From eb2ea07c763a7bec83ef01d601e41c41aa66fa65 Mon Sep 17 00:00:00 2001 From: Juanjo Menent Date: Wed, 11 Jan 2017 20:32:39 +0100 Subject: [PATCH 1/9] FIX #6245 Thirdparty link in supplier invoices list, links to "comm/card" instead of "fourn/card" page --- htdocs/fourn/facture/list.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php index 89dfb083ea0..f2c42c3b14f 100644 --- a/htdocs/fourn/facture/list.php +++ b/htdocs/fourn/facture/list.php @@ -6,7 +6,7 @@ * Copyright (C) 2013 Florian Henry * Copyright (C) 2013 Cédric Salvador * Copyright (C) 2015 Marcos García - * Copyright (C) 2015 juanjo Menent + * Copyright (C) 2015-2007 Juanjo Menent * Copyright (C) 2015 Abbes Bahfir * Copyright (C) 2015-2016 Ferran Marcet * @@ -788,7 +788,7 @@ if ($resql) $thirdparty->name=$obj->name; $thirdparty->client=$obj->client; $thirdparty->code_client=$obj->code_client; - print $thirdparty->getNomUrl(1,'customer'); + print $thirdparty->getNomUrl(1,'supplier'); print ''; if (! $i) $totalarray['nbfield']++; } From ac58fd91af93883ce6207147e934ce7f7f8f1d1a Mon Sep 17 00:00:00 2001 From: Juanjo Menent Date: Wed, 11 Jan 2017 20:46:50 +0100 Subject: [PATCH 2/9] FIX #6253 Supplier invoice list filter does not respect "thirdparty" filter --- htdocs/fourn/facture/list.php | 1 + 1 file changed, 1 insertion(+) diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php index f2c42c3b14f..19f3f8ecbd7 100644 --- a/htdocs/fourn/facture/list.php +++ b/htdocs/fourn/facture/list.php @@ -434,6 +434,7 @@ if ($resql) print ''; print ''; print ''; + print ''; print_barre_liste($langs->trans("BillsSuppliers").($socid?" $soc->name.":""),$page,$_SERVER["PHP_SELF"],$param,$sortfield,$sortorder,'',$num,$nbtotalofrecords,'title_accountancy',0,'','',$limit); From bcba4a1a38a37869c55f58dff8c7c66eb2ad8895 Mon Sep 17 00:00:00 2001 From: Juanjo Menent Date: Wed, 11 Jan 2017 20:48:32 +0100 Subject: [PATCH 3/9] FIX #6253 Supplier invoice list filter does not respect "thirdparty" filter --- htdocs/fourn/facture/list.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/fourn/facture/list.php b/htdocs/fourn/facture/list.php index 19f3f8ecbd7..27c14f2a8d4 100644 --- a/htdocs/fourn/facture/list.php +++ b/htdocs/fourn/facture/list.php @@ -434,7 +434,7 @@ if ($resql) print ''; print ''; print ''; - print ''; + print ''; print_barre_liste($langs->trans("BillsSuppliers").($socid?" $soc->name.":""),$page,$_SERVER["PHP_SELF"],$param,$sortfield,$sortorder,'',$num,$nbtotalofrecords,'title_accountancy',0,'','',$limit); From 8d5c85326718652d4ed5cfc4e8435c52a059b2a8 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 12 Jan 2017 15:12:53 +0100 Subject: [PATCH 4/9] FIX Protection so even if link is output for external user, links is disabled. --- htdocs/societe/class/societe.class.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/htdocs/societe/class/societe.class.php b/htdocs/societe/class/societe.class.php index b3205d3fb44..12d7fcd77ef 100644 --- a/htdocs/societe/class/societe.class.php +++ b/htdocs/societe/class/societe.class.php @@ -1915,7 +1915,14 @@ class Societe extends CommonObject } $link.='>'; $linkend=''; - + + global $user; + if (! $user->rights->societe->client->voir && $user->societe_id > 0 && $this->id != $user->societe_id) + { + $link=''; + $linkend=''; + } + if ($withpicto) $result.=($link.img_object(($notooltip?'':$label), 'company', ($notooltip?'':'class="classfortooltip"')).$linkend); if ($withpicto && $withpicto != 2) $result.=' '; if ($withpicto != 2) $result.=$link.($maxlen?dol_trunc($name,$maxlen):$name).$linkend; From f185a09693859720e85501d9613fcdae52e92dce Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 12 Jan 2017 15:23:30 +0100 Subject: [PATCH 5/9] FIX Security access problem with external users on projects/tasks --- htdocs/langs/en_US/admin.lang | 4 ++-- htdocs/langs/en_US/errors.lang | 1 + htdocs/projet/card.php | 2 +- htdocs/projet/contact.php | 2 +- htdocs/projet/document.php | 2 +- htdocs/projet/element.php | 2 +- htdocs/projet/ganttview.php | 2 +- htdocs/projet/index.php | 2 +- htdocs/projet/info.php | 2 +- htdocs/projet/list.php | 9 ++++++--- htdocs/projet/note.php | 2 +- htdocs/projet/tasks.php | 5 +++-- htdocs/projet/tasks/contact.php | 2 +- htdocs/projet/tasks/document.php | 2 +- htdocs/projet/tasks/list.php | 2 +- htdocs/projet/tasks/note.php | 2 +- htdocs/projet/tasks/task.php | 2 +- htdocs/projet/tasks/time.php | 2 +- 18 files changed, 26 insertions(+), 21 deletions(-) diff --git a/htdocs/langs/en_US/admin.lang b/htdocs/langs/en_US/admin.lang index 7cb41b1d708..8aa36f0544a 100644 --- a/htdocs/langs/en_US/admin.lang +++ b/htdocs/langs/en_US/admin.lang @@ -560,7 +560,7 @@ Permission34=Delete products Permission36=See/manage hidden products Permission38=Export products Permission41=Read projects and tasks (shared project and projects i'm contact for). Can also enter time consumed on assigned tasks (timesheet) -Permission42=Create/modify projects (shared project and projects i'm contact for) +Permission42=Create/modify projects (shared project and projects i'm contact for). Can also create tasks and assign users to project and tasks Permission44=Delete projects (shared project and projects i'm contact for) Permission45=Export projects Permission61=Read interventions @@ -663,7 +663,7 @@ PermissionAdvanced253=Create/modify internal/external users and permissions Permission254=Create/modify external users only Permission255=Modify other users password Permission256=Delete or disable other users -Permission262=Extend access to all third parties (not only those linked to user). Not effective for external users (always limited to themselves). +Permission262=Extend access to all third parties (not only third parties that user is a sale representative). Not effective for external users (always limited to themselves for proposals, orders, invoices, contracts, etc). Not effective for projects (only rules on project permissions, visibility and assignement matters). Permission271=Read CA Permission272=Read invoices Permission273=Issue invoices diff --git a/htdocs/langs/en_US/errors.lang b/htdocs/langs/en_US/errors.lang index 6b99049e9ef..0e0b3e40960 100644 --- a/htdocs/langs/en_US/errors.lang +++ b/htdocs/langs/en_US/errors.lang @@ -176,6 +176,7 @@ ErrorStockIsNotEnoughToAddProductOnShipment=Stock is not enough for product %s t ErrorStockIsNotEnoughToAddProductOnProposal=Stock is not enough for product %s to add it into a new proposal. ErrorFailedToLoadLoginFileForMode=Failed to get the login key for mode '%s'. ErrorPhpMailDelivery=Check that you don't use a too high number of recipients and that your email content is not similar to a Spam. Ask also your administrator to check firewall and server logs files for a more complete information. +ErrorUserNotAssignedToTask=User must be assigned to task to be able to enter time consumed. # Warnings WarningPasswordSetWithNoAccount=A password was set for this member. However, no user account was created. So this password is stored but can't be used to login to Dolibarr. It may be used by an external module/interface but if you don't need to define any login nor password for a member, you can disable option "Manage a login for each member" from Member module setup. If you need to manage a login but don't need any password, you can keep this field empty to avoid this warning. Note: Email can also be used as a login if the member is linked to a user. diff --git a/htdocs/projet/card.php b/htdocs/projet/card.php index ad1d718fc55..8345ce69846 100644 --- a/htdocs/projet/card.php +++ b/htdocs/projet/card.php @@ -68,7 +68,7 @@ if ($id > 0 || ! empty($ref)) // Security check $socid=GETPOST('socid'); -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $object->id,'projet&project'); // fetch optionals attributes and labels diff --git a/htdocs/projet/contact.php b/htdocs/projet/contact.php index 794e9c3af00..492578905d9 100644 --- a/htdocs/projet/contact.php +++ b/htdocs/projet/contact.php @@ -46,7 +46,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu // Security check $socid=0; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $id,'projet&project'); diff --git a/htdocs/projet/document.php b/htdocs/projet/document.php index d59dec0dc4a..5bd46389eef 100644 --- a/htdocs/projet/document.php +++ b/htdocs/projet/document.php @@ -42,7 +42,7 @@ $mine = (GETPOST('mode','alpha') == 'mine' ? 1 : 0); // Security check $socid=0; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result=restrictedArea($user,'projet',$id,'projet&project'); $object = new Project($db); diff --git a/htdocs/projet/element.php b/htdocs/projet/element.php index 5673f74aa34..9fc957fa66b 100644 --- a/htdocs/projet/element.php +++ b/htdocs/projet/element.php @@ -92,7 +92,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu // Security check $socid=$object->socid; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $projectid, 'projet&project'); diff --git a/htdocs/projet/ganttview.php b/htdocs/projet/ganttview.php index b86a961bd69..2b992e05ef6 100644 --- a/htdocs/projet/ganttview.php +++ b/htdocs/projet/ganttview.php @@ -43,7 +43,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu // Security check $socid=0; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $id,'projet&project'); $langs->load("users"); diff --git a/htdocs/projet/index.php b/htdocs/projet/index.php index 752e3615464..20fca4b5abf 100644 --- a/htdocs/projet/index.php +++ b/htdocs/projet/index.php @@ -37,7 +37,7 @@ $mine = GETPOST('mode')=='mine' ? 1 : 0; // Security check $socid=0; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if (!$user->rights->projet->lire) accessforbidden(); $sortfield = GETPOST("sortfield",'alpha'); diff --git a/htdocs/projet/info.php b/htdocs/projet/info.php index c2e45560f74..281a2f8c94d 100644 --- a/htdocs/projet/info.php +++ b/htdocs/projet/info.php @@ -34,7 +34,7 @@ $langs->load("projects"); // Security check $socid=0; $id = GETPOST("id",'int'); -if ($user->societe_id) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result=restrictedArea($user,'projet',$id,''); diff --git a/htdocs/projet/list.php b/htdocs/projet/list.php index 6e7ccc26dd5..721baca4ced 100644 --- a/htdocs/projet/list.php +++ b/htdocs/projet/list.php @@ -40,7 +40,7 @@ $title = $langs->trans("Projects"); // Security check $socid = (is_numeric($_GET["socid"]) ? $_GET["socid"] : 0 ); -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if ($socid > 0) { $soc = new Societe($db); @@ -220,7 +220,9 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."c_lead_status as cls on p.fk_opp_status = cls.rowid"; // We'll need this table joined to the select in order to filter by sale -if ($search_sale > 0 || (! $user->rights->societe->client->voir && ! $socid)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid"; +// For external user, no check is done on company permission because readability is managed by public status of project and assignement. +//if ($search_sale > 0 || (! $user->rights->societe->client->voir && ! $socid)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid"; +if ($search_sale > 0) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid"; if ($search_user > 0) { $sql.=", ".MAIN_DB_PREFIX."element_contact as ecp"; @@ -271,7 +273,8 @@ if ($search_opp_status) } if ($search_public!='') $sql .= " AND p.public = ".$db->escape($search_public); if ($search_sale > 0) $sql.= " AND sc.fk_user = " .$search_sale; -if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND ((s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id.") OR (s.rowid IS NULL))"; +// For external user, no check is done on company permission because readability is managed by public status of project and assignement. +//if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND ((s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id.") OR (s.rowid IS NULL))"; if ($search_user > 0) $sql.= " AND ecp.fk_c_type_contact IN (".join(',',array_keys($listofprojectcontacttype)).") AND ecp.element_id = p.rowid AND ecp.fk_socpeople = ".$search_user; if ($search_opp_amount != '') $sql .= natural_search('p.opp_amount', $search_opp_amount, 1); if ($search_budget_amount != '') $sql .= natural_search('p.budget_amount', $search_budget_amount, 1); diff --git a/htdocs/projet/note.php b/htdocs/projet/note.php index 43df7ce3b3d..57bc235c8d0 100644 --- a/htdocs/projet/note.php +++ b/htdocs/projet/note.php @@ -41,7 +41,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu // Security check $socid=0; -if ($user->societe_id > 0) $socid=$user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $id,'projet&project'); $permissionnote=$user->rights->projet->creer; // Used by the include of actions_setnotes.inc.php diff --git a/htdocs/projet/tasks.php b/htdocs/projet/tasks.php index 9def807c746..5d5871ec280 100644 --- a/htdocs/projet/tasks.php +++ b/htdocs/projet/tasks.php @@ -61,7 +61,7 @@ $extralabels_task=$extrafields_task->fetch_name_optionals_label($taskstatic->tab // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. $result = restrictedArea($user, 'projet', $id,'projet&project'); // Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array @@ -413,7 +413,8 @@ else if ($id > 0 || ! empty($ref)) // Get list of tasks in tasksarray and taskarrayfiltered // We need all tasks (even not limited to a user because a task to user can have a parent that is not affected to him). - $tasksarray=$taskstatic->getTasksArray(0, 0, $object->id, $socid, 0); + $filteronthirdpartyid = $socid; + $tasksarray=$taskstatic->getTasksArray(0, 0, $object->id, $filteronthirdpartyid, 0); // We load also tasks limited to a particular user $tasksrole=($mode=='mine' ? $taskstatic->getUserRolesForProjectsOrTasks(0,$user,$object->id,0) : ''); //var_dump($tasksarray); diff --git a/htdocs/projet/tasks/contact.php b/htdocs/projet/tasks/contact.php index 6689f966c15..23feb647fc8 100644 --- a/htdocs/projet/tasks/contact.php +++ b/htdocs/projet/tasks/contact.php @@ -42,7 +42,7 @@ $project_ref=GETPOST('project_ref','alpha'); // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. //$result = restrictedArea($user, 'projet', $id, 'projet_task'); if (! $user->rights->projet->lire) accessforbidden(); diff --git a/htdocs/projet/tasks/document.php b/htdocs/projet/tasks/document.php index c9a69fc81a4..15c73450be6 100644 --- a/htdocs/projet/tasks/document.php +++ b/htdocs/projet/tasks/document.php @@ -47,7 +47,7 @@ $project_ref = GETPOST('project_ref','alpha'); // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. //$result=restrictedArea($user,'projet',$id,''); if (!$user->rights->projet->lire) accessforbidden(); diff --git a/htdocs/projet/tasks/list.php b/htdocs/projet/tasks/list.php index 5573441d646..f733ab03a1c 100644 --- a/htdocs/projet/tasks/list.php +++ b/htdocs/projet/tasks/list.php @@ -75,7 +75,7 @@ $search_array_options=$extrafields->getOptionalsFromPost($extralabels,'','search // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if (!$user->rights->projet->lire) accessforbidden(); $limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit; diff --git a/htdocs/projet/tasks/note.php b/htdocs/projet/tasks/note.php index 5d5cb38dbe5..880b2a25198 100644 --- a/htdocs/projet/tasks/note.php +++ b/htdocs/projet/tasks/note.php @@ -39,7 +39,7 @@ $project_ref = GETPOST('project_ref','alpha'); // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if (!$user->rights->projet->lire) accessforbidden(); //$result = restrictedArea($user, 'projet', $id, '', 'task'); // TODO ameliorer la verification diff --git a/htdocs/projet/tasks/task.php b/htdocs/projet/tasks/task.php index 6e0648b61e6..15ef42d5c83 100644 --- a/htdocs/projet/tasks/task.php +++ b/htdocs/projet/tasks/task.php @@ -47,7 +47,7 @@ $planned_workload=((GETPOST('planned_workloadhour')!='' && GETPOST('planned_work // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if (! $user->rights->projet->lire) accessforbidden(); // Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php index 96c849d8df9..f6da55731fc 100644 --- a/htdocs/projet/tasks/time.php +++ b/htdocs/projet/tasks/time.php @@ -43,7 +43,7 @@ $project_ref=GETPOST('project_ref','alpha'); // Security check $socid=0; -if ($user->societe_id > 0) $socid = $user->societe_id; +//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement. if (!$user->rights->projet->lire) accessforbidden(); // Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array From edb79de54e8e0aaa2956ae3578298f0e3cc98ddf Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 12 Jan 2017 18:07:19 +0100 Subject: [PATCH 6/9] FIX javascript error --- htdocs/compta/paiement.php | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/htdocs/compta/paiement.php b/htdocs/compta/paiement.php index fa1341dcbc6..5e73c3dd710 100644 --- a/htdocs/compta/paiement.php +++ b/htdocs/compta/paiement.php @@ -391,10 +391,9 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie var form = $("#payment_form"); json["invoice_type"] = $("#invoice_type").val(); - json["amountPayment"] = $("#amountpayment").attr("value"); + json["amountPayment"] = $("#amountpayment").attr("value"); json["amounts"] = _elemToJson(form.find("input.amount")); - json["remains"] = _elemToJson(form.find("input.remain]")); - + json["remains"] = _elemToJson(form.find("input.remain")); if (imgId != null) { json["imgClicked"] = imgId; } From 380b61a0e9b0e8b08094b8843883c1f7a56771d6 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 12 Jan 2017 21:56:50 +0100 Subject: [PATCH 7/9] FIX Can make a stock transfert on product not on sale/purchase. --- htdocs/product/stock/massstockmove.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/product/stock/massstockmove.php b/htdocs/product/stock/massstockmove.php index b8ec52efcab..0cebc666c1e 100644 --- a/htdocs/product/stock/massstockmove.php +++ b/htdocs/product/stock/massstockmove.php @@ -372,7 +372,7 @@ else { $limit = $conf->global->PRODUIT_LIMIT_SIZE; } -print $form->select_produits($id_product,'productid',$filtertype,$limit); +print $form->select_produits($id_product,'productid',$filtertype,$limit,0,-1); print ''; // Batch number if ($conf->productbatch->enabled) From 3a2f44adaca76269c8883461e554e1c27deb377d Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 13 Jan 2017 13:43:09 +0100 Subject: [PATCH 8/9] Fix security permissions to edit/delete time spent --- htdocs/projet/tasks/time.php | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php index f6da55731fc..aa572966321 100644 --- a/htdocs/projet/tasks/time.php +++ b/htdocs/projet/tasks/time.php @@ -128,7 +128,7 @@ if ($action == 'addtimespent' && $user->rights->projet->lire) } } -if ($action == 'updateline' && ! $_POST["cancel"] && $user->rights->projet->creer) +if ($action == 'updateline' && ! $_POST["cancel"] && $user->rights->projet->lire) { $error=0; @@ -141,7 +141,8 @@ if ($action == 'updateline' && ! $_POST["cancel"] && $user->rights->projet->cree if (! $error) { $object->fetch($id, $ref); - + // TODO Check that ($task_time->fk_user == $user->id || in_array($task_time->fk_user, $childids)) + $object->timespent_id = $_POST["lineid"]; $object->timespent_note = $_POST["timespent_note_line"]; $object->timespent_old_duration = $_POST["old_duration"]; @@ -175,9 +176,10 @@ if ($action == 'updateline' && ! $_POST["cancel"] && $user->rights->projet->cree } } -if ($action == 'confirm_delete' && $confirm == "yes" && $user->rights->projet->creer) +if ($action == 'confirm_delete' && $confirm == "yes" && $user->rights->projet->lire) { $object->fetchTimeSpent($_GET['lineid']); + // TODO Check that ($task_time->fk_user == $user->id || in_array($task_time->fk_user, $childids)) $result = $object->delTimeSpent($user); if ($result < 0) @@ -585,6 +587,8 @@ if (($id > 0 || ! empty($ref)) || $projectidforalltimes > 0) $tasktmp = new Task($db); + $childids = $user->getAllChildIds(); + $total = 0; $totalvalue = 0; foreach ($tasks as $task_time) @@ -688,17 +692,20 @@ if (($id > 0 || ! empty($ref)) || $projectidforalltimes > 0) print '
'; print ''; } - else if ($user->rights->projet->creer) + else if ($user->rights->projet->lire) // Read project and enter time consumed on assigned tasks { - print ' '; - print 'rowid.($withproject?'&withproject=1':'').'">'; - print img_edit(); - print ''; - - print ' '; - print 'rowid.($withproject?'&withproject=1':'').'">'; - print img_delete(); - print ''; + if ($task_time->fk_user == $user->id || in_array($task_time->fk_user, $childids)) + { + print ' '; + print 'rowid.($withproject?'&withproject=1':'').'">'; + print img_edit(); + print ''; + + print ' '; + print 'rowid.($withproject?'&withproject=1':'').'">'; + print img_delete(); + print ''; + } } print ''; From 31818e8816337a35561f47e7c3b629bf866739fa Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 13 Jan 2017 15:32:20 +0100 Subject: [PATCH 9/9] Fix missing translation --- htdocs/comm/mailing/card.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/htdocs/comm/mailing/card.php b/htdocs/comm/mailing/card.php index 3660b560f78..74ed28ba268 100644 --- a/htdocs/comm/mailing/card.php +++ b/htdocs/comm/mailing/card.php @@ -755,7 +755,7 @@ else // MAILING_NO_USING_PHPMAIL may be defined or not. // MAILING_LIMIT_SENDBYWEB is always defined to something != 0 (-1=forbidden). - // MAILING_LIMIT_SENDBYCLI may be defined ot not (-1=forbidden, 0=no limit). + // MAILING_LIMIT_SENDBYCLI may be defined ot not (-1=forbidden, 0 or undefined=no limit). if (! empty($conf->global->MAILING_NO_USING_PHPMAIL) && $sendingmode == 'mail') { // EMailing feature may be a spam problem, so when you host several users/instance, having this option may force each user to use their own SMTP agent. @@ -769,8 +769,8 @@ else } else if ($conf->global->MAILING_LIMIT_SENDBYWEB == '-1') { - if (! empty($conf->global->MAILING_LIMIT_WARNING_PHPMAIL) && $sendingmode == 'mail') setEventMessages($conf->global->MAILING_LIMIT_WARNING_PHPMAIL, null, 'warnings'); - if (! empty($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL) && $sendingmode != 'mail') setEventMessages($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL, null, 'warnings'); + if (! empty($conf->global->MAILING_LIMIT_WARNING_PHPMAIL) && $sendingmode == 'mail') setEventMessages($langs->transnoentitiesnoconv($conf->global->MAILING_LIMIT_WARNING_PHPMAIL), null, 'warnings'); + if (! empty($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL) && $sendingmode != 'mail') setEventMessages($langs->transnoentitiesnoconv($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL), null, 'warnings'); // The feature is forbidden from GUI, we show just message to use from command line. setEventMessages($langs->trans("MailingNeedCommand"), null, 'warnings'); @@ -783,8 +783,8 @@ else } else { - if (! empty($conf->global->MAILING_LIMIT_WARNING_PHPMAIL) && $sendingmode == 'mail') setEventMessages($conf->global->MAILING_LIMIT_WARNING_PHPMAIL, null, 'warnings'); - if (! empty($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL) && $sendingmode != 'mail') setEventMessages($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL, null, 'warnings'); + if (! empty($conf->global->MAILING_LIMIT_WARNING_PHPMAIL) && $sendingmode == 'mail') setEventMessages($langs->transnoentitiesnoconv($conf->global->MAILING_LIMIT_WARNING_PHPMAIL), null, 'warnings'); + if (! empty($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL) && $sendingmode != 'mail') setEventMessages($langs->transnoentitiesnoconv($conf->global->MAILING_LIMIT_WARNING_NOPHPMAIL), null, 'warnings'); $text=''; if ($conf->global->MAILING_LIMIT_SENDBYCLI >= 0)