admin/accounting_dev_v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pemindahan submenu peralatan teknisi ke menu Oprasional Peralatan

Browse Source
This commit is contained in:
Wian Drs
2026-09-15 11:47:49 +07:00
parent 8fedd39d8f
commit e4d6245a3d
17 changed files with 151 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/Accountingattachments.php
+1 -1
View File
@@ -23,6 +23,6 @@ class Accountingattachments extends MY_Controller
}
public function download($id){$f=$this->db->get_where('transaction_attachments',array('id'=>(int)$id))->row();if(!$f)show_404();$this->assertEntityAccess($f);$path=FCPATH.'uploads/accounting/'.$f->stored_name;if(!$this->safePath($path))show_404();$this->load->helper('download');force_download($f->original_name,file_get_contents($path));}
public function preview($id){$f=$this->db->get_where('transaction_attachments',array('id'=>(int)$id))->row();if(!$f)show_404();$this->assertEntityAccess($f);$path=FCPATH.'uploads/accounting/'.$f->stored_name;if(!$this->safePath($path))show_404();$mime=function_exists('finfo_open')?(new finfo(FILEINFO_MIME_TYPE))->file($path):$f->mime_type;if($mime!=='application/pdf'&&strpos((string)$mime,'image/')!==0)show_404();$name=str_replace(array('"',"\r","\n"),'',basename($f->original_name));$this->output->set_header('Content-Type: '.$mime)->set_header('Content-Disposition: inline; filename="'.$name.'"')->set_header('Content-Length: '.filesize($path))->set_header('X-Content-Type-Options: nosniff')->set_output(file_get_contents($path));}
private function assertEntityAccess($file){$company=(int)$this->session->userdata('company_id');if(in_array($file->entity_type,array('technician_equipment_document','customer_equipment_registry'),true)){$table=$file->entity_type==='technician_equipment_document'?'technician_equipment_documents':'customer_equipment_registry';$owned=$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$permissions=$this->session->userdata('permissions');$known=is_array($permissions)&&array_key_exists('technician_attachment',$permissions);$fallback=!$known&&(check_permission('technician_equipment','can_view')||check_permission('items','can_view'));if(!is_master_admin_user()&&!check_permission('technician_attachment','can_view')&&!$fallback)show_error('Akses lampiran ditolak.',403,'Akses ditolak');return;}if($file->entity_type==='technician_installation'){$owned=$this->db->select('b.id')->from('item_barcodes b')->join('items i','i.id=b.item_id')->where(array('b.id'=>(int)$file->entity_id,'i.company_id'=>$company))->get()->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('items','can_view');return;}if($file->entity_type==='technician_status_change'){$owned=$this->db->get_where('technician_item_status_logs',array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('items','can_view');return;}$map=array('stock_document'=>array('stock_documents','items'),'asset'=>array('assets','asset'),'asset_maintenance'=>array('asset_maintenance','asset'),'asset_opname'=>array('asset_opnames','asset'));if(!isset($map[$file->entity_type]))return;list($table,$feature)=$map[$file->entity_type];if(!$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row())show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission($feature,'can_view');}
private function assertEntityAccess($file){$company=(int)$this->session->userdata('company_id');if(in_array($file->entity_type,array('technician_equipment_document','customer_equipment_registry'),true)){$table=$file->entity_type==='technician_equipment_document'?'technician_equipment_documents':'customer_equipment_registry';$owned=$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('technician_attachment','can_view');return;}if($file->entity_type==='technician_installation'){$owned=$this->db->select('b.id')->from('item_barcodes b')->join('items i','i.id=b.item_id')->where(array('b.id'=>(int)$file->entity_id,'i.company_id'=>$company))->get()->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('technician_attachment','can_view');return;}if($file->entity_type==='technician_status_change'){$owned=$this->db->get_where('technician_item_status_logs',array('id'=>(int)$file->entity_id,'company_id'=>$company))->row();if(!$owned)show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission('technician_attachment','can_view');return;}$map=array('stock_document'=>array('stock_documents','items'),'asset'=>array('assets','asset'),'asset_maintenance'=>array('asset_maintenance','asset'),'asset_opname'=>array('asset_opnames','asset'));if(!isset($map[$file->entity_type]))return;list($table,$feature)=$map[$file->entity_type];if(!$this->db->get_where($table,array('id'=>(int)$file->entity_id,'company_id'=>$company))->row())show_error('Akses lampiran ditolak.',403,'Akses ditolak');$this->requirePermission($feature,'can_view');}
private function safePath($path){$root=realpath(FCPATH.'uploads/accounting');$real=realpath($path);return$root&&$real&&strpos($real,$root.DIRECTORY_SEPARATOR)===0&&is_file($real);}
}