Commit daad2d0f authored by Laurent Lecluse's avatar Laurent Lecluse
Browse files

Protection de la saisie des dérogations : le privilège d'édition n'était pas testé

parent f6b223bd

module/Plafond/src/Controller/DerogationController.php

+2 −1
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ namespace Plafond\Controller; 


use Application\Controller\AbstractController;

use Application\Entity\Db\Intervenant;

use Application\Provider\Privilege\Privileges;

use Application\Service\Traits\TypeVolumeHoraireServiceAwareTrait;

use Plafond\Entity\Db\PlafondDerogation;

use Plafond\Entity\Db\PlafondEtat;
@@ -26,7 +27,7 @@ class DerogationController extends AbstractController 
        $typesVolumesHoraires = $this->getServiceTypeVolumeHoraire()->getList();





        if ($this->params()->fromPost('action') == 'save') {

        if ($this->isAllowed(Privileges::getResourceId(Privileges::PLAFONDS_DEROGATIONS_EDITION)) && $this->params()->fromPost('action') == 'save') {

            $this->saveDerogations($intervenant);

        }

module/Plafond/view/plafond/derogation/index.phtml

+7 −3
Original line number Diff line number Diff line
@@ -7,11 +7,11 @@ 
 *

 */



echo '<h1>Dérogations accordées</h1>';

use Application\Provider\Privilege\Privileges;



//var_dump($data);

echo '<h1>Dérogations accordées</h1>';



$canDerog = true;

$canDerog = $this->isAllowed(Privileges::getResourceId(Privileges::PLAFONDS_DEROGATIONS_EDITION));



echo $this->messenger()->addCurrentMessagesFromFlashMessenger();
@@ -49,7 +49,11 @@ echo $this->messenger()->addCurrentMessagesFromFlashMessenger(); 
                <?php endforeach; ?>



                <td>

                    <?php if ($canDerog): ?>

                        <input class="form-control" type="text" name="plafond-<?= $id ?>" value="<?= $plafond['derogation'] ?>"/>

                    <?php else: ?>

                        <?= floatToString($plafond['derogation']) ?>

                    <?php endif; ?>

                </td>

            </tr>

        <?php endforeach; ?>