'; - $out.=img_picto($langs->trans("ViewCal"),'object_calendar','class="hideonsmartphone pictoactionview"'); + $out.='
'; - $out.=img_picto($langs->trans("ViewCal"),'object_calendar','class="hideonsmartphone pictoactionview"'); + $out.='
'; -$out.=img_picto($langs->trans("ViewCal"),'object_calendar','class="hideonsmartphone pictoactionview"'); +$out.='
- ';
+ $ret.='
- ';
}
if ($morehtml)
{
diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index 9d01a3c70b2..73198771b93 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -57,21 +57,22 @@ class FormFile
/**
* Show form to upload a new file
*
- * @param string $url Url
- * @param string $title Title zone (Title or '' or 'none')
+ * @param string $url Url
+ * @param string $title Title zone (Title or '' or 'none')
* @param int $addcancel 1=Add 'Cancel' button
* @param int $sectionid If upload must be done inside a particular ECM section
* @param int $perm Value of permission to allow upload
- * @param int $size Length of input file area. Deprecated.
- * @param Object $object Object to use (when attachment is done on an element)
- * @param string $options Add an option column
- * @param integer $useajax Use fileupload ajax (0=never, 1=if enabled, 2=always whatever is option). 2 should never be used.
- * @param string $savingdocmask Mask to use to define output filename. For example 'XXXXX-__YYYYMMDD__-__file__'
- * @param integer $linkfiles 1=Also add form to link files, 0=Do not show form to link files
- * @param string $htmlname Name and id of HTML form ('formuserfile' by default, 'formuserfileecm' when used to upload a file in ECM)
+ * @param int $size Length of input file area. Deprecated.
+ * @param Object $object Object to use (when attachment is done on an element)
+ * @param string $options Add an option column
+ * @param integer $useajax Use fileupload ajax (0=never, 1=if enabled, 2=always whatever is option). 2 should never be used.
+ * @param string $savingdocmask Mask to use to define output filename. For example 'XXXXX-__YYYYMMDD__-__file__'
+ * @param integer $linkfiles 1=Also add form to link files, 0=Do not show form to link files
+ * @param string $htmlname Name and id of HTML form ('formuserfile' by default, 'formuserfileecm' when used to upload a file in ECM)
+ * @param string $accept Specifies the types of files accepted (This is not a security check but an user interface facility. eg '.pdf,image/*' or '.png,.jpg' or 'video/*')
* @return int <0 if KO, >0 if OK
*/
- function form_attach_new_file($url, $title='', $addcancel=0, $sectionid=0, $perm=1, $size=50, $object='', $options='', $useajax=1, $savingdocmask='', $linkfiles=1, $htmlname='formuserfile')
+ function form_attach_new_file($url, $title='', $addcancel=0, $sectionid=0, $perm=1, $size=50, $object='', $options='', $useajax=1, $savingdocmask='', $linkfiles=1, $htmlname='formuserfile', $accept='')
{
global $conf,$langs, $hookmanager;
$hookmanager->initHooks(array('formfile'));
@@ -130,6 +131,7 @@ class FormFile
$out .= 'global->MAIN_DISABLE_MULTIPLE_FILEUPLOAD) || $conf->browser->layout != 'classic')?' name="userfile"':' name="userfile[]" multiple');
$out .= (empty($conf->global->MAIN_UPLOAD_DOC) || empty($perm)?' disabled':'');
+ $out .= (!empty($accept)?' accept="'.$accept.'"':'accept=""');
$out .= '>';
$out .= ' ';
$out .= 'default_values)) // $user->default_values defined from menu default values
+ if (! empty($user->default_values)) // $user->default_values defined from menu 'Setup - Default values'
{
- $qualified=1;
- if (isset($user->default_values[$relativepathstring]['createform_queries'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
- {
- $tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['createform_queries']);
- $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
- foreach($tmpqueryarraytohave as $tmpquerytohave)
- {
- if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0;
- }
- }
- if ($qualified)
+ if (isset($user->default_values[$relativepathstring]['createform']))
{
- //var_dump($user->default_values[$relativepathstring]['createform']);
- if (isset($user->default_values[$relativepathstring]['createform'][$paramname])) $out = $user->default_values[$relativepathstring]['createform'][$paramname];
+ foreach($user->default_values[$relativepathstring]['createform'] as $defkey => $defval)
+ {
+ $qualified = 0;
+ if ($defkey != '_noquery_')
+ {
+ $tmpqueryarraytohave=explode('&', $defkey);
+ $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
+ $foundintru=0;
+ foreach($tmpqueryarraytohave as $tmpquerytohave)
+ {
+ if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
+ }
+ if (! $foundintru) $qualified=1;
+ //var_dump($defkey.'-'.$qualified);
+ }
+ else $qualified = 1;
+
+ if ($qualified)
+ {
+ //var_dump($user->default_values[$relativepathstring][$defkey]['createform']);
+ if (isset($user->default_values[$relativepathstring]['createform'][$defkey][$paramname]))
+ {
+ $out = $user->default_values[$relativepathstring]['createform'][$defkey][$paramname];
+ break;
+ }
+ }
+ }
}
- }
+ }
}
// Management of default search_filters and sort order
//elseif (preg_match('/list.php$/', $_SERVER["PHP_SELF"]) && ! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
elseif (! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname]))
{
- if (! empty($user->default_values)) // $user->default_values defined from menu default values
+ if (! empty($user->default_values)) // $user->default_values defined from menu 'Setup - Default values'
{
//var_dump($user->default_values[$relativepathstring]);
- if ($paramname == 'sortfield') // Sorted on which fields ?
+ if ($paramname == 'sortfield' || $paramname == 'sortorder') // Sorted on which fields ? ASC or DESC ?
{
- $qualified=1;
- if (isset($user->default_values[$relativepathstring]['sortorder_queries'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
+ if (isset($user->default_values[$relativepathstring]['sortorder'])) // Even if paramname is sortfield, data are stored into ['sortorder...']
{
- $tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['sortorder_queries']);
- $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
- foreach($tmpqueryarraytohave as $tmpquerytohave)
+ foreach($user->default_values[$relativepathstring]['sortorder'] as $defkey => $defval)
{
- if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0;
- }
- }
- if ($qualified)
- {
- if (isset($user->default_values[$relativepathstring]['sortorder'])) // We will use the key of $user->default_values[path][sortorder]
- {
- $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
- foreach($user->default_values[$relativepathstring]['sortorder'] as $key => $val)
- {
- if ($out) $out.=', ';
- $out.=dol_string_nospecial($key, '', $forbidden_chars_to_replace);
- }
+ $qualified = 0;
+ if ($defkey != '_noquery_')
+ {
+ $tmpqueryarraytohave=explode('&', $defkey);
+ $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
+ $foundintru=0;
+ foreach($tmpqueryarraytohave as $tmpquerytohave)
+ {
+ if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
+ }
+ if (! $foundintru) $qualified=1;
+ //var_dump($defkey.'-'.$qualified);
+ }
+ else $qualified = 1;
+
+ if ($qualified)
+ {
+ $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
+ foreach($user->default_values[$relativepathstring]['sortorder'][$defkey] as $key => $val)
+ {
+ if ($out) $out.=', ';
+ if ($paramname == 'sortfield')
+ {
+ $out.=dol_string_nospecial($key, '', $forbidden_chars_to_replace);
+ }
+ if ($paramname == 'sortorder')
+ {
+ $out.=dol_string_nospecial($val, '', $forbidden_chars_to_replace);
+ }
+ }
+ //break; // No break for sortfield and sortorder so we can cumulate fields (is it realy usefull ?)
+ }
}
}
}
- elseif ($paramname == 'sortorder') // ASC or DESC ?
+ elseif (isset($user->default_values[$relativepathstring]['filters']))
{
- $qualified=1;
- if (isset($user->default_values[$relativepathstring]['sortorder_queries']))
+ foreach($user->default_values[$relativepathstring]['filters'] as $defkey => $defval)
{
- $tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['sortorder_queries']);
- $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
- foreach($tmpqueryarraytohave as $tmpquerytohave)
- {
- if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0;
- }
- }
- if ($qualified)
- {
- if (isset($user->default_values[$relativepathstring]['sortorder'])) // We will use the val of $user->default_values[path][sortorder]
- {
- $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
- foreach($user->default_values[$relativepathstring]['sortorder'] as $key => $val)
- {
- if ($out) $out.=', ';
- $out.=dol_string_nospecial($val, '', $forbidden_chars_to_replace);
- }
- }
- }
- }
- elseif (isset($user->default_values[$relativepathstring]['filters'][$paramname]))
- {
- $qualified=1;
- if (isset($user->default_values[$relativepathstring]['filters_queries']))
- {
- $tmpqueryarraytohave=explode('&', $user->default_values[$relativepathstring]['filters_queries']);
- $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
- foreach($tmpqueryarraytohave as $tmpquerytohave)
- {
- if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $qualified=0;
- }
- }
- if ($qualified)
- {
- if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all']))
+ $qualified = 0;
+ if ($defkey != '_noquery_')
{
- // We made a search from quick search menu, do we still use default filter ?
- if (empty($conf->global->MAIN_DISABLE_DEFAULT_FILTER_FOR_QUICK_SEARCH))
+ $tmpqueryarraytohave=explode('&', $defkey);
+ $tmpqueryarraywehave=explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING']));
+ $foundintru=0;
+ foreach($tmpqueryarraytohave as $tmpquerytohave)
{
- $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
- $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$paramname], '', $forbidden_chars_to_replace);
+ if (! in_array($tmpquerytohave, $tmpqueryarraywehave)) $foundintru=1;
}
+ if (! $foundintru) $qualified=1;
+ //var_dump($defkey.'-'.$qualified);
}
- else
- {
- $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
- $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$paramname], '', $forbidden_chars_to_replace);
- }
- }
+ else $qualified = 1;
+
+ if ($qualified)
+ {
+ if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all']))
+ {
+ // We made a search from quick search menu, do we still use default filter ?
+ if (empty($conf->global->MAIN_DISABLE_DEFAULT_FILTER_FOR_QUICK_SEARCH))
+ {
+ $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
+ $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace);
+ }
+ }
+ else
+ {
+ $forbidden_chars_to_replace=array(" ","'","/","\\",":","*","?","\"","<",">","|","[","]",";","="); // we accept _, -, . and ,
+ $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace);
+ }
+ break;
+ }
+ }
}
}
}
@@ -424,14 +439,14 @@ function GETPOST($paramname, $check='alpha', $method=0, $filter=NULL, $options=N
}
- // Substitution variables for GETPOST (used to get final url with variable parameters or final default value with variable paramaters)
- // Example of variables: __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__, ...
- // We do this only if var is a GET. If it is a POST, may be we want to post the text with vars as the setup text.
- if (! is_array($out) && empty($_POST[$paramname]))
+ // Substitution variables for GETPOST (used to get final url with variable parameters or final default value with variable paramaters)
+ // Example of variables: __DAY__, __MONTH__, __YEAR__, __MYCOUNTRYID__, __USERID__, __ENTITYID__, ...
+ // We do this only if var is a GET. If it is a POST, may be we want to post the text with vars as the setup text.
+ if (! is_array($out) && empty($_POST[$paramname]))
+ {
+ $maxloop=20; $loopnb=0; // Protection against infinite loop
+ while (preg_match('/__([A-Z0-9]+_?[A-Z0-9]+)__/i', $out, $reg) && ($loopnb < $maxloop)) // Detect '__ABCDEF__' as key 'ABCDEF' and '__ABC_DEF__' as key 'ABC_DEF'. Detection is also correct when 2 vars are side by side.
{
- $maxloop=20; $loopnb=0; // Protection against infinite loop
- while (preg_match('/__([A-Z0-9]+_?[A-Z0-9]+)__/i', $out, $reg) && ($loopnb < $maxloop)) // Detect '__ABCDEF__' as key 'ABCDEF' and '__ABC_DEF__' as key 'ABC_DEF'. Detection is also correct when 2 vars are side by side.
- {
$loopnb++; $newout = '';
if ($reg[1] == 'DAY') { $tmp=dol_getdate(dol_now(), true); $newout = $tmp['mday']; }
@@ -462,57 +477,57 @@ function GETPOST($paramname, $check='alpha', $method=0, $filter=NULL, $options=N
else $newout = ''; // Key not found, we replace with empty string
//var_dump('__'.$reg[1].'__ -> '.$newout);
$out = preg_replace('/__'.preg_quote($reg[1],'/').'__/', $newout, $out);
- }
}
+ }
- // Check is done after replacement
- switch ($check)
- {
- case 'none':
- break;
- case 'int': // Check param is a numeric value (integer but also float or hexadecimal)
- if (! is_numeric($out)) { $out=''; }
- break;
- case 'intcomma':
- if (preg_match('/[^0-9,]+/i',$out)) $out='';
- break;
- case 'alpha':
- $out=trim($out);
- // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
- // '../' is dangerous because it allows dir transversals
- if (preg_match('/"/',$out)) $out='';
- else if (preg_match('/\.\.\//',$out)) $out='';
- break;
- case 'san_alpha':
- $out=filter_var($out,FILTER_SANITIZE_STRING);
- break;
- case 'aZ':
- $out=trim($out);
- if (preg_match('/[^a-z]+/i',$out)) $out='';
- break;
- case 'aZ09':
- $out=trim($out);
- if (preg_match('/[^a-z0-9_\-\.]+/i',$out)) $out='';
- break;
- case 'array':
- if (! is_array($out) || empty($out)) $out=array();
- break;
- case 'nohtml':
- $out=dol_string_nohtmltag($out);
- break;
- case 'alphanohtml': // Recommended for search params
- $out=trim($out);
- // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
- // '../' is dangerous because it allows dir transversals
- if (preg_match('/"/',$out)) $out='';
- else if (preg_match('/\.\.\//',$out)) $out='';
- $out=dol_string_nohtmltag($out);
- break;
- case 'custom':
- if (empty($filter)) return 'BadFourthParameterForGETPOST';
- $out=filter_var($out, $filter, $options);
- break;
- }
+ // Check is done after replacement
+ switch ($check)
+ {
+ case 'none':
+ break;
+ case 'int': // Check param is a numeric value (integer but also float or hexadecimal)
+ if (! is_numeric($out)) { $out=''; }
+ break;
+ case 'intcomma':
+ if (preg_match('/[^0-9,]+/i',$out)) $out='';
+ break;
+ case 'alpha':
+ $out=trim($out);
+ // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
+ // '../' is dangerous because it allows dir transversals
+ if (preg_match('/"/',$out)) $out='';
+ else if (preg_match('/\.\.\//',$out)) $out='';
+ break;
+ case 'san_alpha':
+ $out=filter_var($out,FILTER_SANITIZE_STRING);
+ break;
+ case 'aZ':
+ $out=trim($out);
+ if (preg_match('/[^a-z]+/i',$out)) $out='';
+ break;
+ case 'aZ09':
+ $out=trim($out);
+ if (preg_match('/[^a-z0-9_\-\.]+/i',$out)) $out='';
+ break;
+ case 'array':
+ if (! is_array($out) || empty($out)) $out=array();
+ break;
+ case 'nohtml':
+ $out=dol_string_nohtmltag($out);
+ break;
+ case 'alphanohtml': // Recommended for search params
+ $out=trim($out);
+ // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
+ // '../' is dangerous because it allows dir transversals
+ if (preg_match('/"/',$out)) $out='';
+ else if (preg_match('/\.\.\//',$out)) $out='';
+ $out=dol_string_nohtmltag($out);
+ break;
+ case 'custom':
+ if (empty($filter)) return 'BadFourthParameterForGETPOST';
+ $out=filter_var($out, $filter, $options);
+ break;
+ }
// Code for search criteria persistence.
// Save data into session if key start with 'search_' or is 'smonth', 'syear', 'month', 'year'
@@ -745,7 +760,7 @@ function dol_size($size,$type='')
*/
function dol_sanitizeFileName($str,$newstr='_',$unaccent=1)
{
- $filesystem_forbidden_chars = array('<','>',':','/','\\','?','*','|','"','°');
+ $filesystem_forbidden_chars = array('<','>','/','\\','?','*','|','"','°');
return dol_string_nospecial($unaccent?dol_string_unaccent($str):$str, $newstr, $filesystem_forbidden_chars);
}
diff --git a/htdocs/core/lib/geturl.lib.php b/htdocs/core/lib/geturl.lib.php
index 6f268fda3a7..cb594259c9f 100644
--- a/htdocs/core/lib/geturl.lib.php
+++ b/htdocs/core/lib/geturl.lib.php
@@ -55,7 +55,7 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
curl_setopt($ch, CURLOPT_USERAGENT, 'Dolibarr geturl function');
@curl_setopt($ch, CURLOPT_FOLLOWLOCATION, ($followlocation?true:false)); // We use @ here because this may return warning if safe mode is on or open_basedir is on
-
+
if (count($addheaders)) curl_setopt($ch, CURLOPT_HTTPHEADER, $addheaders);
curl_setopt($ch, CURLINFO_HEADER_OUT, true); // To be able to retrieve request header and log it
@@ -63,7 +63,7 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
// You can force, if supported a version like TLSv1 or TLSv1.2
if (! empty($conf->global->MAIN_CURL_SSLVERSION)) curl_setopt($ch, CURLOPT_SSLVERSION, $conf->global->MAIN_CURL_SSLVERSION);
//curl_setopt($ch, CURLOPT_SSLVERSION, 6); for tls 1.2
-
+
//turning off the server and peer verification(TrustManager Concept).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
@@ -82,12 +82,12 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
{
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT'); // HTTP request is 'PUT'
if (! is_array($param)) parse_str($param, $array_param);
- else
+ else
{
dol_syslog("parameter param must be a string", LOG_WARNING);
$array_param=$param;
}
- curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($array_param)); // Setting param x=a&y=z as PUT fields
+ curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($array_param)); // Setting param x=a&y=z as PUT fields
}
else if ($postorget == 'PUTALREADYFORMATED')
{
@@ -121,7 +121,7 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
$response = curl_exec($ch);
$request = curl_getinfo($ch, CURLINFO_HEADER_OUT); // Reading of request must be done after sending request
-
+
dol_syslog("getURLContent request=".$request);
dol_syslog("getURLContent response=".$response);
@@ -130,7 +130,7 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
{
// Ad keys to $rep
$rep['content']=$response;
-
+
// moving to display page to display curl errors
$rep['curl_error_no']=curl_errno($ch);
$rep['curl_error_msg']=curl_error($ch);
@@ -146,12 +146,12 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
//$rep['header_size']=$info['header_size'];
//$rep['http_code']=$info['http_code'];
dol_syslog("getURLContent http_code=".$rep['http_code']);
-
+
// Add more keys to $rep
$rep['content']=$response;
$rep['curl_error_no']='';
$rep['curl_error_msg']='';
-
+
//closing the curl
curl_close($ch);
}
@@ -159,3 +159,19 @@ function getURLContent($url,$postorget='GET',$param='',$followlocation=1,$addhea
return $rep;
}
+
+/**
+ * Function get second level domain name.
+ * For example: https://www.abc.mydomain.com/dir/page.html return 'mydomain'
+ *
+ * @param string $url Full URL.
+ * @return string Returns domaine name
+ */
+function getDomainFromURL($url)
+{
+ $tmpdomain = preg_replace('/^https?:\/\//i', '', $url); // Remove http(s)://
+ $tmpdomain = preg_replace('/\/.*$/i', '', $tmpdomain); // Remove part after domain
+ $tmpdomain = preg_replace('/\.[^\.]+$/', '', $tmpdomain); // Remove first level domain (.com, .net, ...)
+ $tmpdomain = preg_replace('/^[^\.]+\./', '', $tmpdomain); // Remove part www. before domain name
+ return $tmpdomain;
+}
diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index 581c324674a..c02fbbbb220 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -252,7 +252,8 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
{
//print '
feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write; if (empty($user->rights->$feature->creer) - && empty($user->rights->$feature->write)) { $createok=0; $nbko++; } + && empty($user->rights->$feature->write) + && empty($user->rights->$feature->create)) { $createok=0; $nbko++; } } } diff --git a/htdocs/core/modules/rapport/pdf_paiement.class.php b/htdocs/core/modules/rapport/pdf_paiement.class.php index 35ffc399372..54f0e418eb0 100644 --- a/htdocs/core/modules/rapport/pdf_paiement.class.php +++ b/htdocs/core/modules/rapport/pdf_paiement.class.php @@ -122,6 +122,8 @@ class pdf_paiement $month = sprintf("%02d",$month); $year = sprintf("%04d",$year); + + $file = $dir . "/payments-".$year."-".$month.".pdf"; switch ($this->doc_type) { case "client": $file = $dir . "/payments-".$year."-".$month.".pdf"; @@ -251,7 +253,7 @@ class pdf_paiement while ($i < $num) { $objp = $this->db->fetch_object($result); - + $lines[$i][0] = $objp->facnumber; $lines[$i][1] = dol_print_date($this->db->jdate($objp->dp),"day",false,$outputlangs,true); @@ -328,9 +330,9 @@ class pdf_paiement if (! empty($conf->global->MAIN_UMASK)) @chmod($file, octdec($conf->global->MAIN_UMASK)); - + $this->result = array('fullpath'=>$file); - + return 1; } diff --git a/htdocs/core/photos_resize.php b/htdocs/core/photos_resize.php index 69056ff02be..fcedc2a4e11 100644 --- a/htdocs/core/photos_resize.php +++ b/htdocs/core/photos_resize.php @@ -170,7 +170,7 @@ if ($action == 'confirm_resize' && (isset($_POST["file"]) != "") && (isset($_POS { $fullpath=$dir."/".$original_file; $result=dol_imageResizeOrCrop($fullpath,0,$_POST['sizex'],$_POST['sizey']); - + if ($result == $fullpath) { $object->addThumbs($fullpath); @@ -178,7 +178,7 @@ if ($action == 'confirm_resize' && (isset($_POST["file"]) != "") && (isset($_POS // Update/create database for file $fullpath $rel_filename = preg_replace('/^'.preg_quote(DOL_DATA_ROOT,'/').'/', '', $fullpath); $rel_filename = preg_replace('/^[\\/]/','',$rel_filename); - + include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php'; $ecmfile=new EcmFiles($db); $result = $ecmfile->fetch(0, '', $rel_filename); @@ -188,7 +188,7 @@ if ($action == 'confirm_resize' && (isset($_POST["file"]) != "") && (isset($_POS $rel_dir = dirname($rel_filename); $rel_dir = preg_replace('/[\\/]$/', '', $rel_dir); $rel_dir = preg_replace('/^[\\/]/', '', $rel_dir); - + $ecmfile->label = md5_file(dol_osencode($fullpath)); $result = $ecmfile->update($user); } @@ -198,7 +198,7 @@ if ($action == 'confirm_resize' && (isset($_POST["file"]) != "") && (isset($_POS $rel_dir = dirname($rel_filename); $rel_dir = preg_replace('/[\\/]$/', '', $rel_dir); $rel_dir = preg_replace('/^[\\/]/', '', $rel_dir); - + $ecmfile->filepath = $rel_dir; $ecmfile->filename = $filename; $ecmfile->label = md5_file(dol_osencode($fullpath)); // $fullpath is a full path to file @@ -213,7 +213,7 @@ if ($action == 'confirm_resize' && (isset($_POST["file"]) != "") && (isset($_POS } $result = $ecmfile->create($user); } - + if ($backtourl) { header("Location: ".$backtourl); @@ -246,7 +246,7 @@ if ($action == 'confirm_crop') // Update/create database for file $fullpath $rel_filename = preg_replace('/^'.preg_quote(DOL_DATA_ROOT,'/').'/', '', $fullpath); $rel_filename = preg_replace('/^[\\/]/','',$rel_filename); - + include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php'; $ecmfile=new EcmFiles($db); $result = $ecmfile->fetch(0, '', $rel_filename); @@ -256,7 +256,7 @@ if ($action == 'confirm_crop') $rel_dir = dirname($rel_filename); $rel_dir = preg_replace('/[\\/]$/', '', $rel_dir); $rel_dir = preg_replace('/^[\\/]/', '', $rel_dir); - + $ecmfile->label = md5_file(dol_osencode($fullpath)); $result = $ecmfile->update($user); } @@ -266,7 +266,7 @@ if ($action == 'confirm_crop') $rel_dir = dirname($rel_filename); $rel_dir = preg_replace('/[\\/]$/', '', $rel_dir); $rel_dir = preg_replace('/^[\\/]/', '', $rel_dir); - + $ecmfile->filepath = $rel_dir; $ecmfile->filename = $filename; $ecmfile->label = md5_file(dol_osencode($fullpath)); // $fullpath is a full path to file @@ -281,7 +281,7 @@ if ($action == 'confirm_crop') } $result = $ecmfile->create($user); } - + if ($backtourl) { header("Location: ".$backtourl); @@ -311,7 +311,7 @@ llxHeader($head, $langs->trans("Image"), '', '', 0, 0, array('/includes/jquery/p print load_fiche_titre($langs->trans("ImageEditor")); -$infoarray=dol_getImageSize($dir."/".GETPOST("file")); +$infoarray=dol_getImageSize($dir."/".GETPOST("file",'alpha')); $height=$infoarray['height']; $width=$infoarray['width']; print $langs->trans("CurrentInformationOnImage").': '; @@ -373,7 +373,7 @@ if (! empty($conf->use_javascript_ajax)) print $langs->trans("DefineNewAreaToPick").'...
'; print '
';
print '
';
- print '
';
+ print '.')
';
print '
';
print ''; print '