lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Droits non chargs

Browse Source
This commit is contained in:
Laurent Destailleur 2006-03-14 22:23:12 +00:00
parent a5067856b2
commit 8a17b09486
5 changed files with 78 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
htdocs/contact/exportimport.php
View File

@ -1,5 +1,5 @@
<?php <?php
/* Copyright (C) 2005 Laurent Destailleur <eldy@users.sourceforge.net> /* Copyright (C) 2006 Laurent Destailleur <eldy@users.sourceforge.net>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -29,32 +29,40 @@
require("./pre.inc.php"); require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/contact.class.php"); require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
$user->getrights('commercial');
$langs->load("companies"); $langs->load("companies");
// Protection quand utilisateur externe // Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:''; $contactid = isset($_GET["id"])?$_GET["id"]:'';
$scoid=0;
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
$socid = $user->societe_id; $socid = $user->societe_id;
} }
// Protection restriction commercial // Protection restriction commercial
if ($contactid) if ($contactid && ! $user->rights->commercial->client->voir)
{ {
$sql = "SELECT sc.fk_soc, sp.fk_soc"; $sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp"; $sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid; $sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0) if (! $user->rights->commercial->client->voir && ! $socid)
{ {
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id; $sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
} }
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid; if ($socid) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) ) $resql=$db->query($sql);
{ if ($resql)
if ( $db->num_rows() == 0) accessforbidden(); {
} if ($db->num_rows() == 0) accessforbidden();
}
else
{
dolibarr_print_error($db);
}
} }

43
htdocs/contact/info.php
View File

@ -1,6 +1,6 @@
<?php <?php
/* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2006 Laurent Destailleur <eldy@users.sourceforge.net>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -31,34 +31,47 @@
require("./pre.inc.php"); require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/contact.class.php"); require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
$user->getrights('commercial');
$langs->load("companies"); $langs->load("companies");
// Protection quand utilisateur externe // Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:''; $contactid = isset($_GET["id"])?$_GET["id"]:'';
$socid=0;
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
$socid = $user->societe_id; $socid = $user->societe_id;
} }
// Protection restriction commercial // Protection restriction commercial
if ($contactid) if ($contactid && ! $user->rights->commercial->client->voir)
{ {
$sql = "SELECT sc.fk_soc, sp.fk_soc"; $sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp"; $sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid; $sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0) if (! $user->rights->commercial->client->voir && ! $socid)
{ {
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id; $sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
} }
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid; if ($socid) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) ) $resql=$db->query($sql);
{ if ($resql)
if ( $db->num_rows() == 0) accessforbidden(); {
} if ($db->num_rows() == 0) accessforbidden();
}
else
{
dolibarr_print_error($db);
}
} }
/*
* Fiche info
*/
llxHeader(); llxHeader();

41
htdocs/contact/perso.php
View File

@ -1,6 +1,6 @@
<?php <?php
/* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2005 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2006 Laurent Destailleur <eldy@users.sourceforge.net>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -31,32 +31,41 @@ require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/contact.class.php"); require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
require_once(DOL_DOCUMENT_ROOT."/lib/vcard/vcard.class.php"); require_once(DOL_DOCUMENT_ROOT."/lib/vcard/vcard.class.php");
$user->getrights('commercial');
$langs->load("companies"); $langs->load("companies");
// Protection quand utilisateur externe // Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:''; $contactid = isset($_GET["id"])?$_GET["id"]:'';
$socid=0;
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
$socid = $user->societe_id; $socid = $user->societe_id;
} }
// Protection restriction commercial
if ($contactid)
{
$sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0)
{
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
}
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) ) // Protection restriction commercial
{ if ($contactid && ! $user->rights->commercial->client->voir)
if ( $db->num_rows() == 0) accessforbidden(); {
} $sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid;
if (! $user->rights->commercial->client->voir && ! $socid)
{
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
}
if ($socid) $sql .= " AND sp.fk_soc = ".$socid;
$resql=$db->query($sql);
if ($resql)
{
if ($db->num_rows() == 0) accessforbidden();
}
else
{
dolibarr_print_error($db);
}
} }
if ($_POST["action"] == 'update') if ($_POST["action"] == 'update')

3
htdocs/docsoc.php
View File

@ -33,14 +33,13 @@ require("./pre.inc.php");
$langs->load("companies"); $langs->load("companies");
$langs->load('other'); $langs->load('other');
$user->getrights('commercial');
$mesg = ""; $mesg = "";
// Sécurité accés client // Sécurité accés client
$socid = isset($_GET["socid"])?$_GET["socid"]:''; $socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden(); if ($socid == '') accessforbidden();
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
$action = ''; $action = '';

2
htdocs/socnote.php
View File

@ -32,6 +32,8 @@ require("./pre.inc.php");
$langs->load("companies"); $langs->load("companies");
$user->getrights('commercial');
// Protection quand utilisateur externe // Protection quand utilisateur externe
$socidp = isset($_GET["socid"])?$_GET["socid"]:''; $socidp = isset($_GET["socid"])?$_GET["socid"]:'';