details, view_revenue_tab, view_revenue_user, see_users) %} {% set activities = project_details.activities %} {% set years = project_details.years %} {% import "macros/progressbar.html.twig" as progress %} @@ -260,7 +265,9 @@
@@ -312,38 +321,34 @@ {% endif %} + {% if is_granted('create_export') %} {{ 'label.not_exported'|trans }} - {% if is_granted('create_export') %} - - {{ entry.notExportedDuration|duration }} - - {% else %} + {{ entry.notExportedDuration|duration }} - {% endif %} + + {% endif %} + {% if is_granted('view_invoice') %} {{ 'label.not_invoiced'|trans }} - {% if is_granted('view_invoice') %} - - {{ entry.notBilledRate|money(currency) }} - - {% else %} + {{ entry.notBilledRate|money(currency) }} - {% endif %} + + {% endif %}
- {% if is_granted('budget', project) and (project.timeBudget > 0 or project.budget > 0) %} + {% if view_revenue_tab and (project.timeBudget > 0 or project.budget > 0) %}
@@ -399,6 +404,7 @@
{{ _self.activity_tab(activities, entry.durationTotal, project.customer.currency, chartPrefix, view_revenue_tab) }}
+ {% if see_users %}
@@ -450,6 +456,7 @@
+ {% endif %} {% endmacro %}