Luca/thetool
1
0
Fork 0
Code Issues 5 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

extended permission check to delete orders

Browse Source
This commit is contained in:
Frank Schubert
2021-08-09 17:19:49 +02:00
parent 1a954105cb
commit b678cb4611
2 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
application/Order/OrderController.php
View File

@@ -33,7 +33,7 @@ class OrderController extends mfBaseController {
foreach(OrderModel::search(['create_by' => $this->me->id]) as $order) {
if(!array_key_exists($order->id, $orders)) {
$order[$order->id] = $order;
$orders[$order->id] = $order;
}
}
@@ -416,7 +416,7 @@ class OrderController extends mfBaseController {
}
public function deleteAction() {
if(!$this->me->is(["Admin"])) {
if(!$this->me->is(["Admin","salespartner"])) {
$this->layout()->setFlash("Keine Berechtigung", "error");
$this->redirect("Order");
}
@@ -429,10 +429,26 @@ class OrderController extends mfBaseController {
$this->redirect("Order");
}
if(!$this->me->is("Admin")) {
$my_network_ids = [];
foreach($this->me->my_networks as $network) {
$my_network_ids[] = $network->id;
}
if(!in_array($order->terminations[0]->building->network_id, $my_network_ids) ) {
if($order->create_by != $this->me->id) {
$this->layout()->setFlash("Keine Berechtigung", "error");
$this->redirect("Order");
}
}
}
$order->deletePositions();
// check if Product is unused
// TODO: check if Product is unused
$order->delete();
$this->layout()->setFlash("Bestellung gelöscht", "success");
$this->redirect("Order");
}