lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Double degr de vrifications permettant l'affichage d'un message d'erreur en cas d'dition non autorise.

Browse Source
This commit is contained in:
ywarnier 2006-12-17 20:47:49 +00:00
parent 10449d18df
commit 84377464e2
1 changed files with 32 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
htdocs/user/group/fiche.php
View File

@ -36,6 +36,7 @@ $caneditperms=($user->admin || $user->rights->user->user->creer);
$candisableperms=($user->admin || $user->rights->user->user->supprimer); $candisableperms=($user->admin || $user->rights->user->user->supprimer);
$langs->load("users"); $langs->load("users");
$langs->load("other");
$action=isset($_GET["action"])?$_GET["action"]:$_POST["action"]; $action=isset($_GET["action"])?$_GET["action"]:$_POST["action"];
@ -45,17 +46,22 @@ $action=isset($_GET["action"])?$_GET["action"]:$_POST["action"];
*/ */
if ($_POST["action"] == 'confirm_delete' && $_POST["confirm"] == "yes") if ($_POST["action"] == 'confirm_delete' && $_POST["confirm"] == "yes")
{ {
$editgroup = new Usergroup($db, $_GET["id"]); if($caneditperms){
$editgroup->fetch($_GET["id"]); $editgroup = new Usergroup($db, $_GET["id"]);
$editgroup->delete(); $editgroup->fetch($_GET["id"]);
Header("Location: index.php"); $editgroup->delete();
Header("Location: index.php");
}else{
$message = '<div class="error">'.$langs->trans('ErrorForbidden').'</div>';
}
} }
/** /**
* Action ajout groupe * Action ajout groupe
*/ */
if ($_POST["action"] == 'add' && $caneditperms) if ($_POST["action"] == 'add')
{ {
if($caneditperms){
$message=""; $message="";
if (! $_POST["nom"]) { if (! $_POST["nom"]) {
$message='<div class="error">'.$langs->trans("NameNotDefined").'</div>'; $message='<div class="error">'.$langs->trans("NameNotDefined").'</div>';
@ -86,10 +92,14 @@ if ($_POST["action"] == 'add' && $caneditperms)
$action="create"; // Go back to create page $action="create"; // Go back to create page
} }
} }
}else{
$message = '<div class="error">'.$langs->trans('ErrorForbidden').'</div>';
}
} }
if ($_POST["action"] == 'adduser' && $caneditperms) if ($_POST["action"] == 'adduser')
{ {
if($caneditperms){
if ($_POST["user"]) if ($_POST["user"])
{ {
$edituser = new User($db, $_POST["user"]); $edituser = new User($db, $_POST["user"]);
@ -97,10 +107,14 @@ if ($_POST["action"] == 'adduser' && $caneditperms)
Header("Location: fiche.php?id=".$_GET["id"]); Header("Location: fiche.php?id=".$_GET["id"]);
} }
}else{
$message = '<div class="error">'.$langs->trans('ErrorForbidden').'</div>';
}
} }
if ($_GET["action"] == 'removeuser' && $caneditperms) if ($_GET["action"] == 'removeuser')
{ {
if($caneditperms){
if ($_GET["user"]) if ($_GET["user"])
{ {
$edituser = new User($db, $_GET["user"]); $edituser = new User($db, $_GET["user"]);
@ -108,10 +122,14 @@ if ($_GET["action"] == 'removeuser' && $caneditperms)
Header("Location: fiche.php?id=".$_GET["id"]); Header("Location: fiche.php?id=".$_GET["id"]);
} }
}else{
$message = '<div class="error">'.$langs->trans('ErrorForbidden').'</div>';
}
} }
if ($_POST["action"] == 'update' && $caneditperms) if ($_POST["action"] == 'update')
{ {
if($caneditperms){
$message=""; $message="";
$db->begin(); $db->begin();
@ -131,7 +149,9 @@ if ($_POST["action"] == 'update' && $caneditperms)
$message.='<div class="error">'.$editgroup->error.'</div>'; $message.='<div class="error">'.$editgroup->error.'</div>';
$db->rollback; $db->rollback;
} }
}else{
$message = '<div class="error">'.$langs->trans('ErrorForbidden').'</div>';
}
} }
@ -176,6 +196,9 @@ if ($action == 'create')
/* ************************************************************************** */ /* ************************************************************************** */
else else
{ {
if ($message) { print $message."<br>"; }
if ($_GET["id"] ) if ($_GET["id"] )
{ {
$group = new UserGroup($db); $group = new UserGroup($db);