lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: best compatibility with multicompany and others security issue

Browse Source
This commit is contained in:
Regis Houssin 2016-03-03 08:41:39 +01:00
parent 215b24df54
commit 25686e82c9
6 changed files with 142 additions and 124 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

132
htdocs/holiday/card.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com> /* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com>
* Copyright (C) 2012-2015 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2012-2015 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2012 Regis Houssin <regis.houssin@capnetworks.com> * Copyright (C) 2012-2016 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es> * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es> * Copyright (C) 2014 Ferran Marcet <fmarcet@2byte.es>
* *
@ -95,19 +95,19 @@ if ($action == 'create')
// If no start date // If no start date
if (empty($date_debut)) if (empty($date_debut))
{ {
header('Location: card.php?action=request&error=nodatedebut'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=nodatedebut');
exit; exit;
} }
// If no end date // If no end date
if (empty($date_fin)) if (empty($date_fin))
{ {
header('Location: card.php?action=request&error=nodatefin'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=nodatefin');
exit; exit;
} }
// If start date after end date // If start date after end date
if ($date_debut > $date_fin) if ($date_debut > $date_fin)
{ {
header('Location: card.php?action=request&error=datefin'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=datefin');
exit; exit;
} }
@ -115,7 +115,7 @@ if ($action == 'create')
$verifCP = $cp->verifDateHolidayCP($userID, $date_debut, $date_fin, $halfday); $verifCP = $cp->verifDateHolidayCP($userID, $date_debut, $date_fin, $halfday);
if (! $verifCP) if (! $verifCP)
{ {
header('Location: card.php?action=request&error=alreadyCP'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=alreadyCP');
exit; exit;
} }
@ -123,7 +123,7 @@ if ($action == 'create')
$nbopenedday=num_open_day($date_debut_gmt, $date_fin_gmt, 0, 1, $halfday); $nbopenedday=num_open_day($date_debut_gmt, $date_fin_gmt, 0, 1, $halfday);
if($nbopenedday < 0.5) if($nbopenedday < 0.5)
{ {
header('Location: card.php?action=request&error=DureeHoliday'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=DureeHoliday');
exit; exit;
} }
@ -156,7 +156,7 @@ if ($action == 'create')
{ {
$db->commit(); $db->commit();
header('Location: card.php?id='.$result); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
else else
@ -182,12 +182,12 @@ if ($action == 'update')
// If no right to modify a request // If no right to modify a request
if (! $user->rights->holiday->write) if (! $user->rights->holiday->write)
{ {
header('Location: card.php?action=request&error=CantUpdate'); header('Location: '.$_SERVER["PHP_SELF"].'?action=request&error=CantUpdate');
exit; exit;
} }
$cp = new Holiday($db); $cp = new Holiday($db);
$cp->fetch($_POST['holiday_id']); $cp->fetch($id);
$canedit=(($user->id == $cp->fk_user && $user->rights->holiday->write) || ($user->id != $cp->fk_user && $user->rights->holiday->write_all)); $canedit=(($user->id == $cp->fk_user && $user->rights->holiday->write) || ($user->id != $cp->fk_user && $user->rights->holiday->write_all));
@ -202,25 +202,25 @@ if ($action == 'update')
// If no start date // If no start date
if (empty($_POST['date_debut_'])) { if (empty($_POST['date_debut_'])) {
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=nodatedebut'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=nodatedebut');
exit; exit;
} }
// If no end date // If no end date
if (empty($_POST['date_fin_'])) { if (empty($_POST['date_fin_'])) {
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=nodatefin'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=nodatefin');
exit; exit;
} }
// If start date after end date // If start date after end date
if ($date_debut > $date_fin) { if ($date_debut > $date_fin) {
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=datefin'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=datefin');
exit; exit;
} }
// If no validator designated // If no validator designated
if ($valideur < 1) { if ($valideur < 1) {
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=Valideur'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=Valideur');
exit; exit;
} }
@ -228,7 +228,7 @@ if ($action == 'update')
$nbopenedday=num_open_day($date_debut_gmt, $date_fin_gmt, 0, 1, $halfday); $nbopenedday=num_open_day($date_debut_gmt, $date_fin_gmt, 0, 1, $halfday);
if ($nbopenedday < 0.5) if ($nbopenedday < 0.5)
{ {
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=DureeHoliday'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=DureeHoliday');
exit; exit;
} }
@ -242,18 +242,18 @@ if ($action == 'update')
$verif = $cp->update($user->id); $verif = $cp->update($user->id);
if ($verif > 0) if ($verif > 0)
{ {
header('Location: card.php?id='.$_POST['holiday_id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
else else
{ {
// Otherwise we display the request form with the SQL error message // Otherwise we display the request form with the SQL error message
header('Location: card.php?id='.$_POST['holiday_id'].'&action=edit&error=SQL_Create&msg='.$cp->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit&error=SQL_Create&msg='.$cp->error);
exit; exit;
} }
} }
} else { } else {
header('Location: card.php?id='.$_POST['holiday_id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
} }
@ -276,7 +276,7 @@ if ($action == 'confirm_delete' && GETPOST('confirm') == 'yes' && $user->rights-
// Si l'utilisateur à le droit de lire cette demande, il peut la supprimer // Si l'utilisateur à le droit de lire cette demande, il peut la supprimer
if ($canedit) if ($canedit)
{ {
$result=$cp->delete($id); $result=$cp->delete($cp->id);
} }
else else
{ {
@ -321,7 +321,7 @@ if ($action == 'confirm_send')
if (!$emailTo) if (!$emailTo)
{ {
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
@ -370,7 +370,7 @@ if ($action == 'confirm_send')
$message.= "\n"; $message.= "\n";
$message.= "- ".$langs->transnoentitiesnoconv("Name")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n"; $message.= "- ".$langs->transnoentitiesnoconv("Name")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n";
$message.= "- ".$langs->transnoentitiesnoconv("Period")." : ".dol_print_date($cp->date_debut,'day')." ".$langs->transnoentitiesnoconv("To")." ".dol_print_date($cp->date_fin,'day')."\n"; $message.= "- ".$langs->transnoentitiesnoconv("Period")." : ".dol_print_date($cp->date_debut,'day')." ".$langs->transnoentitiesnoconv("To")." ".dol_print_date($cp->date_fin,'day')."\n";
$message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->rowid."\n\n"; $message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->id."\n\n";
$message.= "\n"; $message.= "\n";
$mail = new CMailFile($subject,$emailTo,$emailFrom,$message); $mail = new CMailFile($subject,$emailTo,$emailFrom,$message);
@ -380,16 +380,16 @@ if ($action == 'confirm_send')
if (!$result) if (!$result)
{ {
header('Location: card.php?id='.$_GET['id'].'&error=mail&error_content='.$mail->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=mail&error_content='.$mail->error);
exit; exit;
} }
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
else else
{ {
// Sinon on affiche le formulaire de demande avec le message d'erreur SQL // Sinon on affiche le formulaire de demande avec le message d'erreur SQL
header('Location: card.php?id='.$_GET['id'].'&error=SQL_Create&msg='.$cp->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=SQL_Create&msg='.$cp->error);
exit; exit;
} }
} }
@ -433,7 +433,7 @@ if ($action == 'confirm_valid')
if (!$emailTo) if (!$emailTo)
{ {
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
@ -455,7 +455,7 @@ if ($action == 'confirm_valid')
$message.= "- ".$langs->transnoentitiesnoconv("ValidatedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n"; $message.= "- ".$langs->transnoentitiesnoconv("ValidatedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n";
$message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->rowid."\n\n"; $message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->id."\n\n";
$message.= "\n"; $message.= "\n";
$mail = new CMailFile($subject,$emailTo,$emailFrom,$message); $mail = new CMailFile($subject,$emailTo,$emailFrom,$message);
@ -464,15 +464,15 @@ if ($action == 'confirm_valid')
$result=$mail->sendfile(); $result=$mail->sendfile();
if(!$result) { if(!$result) {
header('Location: card.php?id='.$_GET['id'].'&error=mail&error_content='.$mail->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=mail&error_content='.$mail->error);
exit; exit;
} }
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} else { } else {
// Sinon on affiche le formulaire de demande avec le message d'erreur SQL // Sinon on affiche le formulaire de demande avec le message d'erreur SQL
header('Location: card.php?id='.$_GET['id'].'&error=SQL_Create&msg='.$cp->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=SQL_Create&msg='.$cp->error);
exit; exit;
} }
@ -485,7 +485,7 @@ if ($action == 'confirm_refuse')
if (! empty($_POST['detail_refuse'])) if (! empty($_POST['detail_refuse']))
{ {
$cp = new Holiday($db); $cp = new Holiday($db);
$cp->fetch($_GET['id']); $cp->fetch($id);
// Si statut en attente de validation et valideur = utilisateur // Si statut en attente de validation et valideur = utilisateur
if ($cp->statut == 2 && $user->id == $cp->fk_validator) if ($cp->statut == 2 && $user->id == $cp->fk_validator)
@ -507,7 +507,7 @@ if ($action == 'confirm_refuse')
if (!$emailTo) if (!$emailTo)
{ {
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
@ -530,7 +530,7 @@ if ($action == 'confirm_refuse')
$message.= "- ".$langs->transnoentitiesnoconv("ModifiedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n"; $message.= "- ".$langs->transnoentitiesnoconv("ModifiedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n";
$message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->rowid."\n\n"; $message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->id."\n\n";
$message.= "\n"; $message.= "\n";
$mail = new CMailFile($subject,$emailTo,$emailFrom,$message); $mail = new CMailFile($subject,$emailTo,$emailFrom,$message);
@ -539,22 +539,22 @@ if ($action == 'confirm_refuse')
$result=$mail->sendfile(); $result=$mail->sendfile();
if(!$result) { if(!$result) {
header('Location: card.php?id='.$_GET['id'].'&error=mail&error_content='.$mail->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=mail&error_content='.$mail->error);
exit; exit;
} }
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} else { } else {
// Sinon on affiche le formulaire de demande avec le message d'erreur SQL // Sinon on affiche le formulaire de demande avec le message d'erreur SQL
header('Location: card.php?id='.$_GET['id'].'&error=SQL_Create&msg='.$cp->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=SQL_Create&msg='.$cp->error);
exit; exit;
} }
} }
} else { } else {
header('Location: card.php?id='.$_GET['id'].'&error=NoMotifRefuse'); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=NoMotifRefuse');
exit; exit;
} }
} }
@ -563,7 +563,7 @@ if ($action == 'confirm_refuse')
if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes') if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes')
{ {
$cp = new Holiday($db); $cp = new Holiday($db);
$cp->fetch($_GET['id']); $cp->fetch($id);
// Si statut en attente de validation et valideur = utilisateur // Si statut en attente de validation et valideur = utilisateur
if (($cp->statut == 2 || $cp->statut == 3) && ($user->id == $cp->fk_validator || $user->id == $cp->fk_user)) if (($cp->statut == 2 || $cp->statut == 3) && ($user->id == $cp->fk_validator || $user->id == $cp->fk_user))
@ -616,7 +616,7 @@ if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes')
if (!$emailTo) if (!$emailTo)
{ {
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
@ -638,7 +638,7 @@ if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes')
$message.= $langs->transnoentities("HolidaysCanceledBody", dol_print_date($cp->date_debut,'day'), dol_print_date($cp->date_fin,'day'))."\n"; $message.= $langs->transnoentities("HolidaysCanceledBody", dol_print_date($cp->date_debut,'day'), dol_print_date($cp->date_fin,'day'))."\n";
$message.= "- ".$langs->transnoentitiesnoconv("ModifiedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n"; $message.= "- ".$langs->transnoentitiesnoconv("ModifiedBy")." : ".dolGetFirstLastname($expediteur->firstname, $expediteur->lastname)."\n";
$message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->rowid."\n\n"; $message.= "- ".$langs->transnoentitiesnoconv("Link")." : ".$dolibarr_main_url_root."/holiday/card.php?id=".$cp->id."\n\n";
$message.= "\n"; $message.= "\n";
$mail = new CMailFile($subject,$emailTo,$emailFrom,$message); $mail = new CMailFile($subject,$emailTo,$emailFrom,$message);
@ -648,17 +648,17 @@ if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes')
if(!$result) if(!$result)
{ {
header('Location: card.php?id='.$_GET['id'].'&error=mail&error_content='.$mail->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=mail&error_content='.$mail->error);
exit; exit;
} }
header('Location: card.php?id='.$_GET['id']); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id);
exit; exit;
} }
else else
{ {
// Sinon on affiche le formulaire de demande avec le message d'erreur SQL // Sinon on affiche le formulaire de demande avec le message d'erreur SQL
header('Location: card.php?id='.$_GET['id'].'&error=SQL_Create&msg='.$cp->error); header('Location: '.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&error=SQL_Create&msg='.$cp->error);
exit; exit;
} }
@ -852,13 +852,8 @@ if (empty($id) || $action == 'add' || $action == 'request' || $action == 'create
// Approved by // Approved by
print '<tr>'; print '<tr>';
print '<td class="fieldrequired">'.$langs->trans("ReviewedByCP").'</td>'; print '<td class="fieldrequired">'.$langs->trans("ReviewedByCP").'</td>';
$validator = new UserGroup($db);
$excludefilter=$user->admin?'':'u.rowid <> '.$user->id;
$valideurobjects = $validator->listUsersForGroup($excludefilter);
$valideurarray = array();
foreach($valideurobjects as $val) $valideurarray[$val->id]=$val->id;
print '<td>'; print '<td>';
print $form->select_dolusers((GETPOST('valideur')>0?GETPOST('valideur'):$user->fk_user), "valideur", 1, "", 0, $valideurarray, 0, 0, 0, 0, '', 0, '', '', 1); // By default, hierarchical parent print $form->select_dolusers((GETPOST('valideur')>0?GETPOST('valideur'):$user->fk_user), "valideur", 1, ($user->admin ? '' : array($user->id)), 0, '', 0, 0, 0, 0, '', 0, '', '', 1); // By default, hierarchical parent
print '</td>'; print '</td>';
print '</tr>'; print '</tr>';
@ -952,35 +947,35 @@ else
{ {
if ($action == 'delete') if ($action == 'delete')
{ {
if($user->rights->holiday->delete) if ($user->rights->holiday->delete)
{ {
print $form->formconfirm("card.php?id=".$id,$langs->trans("TitleDeleteCP"),$langs->trans("ConfirmDeleteCP"),"confirm_delete", '', 0, 1); print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$cp->id,$langs->trans("TitleDeleteCP"),$langs->trans("ConfirmDeleteCP"),"confirm_delete", '', 0, 1);
} }
} }
// Si envoi en validation // Si envoi en validation
if ($action == 'sendToValidate' && $cp->statut == 1) if ($action == 'sendToValidate' && $cp->statut == 1)
{ {
print $form->formconfirm("card.php?id=".$id,$langs->trans("TitleToValidCP"),$langs->trans("ConfirmToValidCP"),"confirm_send", '', 1, 1); print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$cp->id,$langs->trans("TitleToValidCP"),$langs->trans("ConfirmToValidCP"),"confirm_send", '', 1, 1);
} }
// Si validation de la demande // Si validation de la demande
if ($action == 'valid') if ($action == 'valid')
{ {
print $form->formconfirm("card.php?id=".$id,$langs->trans("TitleValidCP"),$langs->trans("ConfirmValidCP"),"confirm_valid", '', 1, 1); print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$cp->id,$langs->trans("TitleValidCP"),$langs->trans("ConfirmValidCP"),"confirm_valid", '', 1, 1);
} }
// Si refus de la demande // Si refus de la demande
if ($action == 'refuse') if ($action == 'refuse')
{ {
$array_input = array(array('type'=>"text",'label'=> $langs->trans('DetailRefusCP'),'name'=>"detail_refuse",'size'=>"50",'value'=>"")); $array_input = array(array('type'=>"text",'label'=> $langs->trans('DetailRefusCP'),'name'=>"detail_refuse",'size'=>"50",'value'=>""));
print $form->formconfirm("card.php?id=".$id."&action=confirm_refuse", $langs->trans("TitleRefuseCP"), $langs->trans('ConfirmRefuseCP'), "confirm_refuse", $array_input, 1, 0); print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$cp->id."&action=confirm_refuse", $langs->trans("TitleRefuseCP"), $langs->trans('ConfirmRefuseCP'), "confirm_refuse", $array_input, 1, 0);
} }
// Si annulation de la demande // Si annulation de la demande
if ($action == 'cancel') if ($action == 'cancel')
{ {
print $form->formconfirm("card.php?id=".$id,$langs->trans("TitleCancelCP"),$langs->trans("ConfirmCancelCP"),"confirm_cancel", '', 1, 1); print $form->formconfirm($_SERVER["PHP_SELF"]."?id=".$cp->id,$langs->trans("TitleCancelCP"),$langs->trans("ConfirmCancelCP"),"confirm_cancel", '', 1, 1);
} }
$head=holiday_prepare_head($cp); $head=holiday_prepare_head($cp);
@ -989,9 +984,9 @@ else
if ($action == 'edit' && $cp->statut == 1) if ($action == 'edit' && $cp->statut == 1)
{ {
$edit = true; $edit = true;
print '<form method="post" action="'.$_SERVER['PHP_SELF'].'?id='.$id.'">'."\n"; print '<form method="post" action="'.$_SERVER['PHP_SELF'].'?id='.$cp->id.'">'."\n";
print '<input type="hidden" name="action" value="update"/>'."\n"; print '<input type="hidden" name="action" value="update"/>'."\n";
print '<input type="hidden" name="holiday_id" value="'.$id.'" />'."\n"; print '<input type="hidden" name="id" value="'.$cp->id.'" />'."\n";
} }
dol_fiche_head($head,'card',$langs->trans("CPTitreMenu"),0,'holiday'); dol_fiche_head($head,'card',$langs->trans("CPTitreMenu"),0,'holiday');
@ -1132,15 +1127,8 @@ else
} else { } else {
print '<tr>'; print '<tr>';
print '<td width="50%">'.$langs->trans('ReviewedByCP').'</td>'; print '<td width="50%">'.$langs->trans('ReviewedByCP').'</td>';
$validator = new UserGroup($db);
$excludefilter=$user->admin?'':'u.rowid <> '.$user->id;
$valideurobjects = $validator->listUsersForGroup($excludefilter);
$valideurarray = array();
foreach($valideurobjects as $val) $valideurarray[$val->id]=$val->id;
print '<td>'; print '<td>';
print $form->select_dolusers($user->fk_user, "valideur", 1, "", 0, $valideurarray); // By default, hierarchical parent print $form->select_dolusers($cp->fk_user, "valideur", 1, ($user->admin ? '' : array($user->id))); // By default, hierarchical parent
print '</td>'; print '</td>';
print '</tr>'; print '</tr>';
} }
@ -1149,19 +1137,19 @@ else
print '<td>'.$langs->trans('DateCreateCP').'</td>'; print '<td>'.$langs->trans('DateCreateCP').'</td>';
print '<td>'.dol_print_date($cp->date_create,'dayhour').'</td>'; print '<td>'.dol_print_date($cp->date_create,'dayhour').'</td>';
print '</tr>'; print '</tr>';
if($cp->statut == 3) { if ($cp->statut == 3) {
print '<tr>'; print '<tr>';
print '<td>'.$langs->trans('DateValidCP').'</td>'; print '<td>'.$langs->trans('DateValidCP').'</td>';
print '<td>'.dol_print_date($cp->date_valid,'dayhour').'</td>'; print '<td>'.dol_print_date($cp->date_valid,'dayhour').'</td>';
print '</tr>'; print '</tr>';
} }
if($cp->statut == 4) { if ($cp->statut == 4) {
print '<tr>'; print '<tr>';
print '<td>'.$langs->trans('DateCancelCP').'</td>'; print '<td>'.$langs->trans('DateCancelCP').'</td>';
print '<td>'.dol_print_date($cp->date_cancel,'dayhour').'</td>'; print '<td>'.dol_print_date($cp->date_cancel,'dayhour').'</td>';
print '</tr>'; print '</tr>';
} }
if($cp->statut == 5) { if ($cp->statut == 5) {
print '<tr>'; print '<tr>';
print '<td>'.$langs->trans('DateRefusCP').'</td>'; print '<td>'.$langs->trans('DateRefusCP').'</td>';
print '<td>'.dol_print_date($cp->date_refuse,'dayhour').'</td>'; print '<td>'.dol_print_date($cp->date_refuse,'dayhour').'</td>';
@ -1192,26 +1180,26 @@ else
// Boutons d'actions // Boutons d'actions
if ($canedit && $cp->statut == 1) if ($canedit && $cp->statut == 1)
{ {
print '<a href="card.php?id='.$_GET['id'].'&action=edit" class="butAction">'.$langs->trans("EditCP").'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=edit" class="butAction">'.$langs->trans("EditCP").'</a>';
} }
if ($canedit && $cp->statut == 1) if ($canedit && $cp->statut == 1)
{ {
print '<a href="card.php?id='.$_GET['id'].'&action=sendToValidate" class="butAction">'.$langs->trans("Validate").'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=sendToValidate" class="butAction">'.$langs->trans("Validate").'</a>';
} }
if ($user->rights->holiday->delete && $cp->statut == 1) // If draft if ($user->rights->holiday->delete && $cp->statut == 1) // If draft
{ {
print '<a href="card.php?id='.$_GET['id'].'&action=delete" class="butActionDelete">'.$langs->trans("DeleteCP").'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=delete" class="butActionDelete">'.$langs->trans("DeleteCP").'</a>';
} }
if ($user->id == $cp->fk_validator && $cp->statut == 2) if ($user->id == $cp->fk_validator && $cp->statut == 2)
{ {
print '<a href="card.php?id='.$_GET['id'].'&action=valid" class="butAction">'.$langs->trans("Approve").'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=valid" class="butAction">'.$langs->trans("Approve").'</a>';
print '<a href="card.php?id='.$_GET['id'].'&action=refuse" class="butAction">'.$langs->trans("ActionRefuseCP").'</a>'; print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=refuse" class="butAction">'.$langs->trans("ActionRefuseCP").'</a>';
} }
if (($user->id == $cp->fk_validator || $user->id == $cp->fk_user) && ($cp->statut == 2 || $cp->statut == 3)) // Status validated or approved if (($user->id == $cp->fk_validator || $user->id == $cp->fk_user) && ($cp->statut == 2 || $cp->statut == 3)) // Status validated or approved
{ {
if (($cp->date_debut > dol_now()) || $user->admin) print '<a href="card.php?id='.$_GET['id'].'&action=cancel" class="butAction">'.$langs->trans("ActionCancelCP").'</a>'; if (($cp->date_debut > dol_now()) || $user->admin) print '<a href="'.$_SERVER["PHP_SELF"].'?id='.$cp->id.'&action=cancel" class="butAction">'.$langs->trans("ActionCancelCP").'</a>';
else print '<a href="#" class="butActionRefused" title="'.$langs->trans("HolidayStarted").'">'.$langs->trans("ActionCancelCP").'</a>'; else print '<a href="#" class="butActionRefused" title="'.$langs->trans("HolidayStarted").'">'.$langs->trans("ActionCancelCP").'</a>';
} }

48
htdocs/holiday/class/holiday.class.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com> /* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com>
* Copyright (C) 2012-2014 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2012-2014 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2012 Regis Houssin <regis.houssin@capnetworks.com> * Copyright (C) 2012-2016 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2013 Florian Henry <florian.henry@open-concept.pro> * Copyright (C) 2013 Florian Henry <florian.henry@open-concept.pro>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
@ -161,7 +161,7 @@ class Holiday extends CommonObject
if (! $error) if (! $error)
{ {
$this->rowid = $this->db->last_insert_id(MAIN_DB_PREFIX."holiday"); $this->id = $this->db->last_insert_id(MAIN_DB_PREFIX."holiday");
} }
// Commit or rollback // Commit or rollback
@ -178,7 +178,7 @@ class Holiday extends CommonObject
else else
{ {
$this->db->commit(); $this->db->commit();
return $this->rowid; return $this->id;
} }
} }
@ -301,7 +301,8 @@ class Holiday extends CommonObject
$sql.= " ua.firstname as validator_firstname"; $sql.= " ua.firstname as validator_firstname";
$sql.= " FROM ".MAIN_DB_PREFIX."holiday as cp, ".MAIN_DB_PREFIX."user as uu, ".MAIN_DB_PREFIX."user as ua"; $sql.= " FROM ".MAIN_DB_PREFIX."holiday as cp, ".MAIN_DB_PREFIX."user as uu, ".MAIN_DB_PREFIX."user as ua";
$sql.= " WHERE cp.fk_user = uu.rowid AND cp.fk_validator = ua.rowid "; // Hack pour la recherche sur le tableau $sql.= " WHERE cp.entity IN (".getEntity('holiday', 1).")";
$sql.= " AND cp.fk_user = uu.rowid AND cp.fk_validator = ua.rowid "; // Hack pour la recherche sur le tableau
$sql.= " AND cp.fk_user = '".$user_id."'"; $sql.= " AND cp.fk_user = '".$user_id."'";
// Filtre de séléction // Filtre de séléction
@ -413,7 +414,8 @@ class Holiday extends CommonObject
$sql.= " ua.firstname as validator_firstname"; $sql.= " ua.firstname as validator_firstname";
$sql.= " FROM ".MAIN_DB_PREFIX."holiday as cp, ".MAIN_DB_PREFIX."user as uu, ".MAIN_DB_PREFIX."user as ua"; $sql.= " FROM ".MAIN_DB_PREFIX."holiday as cp, ".MAIN_DB_PREFIX."user as uu, ".MAIN_DB_PREFIX."user as ua";
$sql.= " WHERE cp.fk_user = uu.rowid AND cp.fk_validator = ua.rowid "; // Hack pour la recherche sur le tableau $sql.= " WHERE cp.entity IN (".getEntity('holiday', 1).")";
$sql.= " AND cp.fk_user = uu.rowid AND cp.fk_validator = ua.rowid "; // Hack pour la recherche sur le tableau
// Filtrage de séléction // Filtrage de séléction
if(!empty($filter)) { if(!empty($filter)) {
@ -560,7 +562,7 @@ class Holiday extends CommonObject
$sql.= " detail_refuse = NULL"; $sql.= " detail_refuse = NULL";
} }
$sql.= " WHERE rowid= '".$this->rowid."'"; $sql.= " WHERE rowid= '".$this->id."'";
$this->db->begin(); $this->db->begin();
@ -607,7 +609,7 @@ class Holiday extends CommonObject
$error=0; $error=0;
$sql = "DELETE FROM ".MAIN_DB_PREFIX."holiday"; $sql = "DELETE FROM ".MAIN_DB_PREFIX."holiday";
$sql.= " WHERE rowid=".$this->rowid; $sql.= " WHERE rowid=".$this->id;
$this->db->begin(); $this->db->begin();
@ -1112,16 +1114,29 @@ class Holiday extends CommonObject
*/ */
function fetchUsers($stringlist=true,$type=true) function fetchUsers($stringlist=true,$type=true)
{ {
global $conf;
// Si vrai donc pour user Dolibarr // Si vrai donc pour user Dolibarr
if ($stringlist) if ($stringlist)
{ {
if($type) if ($type)
{ {
// Si utilisateur de Dolibarr // Si utilisateur de Dolibarr
$sql = "SELECT u.rowid"; $sql = "SELECT u.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX."user as u"; $sql.= " FROM ".MAIN_DB_PREFIX."user as u";
$sql.= " WHERE statut > 0";
if (! empty($conf->multicompany->enabled) && ! empty($conf->multicompany->transverse_mode))
{
$sql.= ", ".MAIN_DB_PREFIX."usergroup_user as ug";
$sql.= " WHERE (ug.fk_user = u.rowid";
$sql.= " AND ug.entity = ".$conf->entity.")";
$sql.= " OR u.admin = 1";
}
else
$sql.= " WHERE u.entity IN (0,".$conf->entity.")";
$sql.= " AND u.statut > 0";
dol_syslog(get_class($this)."::fetchUsers", LOG_DEBUG); dol_syslog(get_class($this)."::fetchUsers", LOG_DEBUG);
$resql=$this->db->query($sql); $resql=$this->db->query($sql);
@ -1138,7 +1153,7 @@ class Holiday extends CommonObject
{ {
$obj = $this->db->fetch_object($resql); $obj = $this->db->fetch_object($resql);
if($i == 0) { if ($i == 0) {
$stringlist.= $obj->rowid; $stringlist.= $obj->rowid;
} else { } else {
$stringlist.= ', '.$obj->rowid; $stringlist.= ', '.$obj->rowid;
@ -1206,7 +1221,18 @@ class Holiday extends CommonObject
{ {
$sql = "SELECT u.rowid, u.lastname, u.firstname"; $sql = "SELECT u.rowid, u.lastname, u.firstname";
$sql.= " FROM ".MAIN_DB_PREFIX."user as u"; $sql.= " FROM ".MAIN_DB_PREFIX."user as u";
$sql.= " WHERE statut > 0";
if (! empty($conf->multicompany->enabled) && ! empty($conf->multicompany->transverse_mode))
{
$sql.= ", ".MAIN_DB_PREFIX."usergroup_user as ug";
$sql.= " WHERE (ug.fk_user = u.rowid";
$sql.= " AND ug.entity = ".$conf->entity.")";
$sql.= " OR u.admin = 1";
}
else
$sql.= " WHERE u.entity IN (0,".$conf->entity.")";
$sql.= " AND u.statut > 0";
dol_syslog(get_class($this)."::fetchUsers", LOG_DEBUG); dol_syslog(get_class($this)."::fetchUsers", LOG_DEBUG);
$resql=$this->db->query($sql); $resql=$this->db->query($sql);

1
htdocs/holiday/define_holiday.php
View File

@ -2,6 +2,7 @@
/* Copyright (C) 2007-2015 Laurent Destailleur <eldy@users.sourceforge.net> /* Copyright (C) 2007-2015 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com> * Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com>
* Copyright (C) 2013 Marcos García <marcosgdf@gmail.com> * Copyright (C) 2013 Marcos García <marcosgdf@gmail.com>
* Copyright (C) 2016 Regis Houssin <regis.houssin@capnetworks.com>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by

2
htdocs/holiday/list.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com> /* Copyright (C) 2011 Dimitri Mouillard <dmouillard@teclib.com>
* Copyright (C) 2013-2015 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2013-2015 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2012 Regis Houssin <regis.houssin@capnetworks.com> * Copyright (C) 2012-2016 Regis Houssin <regis.houssin@capnetworks.com>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by

1
htdocs/install/mysql/migration/3.8.0-3.9.0.sql
View File

@ -593,6 +593,7 @@ ALTER TABLE llx_accounting_bookkeeping MODIFY COLUMN doc_ref varchar(300) NOT NU
ALTER TABLE llx_holiday ADD COLUMN tms timestamp; ALTER TABLE llx_holiday ADD COLUMN tms timestamp;
ALTER TABLE llx_holiday ADD COLUMN entity integer DEFAULT 1 NOT NULL; ALTER TABLE llx_holiday ADD COLUMN entity integer DEFAULT 1 NOT NULL;
ALTER TABLE llx_holiday ADD INDEX idx_holiday_entity (entity);
-- Fix Argentina provences -- Fix Argentina provences
INSERT INTO llx_c_departements ( code_departement, fk_region, cheflieu, tncc, ncc, nom, active) VALUES ('2326', 2305, '', 0, 'MISIONES', 'Misiones', 1); INSERT INTO llx_c_departements ( code_departement, fk_region, cheflieu, tncc, ncc, nom, active) VALUES ('2326', 2305, '', 0, 'MISIONES', 'Misiones', 1);

2
htdocs/install/mysql/tables/llx_holiday.key.sql
View File

@ -1,5 +1,6 @@
-- =================================================================== -- ===================================================================
-- Copyright (C) 2012 Laurent Destailleur <eldy@users.sourceforge.net> -- Copyright (C) 2012 Laurent Destailleur <eldy@users.sourceforge.net>
-- Copyright (C) 2016 Regis Houssin <regis.houssin@capnetworks.com>
-- --
-- This program is free software; you can redistribute it and/or modify -- This program is free software; you can redistribute it and/or modify
-- it under the terms of the GNU General Public License as published by -- it under the terms of the GNU General Public License as published by
@ -16,6 +17,7 @@
-- --
-- =================================================================== -- ===================================================================
ALTER TABLE llx_holiday ADD INDEX idx_holiday_entity (entity);
ALTER TABLE llx_holiday ADD INDEX idx_holiday_fk_user (fk_user); ALTER TABLE llx_holiday ADD INDEX idx_holiday_fk_user (fk_user);
ALTER TABLE llx_holiday ADD INDEX idx_holiday_fk_user_create (fk_user_create); ALTER TABLE llx_holiday ADD INDEX idx_holiday_fk_user_create (fk_user_create);
ALTER TABLE llx_holiday ADD INDEX idx_holiday_date_create (date_create); ALTER TABLE llx_holiday ADD INDEX idx_holiday_date_create (date_create);