lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The default value feature is sensitive to url parameters.

Browse Source
This commit is contained in:
Laurent Destailleur 2017-10-01 14:54:17 +02:00
parent b7810d95b9
commit 3ddd5d3d3a
4 changed files with 169 additions and 146 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
htdocs/core/lib/functions.lib.php
View File

@ -312,22 +312,37 @@ function GETPOST($paramname, $check='alpha', $method=0, $filter=NULL, $options=N
{ {
if (! empty($_GET['action']) && $_GET['action'] == 'create' && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname])) if (! empty($_GET['action']) && $_GET['action'] == 'create' && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
{ {
if (! empty($user->default_values)) // $user->default_values defined from menu default values if (! empty($user->default_values)) // $user->default_values defined from menu 'Setup - Default values'
{ {
$qualified=1; if (isset($user->default_values[$relativepathstring]['createform']))
if (isset($user->default_values[$relativepathstring]['createform_queries'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
{ {
$tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['createform_queries']); foreach($user->default_values[$relativepathstring]['createform'] as $defkey => $defval)
{
$qualified = 0;
if ($defkey != '_noquery_')
{
$tmpqueryarraytohave=explode('&', $defkey);
$tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
$foundintru=0;
foreach($tmpqueryarraytohave as $tmpquerytohave) foreach($tmpqueryarraytohave as $tmpquerytohave)
{ {
if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0; if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
} }
if (! $foundintru) $qualified=1;
//var_dump($defkey.'-'.$qualified);
} }
else $qualified = 1;
if ($qualified) if ($qualified)
{ {
//var_dump($user->default_values[$relativepathstring]['createform']); //var_dump($user->default_values[$relativepathstring][$defkey]['createform']);
if (isset($user->default_values[$relativepathstring]['createform'][$paramname])) $out = $user->default_values[$relativepathstring]['createform'][$paramname]; if (isset($user->default_values[$relativepathstring]['createform'][$defkey][$paramname]))
{
$out = $user->default_values[$relativepathstring]['createform'][$defkey][$paramname];
break;
}
}
}
} }
} }
} }
@ -335,71 +350,69 @@ function GETPOST($paramname, $check='alpha', $method=0, $filter=NULL, $options=N
//elseif (preg_match('/list.php$/', $_SERVER["PHP_SELF"]) && ! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname])) //elseif (preg_match('/list.php$/', $_SERVER["PHP_SELF"]) && ! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
elseif (! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname])) elseif (! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
{ {
if (! empty($user->default_values)) // $user->default_values defined from menu default values if (! empty($user->default_values)) // $user->default_values defined from menu 'Setup - Default values'
{ {
//var_dump($user->default_values[$relativepathstring]); //var_dump($user->default_values[$relativepathstring]);
if ($paramname == 'sortfield') // Sorted on which fields ? if ($paramname == 'sortfield' || $paramname == 'sortorder') // Sorted on which fields ? ASC or DESC ?
{ {
$qualified=1; if (isset($user->default_values[$relativepathstring]['sortorder'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
if (isset($user->default_values[$relativepathstring]['sortorder_queries'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
{ {
$tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['sortorder_queries']); foreach($user->default_values[$relativepathstring]['sortorder'] as $defkey => $defval)
{
$qualified = 0;
if ($defkey != '_noquery_')
{
$tmpqueryarraytohave=explode('&', $defkey);
$tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
$foundintru=0;
foreach($tmpqueryarraytohave as $tmpquerytohave) foreach($tmpqueryarraytohave as $tmpquerytohave)
{ {
if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0; if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
} }
if (! $foundintru) $qualified=1;
//var_dump($defkey.'-'.$qualified);
} }
else $qualified = 1;
if ($qualified) if ($qualified)
{ {
if (isset($user->default_values[$relativepathstring]['sortorder'])) // We will use the key of $user->default_values[path][sortorder]
{
$forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and , $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
foreach($user->default_values[$relativepathstring]['sortorder'] as $key => $val) foreach($user->default_values[$relativepathstring]['sortorder'][$defkey] as $key => $val)
{ {
if ($out) $out.=', '; if ($out) $out.=', ';
if ($paramname == 'sortfield')
{
$out.=dol_string_nospecial($key, '', $forbidden_chars_to_replace); $out.=dol_string_nospecial($key, '', $forbidden_chars_to_replace);
} }
} if ($paramname == 'sortorder')
}
}
elseif ($paramname == 'sortorder') // ASC or DESC ?
{ {
$qualified=1;
if (isset($user->default_values[$relativepathstring]['sortorder_queries']))
{
$tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['sortorder_queries']);
$tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
foreach($tmpqueryarraytohave as $tmpquerytohave)
{
if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0;
}
}
if ($qualified)
{
if (isset($user->default_values[$relativepathstring]['sortorder'])) // We will use the val of $user->default_values[path][sortorder]
{
$forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
foreach($user->default_values[$relativepathstring]['sortorder'] as $key => $val)
{
if ($out) $out.=', ';
$out.=dol_string_nospecial($val, '', $forbidden_chars_to_replace); $out.=dol_string_nospecial($val, '', $forbidden_chars_to_replace);
} }
} }
//break; // No break for sortfield and sortorder so we can cumulate fields (is it realy usefull ?)
} }
} }
elseif (isset($user->default_values[$relativepathstring]['filters'][$paramname])) }
}
elseif (isset($user->default_values[$relativepathstring]['filters']))
{ {
$qualified=1; foreach($user->default_values[$relativepathstring]['filters'] as $defkey => $defval)
if (isset($user->default_values[$relativepathstring]['filters_queries']))
{ {
$tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['filters_queries']); $qualified = 0;
if ($defkey != '_noquery_')
{
$tmpqueryarraytohave=explode('&', $defkey);
$tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
$foundintru=0;
foreach($tmpqueryarraytohave as $tmpquerytohave) foreach($tmpqueryarraytohave as $tmpquerytohave)
{ {
if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0; if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
} }
if (! $foundintru) $qualified=1;
//var_dump($defkey.'-'.$qualified);
} }
else $qualified = 1;
if ($qualified) if ($qualified)
{ {
if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all'])) if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all']))
@ -408,13 +421,15 @@ function GETPOST($paramname, $check='alpha', $method=0, $filter=NULL, $options=N
if (empty($conf->global->MAIN_DISABLE_DEFAULT_FILTER_FOR_QUICK_SEARCH)) if (empty($conf->global->MAIN_DISABLE_DEFAULT_FILTER_FOR_QUICK_SEARCH))
{ {
$forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and , $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
$out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$paramname], '', $forbidden_chars_to_replace); $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace);
} }
} }
else else
{ {
$forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and , $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
$out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$paramname], '', $forbidden_chars_to_replace); $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace);
}
break;
} }
} }
} }

4
htdocs/langs/en_US/admin.lang
View File

@ -452,8 +452,8 @@ DependsOn=This module need the module(s)
RequiredBy=This module is required by module(s) RequiredBy=This module is required by module(s)
TheKeyIsTheNameOfHtmlField=This is the name of the HTML field. This need to have technical knowledges to read the content of the HTML page to get the key name of a field. TheKeyIsTheNameOfHtmlField=This is the name of the HTML field. This need to have technical knowledges to read the content of the HTML page to get the key name of a field.
PageUrlForDefaultValues=You must enter here the relative url of the page. If you include parameters in URL, the default values will be effective if all parameters are set to same value. Examples: PageUrlForDefaultValues=You must enter here the relative url of the page. If you include parameters in URL, the default values will be effective if all parameters are set to same value. Examples:
PageUrlForDefaultValuesCreate=<br>For form to create a new thirdparty, it is <strong>%s</strong>,<br>If we want default only if url has some parameter, we can use <strong>%s</strong> PageUrlForDefaultValuesCreate=<br>For form to create a new thirdparty, it is <strong>%s</strong>,<br>If you want default value only if url has some parameter, you can use <strong>%s</strong>
PageUrlForDefaultValuesList=<br>For page that list thirdparties, it is <strong>%s</strong>,<br>If we want default only if url has some parameter, we can use <strong>%s</strong> PageUrlForDefaultValuesList=<br>For page that list thirdparties, it is <strong>%s</strong>,<br>If you want default value only if url has some parameter, you can use <strong>%s</strong>
EnableDefaultValues=Enable usage of personalized default values EnableDefaultValues=Enable usage of personalized default values
EnableOverwriteTranslation=Enable usage of overwrote translation EnableOverwriteTranslation=Enable usage of overwrote translation
GoIntoTranslationMenuToChangeThis=A translation has been found for the key with this code, so to change this value, you must edit it fom Home-Setup-translation. GoIntoTranslationMenuToChangeThis=A translation has been found for the key with this code, so to change this value, you must edit it fom Home-Setup-translation.

2
htdocs/societe/card.php
View File

@ -94,8 +94,6 @@ if (! empty($canvas))
$result = restrictedArea($user, 'societe', $socid, '&societe', '', 'fk_soc', 'rowid', $objcanvas); $result = restrictedArea($user, 'societe', $socid, '&societe', '', 'fk_soc', 'rowid', $objcanvas);
/* /*
* Actions * Actions
*/ */

16
htdocs/user/class/user.class.php
View File

@ -384,7 +384,9 @@ class User extends CommonObject
{ {
if (! empty($obj->page) && ! empty($obj->type) && ! empty($obj->param)) if (! empty($obj->page) && ! empty($obj->type) && ! empty($obj->param))
{ {
// $obj->page is relative URL with or without params, $obj->type can be 'filters', 'sortorder', 'createform', ... // $obj->page is relative URL with or without params
// $obj->type can be 'filters', 'sortorder', 'createform', ...
// $obj->param is key or param
$pagewithoutquerystring=$obj->page; $pagewithoutquerystring=$obj->page;
$pagequeries=''; $pagequeries='';
if (preg_match('/^([^\?]+)\?(.*)$/', $pagewithoutquerystring, $reg)) // There is query param if (preg_match('/^([^\?]+)\?(.*)$/', $pagewithoutquerystring, $reg)) // There is query param
@ -392,8 +394,16 @@ class User extends CommonObject
$pagewithoutquerystring=$reg[1]; $pagewithoutquerystring=$reg[1];
$pagequeries=$reg[2]; $pagequeries=$reg[2];
} }
$this->default_values[$pagewithoutquerystring][$obj->type][$obj->param]=$obj->value; $this->default_values[$pagewithoutquerystring][$obj->type][$pagequeries?$pagequeries:'_noquery_'][$obj->param]=$obj->value;
if ($pagequeries) $this->default_values[$pagewithoutquerystring][$obj->type.'_queries']=$pagequeries; //if ($pagequeries) $this->default_values[$pagewithoutquerystring][$obj->type.'_queries']=$pagequeries;
}
}
// Sort by key, so _noquery_ is last
foreach($this->default_values as $a => $b)
{
foreach($b as $c => $d)
{
krsort($this->default_values[$a][$c]);
} }
} }
$this->db->free($resql); $this->db->free($resql);