mirror of
https://github.com/SuiteCRM/SuiteCRM-Core.git
synced 2026-07-26 22:39:11 +08:00
6c571ef5d6
In legacy (Suite 7), the Employees module has no ACL integration — Employee.php does not implement bean_implements('ACL'), has no acl_actions records, and access is always granted. Restrictions (edit own record only, delete admin only) are enforced at the controller level.
In SuiteCRM 8, the UserACLHandler blocks non-admin users from accessing Employees because ACLAction::userHasAccess() fails when no acl_actions records exist.
This fix adds an Employees special case in ACLController::checkAccess() that returns true unconditionally, matching the legacy behavior.
Existing controller-level guards remain unchanged:
- Edit: own record only (controller.php:52-60)
- Delete: admin only (controller.php:62-77)
- Save: own record only (Employee.php:304-326)
- Export: admin only (Employee.php:188-220)
- Create: admin only (Menu.php:56-58)
|
||
|---|---|---|
| .. | ||
| language | ||
| metadata | ||
| ACLController.php | ||
| ACLJSController.php | ||
| Forms.php | ||
| install_actions.php | ||
| List.php | ||
| Menu.php | ||
| remove_actions.php | ||
| Save.php | ||
| vardefs.php | ||
