diff --git a/includes/runtime/Controller.php b/includes/runtime/Controller.php index 7eecac852e8e8440df367127a2d9c378591bf072..bcbd0c159e37ee597e07875f9ee2a335ebf67e22 100644 --- a/includes/runtime/Controller.php +++ b/includes/runtime/Controller.php @@ -102,6 +102,24 @@ abstract class Vtiger_Action_Controller extends Vtiger_Controller { function postProcess(Vtiger_Request $request) { return true; } + + /** + * This will return all the permission checks that should be done + * @param Vtiger_Request $request + * @return <Array> + */ + function requiresPermission(Vtiger_Request $request) { + return array(); + } + + function checkPermission(Vtiger_Request $request) { + $permissions = $this->requiresPermission($request); + foreach($permissions as $permission) { + if(!Users_Privileges_Model::isPermitted($request->get($permission['module_parameter']), $permission['action'], $request->get($permission['record_parameter']))) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } + } + } } /** diff --git a/modules/Accounts/actions/TransferOwnership.php b/modules/Accounts/actions/TransferOwnership.php index 37c7d380c10412a30a442e304951b660c8264744..b04eec39931d3d984b93ff9df7bcea827805849b 100644 --- a/modules/Accounts/actions/TransferOwnership.php +++ b/modules/Accounts/actions/TransferOwnership.php @@ -9,22 +9,22 @@ *************************************************************************************/ class Accounts_TransferOwnership_Action extends Vtiger_Action_Controller { + var $transferRecordIds = Array(); - public function requiresPermission(Vtiger_Request $request){ - //Basic permission - $permission[] = 'EditView'; - return $permission; + public function requiresPermission(\Vtiger_Request $request) { + $permissions[] = array('module_parameter' => 'module', 'action' => 'EditView', 'record_parameter' => 'record'); + return $permissions; } - + public function checkPermission(Vtiger_Request $request) { - $permission = $this->requiresPermission($request); + parent::checkPermission($request); + $permissions = $this->requiresPermission($request); $recordIds = $this->getRecordIds($request); foreach ($recordIds as $key => $recordId) { $moduleName = getSalesEntityType($recordId); - $permissionStatus = Users_Privileges_Model::isPermitted($moduleName, $permission[0]); - if(!$permissionStatus){ - $exceptionMessage = vtranslate($moduleName).' '. vtranslate('LBL_PERMISSION_DENIED'); - throw new AppException($exceptionMessage); + $permissionStatus = Users_Privileges_Model::isPermitted($moduleName, $permissions['action']); + if($permissionStatus){ + $this->transferRecordIds[] = $recordId; } } } @@ -33,8 +33,9 @@ class Accounts_TransferOwnership_Action extends Vtiger_Action_Controller { $module = $request->getModule(); $moduleModel = Vtiger_Module_Model::getInstance($module); $transferOwnerId = $request->get('transferOwnerId'); - $recordIds = $this->getRecordIds($request); - + if(!empty($this->transferRecordIds)){ + $recordIds = $this->transferRecordIds; + } $result = $moduleModel->transferRecordsOwnership($transferOwnerId, $recordIds); $response = new Vtiger_Response(); if ($result === true) {