From 9cd111bae5ca4a600576d5045884f53ab07d7cd0 Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Fri, 13 Mar 2020 18:02:35 +0100
Subject: [PATCH] fix timesheet permissions for non-admins (#1542)

---
 src/Repository/TimesheetRepository.php | 27 +++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/src/Repository/TimesheetRepository.php b/src/Repository/TimesheetRepository.php
index 7606284a..88acb8cd 100644
--- a/src/Repository/TimesheetRepository.php
+++ b/src/Repository/TimesheetRepository.php
@@ -527,24 +527,37 @@ class TimesheetRepository extends EntityRepository
             return;
         }
 
-        if (empty($teams)) {
-            return;
-        }
-
         // make sure that admins see all timesheet records
         if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
             return;
         }
 
+        if (null !== $user) {
+            $teams = array_merge($teams, $user->getTeams()->toArray());
+        }
+
         $qb
             ->leftJoin('p.teams', 'teams')
             ->leftJoin('c.teams', 'c_teams');
 
-        $orTeam = $qb->expr()->orX(
-            $qb->expr()->isMemberOf(':teams', 'p.teams'),
+        if (empty($teams)) {
+            $qb->andWhere($qb->expr()->isNull('c_teams'));
+            $qb->andWhere($qb->expr()->isNull('teams'));
+
+            return;
+        }
+
+        $orProject = $qb->expr()->orX(
+            $qb->expr()->isNull('teams'),
+            $qb->expr()->isMemberOf(':teams', 'p.teams')
+        );
+        $qb->andWhere($orProject);
+
+        $orCustomer = $qb->expr()->orX(
+            $qb->expr()->isNull('c_teams'),
             $qb->expr()->isMemberOf(':teams', 'c.teams')
         );
-        $qb->andWhere($orTeam);
+        $qb->andWhere($orCustomer);
 
         $qb->setParameter('teams', $teams);
     }