lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: security with multi-company

Browse Source
This commit is contained in:
Regis Houssin 2009-05-04 10:46:53 +00:00
parent d144a2af4d
commit 524f01348c
15 changed files with 15 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/product/barcode.php
View File

@ -37,9 +37,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/document.php
View File

@ -42,9 +42,8 @@ $action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action'
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/fournisseurs.php
View File

@ -39,9 +39,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/photos.php
View File

@ -38,9 +38,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/price.php
View File

@ -38,9 +38,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/sousproduits/fiche.php
View File

@ -39,9 +39,8 @@ $langs->load("products");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/commande.php
View File

@ -39,9 +39,8 @@ $langs->load("companies");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/commande_fournisseur.php
View File

@ -39,9 +39,8 @@ $langs->load("companies");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/contrat.php
View File

@ -38,9 +38,8 @@ $langs->load("companies");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/facture.php
View File

@ -39,9 +39,8 @@ $langs->load("products");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/facture_fournisseur.php
View File

@ -40,9 +40,8 @@ $langs->load("companies");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/fiche.php
View File

@ -42,9 +42,8 @@ $mode=isset($_GET["mode"])?$_GET["mode"]:'byunit';
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stats/propal.php
View File

@ -38,9 +38,8 @@ $langs->load("companies");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/stock/product.php
View File

@ -40,9 +40,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

3
htdocs/product/traduction.php
View File

@ -39,9 +39,8 @@ $langs->load("bills");
if (isset($_GET["id"]) || isset($_GET["ref"])) if (isset($_GET["id"]) || isset($_GET["ref"]))
{ {
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:''); $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = isset($_GET["ref"])?'ref':'rowid';
} }
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);