diff --git a/modules/Reports/actions/ChartActions.php b/modules/Reports/actions/ChartActions.php
index 8ec2140fb154802488a50feb917391cd121d0b66..7260d21a6d58b3039dc74a9809702e9fb241a671 100644
--- a/modules/Reports/actions/ChartActions.php
+++ b/modules/Reports/actions/ChartActions.php
@@ -16,14 +16,10 @@ class Reports_ChartActions_Action extends Vtiger_Action_Controller {
$this->exposeMethod('unpinChartFromDashboard');
}
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/CheckDuplicate.php b/modules/Reports/actions/CheckDuplicate.php
index eb28be78b2209cafa375a7c9b9d07ef0da8859f1..5858755c979fe20b693970d4ed5f6ba3bacc986b 100644
--- a/modules/Reports/actions/CheckDuplicate.php
+++ b/modules/Reports/actions/CheckDuplicate.php
@@ -10,8 +10,10 @@
class Reports_CheckDuplicate_Action extends Vtiger_Action_Controller {
- function checkPermission(Vtiger_Request $request) {
- return;
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/DeleteAjax.php b/modules/Reports/actions/DeleteAjax.php
index cb9eab3959f884031367827a3e069a2595bc612b..b1c5ab0b9529bc79092858598144cfb886c7e7cd 100644
--- a/modules/Reports/actions/DeleteAjax.php
+++ b/modules/Reports/actions/DeleteAjax.php
@@ -10,14 +10,11 @@
class Reports_DeleteAjax_Action extends Vtiger_DeleteAjax_Action {
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $record = $request->get('record');
-
- $currentUserPrivilegesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPrivilegesModel->isPermitted($moduleName, 'Delete', $record)) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'Delete', 'record_parameter' => 'record');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/Folder.php b/modules/Reports/actions/Folder.php
index 2d34ed231a4395dc59a559300b2c00069c93638f..e39f179c3b3f981006a7fb450678a5b436f7156f 100644
--- a/modules/Reports/actions/Folder.php
+++ b/modules/Reports/actions/Folder.php
@@ -16,14 +16,10 @@ class Reports_Folder_Action extends Vtiger_Action_Controller {
$this->exposeMethod('delete');
}
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/MassDelete.php b/modules/Reports/actions/MassDelete.php
index eb9df6bb38b46614bbe8353d594b34e55e4bce1c..fd62b54db07cfd00002d84aeed038625b8fa3d96 100644
--- a/modules/Reports/actions/MassDelete.php
+++ b/modules/Reports/actions/MassDelete.php
@@ -10,14 +10,10 @@
class Reports_MassDelete_Action extends Vtiger_Mass_Action {
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
function preProcess(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/MoveReports.php b/modules/Reports/actions/MoveReports.php
index d6f42c650e994f867167a2ee166796833be61f05..142a36025fd20abf1d93269d81980d4f0cc0490f 100644
--- a/modules/Reports/actions/MoveReports.php
+++ b/modules/Reports/actions/MoveReports.php
@@ -10,14 +10,10 @@
class Reports_MoveReports_Action extends Vtiger_Mass_Action {
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/actions/Save.php b/modules/Reports/actions/Save.php
index d1c09555f8694ce2094226d80a471d70f2302514..c2bb8b71fe7fd54c4f6bcf99c12a77f74fa8158b 100644
--- a/modules/Reports/actions/Save.php
+++ b/modules/Reports/actions/Save.php
@@ -10,6 +10,12 @@
class Reports_Save_Action extends Vtiger_Save_Action {
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
+ }
+
public function checkPermission(Vtiger_Request $request) {
parent::checkPermission($request);
diff --git a/modules/Reports/views/ChartDetail.php b/modules/Reports/views/ChartDetail.php
index 9f46d862ddecda61e98b5cd2430295c625274a01..9c8398ce1a0a6322c8be56ed44643e1d4601d66c 100644
--- a/modules/Reports/views/ChartDetail.php
+++ b/modules/Reports/views/ChartDetail.php
@@ -10,10 +10,14 @@
class Reports_ChartDetail_View extends Vtiger_Index_View {
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
+ }
+
public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
+ parent::checkPermission($request);
$record = $request->get('record');
$reportModel = Reports_Record_Model::getCleanInstance($record);
$currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
@@ -25,9 +29,10 @@ class Reports_ChartDetail_View extends Vtiger_Index_View {
if(($currentUserPriviligesModel->id != $owner) && $sharingType == "Private"){
$isRecordShared = $reportModel->isRecordHasViewAccess($sharingType);
}
- if(!$isRecordShared || !$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
+ if(!$isRecordShared) {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
}
+ return true;
}
function preProcess(Vtiger_Request $request) {
diff --git a/modules/Reports/views/ChartEdit.php b/modules/Reports/views/ChartEdit.php
index 90bdd818ec833eb1cbb1ed382725d15ea510a89a..bd55cf25a68112fc52410f1d4f8da84ec1364ef5 100644
--- a/modules/Reports/views/ChartEdit.php
+++ b/modules/Reports/views/ChartEdit.php
@@ -16,15 +16,13 @@ Class Reports_ChartEdit_View extends Vtiger_Edit_View {
$this->exposeMethod('step3');
}
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
+ }
+
public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if (!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
-
+ parent::checkPermission($request);
$record = $request->get('record');
if ($record) {
$reportModel = Reports_Record_Model::getCleanInstance($record);
@@ -32,6 +30,7 @@ Class Reports_ChartEdit_View extends Vtiger_Edit_View {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
}
}
+ return true;
}
public function preProcess(Vtiger_Request $request) {
diff --git a/modules/Reports/views/ChartSaveAjax.php b/modules/Reports/views/ChartSaveAjax.php
index f4e31a235367ab65136cbe032c67026bea78a927..f99f572be549868103b3d18a074bc407bfb275c8 100644
--- a/modules/Reports/views/ChartSaveAjax.php
+++ b/modules/Reports/views/ChartSaveAjax.php
@@ -10,20 +10,9 @@
class Reports_ChartSaveAjax_View extends Vtiger_IndexAjax_View {
- public function checkPermission(Vtiger_Request $request) {
- $record = $request->get('record');
- if (!$record) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
-
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
- $reportModel = Reports_Record_Model::getCleanInstance($record);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if (!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/views/Detail.php b/modules/Reports/views/Detail.php
index 686be3d5eafe33bbac83561dd6c924e1a69bd0d8..325c3fb4bde4a49563105a2696d934af20f2a90d 100644
--- a/modules/Reports/views/Detail.php
+++ b/modules/Reports/views/Detail.php
@@ -14,12 +14,15 @@ class Reports_Detail_View extends Vtiger_Index_View {
protected $calculationFields;
protected $count;
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
+ }
+
public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
+ parent::checkPermission($request);
$record = $request->get('record');
-
$reportModel = Reports_Record_Model::getCleanInstance($record);
$currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
@@ -30,9 +33,10 @@ class Reports_Detail_View extends Vtiger_Index_View {
if(($currentUserPriviligesModel->id != $owner) && $sharingType == "Private"){
$isRecordShared = $reportModel->isRecordHasViewAccess($sharingType);
}
- if(!$isRecordShared || !$currentUserPriviligesModel->hasModulePermission($moduleModel->getId()) ) {
+ if(!$isRecordShared) {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
}
+ return true;
}
const REPORT_LIMIT = 500;
diff --git a/modules/Reports/views/Edit.php b/modules/Reports/views/Edit.php
index 7840dcf61bf196e048a3c8ba9bc37479124787d0..406e1955af8a3557a48cc04a1d4d469dfacd4a22 100644
--- a/modules/Reports/views/Edit.php
+++ b/modules/Reports/views/Edit.php
@@ -17,18 +17,19 @@ Class Reports_Edit_View extends Vtiger_Edit_View {
$this->exposeMethod('step3');
}
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
+ }
+
public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if (!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ parent::checkPermission($request);
$recordModel = Reports_Record_Model::getInstanceById($request->get('record'));
if(!$recordModel->isEditableBySharing()) {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
}
+ return true;
}
public function preProcess(Vtiger_Request $request) {
diff --git a/modules/Reports/views/EditFolder.php b/modules/Reports/views/EditFolder.php
index 3faaa0ba0f2eec34a80e1e518033f4d818d5732b..bee02e360eb4dc4749aab4aba27dbbd04c8d32d4 100644
--- a/modules/Reports/views/EditFolder.php
+++ b/modules/Reports/views/EditFolder.php
@@ -10,16 +10,12 @@
class Reports_EditFolder_View extends Vtiger_IndexAjax_View {
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
-
+
public function process (Vtiger_Request $request) {
$viewer = $this->getViewer($request);
diff --git a/modules/Reports/views/ExportReport.php b/modules/Reports/views/ExportReport.php
index 7813c25b07a4151f55b9e2e7395150dd2a7f15bf..f9e1431ceae30a0c460c9bbd382978f9d96ac9e2 100644
--- a/modules/Reports/views/ExportReport.php
+++ b/modules/Reports/views/ExportReport.php
@@ -17,17 +17,10 @@ class Reports_ExportReport_View extends Vtiger_View_Controller {
$this->exposeMethod('GetCSV');
}
- function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $record = $request->get('record');
- $reportModel = Reports_Record_Model::getCleanInstance($record);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
}
function preProcess(Vtiger_Request $request) {
diff --git a/modules/Reports/views/List.php b/modules/Reports/views/List.php
index 2de1ab8c3705d139d1c1d5ba4be7e1b57854eb9c..644df3ea861a203aa1c6a1429163753580662b0a 100644
--- a/modules/Reports/views/List.php
+++ b/modules/Reports/views/List.php
@@ -14,14 +14,10 @@ class Reports_List_View extends Vtiger_Index_View {
protected $listViewEntries = false;
protected $listViewCount = false;
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
diff --git a/modules/Reports/views/MoveReports.php b/modules/Reports/views/MoveReports.php
index e60a9afe5b15a10033f7445f5f04b8da88e2b3db..2e5768314875058e11814f6ade374192f3d6b2b5 100644
--- a/modules/Reports/views/MoveReports.php
+++ b/modules/Reports/views/MoveReports.php
@@ -10,14 +10,10 @@
class Reports_MoveReports_View extends Vtiger_Index_View {
- public function checkPermission(Vtiger_Request $request) {
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if(!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
+ return $permissions;
}
public function process(Vtiger_Request $request) {
diff --git a/modules/Reports/views/SaveAjax.php b/modules/Reports/views/SaveAjax.php
index ea3bc1f180dda93fe8d803c4283be07c0c916a47..62efc0eb7bb5b92d9b2e9653208824222b39b5ea 100644
--- a/modules/Reports/views/SaveAjax.php
+++ b/modules/Reports/views/SaveAjax.php
@@ -10,22 +10,12 @@
class Reports_SaveAjax_View extends Vtiger_IndexAjax_View {
- public function checkPermission(Vtiger_Request $request) {
- $record = $request->get('record');
- if (!$record) {
- throw new AppException('LBL_PERMISSION_DENIED');
- }
-
- $moduleName = $request->getModule();
- $moduleModel = Reports_Module_Model::getInstance($moduleName);
- $reportModel = Reports_Record_Model::getCleanInstance($record);
-
- $currentUserPriviligesModel = Users_Privileges_Model::getCurrentUserPrivilegesModel();
- if (!$currentUserPriviligesModel->hasModulePermission($moduleModel->getId())) {
- throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
- }
+ public function requiresPermission(\Vtiger_Request $request) {
+ $permissions = parent::requiresPermission($request);
+ $permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+ return $permissions;
}
-
+
public function process(Vtiger_Request $request) {
$mode = $request->getMode();
$viewer = $this->getViewer($request);
diff --git a/modules/Vtiger/actions/Delete.php b/modules/Vtiger/actions/Delete.php
index 783d004f492135ded2c4771ded9d9de0c6dab91c..b51e8d7f744dece8c0f32c5cb45c679dde76a0b7 100644
--- a/modules/Vtiger/actions/Delete.php
+++ b/modules/Vtiger/actions/Delete.php
@@ -22,7 +22,8 @@ class Vtiger_Delete_Action extends Vtiger_Action_Controller {
parent::checkPermission($request);
- if ($record) {
+ $nonEntityModules = array('Users', 'Events', 'Calendar', 'Portal', 'Reports');
+ if ($record && !in_array($moduleName, $nonEntityModules)) {
$recordEntityName = getSalesEntityType($record);
if ($recordEntityName !== $moduleName) {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
diff --git a/modules/Vtiger/actions/Save.php b/modules/Vtiger/actions/Save.php
index 583bb1561bc0050228cd9114140985f0874f7435..767f88edcf312fa0ea53ca48dc35ccbe564b0ff2 100644
--- a/modules/Vtiger/actions/Save.php
+++ b/modules/Vtiger/actions/Save.php
@@ -35,7 +35,7 @@ class Vtiger_Save_Action extends Vtiger_Action_Controller {
$moduleName = $request->getModule();
$record = $request->get('record');
- $nonEntityModules = array('Users', 'Events', 'Calendar', 'Portal');
+ $nonEntityModules = array('Users', 'Events', 'Calendar', 'Portal', 'Reports');
if ($record && !in_array($moduleName, $nonEntityModules)) {
$recordEntityName = getSalesEntityType($record);
if ($recordEntityName !== $moduleName) {
diff --git a/modules/Vtiger/views/Edit.php b/modules/Vtiger/views/Edit.php
index e2766d33311ca172bb7bda521f0cb2933ec3fe76..e7246224fb4e8b397597bb8e23732e10e64aa91e 100644
--- a/modules/Vtiger/views/Edit.php
+++ b/modules/Vtiger/views/Edit.php
@@ -29,7 +29,7 @@ Class Vtiger_Edit_View extends Vtiger_Index_View {
$moduleName = $request->getModule();
$record = $request->get('record');
- $nonEntityModules = array('Users', 'Events', 'Calendar');
+ $nonEntityModules = array('Users', 'Events', 'Calendar', 'Reports');
if ($record && !in_array($moduleName, $nonEntityModules)) {
$recordEntityName = getSalesEntityType($record);
if ($recordEntityName !== $moduleName) {