lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: security

Browse Source
This commit is contained in:
Regis Houssin 2009-07-09 15:37:27 +00:00
parent 6d4d493c36
commit 8c68711e02
4 changed files with 7 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/fourn/facture/contact.php
View File

@ -1,6 +1,7 @@
<?php <?php
/* Copyright (C) 2005 Patrick Rouillon <patrick@rouillon.net> /* Copyright (C) 2005 Patrick Rouillon <patrick@rouillon.net>
* Copyright (C) 2005-2009 Destailleur Laurent <eldy@users.sourceforge.net> * Copyright (C) 2005-2009 Destailleur Laurent <eldy@users.sourceforge.net>
* Copyright (C) 2005-2009 Regis Houssin <regis@dolibarr.fr>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -37,7 +38,7 @@ $facid = isset($_GET["facid"])?$_GET["facid"]:'';
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'fournisseur', $facid, '', 'facture'); $result = restrictedArea($user, 'fournisseur', $facid, 'facture_fourn', 'facture');
/* /*

4
htdocs/fourn/facture/document.php
View File

@ -32,8 +32,6 @@ require_once(DOL_DOCUMENT_ROOT.'/lib/fourn.lib.php');
require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php");
require_once(DOL_DOCUMENT_ROOT."/html.formfile.class.php"); require_once(DOL_DOCUMENT_ROOT."/html.formfile.class.php");
if (!$user->rights->fournisseur->facture->lire) accessforbidden();
$langs->load('bills'); $langs->load('bills');
$langs->load('other'); $langs->load('other');
$langs->load("companies"); $langs->load("companies");
@ -43,7 +41,7 @@ $action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action'
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'fournisseur', $facid, '', 'facture'); $result = restrictedArea($user, 'fournisseur', $facid, 'facture_fourn', 'facture');
// Get parameters // Get parameters
$page=$_GET["page"]; $page=$_GET["page"];

4
htdocs/fourn/facture/info.php
View File

@ -29,15 +29,13 @@ require('./pre.inc.php');
require_once(DOL_DOCUMENT_ROOT."/lib/functions2.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/functions2.lib.php");
require_once(DOL_DOCUMENT_ROOT.'/lib/fourn.lib.php'); require_once(DOL_DOCUMENT_ROOT.'/lib/fourn.lib.php');
if (!$user->rights->fournisseur->facture->lire) accessforbidden();
$langs->load('bills'); $langs->load('bills');
$facid = isset($_GET["facid"])?$_GET["facid"]:''; $facid = isset($_GET["facid"])?$_GET["facid"]:'';
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'fournisseur', $facid, '', 'facture'); $result = restrictedArea($user, 'fournisseur', $facid, 'facture_fourn', 'facture');
llxHeader(); llxHeader();

8
htdocs/fourn/facture/note.php
View File

@ -28,8 +28,6 @@
require("./pre.inc.php"); require("./pre.inc.php");
require_once(DOL_DOCUMENT_ROOT.'/lib/fourn.lib.php'); require_once(DOL_DOCUMENT_ROOT.'/lib/fourn.lib.php');
if (!$user->rights->fournisseur->facture->lire) accessforbidden();
$langs->load('bills'); $langs->load('bills');
$langs->load("companies"); $langs->load("companies");
@ -38,7 +36,7 @@ $action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action'
// Security check // Security check
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'fournisseur', $facid, '', 'facture'); $result = restrictedArea($user, 'fournisseur', $facid, 'facture_fourn', 'facture');
$fac = new FactureFournisseur($db); $fac = new FactureFournisseur($db);
$fac->fetch($_GET["facid"]); $fac->fetch($_GET["facid"]);
@ -109,7 +107,7 @@ if ($_GET["facid"])
print '<tr><td nowrap="nowrap">'.$langs->trans("RefSupplier").'</td><td colspan="3">'.$fac->ref_supplier.'</td>'; print '<tr><td nowrap="nowrap">'.$langs->trans("RefSupplier").'</td><td colspan="3">'.$fac->ref_supplier.'</td>';
print "</tr>\n"; print "</tr>\n";
// Société // Soci<EFBFBD>t<EFBFBD>
print '<tr><td>'.$langs->trans('Company').'</td><td colspan="3">'.$fac->fournisseur->getNomUrl(1).'</td></tr>'; print '<tr><td>'.$langs->trans('Company').'</td><td colspan="3">'.$fac->fournisseur->getNomUrl(1).'</td></tr>';
// Note publique // Note publique
@ -130,7 +128,7 @@ if ($_GET["facid"])
} }
print "</td></tr>"; print "</td></tr>";
// Note privée // Note priv<EFBFBD>e
if (! $user->societe_id) if (! $user->societe_id)
{ {
print '<tr><td valign="top">'.$langs->trans("NotePrivate").' :</td>'; print '<tr><td valign="top">'.$langs->trans("NotePrivate").' :</td>';