diff --git a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/CreatedOnDemandTab.java b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/CreatedOnDemandTab.java index 301922672..ebba95f83 100644 --- a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/CreatedOnDemandTab.java +++ b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/CreatedOnDemandTab.java @@ -72,6 +72,7 @@ public class CreatedOnDemandTab implements ITab { @Override public void show() { + beforeShowAction(); if (component == null) { component = componentCreator.create(parent); } @@ -86,6 +87,9 @@ public class CreatedOnDemandTab implements ITab { return component.getDesktop(); } + protected void beforeShowAction() { + } + protected void afterShowAction() { } diff --git a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/LimitingResourcesTabCreator.java b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/LimitingResourcesTabCreator.java index 231df62cd..70fa2502a 100644 --- a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/LimitingResourcesTabCreator.java +++ b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/LimitingResourcesTabCreator.java @@ -24,11 +24,16 @@ import static org.libreplan.web.I18nHelper._; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.BREADCRUMBS_SEPARATOR; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.getSchedulingLabel; +import java.io.IOException; import java.util.HashMap; import java.util.Map; +import javax.servlet.http.HttpServletResponse; + +import org.libreplan.business.users.entities.UserRole; import org.libreplan.web.limitingresources.LimitingResourcesController; import org.libreplan.web.planner.tabs.CreatedOnDemandTab.IComponentCreator; +import org.libreplan.web.security.SecurityUtils; import org.zkoss.ganttz.extensions.ITab; import org.zkoss.zk.ui.Component; import org.zkoss.zk.ui.Executions; @@ -132,6 +137,20 @@ public class LimitingResourcesTabCreator { return new CreatedOnDemandTab(_("Limiting Resources Planning"), "limiting-resources", componentCreator) { + @Override + protected void beforeShowAction() { + if (!SecurityUtils + .isSuperuserOrUserInRoles(UserRole.ROLE_PLANNING)) { + HttpServletResponse response = (HttpServletResponse) Executions + .getCurrent().getNativeResponse(); + try { + response.sendError(HttpServletResponse.SC_FORBIDDEN); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + } + @Override protected void afterShowAction() { limitingResourcesControllerGlobal.reload(); diff --git a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/OrdersTabCreator.java b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/OrdersTabCreator.java index 62c57242b..d2d5e396d 100644 --- a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/OrdersTabCreator.java +++ b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/OrdersTabCreator.java @@ -24,13 +24,17 @@ import static org.libreplan.web.I18nHelper._; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.BREADCRUMBS_SEPARATOR; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.getSchedulingLabel; +import java.io.IOException; import java.util.HashMap; import java.util.Map; +import javax.servlet.http.HttpServletResponse; + import org.libreplan.web.common.Util; import org.libreplan.web.orders.OrderCRUDController; import org.libreplan.web.planner.order.IOrderPlanningGate; import org.libreplan.web.planner.tabs.CreatedOnDemandTab.IComponentCreator; +import org.libreplan.web.security.SecurityUtils; import org.zkoss.ganttz.extensions.ITab; import org.zkoss.zk.ui.Component; import org.zkoss.zk.ui.Executions; @@ -101,6 +105,20 @@ public class OrdersTabCreator { private ITab createGlobalOrdersTab() { return new CreatedOnDemandTab(_("Projects List"), "orders", ordersTabCreator) { + @Override + protected void beforeShowAction() { + if (!SecurityUtils + .isSuperuserOrRolePlanningOrHasAnyAuthorization()) { + HttpServletResponse response = (HttpServletResponse) Executions + .getCurrent().getNativeResponse(); + try { + response.sendError(HttpServletResponse.SC_FORBIDDEN); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + } + @Override protected void afterShowAction() { orderCRUDController.goToList(); diff --git a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/PlanningTabCreator.java b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/PlanningTabCreator.java index 21fdf3fcb..74e3e0506 100644 --- a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/PlanningTabCreator.java +++ b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/PlanningTabCreator.java @@ -24,11 +24,14 @@ import static org.libreplan.web.I18nHelper._; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.BREADCRUMBS_SEPARATOR; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.getSchedulingLabel; +import java.io.IOException; import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; +import javax.servlet.http.HttpServletResponse; + import org.libreplan.business.common.exceptions.InstanceNotFoundException; import org.libreplan.business.orders.daos.IOrderDAO; import org.libreplan.business.orders.entities.Order; @@ -38,6 +41,7 @@ import org.libreplan.web.common.Util; import org.libreplan.web.planner.company.CompanyPlanningController; import org.libreplan.web.planner.order.OrderPlanningController; import org.libreplan.web.planner.tabs.CreatedOnDemandTab.IComponentCreator; +import org.libreplan.web.security.SecurityUtils; import org.zkoss.ganttz.extensions.ICommandOnTask; import org.zkoss.ganttz.extensions.IContextWithPlannerTask; import org.zkoss.ganttz.extensions.ITab; @@ -196,6 +200,20 @@ public class PlanningTabCreator { return new CreatedOnDemandTab(_("Projects Planning"), "company-scheduling", componentCreator) { + @Override + protected void beforeShowAction() { + if (!SecurityUtils + .isSuperuserOrRolePlanningOrHasAnyAuthorization()) { + HttpServletResponse response = (HttpServletResponse) Executions + .getCurrent().getNativeResponse(); + try { + response.sendError(HttpServletResponse.SC_FORBIDDEN); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + } + @Override protected void afterShowAction() { companyPlanningController.setConfigurationForPlanner(); diff --git a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/ResourcesLoadTabCreator.java b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/ResourcesLoadTabCreator.java index dbcef213e..24ef7c5a8 100644 --- a/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/ResourcesLoadTabCreator.java +++ b/libreplan-webapp/src/main/java/org/libreplan/web/planner/tabs/ResourcesLoadTabCreator.java @@ -24,15 +24,19 @@ import static org.libreplan.web.I18nHelper._; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.BREADCRUMBS_SEPARATOR; import static org.libreplan.web.planner.tabs.MultipleTabsPlannerController.getSchedulingLabel; +import java.io.IOException; import java.util.HashMap; import java.util.Map; +import javax.servlet.http.HttpServletResponse; + import org.libreplan.business.orders.entities.Order; +import org.libreplan.business.users.entities.UserRole; import org.libreplan.web.planner.order.IOrderPlanningGate; import org.libreplan.web.planner.tabs.CreatedOnDemandTab.IComponentCreator; import org.libreplan.web.resourceload.ResourceLoadController; +import org.libreplan.web.security.SecurityUtils; import org.zkoss.ganttz.extensions.ITab; -import org.zkoss.ganttz.resourceload.ResourcesLoadPanel.IToolbarCommand; import org.zkoss.zk.ui.Component; import org.zkoss.zk.ui.Executions; import org.zkoss.zul.Image; @@ -135,6 +139,20 @@ public class ResourcesLoadTabCreator { }; return new CreatedOnDemandTab(_("Resource Usage"), "company-load", componentCreator) { + @Override + protected void beforeShowAction() { + if (!SecurityUtils + .isSuperuserOrUserInRoles(UserRole.ROLE_PLANNING)) { + HttpServletResponse response = (HttpServletResponse) Executions + .getCurrent().getNativeResponse(); + try { + response.sendError(HttpServletResponse.SC_FORBIDDEN); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + } + @Override protected void afterShowAction() { resourceLoadControllerGlobal