';
diff --git a/htdocs/adherents/type.php b/htdocs/adherents/type.php
index 628313d5fe9..1d788457abe 100644
--- a/htdocs/adherents/type.php
+++ b/htdocs/adherents/type.php
@@ -292,7 +292,7 @@ if (!$rowid && $action != 'create' && $action != 'edit') {
$membertype->amount = $objp->amount;
print '
'.$langs->trans("VoteAllowed").' ';
diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php
index 997ca45f515..746075ab51e 100644
--- a/htdocs/comm/propal/card.php
+++ b/htdocs/comm/propal/card.php
@@ -1,5 +1,5 @@
+/* Copyright (C) 2001-2007 Rodolphe Quiedeville
* Copyright (C) 2004-2014 Laurent Destailleur
* Copyright (C) 2004 Eric Seigne
* Copyright (C) 2005 Marc Barilley / Ocebo
@@ -817,7 +817,7 @@ if (empty($reshook)) {
}
}
}
- } elseif ($action == 'addline' && GETPOST('submitforalllines', 'alpha') && GETPOST('vatforalllines', 'alpha') !== '') {
+ } elseif ($action == 'addline' && GETPOST('submitforalllines', 'alpha') && GETPOST('vatforalllines', 'alpha') !== '' && $usercancreate) {
// Define vat_rate
$vat_rate = (GETPOST('vatforalllines') ? GETPOST('vatforalllines') : 0);
$vat_rate = str_replace('*', '', $vat_rate);
@@ -835,7 +835,7 @@ if (empty($reshook)) {
$prod_entry_mode = GETPOST('prod_entry_mode');
if ($prod_entry_mode == 'free') {
$idprod = 0;
- $tva_tx = (GETPOST('tva_tx') ? GETPOST('tva_tx') : 0);
+ $tva_tx = (GETPOST('tva_tx') ? price2num(GETPOST('tva_tx')) : 0);
} else {
$idprod = GETPOST('idprod', 'int');
$tva_tx = '';
@@ -2680,7 +2680,7 @@ if ($action == 'create') {
$somethingshown = $form->showLinkedObjectBlock($object, $linktoelem, $compatibleImportElementsList);
// Show online signature link
- $useonlinesignature = 1; // Replace this with 1 when feature to make online signature is ok
+ $useonlinesignature = 1;
if ($object->statut != Propal::STATUS_DRAFT && $useonlinesignature) {
print '' : '');
+ $out = $urltouse.'/public/onlinesign/newonlinesign.php?source=proposal&ref='.($mode ? '' : '');
if ($mode == 1) {
$out .= 'proposal_ref';
}
@@ -72,6 +86,12 @@ function getOnlineSignatureUrl($mode, $type, $ref = '')
$out .= urlencode($ref);
}
$out .= ($mode ? ' ' : '');
+ if ($mode == 1) {
+ $out .= "hash('".$securekeyseed."' + '".$type."' + proposal_ref)";
+ } else {
+ $out .= '&securekey='.dol_hash($securekeyseed.$type.$ref, '0');
+ }
+ /*
if ($mode == 1) {
$out .= '&hashp=hash_of_file ';
} else {
@@ -94,13 +114,15 @@ function getOnlineSignatureUrl($mode, $type, $ref = '')
} else {
$out .= '&hashp='.$hashp;
}
- }
+ }*/
}
// For multicompany
+ /*
if (!empty($out)) {
$out .= "&entity=".$conf->entity; // Check the entity because He may be the same reference in several entities
}
+ */
return $out;
}
diff --git a/htdocs/public/onlinesign/newonlinesign.php b/htdocs/public/onlinesign/newonlinesign.php
index 14a08c675ce..caec61f4a2a 100644
--- a/htdocs/public/onlinesign/newonlinesign.php
+++ b/htdocs/public/onlinesign/newonlinesign.php
@@ -122,6 +122,17 @@ $creditor = $mysoc->name;
$object = new Propal($db);
$object->fetch(0, $ref);
+// Check securitykey
+$securekeyseed = $conf->global->PROPOSAL_ONLINE_SIGNATURE_SECURITY_TOKEN;
+$type = $source;
+$calculatedsecuritykey = dol_hash($securekeyseed.$type.$ref, '0');
+
+if ($calculatedsecuritykey != $SECUREKEY) {
+ http_response_code(403);
+ print 'Bad value for securitykey. Value provided '.dol_escape_htmltag($SECUREKEY).' does not match expected value for ref='.dol_escape_htmltag($ref);
+ exit(-1);
+}
+
/*
* Actions
@@ -144,7 +155,7 @@ if ($action == 'confirm_refusepropal') {
$db->commit();
$message = 'refused';
- setEventMessages("PropalRefused", null, 'warning');
+ setEventMessages("PropalRefused", null, 'warnings');
} else {
$db->rollback();
}
@@ -170,7 +181,7 @@ $replacemainarea = (empty($conf->dol_hide_leftmenu) ? '' : '').'
';
llxHeader($head, $langs->trans("OnlineSignature"), '', '', 0, 0, '', '', '', 'onlinepaymentbody', $replacemainarea, 1);
if ($action == 'refusepropal') {
- print $form->formconfirm($_SERVER["PHP_SELF"].'?ref='.$ref, $langs->trans('RefusePropal'), $langs->trans('ConfirmRefusePropal', $object->ref), 'confirm_refusepropal', '', '', 1);
+ print $form->formconfirm($_SERVER["PHP_SELF"].'?ref='.urlencode($ref).'&securekey='.urlencode($SECUREKEY), $langs->trans('RefusePropal'), $langs->trans('ConfirmRefusePropal', $object->ref), 'confirm_refusepropal', '', '', 1);
}
// Check link validity for param 'source'
@@ -195,7 +206,7 @@ print '
';
print "\n";
print ''."\n";
-print '
'."\n";
+print ''."\n";
// Show logo (search order: logo defined by ONLINE_SIGN_LOGO_suffix, then ONLINE_SIGN_LOGO_, then small company logo, large company logo, theme logo, common logo)
// Define logo and logosmall
@@ -295,6 +306,13 @@ if ($source == 'proposal') {
print ''.$proposal->thirdparty->name.' ';
print ''."\n";
+ // Amount
+
+ print ''.$langs->trans("Amount");
+ print ' ';
+ print ''.price($proposal->total_ttc, 0, $langs, 1, -1, -1, $conf->currency).' ';
+ print ' '.$langs->trans("SignatureProposalRef", $proposal->ref).' ';
@@ -308,7 +326,7 @@ if ($source == 'proposal') {
print $langs->trans("DownloadDocument").'';
}
} else {
- /* TODO If proposal signed newer than proposal ref, get link of proposal signed
+ /* TODO If the file of proposal signed is newer than the default proposal file, get link of proposal signed
*/
}
@@ -358,7 +376,7 @@ if ($action == "dosign" && empty($cancel)) {
print '