用户保护

public function DoCheckToWrite()
{
    if (array_key_exists('org_id', $this->ListChanges()) && ($this->HasUserAccount(true))) {
        $iNewOrg = $this->Get('org_id');
        $aUserOrgs = [$iNewOrg];
        $sHierarchicalKeyCode = MetaModel::IsHierarchicalClass('Organization');
        if ($sHierarchicalKeyCode !== false) {
            $sOrgQuery = 'SELECT Org FROM Organization AS Org JOIN Organization AS Root ON Org.'
                         .$sHierarchicalKeyCode.' ABOVE Root.id WHERE Root.id = :id';
            $oOrgFilter = new DBObjectSearch::FromOQL_AllData($sOrgQuery);
            $oOrgFilter->AllowAllData(true);
            $oOrgSet = new DBObjectSet($oOrgFilter, [], ['id' => $iNewOrg]);
            while ($aRow = $oOrgSet->FetchAssoc()) {
                $oOrg = $aRow['Org'];
                $aUserOrgs[] = $oOrg->GetKey();
            }
        }
        $oUserSet = $this->GetUsers(true);
        while($oUser = $oUserSet->Fetch())
        {
            if (!UserRights::IsAdministrator($oUser)) {
                $oSet = $oUser->get('allowed_org_list');
                if ($oSet->Count() > 0) {
                    $bFound = false;
                    while ($oOrg = $oSet->Fetch()) {
                        if (in_array($oOrg->Get('allowed_org_id'), $aUserOrgs)) {
                            $bFound = true;
                            break;
                        }
                    }
                    if (!$bFound) {
                        $this->m_aCheckErrors[] = $oUser->Get('login').": "
                                .Dict::S('Class:User/Error:AllowedOrgsMustContainUserOrg');
                    }
                }
            }
        }
    }
    return parent::DoCheckToWrite();
}

public function GetUsers($bActiveOnly = false)
{
    $sOQL = $bActiveOnly ? 'SELECT User WHERE contactid = :person' 
                : "SELECT User WHERE contactid = :person AND status='active'";
    $oFilter = DBSearch::FromOQL($sOQL, array('person' => $this->GetKey()));
    $oFilter->AllowAllData(true);
    $oUserSet = new DBObjectSet($oFilter);
    return $oUserSet;
}

public function HasUserAccount($bActiveOnly = false)
{
    static $bHasUserAccount = null;
    if (is_null($bHasUserAccount)) {
        $bHasUserAccount = ($this->GetUsers($bActiveOnly)->Count() > 0);
    }
    return $bHasUserAccount;
}