/**
* Check privilege by vars.
*
* @param string $module
* @param string $method
* @param string|array $vars
* @static
* @access public
* @return void
*/
public static function checkPrivByVars($module, $method, $vars)
{
global $app;
if (!is_array($vars)) {
parse_str($vars, $vars);
}
$method = strtolower($method);
/* Check priv by {$moduleName}ID. */
$checkByID['customer'] = ',assign,edit,delete,linkcontact,';
$checkByID['order'] = ',assign,edit,delete,close,activate,';
$checkByID['resume'] = ',edit,delete,';
$checkByID['address'] = ',edit,delete,';
if ($app->appName == 'crm') {
$checkByID['contact'] = ',edit,delete,';
}
foreach ($checkByID as $moduleName => $methodName) {
if ($module == $moduleName and strpos($methodName, ",{$method},") !== false) {
$idName = "{$moduleName}ID";
$idListName = 'canEdit' . ucwords($moduleName) . 'IdList';
if (!isset($vars[$idName])) {
return false;
}
$idList = isset($app->user->{$idListName}) ? $app->user->{$idListName} : '';
if (strpos($idList, ",{$vars[$idName]},") === false) {
return false;
}
}
}
/* Check priv by objectType and objectID. */
$checkByType['action'] = ',createrecord,';
$checkByType['address'] = ',create,';
foreach ($checkByType as $moduleName => $methodName) {
if ($module == $moduleName and strpos($methodName, ",{$method},") !== false) {
if (!isset($vars['objectType']) or !isset($vars['objectID'])) {
return false;
}
$idName = $vars['objectType'] . 'ID';
$idListName = 'canEdit' . ucwords($vars['objectType']) . 'IdList';
$idList = isset($app->user->{$idListName}) ? $app->user->{$idListName} : '';
return commonModel::checkPrivByVars($vars['objectType'], 'edit', "{$idName}={$vars['objectID']}");
}
}
/* Check priv use another method. module|method */
$checkByGroup['resume']['create'] = 'contact|edit';
foreach ($checkByGroup as $moduleName => $methodNames) {
foreach ($methodNames as $methodName => $settings) {
list($newModuleName, $newMethodName) = explode('|', $settings);
if ($module == $moduleName and $method == $methodName) {
return commonModel::checkPrivByVars($newModuleName, $newMethodName, $vars);
}
}
}
return true;
}