Fix: security and entity feature in ECM module

htdocs/ecm/ecmdirectory.class.php

@@ -1,6 +1,6 @@
 <?php
 /* Copyright (C) 2007-2008 Laurent Destailleur  <eldy@users.sourceforge.net>
- * Copyright (C) 2008      Regis Houssin        <regis@dolibarr.fr>
+ * Copyright (C) 2008-2009 Regis Houssin        <regis@dolibarr.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -121,6 +121,7 @@ class EcmDirectory // extends CommonObject
 	        // Insert request
 			$sql = "INSERT INTO ".MAIN_DB_PREFIX."ecm_directories(";
 			$sql.= "label,";
+			$sql.= "entity,";
 			$sql.= "fk_parent,";
 			$sql.= "description,";
 			$sql.= "cachenbofdoc,";
@@ -128,6 +129,7 @@ class EcmDirectory // extends CommonObject
 			$sql.= "fk_user_c";
 	        $sql.= ") VALUES (";
 			$sql.= " '".addslashes($this->label)."',";
+			$sql.= " '".$conf->entity."',";
 			$sql.= " '".$this->fk_parent."',";
 			$sql.= " '".addslashes($this->description)."',";
 			$sql.= " ".($this->cachenbofdoc).",";
@@ -196,7 +198,6 @@ class EcmDirectory // extends CommonObject
     	
     	// Update request
     	$sql = "UPDATE ".MAIN_DB_PREFIX."ecm_directories SET";
-        
     	$sql.= " label='".addslashes($this->label)."',";
     	$sql.= " fk_parent='".$this->fk_parent."',";
     	$sql.= " description='".addslashes($this->description)."'";
@@ -245,7 +246,6 @@ class EcmDirectory // extends CommonObject
     	
     	// Update request
     	$sql = "UPDATE ".MAIN_DB_PREFIX."ecm_directories SET";
-        
     	$sql.= " cachenbofdoc = cachenbofdoc ".$sign." 1";
       $sql.= " WHERE rowid = ".$this->id;
 
@@ -439,12 +439,15 @@ class EcmDirectory // extends CommonObject
 	*/
 	function load_motherof()
 	{
+		global $conf;
+		
 		$this->motherof=array();
 		
 		// Charge tableau des meres
 		$sql = "SELECT fk_parent as id_parent, rowid as id_son";
 		$sql.= " FROM ".MAIN_DB_PREFIX."ecm_directories";
 		$sql.= " WHERE fk_parent != 0";
+		$sql.= " AND entity = ".$conf->entity;
 		
 		dol_syslog("EcmDirectory::get_full_arbo sql=".$sql);
 		$resql = $this->db->query($sql);
@@ -465,8 +468,8 @@ class EcmDirectory // extends CommonObject
 		
 
 	/**
-	* 	\brief		Reconstruit l'arborescence des cat<EFBFBD>gories sous la forme d'un tableau
+	* 	\brief		Reconstruit l'arborescence des categories sous la forme d'un tableau
-	*				Renvoi un tableau de tableau('id','id_mere',...) tri<EFBFBD> selon
+	*				Renvoi un tableau de tableau('id','id_mere',...) trie selon
 	*				arbre et avec:
 	*				id = id de la categorie
 	*				id_mere = id de la categorie mere
@@ -484,6 +487,8 @@ class EcmDirectory // extends CommonObject
 	*/
 	function get_full_arbo($force=0)
 	{
+		global $conf;
+		
 		if (empty($force) && $this->full_arbo_loaded)
 		{
 			return $this->cats;
@@ -499,10 +504,12 @@ class EcmDirectory // extends CommonObject
 		$sql.= " c.date_c,";
 		$sql.= " u.login as login_c,";
 		$sql.= " ca.rowid as rowid_fille";
-		$sql.= " FROM ".MAIN_DB_PREFIX."user as u, ".MAIN_DB_PREFIX."ecm_directories as c";
+		$sql.= " FROM ".MAIN_DB_PREFIX."user as u";
+		$sql.= ", ".MAIN_DB_PREFIX."ecm_directories as c";
 		$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."ecm_directories as ca";
 		$sql.= " ON c.rowid = ca.fk_parent";
 		$sql.= " WHERE c.fk_user_c = u.rowid";
+		$sql.= " AND c.entity = ".$conf->entity;
 		$sql.= " ORDER BY c.label, c.rowid";
 
 		dol_syslog("EcmDirectory::get_full_arbo sql=".$sql);
@@ -560,7 +567,7 @@ class EcmDirectory // extends CommonObject
 	}
 	
 	/**
-	*	\brief		Calcule les propri<EFBFBD>t<EFBFBD>s fullpath et fulllabel d'une categorie
+	*	\brief		Calcule les proprietes fullpath et fulllabel d'une categorie
 	*				du tableau this->cats et de toutes ces enfants
 	* 	\param		id_categ		id_categ entry to update
 	* 	\param		protection		Deep counter to avoid infinite loop

htdocs/ecm/index.php

@@ -1,5 +1,6 @@
 <?php
 /* Copyright (C) 2008-2009 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2008-2009 Regis Houssin        <regis@dolibarr.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

htdocs/ecm/search.php

@@ -1,5 +1,6 @@
 <?php
 /* Copyright (C) 2008-2009 Laurent Destailleur  <eldy@users.sourceforge.net>
+ * Copyright (C) 2008-2009 Regis Houssin        <regis@dolibarr.fr>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,6 +42,10 @@ $langs->load("propal");
 $langs->load("bills");
 $langs->load("contracts");
 
+// Security check
+if ($user->societe_id) $socid=$user->societe_id;
+$result = restrictedArea($user, 'ecm','');
+
 // Load permissions
 $user->getrights('ecm');
 

mysql/migration/2.6.0-2.7.0.sql

@@ -20,6 +20,7 @@ ALTER TABLE llx_tva ADD COLUMN entity integer DEFAULT 1 NOT NULL AFTER label;
 ALTER TABLE llx_bank_account ADD COLUMN entity integer DEFAULT 1 NOT NULL AFTER label;
 ALTER TABLE llx_document_model ADD COLUMN entity integer DEFAULT 1 NOT NULL AFTER nom;
 ALTER TABLE llx_menu ADD COLUMN entity integer DEFAULT 1 NOT NULL AFTER menu_handler;
+ALTER TABLE llx_ecm_directories ADD COLUMN entity integer DEFAULT 1 NOT NULL AFTER label;
 
 ALTER TABLE llx_rights_def DROP PRIMARY KEY;
 ALTER TABLE llx_user_param DROP INDEX fk_user;

mysql/tables/llx_ecm_directories.sql

@@ -1,5 +1,6 @@
 -- ===================================================================
 -- Copyright (C) 2008 Laurent Destailleur  <eldy@users.sourceforge.net>
+-- Copyright (C) 2009 Regis Houssin        <regis@dolibarr.fr>
 --
 -- This program is free software; you can redistribute it and/or modify
 -- it under the terms of the GNU General Public License as published by
@@ -24,6 +25,7 @@ create table llx_ecm_directories
 (
   rowid           integer AUTO_INCREMENT PRIMARY KEY,
   label           varchar(32) NOT NULL,
+  entity          integer DEFAULT 1 NOT NULL,	-- multi company id
   fk_parent       integer,
   description     varchar(255) NOT NULL,
   cachenbofdoc    integer NOT NULL DEFAULT 0,
@@ -32,3 +34,11 @@ create table llx_ecm_directories
   fk_user_c		  integer,
   fk_user_m		  integer
 ) type=innodb;
+
+-- 
+-- List of codes for the field entity
+--
+-- 1 : first company ecm directories
+-- 2 : second company ecm directories
+-- 3 : etc...
+--