lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

amlioration de la scurit

Browse Source
This commit is contained in:
Regis Houssin 2006-03-10 17:32:47 +00:00
parent 8bb656a475
commit 1df49664a3
5 changed files with 107 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
htdocs/compta/fiche.php
View File

@ -37,13 +37,29 @@ if ($conf->facture->enabled) $langs->load("bills");
if ($conf->projet->enabled) $langs->load("projects");
// Sécurité accés client
$socid = $_GET["socid"];
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden();
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socidp && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE fk_soc = ".$socidp." AND fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
$user->getrights('facture');

25
htdocs/docsoc.php
View File

@ -34,7 +34,30 @@ $langs->load('other');
$mesg = "";
$socid=$_GET["socid"];
// Sécurité accés client
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden();
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socidp && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE fk_soc = ".$socidp." AND fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
/*

24
htdocs/societe/info.php
View File

@ -32,6 +32,30 @@ require_once (DOL_DOCUMENT_ROOT."/societe.class.php");
$langs->load("companies");
$langs->load("other");
// Sécurité accés client
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden();
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socidp && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE fk_soc = ".$socidp." AND fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader();

21
htdocs/societe/notify/fiche.php
View File

@ -32,12 +32,29 @@ require("pre.inc.php");
$langs->load("companies");
// Sécurité accés client
$socid = $_GET["socid"];
if ($user->societe_id > 0)
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden();
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socidp && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE fk_soc = ".$socidp." AND fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
$sortorder=$_GET["sortorder"];
$sortfield=$_GET["sortfield"];
if (! $sortorder) $sortorder="ASC";

23
htdocs/socnote.php
View File

@ -31,6 +31,29 @@ require("./pre.inc.php");
$langs->load("companies");
// Protection quand utilisateur externe
$socidp = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socidp == '') accessforbidden();
if ($user->societe_id > 0)
{
$socidp = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socidp && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE fk_soc = ".$socidp." AND fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
if ($_POST["action"] == 'add') {
$sql = "UPDATE ".MAIN_DB_PREFIX."societe SET note='".addslashes($_POST["note"])."' WHERE idp=".$_POST["socid"];