jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix timesheet permissions for non-admins (#1542)

Browse Source
This commit is contained in:
Kevin Papst
2020-03-13 18:02:35 +01:00
committed by GitHub
parent 137dcbf7e1
commit 9cd111bae5
1 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/Repository/TimesheetRepository.php
View File

@@ -527,24 +527,37 @@ class TimesheetRepository extends EntityRepository
return;
}
if (empty($teams)) {
return;
}
// make sure that admins see all timesheet records
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
return;
}
if (null !== $user) {
$teams = array_merge($teams, $user->getTeams()->toArray());
}
$qb
->leftJoin('p.teams', 'teams')
->leftJoin('c.teams', 'c_teams');
$orTeam = $qb->expr()->orX(
$qb->expr()->isMemberOf(':teams', 'p.teams'),
if (empty($teams)) {
$qb->andWhere($qb->expr()->isNull('c_teams'));
$qb->andWhere($qb->expr()->isNull('teams'));
return;
}
$orProject = $qb->expr()->orX(
$qb->expr()->isNull('teams'),
$qb->expr()->isMemberOf(':teams', 'p.teams')
);
$qb->andWhere($orProject);
$orCustomer = $qb->expr()->orX(
$qb->expr()->isNull('c_teams'),
$qb->expr()->isMemberOf(':teams', 'c.teams')
);
$qb->andWhere($orTeam);
$qb->andWhere($orCustomer);
$qb->setParameter('teams', $teams);
}