Skip to content

Add advanced permission for supplier supplier price editing #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mapiolca merged 3 commits into from
Oct 24, 2025
Merged

Add advanced permission for supplier supplier price editing #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dfd79a5
Add advanced supplier price write permission
mapiolca Oct 24, 2025
74d7d6d
Remove French comments from supplier price permissions
mapiolca Oct 24, 2025
f02391f
Update supplier price permission translation
mapiolca Oct 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions htdocs/core/modules/modProduct.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
* Copyright (C) 2020-2021 Alexandre Spangaro <[email protected]>
* Copyright (C) 2024 MDW <[email protected]>
* Copyright (C) 2025 Frédéric France <[email protected]>
* Copyright (C) 2025 Pierre Ardoin <[email protected]>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -144,6 +145,15 @@ public function __construct($db)
$this->rights[$r][3] = 0; // La permission est-elle une permission par default
$this->rights[$r][4] = 'product_advance';
$this->rights[$r][5] = 'read_supplier_prices';
$r++;

// EN: Advanced permission to write supplier prices
$this->rights[$r][0] = 36; // id de la permission
$this->rights[$r][1] = 'Write supplier prices'; // libelle de la permission
$this->rights[$r][2] = 'w'; // type de la permission (deprecated)
$this->rights[$r][3] = 0; // La permission est-elle une permission par default
$this->rights[$r][4] = 'product_advance';
$this->rights[$r][5] = 'write_supplier_prices';
$r++;

$this->rights[$r][0] = 34; // id de la permission
Expand Down
2 changes: 1 addition & 1 deletion htdocs/langs/en_US/admin.lang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -773,7 +773,7 @@ Permission31=Read products
Permission32=Create/modify products
Permission33=Read prices products
Permission34=Delete products
Permission36=See/manage hidden products
Permission36=Create/modify supplier prices
Permission38=Export products
Permission39=Can set a price lower than the minimum price of products
Permission41=Read projects and tasks (shared projects and projects of which I am a contact).
Expand Down
2 changes: 1 addition & 1 deletion htdocs/langs/fr_FR/admin.lang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -769,7 +769,7 @@ Permission31=Consulter les produits
Permission32=Créer/modifier les produits
Permission33=Lire les prix des produits
Permission34=Supprimer les produits
Permission36=Voir/gérer les produits cachés
Permission36=créer/modifier les prix fournisseurs
Permission38=Exporter les produits
Permission39=Peut définir un prix inférieur au prix minimum de produits
Permission41=Lire les projets et les tâches (projets partagés et projets dont je suis un contact).
Expand Down
35 changes: 25 additions & 10 deletions htdocs/product/price_suppliers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
* Copyright (C) 2019-2024 Frédéric France <[email protected]>
* Copyright (C) 2019 Tim Otte <[email protected]>
* Copyright (C) 2020 Pierre Ardoin <[email protected]>
* Copyright (C) 2025 Pierre Ardoin <[email protected]>
* Copyright (C) 2023 Joachim Kueter <[email protected]>
* Copyright (C) 2025 MDW <[email protected]>
*
Expand Down Expand Up @@ -121,6 +122,8 @@

$usercanread = (($object->type == Product::TYPE_PRODUCT && $user->hasRight('produit', 'lire')) || ($object->type == Product::TYPE_SERVICE && $user->hasRight('service', 'lire')));
$usercancreate = (($object->type == Product::TYPE_PRODUCT && $user->hasRight('produit', 'creer')) || ($object->type == Product::TYPE_SERVICE && $user->hasRight('service', 'creer')));
// EN: Manage advanced permission to write supplier prices
$usercanwritesupplierprice = getDolGlobalString('MAIN_USE_ADVANCED_PERMS') ? $user->hasRight('product', 'product_advance', 'write_supplier_prices') : $usercancreate;

if ($object->id > 0) {
if ($object->type == $object::TYPE_PRODUCT) {
Expand All @@ -133,6 +136,11 @@
restrictedArea($user, 'produit|service', $fieldvalue, 'product&product', '', '', $fieldtype);
}

// EN: Stop unauthorized access to supplier price creation or edition forms
if ((!$usercanwritesupplierprice) && ($action == 'create_price' || $action == 'edit_price')) {
accessforbidden();
}


/*
* Actions
Expand Down Expand Up @@ -182,7 +190,7 @@
}
}

if ($action == 'confirm_remove_pf' && $usercancreate) {
if ($action == 'confirm_remove_pf' && $usercanwritesupplierprice) {
if ($rowid) { // id of product supplier price to remove
$action = '';
$result = $object->remove_product_fournisseur_price($rowid);
Expand All @@ -196,7 +204,7 @@
}
}

if ($action == 'save_price' && $usercancreate) {
if ($action == 'save_price' && $usercanwritesupplierprice) {
$ref_fourn_price_id = GETPOSTINT('ref_fourn_price_id');
$id_fourn = GETPOSTINT("id_fourn");
if (empty($id_fourn)) {
Expand Down Expand Up @@ -390,6 +398,10 @@

if ($id > 0 || $ref) {
if ($action == 'ask_remove_pf') {
// EN: Block action if user cannot write supplier prices
if (!$usercanwritesupplierprice) {
accessforbidden();
}
$form = new Form($db);
$formconfirm = $form->formconfirm($_SERVER["PHP_SELF"].'?id='.$id.'&rowid='.$rowid, $langs->trans('DeleteProductBuyPrice'), $langs->trans('ConfirmDeleteProductBuyPrice'), 'confirm_remove_pf', '', 0, 1);
echo $formconfirm;
Expand Down Expand Up @@ -482,7 +494,7 @@


// Form to add or update a price
if (($action == 'create_price' || $action == 'edit_price') && $usercancreate) {
if (($action == 'create_price' || $action == 'edit_price') && $usercanwritesupplierprice) {
$langs->load("suppliers");

print "<!-- form to add a supplier price -->\n";
Expand Down Expand Up @@ -927,12 +939,13 @@
if ($action != 'create_price' && $action != 'edit_price') {
$parameters = array();
$reshook = $hookmanager->executeHooks('addMoreActionsButtons', $parameters, $object, $action); // Note that $action and $object may have been modified by hook
if (empty($reshook)) {
if ($usercancreate) {
if (empty($reshook)) {

Check failure on line 942 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Line indented incorrectly; expected 3 tabs, found 6

Check failure on line 942 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Tabs must be used to indent lines; spaces are not allowed
// EN: Display add button only when user can write supplier prices

Check failure on line 943 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Tabs must be used to indent lines; spaces are not allowed
if ($usercanwritesupplierprice) {
print '<a class="butAction" href="'.DOL_URL_ROOT.'/product/price_suppliers.php?id='.((int) $object->id).'&action=create_price&token='.newToken().'">';
print $langs->trans("AddSupplierPrice").'</a>';
}
}

Check failure on line 948 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Closing brace indented incorrectly; expected 24 spaces, found 12
}

print "</div>\n";
Expand Down Expand Up @@ -1143,16 +1156,17 @@
print '<tr class="oddeven">';

// Action column
if (getDolGlobalString('MAIN_CHECKBOX_LEFT_COLUMN')) {
print '<td class="center nowraponall">';
if ($usercancreate) {
if (getDolGlobalString('MAIN_CHECKBOX_LEFT_COLUMN')) {

Check failure on line 1159 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Line indented incorrectly; expected 5 tabs, found 4
print '<td class="center nowraponall">';

Check failure on line 1160 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Line indented incorrectly; expected at least 6 tabs, found 5
// EN: Allow editing and deletion when user can write supplier prices

Check failure on line 1161 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Line indented incorrectly; expected at least 6 tabs, found 5
if ($usercanwritesupplierprice) {

Check failure on line 1162 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Line indented incorrectly; expected 6 tabs, found 5
print '<a class="editfielda" href="'.$_SERVER['PHP_SELF'].'?id='.((int) $object->id).'&socid='.((int) $productfourn->fourn_id).'&action=edit_price&token='.newToken().'&rowid='.((int) $productfourn->product_fourn_price_id).'">'.img_edit()."</a>";
print ' &nbsp; ';
print '<a href="'.$_SERVER['PHP_SELF'].'?id='.((int) $object->id).'&socid='.((int) $productfourn->fourn_id).'&action=ask_remove_pf&token='.newToken().'&rowid='.((int) $productfourn->product_fourn_price_id).'">'.img_picto($langs->trans("Remove"), 'delete').'</a>';
}

Check failure on line 1166 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Closing brace indented incorrectly; expected 20 spaces, found 24

print '</td>';
}

Check failure on line 1169 in htdocs/product/price_suppliers.php

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit 

Closing brace indented incorrectly; expected 16 spaces, found 20

// Date from
if (!empty($arrayfields['pfp.datec']['checked'])) {
Expand All @@ -1165,7 +1179,7 @@
}

// Supplier ref
if ($usercancreate) { // change required right here
if ($usercanwritesupplierprice) { // EN: Supplier link allowed when user can write supplier prices
print '<td class="tdoverflowmax150">'.$productfourn->getNomUrl().'</td>';
} else {
print '<td class="tdoverflowmax150">'.dol_escape_htmltag($productfourn->fourn_ref).'</td>';
Expand Down Expand Up @@ -1335,7 +1349,8 @@
// Modify-Remove
if (!getDolGlobalString('MAIN_CHECKBOX_LEFT_COLUMN')) {
print '<td class="center nowraponall">';
if ($usercancreate) {
// EN: Allow editing and deletion when user can write supplier prices
if ($usercanwritesupplierprice) {
print '<a class="editfielda" href="'.$_SERVER['PHP_SELF'].'?id='.((int) $object->id).'&socid='.((int) $productfourn->fourn_id).'&action=edit_price&token='.newToken().'&rowid='.((int) $productfourn->product_fourn_price_id).'">'.img_edit()."</a>";
print ' &nbsp; ';
print '<a href="'.$_SERVER['PHP_SELF'].'?id='.((int) $object->id).'&socid='.((int) $productfourn->fourn_id).'&action=ask_remove_pf&token='.newToken().'&rowid='.((int) $productfourn->product_fourn_price_id).'">'.img_picto($langs->trans("Remove"), 'delete').'</a>';
Expand Down
Loading