Fix: Third party emails must not be visible into notification page

htdocs/core/class/html.formmail.class.php

@@ -630,6 +630,58 @@ class FormMail
 
         return $out;
     }
+
+
+    /**
+     *    \brief  Affiche la partie de formulaire pour saisie d'un mail
+     *    \param  withtopic   1 pour proposer a la saisie le sujet
+     *    \param  withbody    1 pour proposer a la saisie le corps du message
+     *    \param  withfile    1 pour proposer a la saisie l'ajout d'un fichier joint
+     *    \todo   Fonction a virer quand fichier /comm/mailing.php vire (= quand ecran dans /comm/mailing prets)
+     */
+    function mail_topicmessagefile($withtopic=1,$withbody=1,$withfile=1,$defaultbody)
+    {
+        global $langs;
+
+        $langs->load("other");
+
+        print "<table class=\"border\" width=\"100%\">";
+
+        // Topic
+        if ($withtopic)
+        {
+            print "<tr>";
+            print "<td width=\"180\">".$langs->trans("MailTopic")."</td>";
+            print "<td>";
+            print "<input type=\"text\" size=\"60\" name=\"subject\" value=\"\">";
+            print "</td></tr>";
+        }
+
+        // Message
+        if ($withbody)
+        {
+            print "<tr>";
+            print "<td width=\"180\" valign=\"top\">".$langs->trans("MailText")."</td>";
+            print "<td>";
+            print "<textarea rows=\"8\" cols=\"72\" name=\"message\">";
+            print $defaultbody;
+            print "</textarea>";
+            print "</td></tr>";
+        }
+
+        // Si fichier joint
+        if ($withfile)
+        {
+            print "<tr>";
+            print "<td width=\"180\">".$langs->trans("MailFile")."</td>";
+            print "<td>";
+            print "<input type=\"file\" name=\"addedfile\" value=\"".$langs->trans("Upload")."\"/>";
+            print "</td></tr>";
+        }
+
+        print "</table>";
+    }
+
 }
 
 ?>

htdocs/societe/notify/fiche.php

@@ -52,8 +52,6 @@ $pagenext = $page + 1;
 if (! $sortorder) $sortorder="ASC";
 if (! $sortfield) $sortfield="c.name";
 
-$now=dol_now();
-
 
 /*
  * Actions
@@ -62,29 +60,12 @@ $now=dol_now();
 // Add a notification
 if ($action == 'add')
 {
-    $error=0;
-
-    if (empty($contactid))
-    {
-        $mesg='<div class="error">'.$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("Contact")).'</div>';
-        $error++;
-    }
-    if ($actionid <= 0)
-    {
-        $mesg='<div class="error">'.$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("Action")).'</div>';
-        $error++;
-    }
-
-    if (! $error)
-    {
-        $db->begin();
-
 	$sql = "DELETE FROM ".MAIN_DB_PREFIX."notify_def";
-        $sql .= " WHERE fk_soc=".$socid." AND fk_contact=".$contactid." AND fk_action=".$actionid;
+	$sql .= " WHERE fk_soc=".$socid." AND fk_contact=".$_POST["contactid"]." AND fk_action=".$_POST["actionid"];
 	if ($db->query($sql))
 	{
 		$sql = "INSERT INTO ".MAIN_DB_PREFIX."notify_def (datec,fk_soc, fk_contact, fk_action)";
-            $sql .= " VALUES ('".$db->idate($now)."',".$socid.",".$contactid.",".$actionid.")";
+		$sql .= " VALUES (".$db->idate(mktime()).",".$socid.",".$_POST["contactid"].",".$_POST["actionid"].")";
 
 		if ($db->query($sql))
 		{
@@ -92,7 +73,6 @@ if ($action == 'add')
 		}
 		else
 		{
-                $error++;
 			dol_print_error($db);
 		}
 	}
@@ -100,16 +80,6 @@ if ($action == 'add')
 	{
 		dol_print_error($db);
 	}
-
-        if (! $error)
-        {
-            $db->commit();
-        }
-        else
-        {
-            $db->rollback();
-        }
-    }
 }
 
 // Remove a notification
@@ -129,8 +99,8 @@ $form = new Form($db);
 
 llxHeader();
 
-$object = new Societe($db);
+$soc = new Societe($db);
-$result=$object->fetch($socid);
+$result=$soc->fetch($socid);
 
 if ($result > 0)
 {
@@ -138,7 +108,7 @@ if ($result > 0)
 	$langs->load("other");
 
 
-    $head = societe_prepare_head($object);
+	$head = societe_prepare_head($soc);
 
 	dol_fiche_head($head, 'notify', $langs->trans("ThirdParty"),0,'company');
 
@@ -146,38 +116,14 @@ if ($result > 0)
 	print '<table class="border"width="100%">';
 
 	print '<tr><td width="20%">'.$langs->trans("ThirdPartyName").'</td><td colspan="3">';
-    print $form->showrefnav($object,'socid','',($user->societe_id?0:1),'rowid','nom');
+	print $form->showrefnav($soc,'socid','',($user->societe_id?0:1),'rowid','nom');
 	print '</td></tr>';
 
-    // Prefix
-    if (! empty($conf->global->SOCIETE_USEPREFIX))  // Old not used prefix field
-    {
-        print '<tr><td>'.$langs->trans('Prefix').'</td><td colspan="3">'.$object->prefix_comm.'</td></tr>';
-    }
-
-    if ($object->client)
-    {
-        print '<tr><td>';
-        print $langs->trans('CustomerCode').'</td><td colspan="3">';
-        print $object->code_client;
-        if ($object->check_codeclient() <> 0) print ' <font class="error">('.$langs->trans("WrongCustomerCode").')</font>';
-        print '</td></tr>';
-    }
-
-    if ($object->fournisseur)
-    {
-        print '<tr><td>';
-        print $langs->trans('SupplierCode').'</td><td colspan="3">';
-        print $object->code_fournisseur;
-        if ($object->check_codefournisseur() <> 0) print ' <font class="error">('.$langs->trans("WrongSupplierCode").')</font>';
-        print '</td></tr>';
-    }
-
 	print '<tr><td width="30%">'.$langs->trans("NbOfActiveNotifications").'</td>';
 	print '<td colspan="3">';
 	$sql = "SELECT COUNT(n.rowid) as nb";
 	$sql.= " FROM ".MAIN_DB_PREFIX."notify_def as n";
-    $sql.= " WHERE fk_soc = ".$object->id;
+	$sql.= " WHERE fk_soc = ".$soc->id;
 	$resql=$db->query($sql);
 	if ($resql)
 	{
@@ -197,11 +143,11 @@ if ($result > 0)
 	print '</td></tr>';
 	print '</table>';
 
+	print '</div>';
+
+
 	// Help
-    print '<br>'.$langs->trans("NotificationsDesc").'<br>';
+	print $langs->trans("NotificationsDesc").'<br><br>';
-
-
-    dol_fiche_end();
 
 
 	print "\n";
@@ -211,13 +157,11 @@ if ($result > 0)
 
 	print '<form action="fiche.php?socid='.$socid.'" method="post">';
 	print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
-    print '<input type="hidden" name="action" value="add">';
-
-    $param="&socid=".$socid;
 
 	// Line with titles
 	print '<table width="100%" class="noborder">';
 	print '<tr class="liste_titre">';
+	$param="&socid=".$socid;
 	print_liste_field_titre($langs->trans("Contact"),"fiche.php","c.name",'',$param,'"width="45%"',$sortfield,$sortorder);
 	print_liste_field_titre($langs->trans("Action"),"fiche.php","a.titre",'',$param,'"width="35%"',$sortfield,$sortorder);
     print_liste_field_titre($langs->trans("Type"),"fiche.php","",'',$param,'"width="10%"',$sortfield,$sortorder);
@@ -225,7 +169,7 @@ if ($result > 0)
 	print '</tr>';
 
 	$var=false;
-    $listofemails=$object->thirdparty_and_contact_email_array();
+	$listofemails=$soc->thirdparty_and_contact_email_array();
 	if (count($listofemails) > 0)
 	{
 	    $actions=array();
@@ -239,6 +183,7 @@ if ($result > 0)
             $label=$langs->trans("Notify_".$notifiedevent['code'])!=$langs->trans("Notify_".$notifiedevent['code'])?$langs->trans("Notify_".$notifiedevent['code']):$notifiedevent['label'];
             $actions[$notifiedevent['rowid']]=$label;
         }
+		print '<input type="hidden" name="action" value="add">';
 		print '<tr '.$bc[$var].'><td>';
 		print $html->selectarray("contactid",$listofemails);
 		print '</td>';
@@ -264,7 +209,6 @@ if ($result > 0)
 	print '</form>';
 	print '<br>';
 
-    dol_htmloutput_mesg($mesg);
 
 	// List of active notifications
 	print_fiche_titre($langs->trans("ListOfActiveNotifications"),'','');
@@ -288,7 +232,7 @@ if ($result > 0)
 	$sql.= " ".MAIN_DB_PREFIX."socpeople c";
 	$sql.= " WHERE a.rowid = n.fk_action";
 	$sql.= " AND c.rowid = n.fk_contact";
-    $sql.= " AND c.fk_soc = ".$object->id;
+	$sql.= " AND c.fk_soc = ".$soc->id;
 
 	$resql=$db->query($sql);
 	if ($resql)
@@ -351,9 +295,9 @@ if ($result > 0)
 	// Line with titles
 	print '<table width="100%" class="noborder">';
 	print '<tr class="liste_titre">';
-    print_liste_field_titre($langs->trans("Contact"),"fiche.php","c.name",'',$param,'',$sortfield,$sortorder);
+	print_liste_field_titre($langs->trans("Contact"),"fiche.php","c.name",'',"&socid=$socid",'',$sortfield,$sortorder);
-    print_liste_field_titre($langs->trans("Action"),"fiche.php","a.titre",'',$param,'',$sortfield,$sortorder);
+	print_liste_field_titre($langs->trans("Action"),"fiche.php","a.titre",'',"&socid=$socid",'',$sortfield,$sortorder);
-    print_liste_field_titre($langs->trans("Date"),"fiche.php","a.daten",'',$param,'align="right"',$sortfield,$sortorder);
+	print_liste_field_titre($langs->trans("Date"),"fiche.php","a.titre",'',"&socid=$socid",'align="right"',$sortfield,$sortorder);
 	print '</tr>';
 
 	// List
@@ -365,7 +309,7 @@ if ($result > 0)
     $sql.= " ".MAIN_DB_PREFIX."socpeople as c";
     $sql.= " WHERE a.rowid = n.fk_action";
     $sql.= " AND c.rowid = n.fk_contact";
-    $sql.= " AND c.fk_soc = ".$object->id;
+    $sql.= " AND c.fk_soc = ".$soc->id;
 
 	$resql=$db->query($sql);
 	if ($resql)