diff --git a/htdocs/api/class/api_access.class.php b/htdocs/api/class/api_access.class.php
index 68ec526ec7e..407f94ac915 100644
--- a/htdocs/api/class/api_access.class.php
+++ b/htdocs/api/class/api_access.class.php
@@ -76,12 +76,34 @@ class DolibarrApiAccess implements iAuthenticate
$userClass = Defaults::$userIdentifierClass;
+ /*foreach ($_SERVER as $key => $val)
+ {
+ dol_syslog($key.' - '.$val);
+ }*/
+
+ // api key can be provided in url with parameter api_key=xxx or ni header with header DOLAPIKEY:xxx
+ $api_key = '';
if (isset($_GET['api_key']))
+ {
+ // TODO Add option to disable use of api key on url. Return errors if used.
+ $api_key = $_GET['api_key']; // For backward compatibility
+ }
+ if (isset($_GET['DOLAPIKEY']))
+ {
+ // TODO Add option to disable use of api key on url. Return errors if used.
+ $api_key = $_GET['DOLAPIKEY']; // With GET method
+ }
+ if (isset($_SERVER['HTTP_DOLAPIKEY']))
+ {
+ $api_key = $_SERVER['HTTP_DOLAPIKEY']; // With header method (recommanded)
+ }
+
+ if ($api_key)
{
$sql = "SELECT u.login, u.datec, u.api_key, ";
$sql.= " u.tms as date_modification, u.entity";
$sql.= " FROM ".MAIN_DB_PREFIX."user as u";
- $sql.= " WHERE u.api_key = '".$db->escape($_GET['api_key'])."'";
+ $sql.= " WHERE u.api_key = '".$db->escape($api_key)."'";
$result = $db->query($sql);
if ($result)
@@ -97,8 +119,8 @@ class DolibarrApiAccess implements iAuthenticate
throw new RestException(503, 'Error when fetching user api_key :'.$db->error_msg);
}
- if ($stored_key != $_GET['api_key']) {
- $userClass::setCacheIdentifier($_GET['api_key']);
+ if ($stored_key != $api_key) {
+ $userClass::setCacheIdentifier($api_key);
return false;
}
@@ -121,7 +143,7 @@ class DolibarrApiAccess implements iAuthenticate
}
else
{
- throw new RestException(401, "Failed to login to API. No parameter 'api_key' provided");
+ throw new RestException(401, "Failed to login to API. No parameter 'DOLAPIKEY' on HTTP header (neither in URL).");
}
$userClass::setCacheIdentifier(static::$role);
diff --git a/htdocs/api/class/api_login.class.php b/htdocs/api/class/api_login.class.php
index 439308fcaea..704ec1b6874 100644
--- a/htdocs/api/class/api_login.class.php
+++ b/htdocs/api/class/api_login.class.php
@@ -34,12 +34,14 @@ class Login
/**
* Login
*
- * Log user with username and password. Using method POST is recommanded for security reasons (method GET is often logged by default by web servers with parameters so with login and pass)
- *
- * @param string $login Username
+ * Request the API token for a couple username / password.
+ * Using method POST is recommanded for security reasons (method GET is often logged by default by web servers with parameters so with login and pass into server log file).
+ * Both method are provided for developer conveniance. Best is to not use at all the login API method and enter directly the "api_key" into field at the top right of page (Note: "api_key" can be found/set on the user page).
+ *
+ * @param string $login User login
* @param string $password User password
* @param int $entity Entity (when multicompany module is used). Empty means 1=first company.
- * @param int $reset Reset token (0=get current token, 1=ask a new token, meaning that all future access using current token will failed)
+ * @param int $reset Reset token (0=get current token, 1=ask a new token and canceled old token. This means access using current existing API token of user will fails: new token will be required for new access)
* @return array Response status and user token
*
* @throws RestException
diff --git a/htdocs/api/index.php b/htdocs/api/index.php
index 8ad60c4b340..37be4d8cc26 100644
--- a/htdocs/api/index.php
+++ b/htdocs/api/index.php
@@ -56,6 +56,16 @@ if (empty($conf->global->MAIN_MODULE_API))
exit;
}
+// Test if explorer is not disabled
+if (preg_match('/api\/index\.php\/explorer/', $_SERVER["PHP_SELF"]) && ! empty($conf->global->API_EXPLORER_DISABLED))
+{
+ $langs->load("admin");
+ dol_syslog("Call Dolibarr API interfaces with module REST disabled");
+ print $langs->trans("WarningAPIExplorerDisabled").'.
';
+ exit;
+}
+
+
$api = new DolibarrApi($db);
diff --git a/htdocs/cashdesk/index.php b/htdocs/cashdesk/index.php
index 4a892f909e5..9a61a50b38a 100644
--- a/htdocs/cashdesk/index.php
+++ b/htdocs/cashdesk/index.php
@@ -59,7 +59,18 @@ top_htmlhead('','',0,0,'',$arrayofcss);
| 0?'&socid='.$socid:'').($userid>0?'&userid='.$userid:'').'">'.$oldyear.' | '; - print '0 | '; print ''; print ' | 0 | '; diff --git a/htdocs/compta/paiement/avalider.php b/htdocs/compta/paiement/avalider.php index 02201093830..a244a1feb60 100644 --- a/htdocs/compta/paiement/avalider.php +++ b/htdocs/compta/paiement/avalider.php @@ -38,22 +38,29 @@ if ($user->societe_id > 0) } -/* - * Affichage - */ - -llxHeader(); - -$sortfield = GETPOST("sortfield",'alpha'); -$sortorder = GETPOST("sortorder",'alpha'); -$page = GETPOST("page",'int'); +$limit = GETPOST('limit')?GETPOST('limit','int'):$conf->liste_limit; +$sortfield = GETPOST('sortfield','alpha'); +$sortorder = GETPOST('sortorder','alpha'); +$page = GETPOST('page','int'); if ($page == -1) { $page = 0; } -$offset = $conf->liste_limit * $page; +$offset = $limit * $page; $pageprev = $page - 1; $pagenext = $page + 1; if (! $sortorder) $sortorder="DESC"; if (! $sortfield) $sortfield="p.rowid"; -$limit = GETPOST('limit')?GETPOST('limit','int'):$conf->liste_limit; + + +/* + * Actions + */ + + + +/* + * View + */ + +llxHeader(); $sql = "SELECT p.rowid, p.datep as dp, p.amount, p.statut"; $sql.=", c.libelle as paiement_type, p.num_paiement"; @@ -70,10 +77,20 @@ if ($socid) $sql.= " AND f.fk_soc = ".$socid; } $sql.= " AND p.statut = 0"; -$sql.= " ORDER BY $sortfield $sortorder"; -$sql.= $db->plimit($limit+1, $offset); -$resql = $db->query($sql); +$sql.= $db->order($sortfield,$sortorder); + +// Count total nb of records +$nbtotalofrecords = ''; +if (empty($conf->global->MAIN_DISABLE_FULL_SCANLIST)) +{ + $result = $db->query($sql); + $nbtotalofrecords = $db->num_rows($result); +} + +$sql.= $db->plimit($limit + 1,$offset); + +$resql = $db->query($sql); if ($resql) { $num = $db->num_rows($resql); diff --git a/htdocs/compta/paiement/card.php b/htdocs/compta/paiement/card.php index 07b8d95ddbc..7de97eba2e0 100644 --- a/htdocs/compta/paiement/card.php +++ b/htdocs/compta/paiement/card.php @@ -199,11 +199,12 @@ if ($action == 'valide') } -print '|||||||
| '.$langs->trans('Ref').' | '; print $form->showrefnav($object, 'ref', $linkback, 1, 'ref', 'ref', ''); @@ -280,6 +281,8 @@ if (! empty($conf->banque->enabled)) print ' | ||
| '.$langs->trans('Bill').' | '; print ''.$langs->trans('Company').' | '; @@ -363,6 +373,8 @@ if ($resql) $var=!$var; print "
| '.$langs->trans("DateChequeReceived").' '; print " | \n"; @@ -539,7 +542,8 @@ if ($action == 'new') $i++; } print "