lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: permission check in invoice webservice

Browse Source 
remove comment & indent code
This commit is contained in:
jfefe 2013-09-09 17:05:58 +02:00
parent afe58abdcd
commit 13e235ca8a
1 changed files with 67 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/webservices/server_invoice.php
View File

@ -330,9 +330,6 @@ function getInvoice($authentication,$id='',$ref='',$ref_ext='')
'close_code' => $invoice->close_code?$invoice->close_code:'', 'close_code' => $invoice->close_code?$invoice->close_code:'',
'close_note' => $invoice->close_note?$invoice->close_note:'', 'close_note' => $invoice->close_note?$invoice->close_note:'',
'lines' => $linesresp 'lines' => $linesresp
// 'lines' => array('0'=>array('id'=>222,'type'=>1),
// '1'=>array('id'=>333,'type'=>1))
)); ));
} }
else else
@ -393,10 +390,6 @@ function getInvoicesForThirdParty($authentication,$idthirdparty)
$sql.='SELECT f.rowid as facid, facnumber as ref, ref_ext, type, fk_statut as status, total_ttc, total, tva'; $sql.='SELECT f.rowid as facid, facnumber as ref, ref_ext, type, fk_statut as status, total_ttc, total, tva';
$sql.=' FROM '.MAIN_DB_PREFIX.'facture as f'; $sql.=' FROM '.MAIN_DB_PREFIX.'facture as f';
//$sql.=', '.MAIN_DB_PREFIX.'societe as s';
//$sql.= ' LEFT JOIN '.MAIN_DB_PREFIX.'product as p ON pt.fk_product = p.rowid';
//$sql.=" WHERE f.fk_soc = s.rowid AND nom = '".$db->escape($idthirdparty)."'";
//$sql.=" WHERE f.fk_soc = s.rowid AND nom = '".$db->escape($idthirdparty)."'";
$sql.=" WHERE f.entity = ".$conf->entity; $sql.=" WHERE f.entity = ".$conf->entity;
if ($idthirdparty != 'all' ) $sql.=" AND f.fk_soc = ".$db->escape($idthirdparty); if ($idthirdparty != 'all' ) $sql.=" AND f.fk_soc = ".$db->escape($idthirdparty);
@ -414,12 +407,14 @@ function getInvoicesForThirdParty($authentication,$idthirdparty)
$invoice->fetch($obj->facid); $invoice->fetch($obj->facid);
// Sécurité pour utilisateur externe // Sécurité pour utilisateur externe
if( $socid && ( $socid != $order->socid) ) if( $socid && ( $socid != $invoice->socid) )
{ {
$error++; $error++;
$errorcode='PERMISSION_DENIED'; $errorlabel=$order->socid.' User does not have permission for this request'; $errorcode='PERMISSION_DENIED'; $errorlabel=$invoice->socid.' User does not have permission for this request';
} }
if(!$error)
{
// Define lines of invoice // Define lines of invoice
$linesresp=array(); $linesresp=array();
foreach($invoice->lines as $line) foreach($invoice->lines as $line)
@ -461,6 +456,7 @@ function getInvoicesForThirdParty($authentication,$idthirdparty)
'close_note' => $invoice->close_note?$invoice->close_note:'', 'close_note' => $invoice->close_note?$invoice->close_note:'',
'lines' => $linesresp 'lines' => $linesresp
); );
}
$i++; $i++;
} }