diff --git a/modules/candidates/CandidatesUI.php b/modules/candidates/CandidatesUI.php index a282e13dd..1f1486f4e 100755 --- a/modules/candidates/CandidatesUI.php +++ b/modules/candidates/CandidatesUI.php @@ -266,11 +266,11 @@ public function handleRequest() break; /* Administrators can hide a candidate from a site with this action. */ - case 'administrativeHideShow': - if ($this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_MULTI_SA) - { - CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.'); - } + case 'administrativeHideShow': + if ($this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_SA) + { + CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.'); + } $this->administrativeHideShow(); break; @@ -493,11 +493,11 @@ private function show() return; } - if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_MULTI_SA) - { - $this->listByView('This candidate is hidden - only a CATS Administrator can unlock the candidate.'); - return; - } + if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_SA) + { + $this->listByView('This candidate is hidden - only a Site Administrator can unlock the candidate.'); + return; + } /* We want to handle formatting the city and state here instead * of in the template. @@ -1081,11 +1081,11 @@ private function edit() CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'The specified candidate ID could not be found.'); } - if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_MULTI_SA) - { - $this->listByView('This candidate is hidden - only a CATS Administrator can unlock the candidate.'); - return; - } + if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('candidates.hidden') < ACCESS_LEVEL_SA) + { + $this->listByView('This candidate is hidden - only a Site Administrator can unlock the candidate.'); + return; + } $users = new Users($this->_siteID); $usersRS = $users->getSelectList(); diff --git a/modules/candidates/Show.tpl b/modules/candidates/Show.tpl index 84206d2e8..e1bcd2652 100755 --- a/modules/candidates/Show.tpl +++ b/modules/candidates/Show.tpl @@ -43,7 +43,7 @@ use OpenCATS\UI\CandidateDuplicateQuickActionMenu;

Candidate Details

data['isAdminHidden'] == 1): ?> -

This Candidate is hidden. Only CATS Administrators can view it or search for it. To make it visible by the site users, click Here.

+

This Candidate is hidden. Only Site Administrators can view it or search for it. To make it visible by the site users, click Here.

@@ -440,7 +440,7 @@ use OpenCATS\UI\CandidateDuplicateQuickActionMenu;      - getUserAccessLevel('candidates.administrativeHideShow') >= ACCESS_LEVEL_MULTI_SA): ?> + getUserAccessLevel('candidates.administrativeHideShow') >= ACCESS_LEVEL_SA): ?> data['isAdminHidden'] == 1): ?> delete Administrative Show diff --git a/modules/joborders/JobOrdersUI.php b/modules/joborders/JobOrdersUI.php index ce7ae0f02..4ded53c69 100755 --- a/modules/joborders/JobOrdersUI.php +++ b/modules/joborders/JobOrdersUI.php @@ -290,7 +290,7 @@ public function handleRequest() */ case 'administrativeHideShow': - if ($this->getUserAccessLevel('joborders.administrativeHideShow') < ACCESS_LEVEL_MULTI_SA) + if ($this->getUserAccessLevel('joborders.administrativeHideShow') < ACCESS_LEVEL_SA) { CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.'); } @@ -379,9 +379,9 @@ private function show() CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'The specified job order ID could not be found.'); } - if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('joborders.hidden') < ACCESS_LEVEL_MULTI_SA) + if ($data['isAdminHidden'] == 1 && $this->getUserAccessLevel('joborders.hidden') < ACCESS_LEVEL_SA) { - $this->listByView('This Job Order is hidden - only a CATS Administrator can unlock the Job Order.'); + $this->listByView('This Job Order is hidden - only a Site Administrator can unlock the Job Order.'); return; } diff --git a/modules/joborders/Show.tpl b/modules/joborders/Show.tpl index b9ec1daa9..e2c6c0ee9 100755 --- a/modules/joborders/Show.tpl +++ b/modules/joborders/Show.tpl @@ -25,7 +25,7 @@ use OpenCATS\UI\QuickActionMenu;

Job Order Details

data['isAdminHidden'] == 1): ?> -

This Job Order is hidden. Only CATS Administrators can view it or search for it. To make it visible by the site users, click Here.

+

This Job Order is hidden. Only Site Administrators can view it or search for it. To make it visible by the site users, click Here.

frozen)): ?> @@ -332,7 +332,7 @@ use OpenCATS\UI\QuickActionMenu;      - getUserAccessLevel('joborders.hidden') >= ACCESS_LEVEL_MULTI_SA): ?> + getUserAccessLevel('joborders.hidden') >= ACCESS_LEVEL_SA): ?> data['isAdminHidden'] == 1): ?> delete Administrative Show diff --git a/test/features/GET_POST_requestsSecurity.feature b/test/features/GET_POST_requestsSecurity.feature index ef1b56080..acad2eebe 100644 --- a/test/features/GET_POST_requestsSecurity.feature +++ b/test/features/GET_POST_requestsSecurity.feature @@ -156,7 +156,7 @@ Scenario Outline: Candidate module actions | ADMIN | GET | index.php?m=candidates&a=removeFromPipeline | | | ADMIN | GET | index.php?m=candidates&a=addEditImage | | | ADMIN | GET | index.php?m=candidates&a=createAttachment | | - | ADMIN | GET | index.php?m=candidates&a=administrativeHideShow | not | + | ADMIN | GET | index.php?m=candidates&a=administrativeHideShow | | | ADMIN | GET | index.php?m=candidates&a=deleteAttachment | | | ADMIN | GET | index.php?m=candidates&a=savedLists | | | ADMIN | GET | index.php?m=candidates&a=emailCandidates | | @@ -351,7 +351,7 @@ Scenario Outline: Job Order module actions | ADMIN | GET | index.php?m=joborders&a=search | | | ADMIN | GET | index.php?m=joborders&a=search&getback=getback | | | ADMIN | GET | index.php?m=joborders&a=addActivityChangeStatus | | - | ADMIN | GET | index.php?m=joborders&a=administrativeHideShow | not | + | ADMIN | GET | index.php?m=joborders&a=administrativeHideShow | | | ADMIN | GET | index.php?m=joborders&a=listByView | | | ADMIN | GET | index.php?m=joborders&a=considerCandidateSearch | | | ADMIN | GET | index.php?m=joborders&a=addToPipeline | | @@ -1369,4 +1369,4 @@ Scenario Outline: Reports module actions #When I do GET request "index.php?m=settings&a=ajax_wizardWebsite" #And the response should contain "You don't have permission" - \ No newline at end of file + diff --git a/test/features/moduleSubPagesSecurity.feature b/test/features/moduleSubPagesSecurity.feature index f0e4c9645..adde9c0ad 100644 --- a/test/features/moduleSubPagesSecurity.feature +++ b/test/features/moduleSubPagesSecurity.feature @@ -44,7 +44,7 @@ Feature: Access Level to objects check - sub pages (show, ...) | EDIT | see | see | | | see | see | not see | see | not see | not see | see | see | | not | | see | not | | DELETE | see | see | | | see | see | not see | see | see | not see | see | see | | | | see | | | DEMO | see | see | | | see | see | see | see | see | not see | see | see | | | | see | | - | ADMIN | see | see | | | see | see | see | see | see | not see | see | see | | | | see | | + | ADMIN | see | see | | | see | see | see | see | see | see | see | see | | | | see | | | MULTI_ADMIN | see | see | | | see | see | see | see | see | see | see | see | | | | see | | | ROOT | see | see | | | see | see | see | see | see | see | see | see | | | | see | | @@ -87,7 +87,7 @@ Feature: Access Level to objects check - sub pages (show, ...) | EDIT | see | see | | | | see | see | see | see | not see | not see | not see | | | see | not | | not | | not | | DELETE | see | see | | | | see | see | see | see | see | not see | not see | | | see | | | | | | | DEMO | see | see | | | | see | see | see | see | see | see | not see | | | see | | | | | | - | ADMIN | see | see | | | | see | see | see | see | see | see | not see | | | see | | | | | | + | ADMIN | see | see | | | | see | see | see | see | see | see | see | | | see | | | | | | | MULTI_ADMIN | see | see | | | | see | see | see | see | see | see | see | | | see | | | | | | | ROOT | see | see | | | | see | see | see | see | see | see | see | | | see | | | | | | @@ -229,4 +229,4 @@ Feature: Access Level to objects check - sub pages (show, ...) # no sub pages ##missing checks for quick action menus on Show pages - \ No newline at end of file +