From dd8387233939adecfbb8ea1632a4350ddb62efb3 Mon Sep 17 00:00:00 2001 From: Kevin Papst Date: Sun, 16 May 2021 00:52:42 +0200 Subject: [PATCH] new permission to hide user choice in report (#2572) --- src/Controller/Reporting/ReportByUserController.php | 2 +- src/EventSubscriber/Actions/UserSubscriber.php | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Controller/Reporting/ReportByUserController.php b/src/Controller/Reporting/ReportByUserController.php index 8a8c2b59..9462aed1 100644 --- a/src/Controller/Reporting/ReportByUserController.php +++ b/src/Controller/Reporting/ReportByUserController.php @@ -42,7 +42,7 @@ final class ReportByUserController extends AbstractController private function canSelectUser(): bool { // also found in App\EventSubscriber\Actions\UserSubscriber - if (!$this->isGranted('view_other_timesheet')) { + if (!$this->isGranted('view_other_timesheet') || !$this->isGranted('view_other_reporting')) { return false; } diff --git a/src/EventSubscriber/Actions/UserSubscriber.php b/src/EventSubscriber/Actions/UserSubscriber.php index 703d6e08..1a809286 100644 --- a/src/EventSubscriber/Actions/UserSubscriber.php +++ b/src/EventSubscriber/Actions/UserSubscriber.php @@ -60,7 +60,8 @@ class UserSubscriber extends AbstractActionsSubscriber $viewOther = $this->isGranted('view_other_timesheet'); if ($this->isGranted('view_reporting')) { - if ($viewOther || ($event->getUser()->getId() === $user->getId())) { + // also found in App\Controller\Reporting\ReportByUserController + if (($viewOther && $this->isGranted('view_other_reporting')) || ($event->getUser()->getId() === $user->getId())) { $event->addAction('menu.reporting', ['url' => $this->path('report_user_month', ['user' => $user->getId()]), 'icon' => 'reporting']); } }