lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: security with multi-company

Browse Source
This commit is contained in:
Regis Houssin 2009-05-04 08:31:42 +00:00
parent 7eb2cdef3d
commit 825f3346c9
21 changed files with 230 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/categories/categorie.php
View File

@ -41,19 +41,20 @@ if ($_REQUEST["socid"])
if ($_REQUEST["typeid"] == 2) { $type = 'societe'; $socid = isset($_REQUEST["socid"])?$_REQUEST["socid"]:''; }
$objecttype = 'societe';
$objectid = isset($_REQUEST["socid"])?$_REQUEST["socid"]:'';
$fieldid = 'rowid';
}
else if ($_REQUEST["id"] || $_REQUEST["ref"])
{
$type = 'produit';
$objecttype = 'produit';
$objectid = isset($_REQUEST["id"])?$_REQUEST["id"]:(isset($_REQUEST["ref"])?$_REQUEST["ref"]:'');
$dbtablename = 'product';
$fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
// Security check
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, $objecttype, $objectid, $dbtablename);
$result = restrictedArea($user,$objecttype,$objectid,$dbtablename,'','',$fieldid);
/*
* Actions

18
htdocs/product/barcode.php
View File

@ -1,7 +1,7 @@
<?php
/* Copyright (C) 2001-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2008 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2007 Regis Houssin <regis@dolibarr.fr>
* Copyright (C) 2005-2009 Regis Houssin <regis@dolibarr.fr>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@ -33,8 +33,20 @@ require_once(DOL_DOCUMENT_ROOT."/includes/barcode/html.formbarcode.class.php");
$langs->load("products");
$langs->load("bills");
if (!$user->rights->barcode->lire)
accessforbidden();
// Security check
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
/*
* Actions

18
htdocs/product/document.php
View File

@ -36,12 +36,22 @@ require_once(DOL_DOCUMENT_ROOT."/html.formfile.class.php");
$langs->load("other");
$langs->load("products");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action']) : $_GET['action'];
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
// Security check
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
// Get parameters
$page=$_GET["page"];

2
htdocs/product/fiche.php
View File

@ -36,8 +36,6 @@ require_once(DOL_DOCUMENT_ROOT."/facture.class.php");
require_once(DOL_DOCUMENT_ROOT."/product.class.php");
require_once(DOL_DOCUMENT_ROOT."/commande/commande.class.php");
if (!$user->rights->produit->lire) accessforbidden();
$langs->load("bills");
$langs->load("other");
$langs->load("stocks");

14
htdocs/product/fournisseurs.php
View File

@ -36,9 +36,19 @@ $langs->load("suppliers");
$langs->load("bills");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/photos.php
View File

@ -35,9 +35,19 @@ $langs->load("products");
$langs->load("bills");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

9
htdocs/product/popuprop.php
View File

@ -28,6 +28,10 @@
require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT.'/product.class.php');
// Security check
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit');
$sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"];
$sortorder = isset($_GET["sortorder"])?$_GET["sortorder"]:$_POST["sortorder"];
$page = $_GET["page"];
@ -46,7 +50,10 @@ $staticproduct=new Product($db);
llxHeader();
//On n'affiche le lien page suivante que s'il y a une page suivante ...
$sql = "select count(*) as c from ".MAIN_DB_PREFIX."product";
$sql = "SELECT count(*) as c";
$sql.= " FROM ".MAIN_DB_PREFIX."product";
$sql.= " WHERE entity = ".$conf->entity;
$result=$db->query($sql);
if ($result)
{

14
htdocs/product/price.php
View File

@ -35,9 +35,19 @@ $langs->load("products");
$langs->load("bills");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
/*

5
htdocs/product/reassort.php
View File

@ -32,8 +32,9 @@ require_once(DOL_DOCUMENT_ROOT."/categories/categorie.class.php");
$langs->load("products");
$langs->load("stocks");
if (!$user->rights->produit->lire)
accessforbidden();
// Security check
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit');
$sref=isset($_GET["sref"])?$_GET["sref"]:$_POST["sref"];

14
htdocs/product/sousproduits/fiche.php
View File

@ -36,9 +36,19 @@ $langs->load("bills");
$langs->load("products");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/stats/commande.php
View File

@ -36,9 +36,19 @@ $langs->load("products");
$langs->load("companies");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/stats/commande_fournisseur.php
View File

@ -36,9 +36,19 @@ $langs->load("products");
$langs->load("companies");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

34
htdocs/product/stats/commandestats.class.php
View File

@ -35,7 +35,12 @@ class CommandeStats
function getNbCommandeByYear()
{
$result = array();
$sql = "SELECT date_format(date_commande,'%Y') as dm, count(*) FROM ".MAIN_DB_PREFIX."commande GROUP BY dm DESC WHERE fk_statut > 0";
$sql = "SELECT date_format(date_commande,'%Y') as dm, count(*)";
$sql.= " FROM ".MAIN_DB_PREFIX."commande";
$sql.= " WHERE fk_statut > 0";
$sql.= " AND entity = ".$conf->entity;
$sql.= " GROUP BY dm DESC";
if ($this->db->query($sql))
{
$num = $this->db->num_rows();
@ -58,9 +63,12 @@ class CommandeStats
function getNbCommandeByMonth($year)
{
$result = array();
$sql = "SELECT date_format(date_commande,'%m') as dm, count(*) FROM ".MAIN_DB_PREFIX."commande";
$sql .= " WHERE date_format(date_commande,'%Y') = $year AND fk_statut > 0";
$sql .= " GROUP BY dm DESC";
$sql = "SELECT date_format(date_commande,'%m') as dm, count(*)";
$sql.= " FROM ".MAIN_DB_PREFIX."commande";
$sql.= " WHERE date_format(date_commande,'%Y') = ".$year;
$sql.= " AND fk_statut > 0";
$sql.= " AND entity = ".$conf->entity;
$sql.= " GROUP BY dm DESC";
if ($this->db->query($sql))
{
@ -90,9 +98,12 @@ class CommandeStats
function getCommandeAmountByMonth($year)
{
$result = array();
$sql = "SELECT date_format(date_commande,'%m') as dm, sum(total_ht) FROM ".MAIN_DB_PREFIX."commande";
$sql .= " WHERE date_format(date_commande,'%Y') = $year AND fk_statut > 0";
$sql .= " GROUP BY dm DESC";
$sql = "SELECT date_format(date_commande,'%m') as dm, sum(total_ht)";
$sql.= " FROM ".MAIN_DB_PREFIX."commande";
$sql.= " WHERE date_format(date_commande,'%Y') = ".$year;
$sql.= " AND fk_statut > 0";
$sql.= " AND entity = ".$conf->entity;
$sql.= " GROUP BY dm DESC";
if ($this->db->query($sql))
{
@ -122,9 +133,12 @@ class CommandeStats
function getCommandeAverageByMonth($year)
{
$result = array();
$sql = "SELECT date_format(date_commande,'%m') as dm, avg(total_ht) FROM ".MAIN_DB_PREFIX."commande";
$sql .= " WHERE date_format(date_commande,'%Y') = $year AND fk_statut > 0";
$sql .= " GROUP BY dm DESC";
$sql = "SELECT date_format(date_commande,'%m') as dm, avg(total_ht)";
$sql.= " FROM ".MAIN_DB_PREFIX."commande";
$sql.= " WHERE date_format(date_commande,'%Y') = ".$year;
$sql.= " AND fk_statut > 0";
$sql.= " AND entity = ".$conf->entity;
$sql.= " GROUP BY dm DESC";
if ($this->db->query($sql))
{

27
htdocs/product/stats/contrat.php
View File

@ -34,6 +34,21 @@ $langs->load("contracts");
$langs->load("products");
$langs->load("companies");
// Security check
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';
$page = $_GET["page"];
@ -46,18 +61,6 @@ $pagenext = $_GET["page"] + 1;
if (! $sortorder) $sortorder="DESC";
if (! $sortfield) $sortfield="c.datec";
// Securite
$socid = 0;
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
else
{
$socid = 0;
}
/*
* View

14
htdocs/product/stats/facture.php
View File

@ -36,9 +36,19 @@ $langs->load("bills");
$langs->load("products");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/stats/facture_fournisseur.php
View File

@ -37,9 +37,19 @@ $langs->load("products");
$langs->load("companies");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/stats/fiche.php
View File

@ -39,9 +39,19 @@ $langs->load("other");
$mode=isset($_GET["mode"])?$_GET["mode"]:'byunit';
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

3
htdocs/product/stats/index.php
View File

@ -31,6 +31,9 @@
require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/propal.class.php");
// Security check
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit');
llxHeader();

14
htdocs/product/stats/propal.php
View File

@ -35,9 +35,19 @@ $langs->load("products");
$langs->load("companies");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

16
htdocs/product/stock/product.php
View File

@ -32,16 +32,24 @@ require_once(DOL_DOCUMENT_ROOT."/lib/product.lib.php");
require_once(DOL_DOCUMENT_ROOT."/product.class.php");
require_once(DOL_DOCUMENT_ROOT."/html.formproduct.class.php");
if (! $user->rights->produit->lire || ! $product->type == 0 || ! $conf->stock->enabled) accessforbidden();
$langs->load("products");
$langs->load("orders");
$langs->load("bills");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
$mesg = '';

14
htdocs/product/traduction.php
View File

@ -36,9 +36,19 @@ $langs->load("products");
$langs->load("bills");
// Security check
$id = isset($_GET["id"])?$_GET["id"]:'';
$id = '';
if (isset($_GET["id"]))
{
$id = $_GET["id"];
$fieldid = 'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
}
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product');
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
/*