Ajout filtre acces client

htdocs/comm/clients.php3

@@ -1,8 +1,5 @@
 <?PHP
-/* Copyright (C) 2001-2002 Rodolphe Quiedeville <rodolphe@quiedeville.org>
+/* Copyright (C) 2001-2003 Rodolphe Quiedeville <rodolphe@quiedeville.org>
- *
- * $Id$
- * $Source$
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -18,6 +15,9 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  *
+ * $Id$
+ * $Source$
+ *
  */
 require("./pre.inc.php3");
 require("../contact.class.php3");
@@ -27,6 +27,16 @@ require("../actioncomm.class.php3");
 
 llxHeader();
 
+/*
+ * Sécurité accés client
+ */
+if ($user->societe_id > 0) 
+{
+  $action = '';
+  $socidp = $user->societe_id;
+}
+
+
 $db = new Db();
 
 if ($sortorder == "") {
@@ -73,51 +83,55 @@ if ($action=='add_action') {
 }
 
 
-if ($action == 'attribute_prefix') {
+if ($action == 'attribute_prefix')
+{
   $societe = new Societe($db, $socid);
   $societe->attribute_prefix($db, $socid);
 }
 
-if ($action == 'recontact') {
+if ($action == 'recontact')
+{
   $dr = mktime(0, 0, 0, $remonth, $reday, $reyear);
   $sql = "INSERT INTO llx_soc_recontact (fk_soc, datere, author) VALUES ($socid, $dr,'". $GLOBALS["REMOTE_USER"]."')";
   $result = $db->query($sql);
 }
 
-if ($action == 'note') {
+if ($action == 'note')
+{
   $sql = "UPDATE societe SET note='$note' WHERE idp=$socid";
   $result = $db->query($sql);
 }
 
-if ($action == 'stcomm') {
+if ($action == 'stcomm')
-  if ($stcommid <> 'null' && $stcommid <> $oldstcomm) {
+{
+  if ($stcommid <> 'null' && $stcommid <> $oldstcomm)
+    {
       $sql = "INSERT INTO socstatutlog (datel, fk_soc, fk_statut, author) ";
       $sql .= " VALUES ('$dateaction',$socid,$stcommid,'" . $GLOBALS["REMOTE_USER"] . "')";
       $result = @$db->query($sql);
       
-    if ($result) {
+      if ($result)
+	{
 	  $sql = "UPDATE societe SET fk_stcomm=$stcommid WHERE idp=$socid";
 	  $result = $db->query($sql);
-    } else {
+	}
+      else
+	{
 	  $errmesg = "ERREUR DE DATE !";
 	}
     }
 
-  if ($actioncommid) {
+  if ($actioncommid)
+    {
       $sql = "INSERT INTO actioncomm (datea, fk_action, fk_soc, fk_user_author) VALUES ('$dateaction',$actioncommid,$socid,'" . $user->id . "')";
       $result = @$db->query($sql);
       
-    if (!$result) {
+      if (!$result)
+	{
 	  $errmesg = "ERREUR DE DATE !";
 	}
     }
 }
-if ($page == -1) { $page = 0 ; }
-
-$offset = $conf->liste_limit * $page ;
-$pageprev = $page - 1;
-$pagenext = $page + 1;
-
 
 /*
  * Recherche
@@ -139,6 +153,13 @@ if ($mode == 'search') {
   }
 }
 
+if ($page == -1) { $page = 0 ; }
+
+$offset = $conf->liste_limit * $page ;
+$pageprev = $page - 1;
+$pagenext = $page + 1;
+
+
 
 /*
  * Mode Liste
@@ -150,15 +171,23 @@ if ($mode == 'search') {
 
 $sql = "SELECT s.idp, s.nom, s.ville, ".$db->pdate("s.datec")." as datec, ".$db->pdate("s.datea")." as datea,  st.libelle as stcomm, s.prefix_comm FROM societe as s, c_stcomm as st WHERE s.fk_stcomm = st.id AND s.client=1";
 
-  if (strlen($stcomm)) {
+if (strlen($stcomm))
+{
   $sql .= " AND s.fk_stcomm=$stcomm";
 }
 
-  if (strlen($begin)) {
+if (strlen($begin))
+{
   $sql .= " AND upper(s.nom) like '$begin%'";
 }
 
-  if ($socname) {
+if ($user->societe_id)
+{
+  $sql .= " AND s.idp = " .$user->societe_id;
+}
+
+if ($socname)
+{
   $sql .= " AND lower(s.nom) like '%".strtolower($socname)."%'";
   $sortfield = "lower(s.nom)";
   $sortorder = "ASC";
@@ -167,13 +196,17 @@ if ($mode == 'search') {
 $sql .= " ORDER BY $sortfield $sortorder " . $db->plimit($conf->liste_limit, $offset);
 
 $result = $db->query($sql);
-  if ($result) {
+if ($result)
+{
   $num = $db->num_rows();
   $i = 0;
   
-    if ($sortorder == "DESC") {
+  if ($sortorder == "DESC")
+    {
       $sortorder="ASC";
-    } else {
+    }
+  else
+    {
       $sortorder="DESC";
     }
   print "<TABLE border=\"0\" width=\"100%\" cellspacing=\"0\" cellpadding=\"4\">";
@@ -181,11 +214,12 @@ if ($mode == 'search') {
   print "<TD valign=\"center\">";
   print_liste_field_titre("Société",$PHP_SELF,"s.nom");
   print "</td><TD>Ville</TD>";
-    print "<TD>email</TD>";
+  print "<TD align=\"center\">Préfix</td><td colspan=\"2\">&nbsp;</td>";
-    print "<TD align=\"center\">Statut</TD><td>&nbsp;</td><td colspan=\"2\">&nbsp;</td>";
   print "</TR>\n";
   $var=True;
-    while ($i < $num) {
+
+  while ($i < $num)
+    {
       $obj = $db->fetch_object( $i);
       
       $var=!$var;
@@ -193,13 +227,23 @@ if ($mode == 'search') {
       print "<TR $bc[$var]>";
       print "<TD><a href=\"fiche.php3?socid=$obj->idp\">$obj->nom</A></td>\n";
       print "<TD>".$obj->ville."&nbsp;</TD>\n";
-      print "<TD>&nbsp;</TD>\n";
-      print "<TD align=\"center\">$obj->stcomm</TD>\n";
       print "<TD align=\"center\">$obj->prefix_comm&nbsp;</TD>\n";
+
+      if ($user->societe_id == 0)
+	{
 	  print "<TD align=\"center\"><a href=\"addpropal.php3?socidp=$obj->idp&action=create\">[Propal]</A></td>\n";
-      if ($conf->fichinter->enabled) {
+	  if ($conf->fichinter->enabled)
+	    {
 	      print "<TD align=\"center\"><a href=\"../fichinter/fiche.php3?socidp=$obj->idp&action=create\">[Fiche Inter]</A></td>\n";
-      } else {
+	    }
+	  else
+	    {
+	      print "<TD>&nbsp;</TD>\n";
+	    }
+	}
+      else
+	{
+	  print "<TD>&nbsp;</TD>\n";
 	  print "<TD>&nbsp;</TD>\n";
 	}
       print "</TR>\n";
@@ -207,7 +251,9 @@ if ($mode == 'search') {
     }
   print "</TABLE>";
   $db->free();
-  } else {
+}
+else
+{
   print $db->error() . ' ' . $sql;
 }
 

htdocs/compta/facture.php3

@@ -30,6 +30,17 @@ $db = new Db();
 $yn[1] = "oui";
 $yn[0] = "<b>non</b>";
 
+/*
+ * Sécurité accés client
+ */
+if ($user->societe_id > 0) 
+{
+  $action = '';
+  $socidp = $user->societe_id;
+}
+/*
+ *
+ */	
 if ($action == 'valid') 
 {
   $fac = new Facture($db);
@@ -75,7 +86,6 @@ if ($action == 'add')
   
   if (! $propalid) 
     {
-
       $facture = new Facture($db, $socid);
       $facture->number = $facnumber;
       $facture->date = $datefacture;
@@ -89,7 +99,6 @@ if ($action == 'add')
     }
   else
     {
-
       $facture = new Facture($db, $socid);
 
       $facture->number   = $facnumber;
@@ -108,7 +117,6 @@ if ($action == 'add')
     }
   $facid = $facid;
   $action = '';  
-  
 }
 /*
  *
@@ -172,7 +180,6 @@ if ($action == 'send')
  *
  *
  */
-
 if ($action == 'create') 
 {
   print_titre("Emettre une facture");
@@ -271,6 +278,11 @@ else
     $sql = "SELECT s.nom as socnom, s.idp as socidp, f.facnumber, f.amount, f.total, ".$db->pdate("f.datef")." as df, f.paye, f.fk_statut as statut, f.fk_user_author, f.note";
     $sql .= " FROM societe as s,llx_facture as f WHERE f.fk_soc = s.idp AND f.rowid = $facid";
 
+    if ($user->societe_id > 0) 
+      {
+	$sql .= " AND s.idp = ".$user->societe_id;
+      }
+
     $result = $db->query( $sql);
   
     if ($result)
@@ -287,6 +299,9 @@ else
 	print $db->error();
       }
 
+    if ($num > 0)
+      {
+
 	$soc = new Societe($db, $obj->socidp);
 
 	$author = new User($db);
@@ -333,7 +348,8 @@ else
 	$sql .= " FROM llx_paiement as p, c_paiement as c WHERE p.fk_facture = $facid AND p.fk_paiement = c.id";
 	
 	$result = $db->query($sql);
-    if ($result) {
+	if ($result)
+	  {
 	    $num = $db->num_rows();
 	    $i = 0; $total = 0;
 	    print "<p><b>Paiements</b>";
@@ -345,7 +361,8 @@ else
 	    print "</TR>\n";
     
 	    $var=True;
-      while ($i < $num) {
+	    while ($i < $num)
+	      {
 		$objp = $db->fetch_object( $i);
 		$var=!$var;
 		print "<TR $bc[$var]>";
@@ -357,7 +374,8 @@ else
 		$i++;
 	      }
 
-      if ($obj->paye == 0) {
+	    if ($obj->paye == 0)
+	      {
 		print "<tr><td colspan=\"2\" align=\"right\">Total :</td><td align=\"right\"><b>".price($total)."</b></td><td>$_MONNAIE</td></tr>\n";
 		print "<tr><td colspan=\"2\" align=\"right\">Facturé :</td><td align=\"right\" bgcolor=\"#d0d0d0\">".price($obj->total)."</td><td bgcolor=\"#d0d0d0\">$_MONNAIE</td></tr>\n";
 		
@@ -397,7 +415,8 @@ else
 	    print "</TR>\n";
 	    
 	    $var=True;
-	while ($i < $num) {
+	    while ($i < $num)
+	      {
 		$objp = $db->fetch_object( $i);
 		$var=!$var;
 		print "<TR $bc[$var]>";
@@ -468,7 +487,8 @@ else
 	 * Fin Ajout ligne
 	 *
 	 */
-    
+	if ($user->societe_id == 0)
+	  {
 	    print "<p><TABLE border=\"1\" width=\"100%\" cellspacing=\"0\" cellpadding=\"4\"><tr>";
 	
 	    if ($obj->statut == 0) 
@@ -510,8 +530,9 @@ else
 	      {
 		print "<td align=\"center\" width=\"25%\"><a href=\"facture.php3?facid=$facid&action=pdf\">Générer la facture</a></td>";
 	      }
-    print "</tr></table><p>";
+	    print "</tr></table>";
-
+	  }
+	print "<p>\n";
 	/*
 	 * Documents générés
 	 *
@@ -647,12 +668,6 @@ else
 	    print "</form>";
 	  }
 	
-    /*
-     *
-     *
-     */
-    
-
 	/*
 	 *   Propales
 	 */
@@ -661,9 +676,11 @@ else
 	$sql .= " FROM llx_propal as p, llx_fa_pr as fp WHERE fp.fk_propal = p.rowid AND fp.fk_facture = $facid";
   
 	$result = $db->query($sql);
-    if ($result) {
+	if ($result)
+	  {
 	    $num = $db->num_rows();
-      if ($num) {
+	    if ($num)
+	      {
 		$i = 0; $total = 0;
 		print "<p><b>Proposition(s) commerciale(s) associée(s)</b>";
 		print '<TABLE border="1" width="100%" cellspacing="0" cellpadding="4">';
@@ -674,7 +691,8 @@ else
 		print "</TR>\n";
 		
 		$var=True;
-	while ($i < $num) {
+		while ($i < $num)
+		  {
 		    $objp = $db->fetch_object( $i);
 		    $var=!$var;
 		    print "<TR $bc[$var]>";
@@ -691,11 +709,16 @@ else
 	  } else {
 	    print $db->error();
 	  }	
-
+      }
+    else
+      {
+	/* Facture non trouvée */
+	print "Facture inexistante ou accés refusé";
+      }
   } else {
     /*
      *
-     * Liste
+     * Mode Liste
      *
      *
      */