lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

amlioration de la scurit

Browse Source
This commit is contained in:
Regis Houssin 2006-03-11 16:04:19 +00:00
parent 049da37e0f
commit 8a84922e90
3 changed files with 77 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
htdocs/contact/exportimport.php
View File

@ -31,6 +31,32 @@ require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
$langs->load("companies");
// Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:'';
if ($user->societe_id > 0)
{
$socid = $user->societe_id;
}
// Protection restriction commercial
if ($contactid)
{
$sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0)
{
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
}
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
/*
*

26
htdocs/contact/info.php
View File

@ -33,6 +33,32 @@ require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
$langs->load("companies");
// Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:'';
if ($user->societe_id > 0)
{
$socid = $user->societe_id;
}
// Protection restriction commercial
if ($contactid)
{
$sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0)
{
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
}
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader();

25
htdocs/contact/perso.php
View File

@ -33,6 +33,31 @@ require_once(DOL_DOCUMENT_ROOT."/lib/vcard/vcard.class.php");
$langs->load("companies");
// Protection quand utilisateur externe
$contactid = isset($_GET["id"])?$_GET["id"]:'';
if ($user->societe_id > 0)
{
$socid = $user->societe_id;
}
// Protection restriction commercial
if ($contactid)
{
$sql = "SELECT sc.fk_soc, sp.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."socpeople as sp";
$sql .= " WHERE sp.idp = ".$contactid;
if (!$user->rights->commercial->client->voir && !$user->societe_id > 0)
{
$sql .= " AND sc.fk_soc = sp.fk_soc AND sc.fk_user = ".$user->id;
}
if ($user->societe_id > 0) $sql .= " AND sp.fk_soc = ".$socid;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
if ($_POST["action"] == 'update')
{