code

service/report.class.php

@@ -88,60 +88,16 @@ class report {
                     $sqlWhere .= " and '".common::check_input($_POST['party_id'])."' = any(party_ids)";
                 }
             }
-
-            $sqlWhere_party_id = '';
-            $sqlWhere_group_name = '';
-            if(_isCustomerLogin()){
-                $ocean_contact_id = _getCompanyContactHandNew($_SESSION["ONLINE_USER"]);
-                $air_contact_id = _getAirContactID('public');
-
-                $all_id = $ocean_contact_id;
-                if (utils::endWith($ocean_contact_id,";")){
-                    $all_id .=$air_contact_id;
-                } else {
-                    $all_id .=";".$air_contact_id;
-                }
-                $all_id = strtolower($all_id);
-                $unique_arr = explode(';', $all_id);
-                //构建安全的数组字面量用于 PostgreSQL 的 && 交集判断
-                // 转义每个 ID 防注入
-                $escaped_ids = array();
-                foreach($unique_arr as $id){
-                    $id = trim($id);
-                    if (empty($id))
-                        continue;
-                    $escaped_ids[] =  "'" .common::check_input($id) . "'";
-                }
-                if(empty($escaped_ids)){
-                    $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
-                }
-                $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
-                $sqlWhere_party_id = " OR party_ids && $array_str ";
-
-                //Group Name 判断
-                $company = _getCompanyHandNew($_SESSION["ONLINE_USER"],'public');
-                //$company = strtolower($company);
-                $aa = explode(";", $company);
-
-                $escaped_company = array();
-                foreach ($aa as $value) {
-                    $value = trim($value);
-                    if (empty($value))
-                        continue;
-                    $escaped_company[] = "'" . common::check_input($value) . "'";
-                }
-                if(empty($escaped_company)){
-                    $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
-                }
-                $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
-                $sqlWhere_group_name = "  OR group_names && $array_str";
-                
-                $systemAccountsqlWhere = " OR '".common::check_input(_getLoginName())."' = any(system_account)";
-                $sqlWhere .= " and ( access_type = 'All Users' ".$sqlWhere_party_id . " ".$sqlWhere_group_name ." ".$systemAccountsqlWhere .")";
-            } else {
-                //$systemAccountsqlWhere = " OR system_account IS NULL  OR array_length(system_account, 1) = 0  OR '".common::check_input(_getLoginName())."' = any(system_account)";
-                //$sqlWhere .= " and ( 1<>1 ".$systemAccountsqlWhere .")";
-            }
+            //这里不需要控制,能进来这个页面的帐号，都可以配置任何权限的模板的
+            // if(strtolower(_getLoginName()) == "chud" ||strtolower(_getLoginName()) == "it.andywu" ){
+            //     //这两个帐号不受KlnReportControl控制
+            // } else {
+            //     $sqlWhereArr = common::getKlnReportControl();
+            //     $sqlWhere_party_id = $sqlWhereArr['contactIdSqlWhere'];
+            //     $sqlWhere_group_name = $sqlWhereArr['groupNameSqlWhere'];
+            //     $systemAccountsqlWhere = " OR '".common::check_input(_getLoginName())."' = any(system_account)";
+            //     $sqlWhere .= " and ( access_type = 'All Users' ".$sqlWhere_party_id . " ".$sqlWhere_group_name ." ".$systemAccountsqlWhere .")";
+            // }
 
             $rc = $_POST ['rc'];
             if ($rc == -1) {
@@ -389,61 +345,15 @@ class report {
                 $sqlWhere .= " and (lower(name) like '%".strtolower($text_search)."%')";
             }
             
-            $sqlWhere_party_id = '';
-            $sqlWhere_group_name = '';
-            if(_isCustomerLogin()){
-                $ocean_contact_id = _getCompanyContactHandNew($_SESSION["ONLINE_USER"]);
-                $air_contact_id = _getAirContactID('public');
-
-                $all_id = $ocean_contact_id;
-                if (utils::endWith($ocean_contact_id,";")){
-                    $all_id .=$air_contact_id;
-                } else {
-                    $all_id .=";".$air_contact_id;
-                }
-                $all_id = strtolower($all_id);
-                $unique_arr = explode(';', $all_id);
-                //构建安全的数组字面量用于 PostgreSQL 的 && 交集判断
-                // 转义每个 ID 防注入
-                $escaped_ids = array();
-                foreach($unique_arr as $id){
-                    $id = trim($id);
-                    if (empty($id))
-                        continue;
-                    $escaped_ids[] =  "'" .common::check_input($id) . "'";
-                }
-                if(empty($escaped_ids)){
-                    $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
-                }
-                $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
-                $sqlWhere_party_id = " OR party_ids && $array_str ";
-                
-                //Group Name 判断
-                $company = _getCompanyHandNew($_SESSION["ONLINE_USER"],'public');
-                //$company = strtolower($company);
-                $aa = explode(";", $company);
-
-                $escaped_company = array();
-                foreach ($aa as $value) {
-                    $value = trim($value);
-                    if (empty($value))
-                        continue;
-                    $escaped_company[] = "'" . common::check_input($value) . "'";
-                }
-                if(empty($escaped_company)){
-                    $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
-                }
-                $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
-                $sqlWhere_group_name = "  OR group_names && $array_str";
-
+            if(strtolower(_getLoginName()) == "chud" || strtolower(_getLoginName()) == "it.andywu" || strtolower(_getLoginName()) == "ra.admin"){
+                //这两个帐号不受KlnReportControl控制
+            } else {
+                $sqlWhereArr = common::getKlnReportControl();
+                $sqlWhere_party_id = $sqlWhereArr['contactIdSqlWhere'];
+                $sqlWhere_group_name = $sqlWhereArr['groupNameSqlWhere'];
                 $systemAccountsqlWhere = " OR '".common::check_input(_getLoginName())."' = any(system_account)";
                 $sqlWhere .= " and ( access_type = 'All Users' ".$sqlWhere_party_id . " ".$sqlWhere_group_name ." ".$systemAccountsqlWhere .")";
-            } else {
-                //$systemAccountsqlWhere = " OR system_account IS NULL  OR array_length(system_account, 1) = 0  OR '".common::check_input(_getLoginName())."' = any(system_account)";
-                //$sqlWhere .= " and ( 1<>1 ".$systemAccountsqlWhere .")";
             }
-
-           
             $rc = $_POST ['rc'];
             if ($rc == - 1) {
                 $sql = "select count(*) from public.kln_report_template where " .$sqlWhere;

utils/common.class.php

@@ -4504,6 +4504,7 @@ class common {
             "oc.po_no" => "container_po_no",
             "oc.item_no" => "item_no",
             "oc.invoice_no" => "container_invoice_no",
+            "oc.seal_no" => "seal_no",
             "oi.po_no" => "item_po_no",
             "oi.sku_no" => "sku_no",
             "oi.quantity" => "item_qty",
@@ -5057,5 +5058,107 @@ class common {
             return [];
         }
     }
+
+    /**
+     * KLN Report Control: Contact_id and Group Name
+    */
+    public static function getKlnReportControl()
+    {
+        $data =["contactIdSqlWhere" => " OR 1<>1 ", "groupNameSqlWhere" => " OR 1<>1 "];
+        if (_isCustomerLogin()){
+            //contact_id判断
+            $ocean_contact_id = _getCompanyContactHandNew($_SESSION["ONLINE_USER"]);
+            $air_contact_id = _getAirContactID('public');
+            $all_id = $ocean_contact_id;
+            if (utils::endWith($ocean_contact_id,";")){
+                $all_id .=$air_contact_id;
+            } else {
+                $all_id .=";".$air_contact_id;
+            }
+            $unique_arr = explode(';', $all_id);
+            //构建安全的数组字面量用于 PostgreSQL 的 && 交集判断
+            // 转义每个 ID 防注入
+            $escaped_ids = array();
+            foreach($unique_arr as $id){
+                $id = trim($id);
+                if (empty($id))
+                    continue;
+                $escaped_ids[] =  "'" .common::check_input($id) . "'";
+            }
+            if(empty($escaped_ids)){
+                $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
+            }
+            $contactIdSqlWhereStr = 'ARRAY[' . implode(',', $escaped_ids) . ']';
+            $data['contactIdSqlWhere'] = " OR party_ids && $contactIdSqlWhereStr ";
+
+            //Group Name 判断
+            $company = _getCompanyHandNew($_SESSION["ONLINE_USER"],'public');
+            $aa = explode(";", $company);
+
+            $escaped_company = array();
+            foreach ($aa as $value) {
+                $value = trim($value);
+                if (empty($value))
+                    continue;
+                $escaped_company[] = "'" . common::check_input($value) . "'";
+            }
+            if(empty($escaped_company)){
+                $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
+            }
+            $groupNameSqlWhereStr = 'ARRAY[' . implode(',', $escaped_company) . ']';
+            $data['groupNameSqlWhere'] = "  OR group_names && $groupNameSqlWhereStr";
+        } else {
+            //contact_id判断
+            $ocean_contact_id = $_SESSION["ONLINE_USER"]['employee_contact_id_user'];
+            $air_contact_id = $_SESSION["ONLINE_USER"]['employee_air_contact_id_user'];
+            $all_id = $ocean_contact_id;
+            if (utils::endWith($ocean_contact_id,";")){
+                $all_id .=$air_contact_id;
+            } else {
+                $all_id .=";".$air_contact_id;
+            }
+            $unique_arr = explode(';', $all_id);
+            //构建安全的数组字面量用于 PostgreSQL 的 && 交集判断
+            // 转义每个 ID 防注入
+            $escaped_ids = array();
+            foreach($unique_arr as $id){
+                $id = trim($id);
+                if (empty($id))
+                    continue;
+                $escaped_ids[] =  "'" .common::check_input($id) . "'";
+            }
+            if(empty($escaped_ids)){
+                $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
+            }
+            $contactIdSqlWhereStr = 'ARRAY[' . implode(',', $escaped_ids) . ']';
+            $data['contactIdSqlWhere'] = " OR party_ids && $contactIdSqlWhereStr ";
+
+            //Group Name 判断
+            $oceanCompany = $_SESSION["ONLINE_USER"]['employee_company_name'];
+            $airCompany = $_SESSION["ONLINE_USER"]['employee_air_company_name'];
+            $company = $oceanCompany;
+            if (utils::endWith($oceanCompany,";")){
+                $company .=$airCompany;
+            } else {
+                $company .=";".$airCompany;
+            }
+            $aa = explode(";", $company);
+
+            $escaped_company = array();
+            foreach ($aa as $value) {
+                $value = trim($value);
+                if (empty($value))
+                    continue;
+                $escaped_company[] = "'" . common::check_input($value) . "'";
+            }
+            if(empty($escaped_company)){
+                $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
+            }
+            $groupNameSqlWhereStr = 'ARRAY[' . implode(',', $escaped_company) . ']';
+            $data['groupNameSqlWhere'] = "  OR group_names && $groupNameSqlWhereStr";
+        }
+
+        return $data;
+    }
 }
 ?>