diff --git a/htdocs/core/ajax/fileupload.php b/htdocs/core/ajax/fileupload.php index aba272d69a5..4a817d22f10 100644 --- a/htdocs/core/ajax/fileupload.php +++ b/htdocs/core/ajax/fileupload.php @@ -33,9 +33,6 @@ if (!defined('NOREQUIREAJAX')) { if (!defined('NOREQUIRESOC')) { define('NOREQUIRESOC', '1'); } -/*if (!defined('NOREQUIRETRAN')) { - define('NOREQUIRETRAN', '1'); -}*/ // Load Dolibarr environment require '../../main.inc.php'; @@ -49,41 +46,11 @@ error_reporting(E_ALL | E_STRICT); //print 'upload_dir='.GETPOST('upload_dir'); $id = GETPOST('fk_element', 'int'); -$elementupload = GETPOST('element', 'alpha'); -$element = $elementupload; +$element = GETPOST('element', 'alpha'); // 'myobject' (myobject=mymodule) or 'myobject@mymodule' or 'myobject_mysubobject' (myobject=mymodule) +$elementupload = $element; -if ($element == "invoice_supplier") { - $element = "fournisseur"; -} - -$object = new GenericObject($db); -$tmparray = explode('@', $element); - -if (empty($tmparray[1])) { - $subelement = ''; - - $object->module = $element; - $object->element = $element; - $object->table_element = $element; - - // Special case for compatibility - if ($object->table_element == 'websitepage') { - $object->table_element = 'website_page'; - } -} else { - $element = $tmparray[0]; - $subelement = $tmparray[1]; - - $object->module = $element; - $object->element = $subelement; - $object->table_element = $object->module.'_'.$object->element; -} -$object->id = $id; - -// Security check -if (!empty($user->socid)) { - $socid = $user->socid; -} +// Load object according to $id and $element +$object = fetchObjectByElement($id, $element); $module = $object->module; $element = $object->element; @@ -91,7 +58,19 @@ $usesublevelpermission = ($module != $element ? $element : ''); if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // There is no permission on object defined, we will check permission on module directly $usesublevelpermission = ''; } -$result = restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission, 'fk_soc', 'rowid', 0, 1); + +//print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n"; + +// Security check +if (!empty($user->socid)) { + $socid = $user->socid; + if (!empty($object->socid) && $socid != $object->socid) { + httponly_accessforbidden("Access on object not allowed for this external user."); // This includes the exit. + } +} + +$result = restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission, 'fk_soc', 'rowid', 0, 1); // Call with mode return + if (!$result) { header('HTTP/1.0 403 Forbidden'); exit; diff --git a/htdocs/core/ajax/objectonoff.php b/htdocs/core/ajax/objectonoff.php index f3b292889e5..9225e8dbb5e 100644 --- a/htdocs/core/ajax/objectonoff.php +++ b/htdocs/core/ajax/objectonoff.php @@ -47,19 +47,24 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/genericobject.class.php'; $action = GETPOST('action', 'aZ09'); $id = GETPOST('id', 'int'); -$element = GETPOST('element', 'alpha'); // 'module' or 'myobject@mymodule' or 'mymodule_myobject' +$element = GETPOST('element', 'alpha'); // 'myobject' (myobject=mymodule) or 'myobject@mymodule' or 'myobject_mysubobject' (myobject=mymodule) $field = GETPOST('field', 'alpha'); $value = GETPOST('value', 'int'); $format = 'int'; -// Load object according to $element +// Load object according to $id and $element $object = fetchObjectByElement($id, $element); $object->fields[$field] = array('type' => $format, 'enabled' => 1); $module = $object->module; $element = $object->element; -//var_dump($object->module); var_dump($object->element); var_dump($object->table_element); +$usesublevelpermission = ($module != $element ? $element : ''); +if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // There is no permission on object defined, we will check permission on module directly + $usesublevelpermission = ''; +} + +//print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n"; // Security check if (!empty($user->socid)) { @@ -72,12 +77,6 @@ if (!empty($user->socid)) { // We check permission. // Check is done on $user->rights->element->create or $user->rights->element->subelement->create (because $action = 'set') if (preg_match('/status$/', $field)) { - $module = $object->module; - $element = $object->element; - $usesublevelpermission = ($module != $element ? $element : ''); - if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // There is no permission on object defined, we will check permission on module directly - $usesublevelpermission = ''; - } restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission); } elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch'))) { // Special case for products restrictedArea($user, 'produit|service', $object, 'product&product', '', '', 'rowid'); diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php index 25aee10e2f3..043d9e6e18e 100644 --- a/htdocs/core/lib/ajax.lib.php +++ b/htdocs/core/lib/ajax.lib.php @@ -723,7 +723,7 @@ function ajax_object_onoff($object, $code, $field, $text_on, $text_off, $input = action: \'set\', field: \''.dol_escape_js($field).'\', value: \'1\', - element: \''.dol_escape_js(((empty($object->module) || $object->module == $object->element) ? '' : $object->module.'@').$object->element).'\', + element: \''.dol_escape_js((empty($object->module) || $object->module == $object->element) ? $object->element : $object->element.'@'.$object->module).'\', id: \''.((int) $object->id).'\', token: \''.currentToken().'\' }, @@ -755,7 +755,7 @@ function ajax_object_onoff($object, $code, $field, $text_on, $text_off, $input = action: \'set\', field: \''.dol_escape_js($field).'\', value: \'0\', - element: \''.dol_escape_js(((empty($object->module) || $object->module == $object->element) ? '' : $object->module.'@').$object->element).'\', + element: \''.dol_escape_js((empty($object->module) || $object->module == $object->element) ? $object->element : $object->element.'@'.$object->module).'\', id: \''.((int) $object->id).'\', token: \''.currentToken().'\' }, diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php index 3141ddfaa73..cebcbfe373f 100644 --- a/htdocs/core/lib/files.lib.php +++ b/htdocs/core/lib/files.lib.php @@ -3388,7 +3388,7 @@ function getFilesUpdated(&$file_list, SimpleXMLElement $dir, $path = '', $pathre } /** - * Function to manage the drag and drop file. + * Function to manage the drag and drop of a file. * We use global variable $object * * @param string $htmlname The id of the component where we need to drag and drop @@ -3397,6 +3397,7 @@ function getFilesUpdated(&$file_list, SimpleXMLElement $dir, $path = '', $pathre function dragAndDropFileUpload($htmlname) { global $object, $langs; + $out = ""; $out .= ''; $out .= "\n\n"; @@ -3413,7 +3414,7 @@ function dragAndDropFileUpload($htmlname) $("#'.$htmlname.'Message").removeClass("hidden"); ev.preventDefault(); }); - + $(".cssDragDropArea").on("dragleave", function(ev) { // Going out of drop area. Remove Highlight if (enterTargetDragDrop == ev.target){ @@ -3429,38 +3430,38 @@ function dragAndDropFileUpload($htmlname) }); $(".cssDragDropArea").on("drop", function(e) { - console.log("Trigger event file droped"); + console.log("Trigger event file dropped. fk_element='.dol_escape_js($object->id).' element='.dol_escape_js($object->element).'"); e.preventDefault(); fd = new FormData(); - fd.append("fk_element","'.dol_escape_json($object->id).'"); - fd.append("element","'.dol_escape_json($object->element).'"); - fd.append("token","'.newToken().'"); - fd.append("action","linkit"); + fd.append("fk_element", "'.dol_escape_js($object->id).'"); + fd.append("element", "'.dol_escape_js($object->element).'"); + fd.append("token", "'.currentToken().'"); + fd.append("action", "linkit"); var dataTransfer = e.originalEvent.dataTransfer; - if(dataTransfer.files && dataTransfer.files.length){ + if (dataTransfer.files && dataTransfer.files.length){ var droppedFiles = e.originalEvent.dataTransfer.files; $.each(droppedFiles, function(index,file){ - fd.append("files[]",file,file.name) + fd.append("files[]", file,file.name) }); } $(".cssDragDropArea").removeClass("highlightDragDropArea"); counterdragdrop = 0; $.ajax({ - url:"'.DOL_URL_ROOT.'/core/ajax/fileupload.php", - type:"POST", - processData:false, + url: "'.DOL_URL_ROOT.'/core/ajax/fileupload.php", + type: "POST", + processData: false, contentType: false, - data:fd, - success:function(){ - console.log("Uploaded.",arguments); - window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_json($object->id).'&seteventmessages=UploadFileDragDropSuccess:mesgs"; + data: fd, + success:function() { + console.log("Uploaded.", arguments); + window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_js($object->id).'&seteventmessages=UploadFileDragDropSuccess:mesgs"; }, - error:function(){ - console.log("Error Uploading.",arguments) - if (arguments[0].status == 403){ - window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_json($object->id).'&seteventmessages=ErrorUploadPermissionDenied:errors"; + error:function() { + console.log("Error Uploading.", arguments) + if (arguments[0].status == 403) { + window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_js($object->id).'&seteventmessages=ErrorUploadPermissionDenied:errors"; } - window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_json($object->id).'&seteventmessages=ErrorUploadFileDragDropPermissionDenied:errors"; + window.location.href = "'.$_SERVER["PHP_SELF"].'?id='.dol_escape_js($object->id).'&seteventmessages=ErrorUploadFileDragDropPermissionDenied:errors"; }, }) }); diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5e8ef2a579c..84e4a8b36ee 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -11199,7 +11199,10 @@ function dolGetButtonTitle($label, $helpText = '', $iconClass = 'fa fa-file', $u /** * Get an array with properties of an element. * - * @param string $element_type Element type (Value of $object->element). Example: 'action', 'facture', 'project_task', 'myobject@mymodule' or 'mymodule_myobject' ... + * @param string $element_type Element type (Value of $object->element). Example: + * 'action', 'facture', 'project_task', + * 'myobject@mymodule' or + * 'myobject_mysubobject' (where mymodule = myobject, like 'project_task') * @return array (module, classpath, element, subelement, classfile, classname) * @see fetchObjectByElement() */ @@ -11209,19 +11212,20 @@ function getElementProperties($element_type) $classfile = $classname = $classpath = ''; - // Parse element/subelement (ex: project_task) + // Parse element/subelement $module = $element_type; $element = $element_type; $subelement = $element_type; - // If we ask an resource form external module (instead of default path) - if (preg_match('/^([^@]+)@([^@]+)$/i', $element_type, $regs)) { + // If we ask a resource form external module (instead of default path) + if (preg_match('/^([^@]+)@([^@]+)$/i', $element_type, $regs)) { // 'myobject@mymodule' $element = $subelement = $regs[1]; $module = $regs[2]; } - //print '
1. element : '.$element.' - module : '.$module .'
'; - if (preg_match('/^([^_]+)_([^_]+)/i', $element, $regs)) { + // If we ask a resource for a string with an element and a subelement + // Example 'project_task' + if (preg_match('/^([^_]+)_([^_]+)/i', $element, $regs)) { // 'myobject_mysubobject' with myobject=mymodule $module = $element = $regs[1]; $subelement = $regs[2]; } @@ -11293,14 +11297,18 @@ function getElementProperties($element_type) if ($element_type == 'order_supplier') { $classpath = 'fourn/class'; $module = 'fournisseur'; - $subelement = 'commandefournisseur'; $classfile = 'fournisseur.commande'; + $element = 'commande'; + $subelement = ''; + $classname = 'CommandeFournisseur'; } if ($element_type == 'invoice_supplier') { $classpath = 'fourn/class'; $module = 'fournisseur'; - $subelement = 'facturefournisseur'; $classfile = 'fournisseur.facture'; + $element = 'facture'; + $subelement = ''; + $classname = 'FactureFournisseur'; } if ($element_type == "service") { $classpath = 'product/class'; @@ -11353,6 +11361,10 @@ function fetchObjectByElement($element_id, $element_type, $element_ref = '') $objecttmp = new $classname($db); $ret = $objecttmp->fetch($element_id, $element_ref); if ($ret >= 0) { + if (empty($objecttmp->module)) { + $objecttmp->module = $element_prop['module']; + } + return $objecttmp; } } else { diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php index 8e948f2ed32..211f39606bd 100644 --- a/htdocs/core/lib/security.lib.php +++ b/htdocs/core/lib/security.lib.php @@ -393,6 +393,15 @@ function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', if ($features == 'product') { $features = 'produit'; } + if ($features == 'fournisseur') { // When vendor invoice and pruchase order are into module 'fournisseur' + $features = 'fournisseur'; + $feature2 = ''; + if ($object->element == 'invoice_supplier') { + $feature2 = 'facture'; + } elseif ($object->element == 'order_supplier') { + $feature2 = 'commande'; + } + } // Get more permissions checks from hooks $parameters = array('features'=>$features, 'originalfeatures'=>$originalfeatures, 'objectid'=>$objectid, 'dbt_select'=>$dbt_select, 'idtype'=>$dbt_select, 'isdraft'=>$isdraft); diff --git a/htdocs/theme/eldy/global.inc.php b/htdocs/theme/eldy/global.inc.php index 74b4257f7e6..b784de02b32 100644 --- a/htdocs/theme/eldy/global.inc.php +++ b/htdocs/theme/eldy/global.inc.php @@ -7592,7 +7592,7 @@ div.clipboardCPValue.hidewithsize { } /* ============================================================================== */ -/* For drag and drop feature */ +/* For drag and drop file feature */ /* ============================================================================== */ .cssDragDropArea{ @@ -7600,11 +7600,11 @@ div.clipboardCPValue.hidewithsize { } .highlightDragDropArea{ border: 2px #000 dashed !important; - background-color: #bbbbbb !important; + background-color: #eee !important; } .highlightDragDropArea * :not(.dragDropAreaMessage *){ - opacity:0.7; - filter: blur(3px) grayscale(100%); + opacity:0.8; + filter: blur(1px) grayscale(90%); } .dragDropAreaMessage { position: absolute; @@ -7612,6 +7612,7 @@ div.clipboardCPValue.hidewithsize { top:50%; transform: translate(-50%, -50%); text-align:center; + font-size: 2em; } /* ============================================================================== */ diff --git a/htdocs/theme/md/style.css.php b/htdocs/theme/md/style.css.php index 943fad9e127..ef8f97716b2 100644 --- a/htdocs/theme/md/style.css.php +++ b/htdocs/theme/md/style.css.php @@ -7509,7 +7509,7 @@ div.clipboardCPValue.hidewithsize { } /* ============================================================================== */ -/* For drag and drop feature */ +/* For drag and drop file feature */ /* ============================================================================== */ .cssDragDropArea{ @@ -7517,11 +7517,11 @@ div.clipboardCPValue.hidewithsize { } .highlightDragDropArea{ border: 2px #000 dashed !important; - background-color: #bbbbbb !important; + background-color: #eee !important; } .highlightDragDropArea * :not(.dragDropAreaMessage *){ - opacity:0.7; - filter: blur(3px) grayscale(100%); + opacity:0.8; + filter: blur(1px) grayscale(90%); } .dragDropAreaMessage { position: absolute; @@ -7529,6 +7529,7 @@ div.clipboardCPValue.hidewithsize { top:50%; transform: translate(-50%, -50%); text-align:center; + font-size: 2em; } /* ============================================================================== */