Skip to content
Snippets Groups Projects
Commit 600840cb authored by nicolas lebozec's avatar nicolas lebozec
Browse files

FIX #22934 TIME 0:10 Correction of out of perimeter and Changed to be able to...

FIX #22934 TIME 0:10 Correction of out of perimeter and Changed to be able to see the groups of users who are in my scope in the user admin even if I don't have the right to administer groups
parent 5a4ced20
No related branches found
No related tags found
No related merge requests found
......@@ -108,6 +108,14 @@ class UserController
if ($GLOBALS['id'] == $args['id'] || PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_users'])) {
$user = UserController::getUserInformationsById(['id' => $args['id']]);
$user['groups'] = [];
$userGroups = UserGroupModel::get(['select' => ['group_id'], 'where' => ['user_id = ?'], 'data' => [$args['id']]]);
$groupsIds = array_column($userGroups, 'group_id');
if ($GLOBALS['id'] != $args['id']) {
$groupsIds = array_values(array_intersect($groupsIds, array_column(UserController::getManageableGroups(['userId' => $GLOBALS['id']]), 'id')));
}
$groups = GroupModel::get(['select' => ['label', 'id'], 'where' => ['id in (?)'], 'data' => [$groupsIds]]);
$user['groups'] = $groups;
} else {
$user = UserModel::getById(['select' => ['id', 'firstname', 'lastname', 'email', 'phone', 'substitute'], 'id' => $args['id']]);
}
......@@ -116,24 +124,6 @@ class UserController
return $response->withStatus(400)->withJson(['errors' => 'User does not exist']);
}
$user['groups'] = [];
$userGroups = UserGroupModel::get(['select' => ['group_id'], 'where' => ['user_id = ?'], 'data' => [$args['id']]]);
$groupsIds = array_column($userGroups, 'group_id');
$actuallyAlone = false;
if (empty($groupsIds)) {
$actuallyAlone = true;
} elseif ($GLOBALS['id'] != $args['id']) {
$groupsIds = array_values(array_intersect($groupsIds, array_column(UserController::getManageableGroups(['userId' => $GLOBALS['id']]), 'id')));
}
if (!empty($groupsIds)) {
$groups = GroupModel::get(['select' => ['label', 'id'], 'where' => ['id in (?)'], 'data' => [$groupsIds]]);
$user['groups'] = $groups;
} elseif (!$actuallyAlone) {
return $response->withStatus(403)->withJson(['errors' => 'User out of perimeter']);
}
HistoryController::add([
'code' => 'OK',
'objectType' => 'users',
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment