lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Debug v18

Browse Source
This commit is contained in:
Laurent Destailleur 2023-03-27 10:00:12 +02:00
parent 92b11c240f
commit 1e94959042
6 changed files with 28 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/comm/action/card.php
View File

@ -32,7 +32,6 @@
// Load Dolibarr environment
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formactions.class.php';
@ -154,7 +153,7 @@ if (!empty($conf->global->AGENDA_REMINDER_EMAIL)) {
$TDurationTypes = array('y'=>$langs->trans('Years'), 'm'=>$langs->trans('Month'), 'w'=>$langs->trans('Weeks'), 'd'=>$langs->trans('Days'), 'h'=>$langs->trans('Hours'), 'i'=>$langs->trans('Minutes'));
$result = restrictedArea($user, 'agenda', $object->id, 'actioncomm&societe', 'myactions|allactions', 'fk_soc', 'id');
$result = restrictedArea($user, 'agenda', $object, 'actioncomm&societe', 'myactions|allactions', 'fk_soc', 'id');
$usercancreate = $user->hasRight('agenda', 'allactions', 'create') || (($object->authorid == $user->id || $object->userownerid == $user->id) && $user->rights->agenda->myactions->create);

10
htdocs/core/ajax/ajaxtooltip.php
View File

@ -1,5 +1,5 @@
<?php
/* Copyright (C) 2007-2018 Laurent Destailleur <eldy@users.sourceforge.net>
/* Copyright (C) 2007-2023 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2018-2023 Frédéric France <frederic.france@netlogic.fr>
*
* This program is free software; you can redistribute it and/or modify
@ -22,7 +22,6 @@
* \brief This script returns content of tooltip
*/
if (!defined('NOTOKENRENEWAL')) {
define('NOTOKENRENEWAL', 1); // Disables token renewal
}
@ -41,7 +40,7 @@ include_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php';
$id = GETPOST('id', 'aZ09');
$objecttype = GETPOST('objecttype', 'aZ09'); // 'module' or 'myobject@mymodule', 'mymodule_myobject'
$objecttype = GETPOST('objecttype', 'aZ09arobase'); // 'module' or 'myobject@mymodule', 'mymodule_myobject'
$params = array();
if (GETPOSTISSET('infologin')) {
@ -53,6 +52,9 @@ if (GETPOSTISSET('option')) {
// Load object according to $element
$object = fetchObjectByElement($id, $objecttype);
if (empty($object->element)) {
httponly_accessforbidden('Failed to get object from objecttype='.$objecttype.' id='.$id);
}
$module = $object->module;
$element = $object->element;
@ -62,6 +64,8 @@ if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // The
$usesublevelpermission = '';
}
//print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n";
// Security check
restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission);

9
htdocs/core/lib/functions.lib.php
View File

@ -536,6 +536,7 @@ function GETPOSTISARRAY($paramname, $method = 0)
* 'alphanohtml'=check there is no html content and no " and no ../
* 'aZ'=check it's a-z only
* 'aZ09'=check it's simple alpha string (recommended for keys)
* 'aZ09arobase'=check it's a string for an element type
* 'aZ09comma'=check it's a string for a sortfield or sortorder
* 'san_alpha'=Use filter_var with FILTER_SANITIZE_STRING (do not use this for free text string)
* 'nohtml'=check there is no html content
@ -935,6 +936,14 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
}
}
break;
case 'aZ09arobase': // great to sanitize objecttype parameter
if (!is_array($out)) {
$out = trim($out);
if (preg_match('/[^a-z0-9_\-\.@]+/i', $out)) {
$out = '';
}
}
break;
case 'aZ09comma': // great to sanitize sortfield or sortorder params that can be t.abc,t.def_gh
if (!is_array($out)) {
$out = trim($out);

10
htdocs/core/lib/security.lib.php
View File

@ -340,7 +340,7 @@ function dolGetLdapPasswordHash($password, $type = 'md5')
* @param string $feature2 Feature to check, second level of permission (optional). Can be a 'or' check with 'sublevela|sublevelb'.
* This is used to check permission $user->rights->features->feature2...
* @param string $dbt_keyfield Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA.
* @param string $dbt_select Field name for select if not "rowid". Not used if objectid is null (optional)
* @param string $dbt_select Field rowid name, for select into tableandshare if not "rowid". Not used if objectid is null (optional)
* @param int $isdraft 1=The object with id=$objectid is a draft
* @param int $mode Mode (0=default, 1=return without dieing)
* @return int If mode = 0 (default): Always 1, die process if not allowed. If mode = 1: Return 0 if access not allowed.
@ -351,6 +351,7 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '',
global $db, $conf;
global $hookmanager;
// Define $objectid
if (is_object($object)) {
$objectid = $object->id;
} else {
@ -369,6 +370,11 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '',
// Fix syntax of $features param
$originalfeatures = $features;
if ($features == 'agenda') {
$tableandshare = 'actioncomm&societe';
$feature2 = 'myactions|allactions';
$dbt_select = 'id';
}
if ($features == 'facturerec') {
$features = 'facture';
}
@ -403,6 +409,8 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '',
}
}
//print $features.' - '.$tableandshare.' - '.$feature2.' - '.$dbt_select."\n";
// Get more permissions checks from hooks
$parameters = array('features'=>$features, 'originalfeatures'=>$originalfeatures, 'objectid'=>$objectid, 'dbt_select'=>$dbt_select, 'idtype'=>$dbt_select, 'isdraft'=>$isdraft);
$reshook = $hookmanager->executeHooks('restrictedArea', $parameters);

2
htdocs/knowledgemanagement/class/knowledgerecord.class.php
View File

@ -770,7 +770,7 @@ class KnowledgeRecord extends CommonObject
$params = [
'id' => $this->id,
'objecttype' => $this->element,
'objecttype' => $this->element.($this->module ? '@'.$this->module : ''),
'option' => $option,
'nofetch' => 1,
];

2
htdocs/modulebuilder/template/class/myobject.class.php
View File

@ -796,7 +796,7 @@ class MyObject extends CommonObject
$result = '';
$params = [
'id' => $this->id,
'objecttype' => $this->element,
'objecttype' => $this->element.($this->module ? '@'.$this->module : ''),
'option' => $option,
];
$classfortooltip = 'classfortooltip';