diff --git a/htdocs/public/test/test_arrays.php b/htdocs/public/test/test_arrays.php index b2a87a75480..01910f71aaf 100644 --- a/htdocs/public/test/test_arrays.php +++ b/htdocs/public/test/test_arrays.php @@ -22,19 +22,22 @@ if (!defined("NOLOGIN")) { define("NOLOGIN", '1'); // If this page is public (can be called outside logged session) } - require '../../main.inc.php'; +// Security if ($dolibarr_main_prod) { - accessforbidden(); + accessforbidden('Access forbidden when $dolibarr_main_prod is set to 1'); } -$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header + + +/* + * View + */ $form = new Form($db); - - +$usedolheader = 1; // 1 = Test inside a dolibarr page, 0 = Use hard coded header // HEADER //-------- @@ -150,7 +153,7 @@ This page is a sample of page using tables. It is designed to make test with


Example 1 : Standard table/thead/tbody/tr/th-td (no class pair/impair on td) => Use this if you need the drag and drop for lines or for long result tables
- +
+ + + + + diff --git a/htdocs/public/test/test_exec.php b/htdocs/public/test/test_exec.php new file mode 100644 index 00000000000..94a1d96462b --- /dev/null +++ b/htdocs/public/test/test_exec.php @@ -0,0 +1,101 @@ +\n"; +print "Legend:
\n"; +print 'PHP_SESSION_DISABLED='.PHP_SESSION_DISABLED."
\n"; +print 'PHP_SESSION_NONE='.PHP_SESSION_NONE."
\n"; +print 'PHP_SESSION_ACTIVE='.PHP_SESSION_ACTIVE."
\n"; +print '
'; + +print 'session_status='.session_status().' (before main.inc.php)
'; + +print '

'."\n"; + +require '../../main.inc.php'; + +// Security +if ($dolibarr_main_prod) { + accessforbidden('Access forbidden when $dolibarr_main_prod is set to 1'); +} + + +/* + * View + */ + +print "*** TEST READ OF /tmp/test.txt FILE
\n"; + +$out=''; +$ret=0; + +$file = '/tmp/test.txt'; +$f=fopen($file, 'r'); +if ($f) { + $s=fread($f, 4096); + print $s; + fclose($f); +} else { + print "Failed to open file ".$file."
\n"; +} + +print '

'."\n"; + + +print "*** TEST READ OF /test.txt FILE AND LS /dev/std*
\n"; + +exec('cat /test.txt; ls /dev/std*; sleep 1;', $out, $ret); +print $ret."
\n"; +print_r($out); +print '
'; + +print '

'."\n"; + + +print "*** TRY TO RUN CLAMDSCAN
\n"; + +$ret = 0; +$out = null; +exec('/usr/bin/clamdscan --fdpass filethatdoesnotexists.php', $out, $ret); +print $ret."
\n"; +print_r($out); diff --git a/htdocs/public/test/test_forms.php b/htdocs/public/test/test_forms.php index d89e04e12a6..47d827cbaf5 100644 --- a/htdocs/public/test/test_forms.php +++ b/htdocs/public/test/test_forms.php @@ -8,10 +8,16 @@ if (!defined('NOSESSION')) { require '../../main.inc.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; +// Security if ($dolibarr_main_prod) { - accessforbidden(); + accessforbidden('Access forbidden when $dolibarr_main_prod is set to 1'); } + +/* + * View + */ + llxHeader(); ?> diff --git a/htdocs/public/test/test_sessionlock.php b/htdocs/public/test/test_sessionlock.php index 18a1ef73d08..8464ba2eb4f 100644 --- a/htdocs/public/test/test_sessionlock.php +++ b/htdocs/public/test/test_sessionlock.php @@ -52,11 +52,15 @@ print '
'; require '../../main.inc.php'; -/* No need for this. +// Security if ($dolibarr_main_prod) { accessforbidden(); } -*/ + + +/* + * View + */ print 'session_status='.session_status().' (after main.inc.php)'; print '
'; diff --git a/htdocs/public/ticket/create_ticket.php b/htdocs/public/ticket/create_ticket.php index b911e7480d3..51424d9277e 100644 --- a/htdocs/public/ticket/create_ticket.php +++ b/htdocs/public/ticket/create_ticket.php @@ -4,7 +4,7 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or + * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, @@ -47,6 +47,12 @@ if (!defined('NOBROWSERNOTIF')) { define('NOBROWSERNOTIF', '1'); } +// For MultiCompany module. +// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php +$entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); +if (is_numeric($entity)) { + define("DOLENTITY", $entity); +} require '../../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/ticket/class/actions_ticket.class.php'; @@ -75,6 +81,10 @@ $extrafields = new ExtraFields($db); $extrafields->fetch_name_optionals_label($object->table_element); +if (empty($conf->ticket->enabled)) { + accessforbidden('', 0, 0, 1); +} + /* * Actions @@ -89,7 +99,7 @@ if ($reshook < 0) { setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); } // Add file in email form -if (empty($reshook) && GETPOST('addfile', 'alpha') && !GETPOST('add', 'alpha')) { +if (empty($reshook) && GETPOST('addfile', 'alpha') && !GETPOST('save', 'alpha')) { ////$res = $object->fetch('','',GETPOST('track_id')); ////if($res > 0) ////{ @@ -108,7 +118,7 @@ if (empty($reshook) && GETPOST('addfile', 'alpha') && !GETPOST('add', 'alpha')) } // Remove file -if (empty($reshook) && GETPOST('removedfile', 'alpha') && !GETPOST('add', 'alpha')) { +if (empty($reshook) && GETPOST('removedfile', 'alpha') && !GETPOST('save', 'alpha')) { include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; // Set tmp directory @@ -116,11 +126,11 @@ if (empty($reshook) && GETPOST('removedfile', 'alpha') && !GETPOST('add', 'alpha $upload_dir_tmp = $vardir.'/temp/'.session_id(); // TODO Delete only files that was uploaded from email form - dol_remove_file_process($_POST['removedfile'], 0, 0); + dol_remove_file_process(GETPOST('removedfile'), 0, 0); $action = 'create_ticket'; } -if (empty($reshook) && $action == 'create_ticket' && GETPOST('add', 'alpha')) { +if (empty($reshook) && $action == 'create_ticket' && GETPOST('save', 'alpha')) { $error = 0; $origin_email = GETPOST('email', 'alpha'); if (empty($origin_email)) { @@ -163,7 +173,7 @@ if (empty($reshook) && $action == 'create_ticket' && GETPOST('add', 'alpha')) { // Check Captcha code if is enabled if (!empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA)) { $sessionkey = 'dol_antispam_value'; - $ok = (array_key_exists($sessionkey, $_SESSION) === true && (strtolower($_SESSION[$sessionkey]) === strtolower(GETPOST('code', 'none')))); + $ok = (array_key_exists($sessionkey, $_SESSION) === true && (strtolower($_SESSION[$sessionkey]) === strtolower(GETPOST('code', 'restricthtml')))); if (!$ok) { $error++; array_push($object->errors, $langs->trans("ErrorBadValueForCode")); @@ -249,7 +259,7 @@ if (empty($reshook) && $action == 'create_ticket' && GETPOST('add', 'alpha')) { $message = ($conf->global->TICKET_MESSAGE_MAIL_NEW ? $conf->global->TICKET_MESSAGE_MAIL_NEW : $langs->transnoentities('TicketNewEmailBody')).'

'; $message .= $langs->transnoentities('TicketNewEmailBodyInfosTicket').'
'; - $url_public_ticket = ($conf->global->TICKET_URL_PUBLIC_INTERFACE ? $conf->global->TICKET_URL_PUBLIC_INTERFACE.'/' : dol_buildpath('/public/ticket/view.php', 2)).'?track_id='.$object->track_id; + $url_public_ticket = ($conf->global->TICKET_URL_PUBLIC_INTERFACE ? $conf->global->TICKET_URL_PUBLIC_INTERFACE.'/view.php' : dol_buildpath('/public/ticket/view.php', 2)).'?track_id='.$object->track_id; $infos_new_ticket = $langs->transnoentities('TicketNewEmailBodyInfosTrackId', ''.$object->track_id.'').'
'; $infos_new_ticket .= $langs->transnoentities('TicketNewEmailBodyInfosTrackUrl').'

'; @@ -293,7 +303,7 @@ if (empty($reshook) && $action == 'create_ticket' && GETPOST('add', 'alpha')) { if (is_array($object->array_options) && count($object->array_options) > 0) { foreach ($object->array_options as $key => $value) { $key = substr($key, 8); // remove "options_" - $message_admin .= '
  • '.$langs->trans($extrafields->attributes[$object->element]['label'][$key]).' : '.$extrafields->showOutputField($key, $value).'
    • '; + $message_admin .= '
  • '.$langs->trans($extrafields->attributes[$object->table_element]['label'][$key]).' : '.$extrafields->showOutputField($key, $value, '', $object->table_element).'
    • '; } } $message_admin .= ''; @@ -338,7 +348,7 @@ if (empty($reshook) && $action == 'create_ticket' && GETPOST('add', 'alpha')) { $messagetoshow = str_replace(array('{s1}', '{s2}'), array(''.$object->track_id.'', ''.$object->ref.''), $messagetoshow); setEventMessages($messagetoshow, null, 'warnings'); setEventMessages($langs->trans('PleaseRememberThisId'), null, 'warnings'); - header("Location: index.php"); + header("Location: index.php".(!empty($entity) && !empty($conf->multicompany->enabled)?'?entity='.$entity:'')); exit; } } else { diff --git a/htdocs/public/ticket/index.php b/htdocs/public/ticket/index.php index 31ee838f6f5..227dcf3867b 100644 --- a/htdocs/public/ticket/index.php +++ b/htdocs/public/ticket/index.php @@ -40,7 +40,6 @@ if (!defined('NOBROWSERNOTIF')) { // For MultiCompany module. // Do not use GETPOST here, function is not defined and define must be done before including main.inc.php -// TODO This should be useless. Because entity must be retrieve from object ref and not from url. $entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); if (is_numeric($entity)) { define("DOLENTITY", $entity); @@ -61,6 +60,10 @@ $langs->loadLangs(array('companies', 'other', 'ticket', 'errors')); $track_id = GETPOST('track_id', 'alpha'); $action = GETPOST('action', 'aZ09'); +if (empty($conf->ticket->enabled)) { + accessforbidden('', 0, 0, 1); +} + /* * View @@ -73,7 +76,6 @@ if (empty($conf->global->TICKET_ENABLE_PUBLIC_INTERFACE)) { print $langs->trans('TicketPublicInterfaceForbidden'); exit; } - $arrayofjs = array(); $arrayofcss = array('/ticket/css/styles.css.php'); @@ -82,9 +84,9 @@ llxHeaderTicket($langs->trans("Tickets"), "", 0, 0, $arrayofjs, $arrayofcss); print '
    '; print '

    '.($conf->global->TICKET_PUBLIC_TEXT_HOME ? $conf->global->TICKET_PUBLIC_TEXT_HOME : $langs->trans("TicketPublicDesc")).'

    '; print '
    '; -print '

    '.dol_escape_htmltag($langs->trans("CreateTicket")).'
    '; -print '

    '.dol_escape_htmltag($langs->trans("ViewMyTicketList")).'
    '; -print '
    '.img_picto('', 'ticket', 'class="fa-15x"').'
    '.dol_escape_htmltag($langs->trans("ShowTicketWithTrackId")).'
    '; +print '

    '.dol_escape_htmltag($langs->trans("CreateTicket")).'
    '; +print '

    '.dol_escape_htmltag($langs->trans("ViewMyTicketList")).'
    '; +print '
    '.img_picto('', 'ticket', 'class="fa-15x"').'
    '.dol_escape_htmltag($langs->trans("ShowTicketWithTrackId")).'
    '; print '
    '; print '
    '; print '
    '; diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php index 3c5dfffba17..1a3c0c3babd 100644 --- a/htdocs/public/ticket/list.php +++ b/htdocs/public/ticket/list.php @@ -40,6 +40,13 @@ if (!defined('NOBROWSERNOTIF')) { } // If this page is public (can be called outside logged session) +// For MultiCompany module. +// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php +$entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1)); +if (is_numeric($entity)) { + define("DOLENTITY", $entity); +} + require '../../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/ticket/class/actions_ticket.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formticket.class.php'; @@ -70,6 +77,12 @@ if (isset($_SESSION['email_customer'])) { $object = new Ticket($db); +// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context +$hookmanager->initHooks(array('ticketpubliclist', 'globalcard')); + +if (empty($conf->ticket->enabled)) { + accessforbidden('', 0, 0, 1); +} @@ -151,10 +164,6 @@ if ($action == "view_ticketlist") { } } -//$object->doActions($action); - - - /* * View */ @@ -212,6 +221,9 @@ if ($action == "view_ticketlist") { $filter = array(); $param = 'action=view_ticketlist'; + if (!empty($entity) && !empty($conf->multicompany->enabled)) { + $param .= '&entity='.$entity; + } // Definition of fields for list $arrayfields = array( @@ -285,8 +297,8 @@ if ($action == "view_ticketlist") { require DOL_DOCUMENT_ROOT.'/core/actions_changeselectedfields.inc.php'; - $sortfield = GETPOST("sortfield", 'alpha'); - $sortorder = GETPOST("sortorder", 'alpha'); + $sortfield = GETPOST('sortfield', 'aZ09comma'); + $sortorder = GETPOST('sortorder', 'aZ09comma'); if (!$sortfield) { $sortfield = 't.datec'; @@ -332,7 +344,7 @@ if ($action == "view_ticketlist") { // Add fields for extrafields if (is_array($extrafields->attributes[$object->table_element]['label']) && count($extrafields->attributes[$object->table_element]['label'])) { foreach ($extrafields->attributes[$object->table_element]['label'] as $key => $val) { - $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key.' as options_'.$key : ''); + $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key." as options_".$key : ''); } } $sql .= " FROM ".MAIN_DB_PREFIX."ticket as t"; @@ -359,28 +371,28 @@ if ($action == "view_ticketlist") { if (!empty($filter)) { foreach ($filter as $key => $value) { if (strpos($key, 'date')) { // To allow $filter['YEAR(s.dated)']=>$year - $sql .= ' AND '.$key.' = \''.$db->escape($value).'\''; + $sql .= " AND ".$key." = '".$db->escape($value)."'"; } elseif (($key == 't.fk_user_assign') || ($key == 't.type_code') || ($key == 't.category_code') || ($key == 't.severity_code')) { $sql .= " AND ".$key." = '".$db->escape($value)."'"; } elseif ($key == 't.fk_statut') { if (is_array($value) && count($value) > 0) { - $sql .= 'AND '.$key.' IN ('.$db->sanitize(implode(',', $value)).')'; + $sql .= " AND ".$key." IN (".$db->sanitize(implode(',', $value)).")"; } else { - $sql .= ' AND '.$key.' = '.((int) $value); + $sql .= " AND ".$key." = ".((int) $value); } } else { - $sql .= ' AND '.$key.' LIKE \'%'.$db->escape($value).'%\''; + $sql .= " AND ".$key." LIKE '%".$db->escape($value)."%'"; } } } //$sql .= " GROUP BY t.track_id"; - $sql .= " ORDER BY ".$sortfield.' '.$sortorder; + $sql .= $db->order($sortfield, $sortorder); $resql = $db->query($sql); if ($resql) { $num_total = $db->num_rows($resql); if (!empty($limit)) { - $sql .= ' '.$db->plimit($limit + 1, $offset); + $sql .= $db->plimit($limit + 1, $offset); } $resql = $db->query($sql); @@ -389,7 +401,7 @@ if ($action == "view_ticketlist") { print_barre_liste($langs->trans('TicketList'), $page, 'public/list.php', $param, $sortfield, $sortorder, '', $num, $num_total, 'ticket'); // Search bar - print '
    '."\n"; + print ''."\n"; print ''; print ''; print ''; @@ -398,6 +410,11 @@ if ($action == "view_ticketlist") { $varpage = empty($contextpage) ? $url_page_current : $contextpage; $selectedfields = $form->multiSelectArrayWithCheckbox('selectedfields', $arrayfields, $varpage); // This also change content of $arrayfields + // allow to display information before list + $parameters=array('arrayfields'=>$arrayfields); + $reshook=$hookmanager->executeHooks('printFieldListHeader', $parameters, $object, $action); // Note that $action and $object may have been modified by hook + print $hookmanager->resPrint; + print '