espocrm-extensions/espocrm-base
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

forbid mass remove by where if no mass update permission

Browse Source
This commit is contained in:
yuri
2019-02-12 14:12:05 +02:00
parent 3709523836
commit 25d6ca3fea
3 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/Espo/Core/Controllers/Record.php
+9 -1
View File
@@ -321,7 +321,15 @@ class Record extends Base
throw new Forbidden();
}
return $this->getRecordService()->massDelete($this->getMassActionParamsFromData($data));
$actionParams = $this->getMassActionParamsFromData($data);
if (array_key_exists('where', $actionParams)) {
if ($this->getAcl()->get('massUpdatePermission') !== 'yes') {
throw new Forbidden();
}
}
return $this->getRecordService()->massDelete($actionParams);
}
public function actionCreateLink($params, $data, $request)
application/Espo/Services/Record.php
+12 -12
View File
@@ -1598,7 +1598,7 @@ class Record extends \Espo\Core\Services\Base
public function massUpdate(array $params, $data)
{
$idsUpdated = [];
$updatedIdList = [];
$repository = $this->getRepository();
$count = 0;
@@ -1619,7 +1619,7 @@ class Record extends \Espo\Core\Services\Base
}
if ($this->checkAssignment($entity)) {
if ($repository->save($entity, ['massUpdate' => true])) {
$idsUpdated[] = $entity->id;
$updatedIdList[] = $entity->id;
$count++;
$this->processActionHistoryRecord('update', $entity);
@@ -1657,7 +1657,7 @@ class Record extends \Espo\Core\Services\Base
$entity->set($data);
if ($this->checkAssignment($entity)) {
if ($repository->save($entity, ['massUpdate' => true, 'skipStreamNotesAcl' => true])) {
$idsUpdated[] = $entity->id;
$updatedIdList[] = $entity->id;
$count++;
$this->processActionHistoryRecord('update', $entity);
@@ -1666,18 +1666,18 @@ class Record extends \Espo\Core\Services\Base
}
}
$this->afterMassUpdate($idsUpdated, $data);
$this->afterMassUpdate($updatedIdList, $data);
return (object) [
'count' => $count
];
}
$this->afterMassUpdate($idsUpdated, $data);
$this->afterMassUpdate($updatedIdList, $data);
return (object) [
'count' => $count,
'ids' => $idsUpdated
'ids' => $updatedIdList
];
}
@@ -1698,7 +1698,7 @@ class Record extends \Espo\Core\Services\Base
public function massDelete(array $params)
{
$idsRemoved = array();
$removedIdList = [];
$repository = $this->getRepository();
$count = 0;
@@ -1709,7 +1709,7 @@ class Record extends \Espo\Core\Services\Base
$entity = $this->getEntity($id);
if ($entity && $this->getAcl()->check($entity, 'delete') && $this->checkEntityForMassRemove($entity)) {
if ($repository->remove($entity)) {
$idsRemoved[] = $entity->id;
$removedIdList[] = $entity->id;
$count++;
$this->processActionHistoryRecord('delete', $entity);
@@ -1745,7 +1745,7 @@ class Record extends \Espo\Core\Services\Base
if ($this->getAcl()->check($entity, 'delete') && $this->checkEntityForMassRemove($entity)) {
if ($repository->remove($entity)) {
$idsRemoved[] = $entity->id;
$removedIdList[] = $entity->id;
$count++;
$this->processActionHistoryRecord('delete', $entity);
@@ -1753,18 +1753,18 @@ class Record extends \Espo\Core\Services\Base
}
}
$this->afterMassDelete($idsRemoved);
$this->afterMassDelete($removedIdList);
return [
'count' => $count
];
}
$this->afterMassDelete($idsRemoved);
$this->afterMassDelete($removedIdList);
return [
'count' => $count,
'ids' => $idsRemoved
'ids' => $removedIdList
];
}
client/src/views/record/list.js
+4
View File
@@ -976,6 +976,10 @@ Espo.define('views/record/list', 'view', function (Dep) {
}, this);
}
if (this.getAcl().get('massUpdatePermission') !== 'yes') {
this.removeAllResultMassAction('remove');
}
Espo.Utils.clone(this.massActionList).forEach(function (item) {
var propName = 'massAction' + Espo.Utils.upperCaseFirst(item) + 'Disabled';
if (this[propName] || this.options[propName]) {