dinislage/PrestaShop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[-] BO : restricted some unauthorized accesses #PSCFV-3611

Browse Source
This commit is contained in:
dMetzger
2012-08-14 08:34:16 +00:00
parent 74ec20eea0
commit b2ab9a3d95
3 changed files with 48 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin-dev/themes/default/template/header.tpl
+1 -1
View File
@@ -93,7 +93,7 @@
}
</style>
</head>
<body style="{if $bo_color}background:{$bo_color};{/if}{if $bo_width > 0}text-align:center;{/if}">
<body style="{if isset($bo_color) && $bo_color}background:{$bo_color};{/if}{if isset($bo_width) && $bo_width > 0}text-align:center;{/if}">
{if $display_header}
<div id="ajax_running"><img src="../img/admin/ajax-loader-yellow.gif" alt="" /> {l s='Loading...'}</div>
classes/Profile.php
+15 -10
View File
@@ -110,17 +110,25 @@ class ProfileCore extends ObjectModel
return (isset($accesses[$id_tab]) ? $accesses[$id_tab] : false);
}
public static function getProfileAccesses($id_profile)
public static function getProfileAccesses($id_profile, $type = 'id_tab')
{
if (!in_array($type, array('id_tab', 'class_name')))
return false;
if (!isset(self::$_cache_accesses[$id_profile]))
self::$_cache_accesses[$id_profile] = array();
if (!isset(self::$_cache_accesses[$id_profile][$type]))
{
self::$_cache_accesses[$id_profile][$type] = array();
// Super admin profile has full auth
if ($id_profile == _PS_ADMIN_PROFILE_)
{
foreach (Tab::getTabs(Context::getContext()->language->id) as $tab)
self::$_cache_accesses[$id_profile][$tab['id_tab']] = array(
self::$_cache_accesses[$id_profile][$type][$tab[$type]] = array(
'id_profile' => _PS_ADMIN_PROFILE_,
'id_tab' => $tab['id_tab'],
'class_name' => $tab['class_name'],
'view' => '1',
'add' => '1',
'edit' => '1',
@@ -131,19 +139,16 @@ class ProfileCore extends ObjectModel
{
$result = Db::getInstance()->executeS('
SELECT *
FROM `'._DB_PREFIX_.'access`
FROM `'._DB_PREFIX_.'access` a
LEFT JOIN `'._DB_PREFIX_.'tab` t ON t.id_tab = a.id_tab
WHERE `id_profile` = '.(int)$id_profile);
self::$_cache_accesses[$id_profile] = array();
foreach ($result as $row)
{
if (!isset(self::$_cache_accesses[$id_profile][$row['id_tab']]))
self::$_cache_accesses[$id_profile][$row['id_tab']] = array();
self::$_cache_accesses[$id_profile][$row['id_tab']] = $row;
}
self::$_cache_accesses[$id_profile][$type][$row[$type]] = $row;
}
}
return self::$_cache_accesses[$id_profile];
return self::$_cache_accesses[$id_profile][$type];
}
}
classes/controller/AdminController.php
+32 -23
View File
@@ -1270,9 +1270,39 @@ class AdminControllerCore extends Controller
if (empty($sub_tabs))
unset($tabs[$index]);
}
if (Validate::isLoadedObject($this->context->employee))
{
$accesses = Profile::getProfileAccesses($this->context->employee->id_profile, 'class_name');
/* Hooks are volontary out the initialize array (need those variables already assigned) */
$bo_color = empty($this->context->employee->bo_color) ? '#FFFFFF' : $this->context->employee->bo_color;
/* Hooks are volontary out the initialize array (need those variables already assigned) */
$bo_color = empty($this->context->employee->bo_color) ? '#FFFFFF' : $this->context->employee->bo_color;
$this->context->smarty->assign(array(
'autorefresh_notifications' => Configuration::get('PS_ADMIN_REFRESH_NOTIFICATION'),
'help_box' => Configuration::get('PS_HELPBOX'),
'round_mode' => Configuration::get('PS_PRICE_ROUND_MODE'),
'brightness' => Tools::getBrightness($bo_color) < 128 ? 'white' : '#383838',
'bo_width' => (int)$this->context->employee->bo_width,
'bo_color' => isset($this->context->employee->bo_color) ? Tools::htmlentitiesUTF8($this->context->employee->bo_color) : null,
'show_new_orders' => Configuration::get('PS_SHOW_NEW_ORDERS') && $accesses['AdminOrders']['view'],
'show_new_customers' => Configuration::get('PS_SHOW_NEW_CUSTOMERS') && $accesses['AdminCustomers']['view'],
'show_new_messages' => Configuration::get('PS_SHOW_NEW_MESSAGES') && $accesses['AdminCustomerThreads']['view'],
'first_name' => Tools::substr($this->context->employee->firstname, 0, 1),
'last_name' => htmlentities($this->context->employee->lastname, ENT_COMPAT, 'UTF-8'),
'employee' => $this->context->employee,
'search_type' => Tools::getValue('bo_search_type'),
'bo_query' => Tools::safeOutput(Tools::stripslashes(Tools::getValue('bo_query'))),
'quick_access' => $quick_access,
'multi_shop' => Shop::isFeatureActive(),
'shop_list' => Helper::renderShopList(),
'shop' => $this->context->shop,
'shop_group' => new ShopGroup((int)Shop::getContextShopGroupID()),
'current_parent_id' => (int)Tab::getCurrentParentId(),
'tabs' => $tabs,
'is_multishop' => $is_multishop,
'multishop_context' => $this->multishop_context,
));
}
$this->context->smarty->assign(array(
'img_dir' => _PS_IMG_,
'iso' => $this->context->language->iso_code,
@@ -1280,35 +1310,14 @@ class AdminControllerCore extends Controller
'iso_user' => $this->context->language->iso_code,
'country_iso_code' => $this->context->country->iso_code,
'version' => _PS_VERSION_,
'autorefresh_notifications' => Configuration::get('PS_ADMIN_REFRESH_NOTIFICATION'),
'help_box' => Configuration::get('PS_HELPBOX'),
'round_mode' => Configuration::get('PS_PRICE_ROUND_MODE'),
'brightness' => Tools::getBrightness($bo_color) < 128 ? 'white' : '#383838',
'lang_iso' => $this->context->language->iso_code,
'link' => $this->context->link,
'bo_width' => (int)$this->context->employee->bo_width,
'bo_color' => isset($this->context->employee->bo_color) ? Tools::htmlentitiesUTF8($this->context->employee->bo_color) : null,
'shop_name' => Configuration::get('PS_SHOP_NAME'),
'show_new_orders' => Configuration::get('PS_SHOW_NEW_ORDERS'),
'show_new_customers' => Configuration::get('PS_SHOW_NEW_CUSTOMERS'),
'show_new_messages' => Configuration::get('PS_SHOW_NEW_MESSAGES'),
'first_name' => Tools::substr($this->context->employee->firstname, 0, 1),
'last_name' => htmlentities($this->context->employee->lastname, ENT_COMPAT, 'UTF-8'),
'base_url' => $this->context->shop->getBaseURL(),
'employee' => $this->context->employee,
'search_type' => Tools::getValue('bo_search_type'),
'bo_query' => Tools::safeOutput(Tools::stripslashes(Tools::getValue('bo_query'))),
'quick_access' => $quick_access,
'multi_shop' => Shop::isFeatureActive(),
'shop_list' => Helper::renderShopList(),
'shop' => $this->context->shop,
'shop_group' => new ShopGroup((int)Shop::getContextShopGroupID()),
'tab' => $tab,
'current_parent_id' => (int)Tab::getCurrentParentId(),
'tabs' => $tabs,
'install_dir_exists' => file_exists(_PS_ADMIN_DIR_.'/../install'),
'is_multishop' => $is_multishop,
'multishop_context' => $this->multishop_context,
'pic_dir' => _THEME_PROD_PIC_DIR_,
'controller_name' => htmlentities(Tools::getValue('controller')),
'currentIndex' => self::$currentIndex