diff --git a/Controller/ReportController.php b/Controller/ReportController.php index 317f71bf9..0f49e406d 100644 --- a/Controller/ReportController.php +++ b/Controller/ReportController.php @@ -70,6 +70,21 @@ class ReportController extends Controller */ public function selectReportTypeAction($person_id, Request $request) { + $em = $this->getDoctrine()->getManager(); + + $person = $em->getRepository('ChillPersonBundle:Person') + ->find($person_id); + + if ($person === NULL) { + throw $this->createNotFoundException('Person not found!'); + } + + $this->denyAccessUnlessGranted('CHILL_PERSON_SEE', $person, 'access denied for person view'); + // check access on report creation for a dummy report + $this->denyAccessUnlessGranted('CHILL_REPORT_CREATE', + (new Report())->setPerson($person), 'access denied for report creation'); + + $cFGroupId = $request->query->get('cFGroup'); if($cFGroupId) { @@ -78,8 +93,6 @@ class ReportController extends Controller array('person_id' => $person_id, 'cf_group_id' => $cFGroupId))); } - $em = $this->getDoctrine()->getManager(); - $cFGroups = $em->getRepository('ChillCustomFieldsBundle:CustomFieldsGroup') ->findByEntity('Chill\ReportBundle\Entity\Report'); @@ -210,6 +223,9 @@ class ReportController extends Controller } $this->denyAccessUnlessGranted('CHILL_PERSON_SEE', $person); + // check access on report creation for a dummy report + $this->denyAccessUnlessGranted('CHILL_REPORT_CREATE', + (new Report())->setPerson($person), 'access denied for report creation'); if ($cFGroup === NULL){ throw $this->createNotFoundException("custom fields group not found"); diff --git a/Resources/views/Report/list.html.twig b/Resources/views/Report/list.html.twig index 966703d1d..9e0ad5c47 100644 --- a/Resources/views/Report/list.html.twig +++ b/Resources/views/Report/list.html.twig @@ -26,7 +26,7 @@ {{ 'Date' | trans }} {{ 'Report type' | trans }} - {{ 'Report scope' | trans }} + {{ 'Circle' | trans }} @@ -37,8 +37,20 @@ {% if report.date %}{{ report.date|localizeddate('long', 'none') }}{% endif %} {{ report.cFGroup.getName(app.request.locale) }} {{ report.scope.name|localize_translatable_string }} - {{ 'View' | trans }} - {{ 'Update' | trans }} + + + {% endfor %} diff --git a/Resources/views/Report/new.html.twig b/Resources/views/Report/new.html.twig index ca1955301..ab6f44c4a 100644 --- a/Resources/views/Report/new.html.twig +++ b/Resources/views/Report/new.html.twig @@ -23,7 +23,9 @@ {% block personcontent %} {{ form_start(form) }} - {{ form_widget(form) }} + {{ form_row(form.user) }} + {{ form_row(form.date) }} + {{ form_row(form.scope) }}
diff --git a/Resources/views/Report/view.html.twig b/Resources/views/Report/view.html.twig index 499ae3d84..686735448 100644 --- a/Resources/views/Report/view.html.twig +++ b/Resources/views/Report/view.html.twig @@ -27,8 +27,8 @@
{{ 'Person'|trans }} :
{{ entity.person }}
-
{{ 'Scope'|trans }} :
-
{{ entity.scope.name|localize_translatable_string }}
+
{{ 'Circle'|trans }} :
+
{{ entity.scope.name|localize_translatable_string }}
{{ 'Date'|trans }} :
{{ entity.date|localizeddate('long', 'none') }}
{{ 'User'|trans }} :
@@ -38,7 +38,8 @@ {{ chill_custom_fields_group_widget(entity.cFData, entity.cFGroup) }}
- + + {% if is_granted('CHILL_REPORT_UPDATE', entity) %} {{ 'Update the report' | trans }} - + {% endif %} {% endblock %}