diff --git a/htdocs/admin/index.php b/htdocs/admin/index.php index df25c92c861..19c81832b09 100644 --- a/htdocs/admin/index.php +++ b/htdocs/admin/index.php @@ -59,6 +59,7 @@ print "
"; print $langs->trans("SetupDescription2")."
"; print "
"; +print '
'; print img_picto('','puce').' '.$langs->trans("SetupDescription3")."
"; //print '
'; print '
'; @@ -66,6 +67,7 @@ print img_picto('','puce').' '.$langs->trans("SetupDescription4")."
"; //print '
'; print '
'; print img_picto('','puce').' '.$langs->trans("SetupDescription5")."
"; +print '
'; print "
"; /* diff --git a/htdocs/user/clicktodial.php b/htdocs/user/clicktodial.php index 757e1e011b9..669eaa59c3d 100644 --- a/htdocs/user/clicktodial.php +++ b/htdocs/user/clicktodial.php @@ -29,8 +29,15 @@ require_once(DOL_DOCUMENT_ROOT."/lib/usergroups.lib.php"); $langs->load("users"); $langs->load("admin"); -$form = new Form($db); - +// Security check +$socid=0; +if ($user->societe_id > 0) $socid = $user->societe_id; +$feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; +} +$result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); /* * Actions @@ -53,6 +60,8 @@ if ($_POST["action"] == 'update' && ! $_POST['cancel']) * View */ +$form = new Form($db); + llxHeader("","ClickToDial"); diff --git a/htdocs/user/fiche.php b/htdocs/user/fiche.php index fd3dd10fcce..a87ff8b954f 100644 --- a/htdocs/user/fiche.php +++ b/htdocs/user/fiche.php @@ -37,7 +37,7 @@ if ($conf->adherent->enabled) require_once(DOL_DOCUMENT_ROOT."/adherents/adheren // Define value to know what current user can do on users $canadduser=($user->admin || $user->rights->user->user->creer); -$canreadperms=($user->admin || $user->rights->user->user->lire); +$canreaduser=($user->admin || $user->rights->user->user->lire); $caneditperms=($user->admin || $user->rights->user->user->creer); $candisableperms=($user->admin || $user->rights->user->user->supprimer); // Define value to know what current user can do on properties of edited user @@ -54,8 +54,13 @@ if ($_GET["id"]) $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; + $canreaduser=1; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); -if ($user->id <> $_GET["id"] && ! $canreadperms) accessforbidden(); +if ($user->id <> $_GET["id"] && ! $canreaduser) accessforbidden(); $langs->load("users"); $langs->load("companies"); @@ -1225,7 +1230,7 @@ else print ""; print ''; - if ($canreadperms) + if ($canreaduser) { print ''.img_object($langs->trans("ShowGroup"),"group").' '.$group->nom.''; } diff --git a/htdocs/user/home.php b/htdocs/user/home.php index ddbed2bace4..ccd7b18717d 100644 --- a/htdocs/user/home.php +++ b/htdocs/user/home.php @@ -18,22 +18,25 @@ */ /** - \file htdocs/user/home.php - \brief Page acceuil de la zone utilisateurs et groupes - \version $Id$ -*/ + * \file htdocs/user/home.php + * \brief Page acceuil de la zone utilisateurs et groupes + * \version $Id$ + */ require("./pre.inc.php"); if (! $user->rights->user->user->lire && !$user->admin) { - // Redirection vers la page de l'utilisateur - Header("Location: fiche.php?id=".$user->id); + // Redirection vers la page de l'utilisateur + Header("Location: fiche.php?id=".$user->id); } $langs->load("users"); +/* + * View + */ llxHeader(); @@ -73,7 +76,7 @@ print ''; /* - * Derniers utilisateurs créés + * Derniers utilisateurs crees */ $max=10; @@ -88,56 +91,56 @@ $sql.= " DESC limit $max"; $resql=$db->query($sql); if ($resql) { - $num = $db->num_rows($resql); - print ''; - print ''; - $var = true; - $i = 0; + $num = $db->num_rows($resql); + print '
'.$langs->trans("LastUsersCreated",min($num,$max)).'
'; + print ''; + $var = true; + $i = 0; - while ($i < $num && $i < $max) - { - $obj = $db->fetch_object($resql); - $var=!$var; + while ($i < $num && $i < $max) + { + $obj = $db->fetch_object($resql); + $var=!$var; - print ""; - print ""; - print "'; - print "'; - print ""; - print ''; - $i++; - } - print "
'.$langs->trans("LastUsersCreated",min($num,$max)).'
rowid\">".img_object($langs->trans("ShowUser"),"user")." ".$obj->firstname." ".$obj->name.""; - if ($conf->global->MAIN_MODULE_MULTICOMPANY && $obj->admin && ! $obj->entity) - { - print img_redstar($langs->trans("SuperAdministrator")); - } - else if ($obj->admin) - { - print img_picto($langs->trans("Administrator"),'star'); - } - print "".$obj->login.'"; - if ($obj->fk_societe) - { - print ''.img_object($langs->trans("ShowCompany"),"company").' '.$obj->nom.''; - } - else if ($obj->ldap_sid) - { - print $langs->trans("DomainUser"); - } - else print $langs->trans("InternalUser"); - print '".dol_print_date($obj->datec,'dayhour')."

"; + print ""; + print "rowid\">".img_object($langs->trans("ShowUser"),"user")." ".$obj->firstname." ".$obj->name.""; + if ($conf->global->MAIN_MODULE_MULTICOMPANY && $obj->admin && ! $obj->entity) + { + print img_redstar($langs->trans("SuperAdministrator")); + } + else if ($obj->admin) + { + print img_picto($langs->trans("Administrator"),'star'); + } + print ""; + print "".$obj->login.''; + print ""; + if ($obj->fk_societe) + { + print ''.img_object($langs->trans("ShowCompany"),"company").' '.$obj->nom.''; + } + else if ($obj->ldap_sid) + { + print $langs->trans("DomainUser"); + } + else print $langs->trans("InternalUser"); + print ''; + print "".dol_print_date($obj->datec,'dayhour').""; + print ''; + $i++; + } + print "
"; - $db->free($resql); + $db->free($resql); } else { - dol_print_error($db); + dol_print_error($db); } /* - * Derniers groupes créés + * Derniers groupes cr��s */ $max=5; @@ -149,35 +152,35 @@ if ($max) $sql.= " LIMIT $max"; if ( $db->query($sql) ) { - $num = $db->num_rows(); - print ''; - print ''; - $var = true; - $i = 0; + $num = $db->num_rows(); + print '
'.$langs->trans("LastGroupsCreated",($num ? $num : $max)).'
'; + print ''; + $var = true; + $i = 0; - while ($i < $num && (! $max || $i < $max)) - { - $obj = $db->fetch_object(); - $var=!$var; + while ($i < $num && (! $max || $i < $max)) + { + $obj = $db->fetch_object(); + $var=!$var; - print ""; - print '"; - print ""; - print ""; - $i++; - } - print "
'.$langs->trans("LastGroupsCreated",($num ? $num : $max)).'
'.img_object($langs->trans("ShowGroup"),"group").' '.$obj->nom.''; - if (!$obj->entity) - { - print img_picto($langs->trans("GlobalGroup"),'redstar'); - } - print "".dol_print_date($obj->datec)."

"; + print ""; + print ''.img_object($langs->trans("ShowGroup"),"group").' '.$obj->nom.''; + if (!$obj->entity) + { + print img_picto($langs->trans("GlobalGroup"),'redstar'); + } + print ""; + print "".dol_print_date($obj->datec).""; + print ""; + $i++; + } + print "
"; - $db->free(); + $db->free(); } else { - dol_print_error($db); + dol_print_error($db); } diff --git a/htdocs/user/info.php b/htdocs/user/info.php index 911ae2fc501..f19f89fd0dd 100644 --- a/htdocs/user/info.php +++ b/htdocs/user/info.php @@ -17,10 +17,10 @@ */ /** - \file htdocs/user/info.php - \ingroup core - \brief Page des informations d'un utilisateur - \version $Id$ + * \file htdocs/user/info.php + * \ingroup core + * \brief Page des informations d'un utilisateur + * \version $Id$ */ require("./pre.inc.php"); @@ -40,6 +40,10 @@ $fuser->fetch(); $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); // If user is not user read and no permission to read other users, we stop diff --git a/htdocs/user/ldap.php b/htdocs/user/ldap.php index b9e9c16bf3c..3c0e8eac694 100644 --- a/htdocs/user/ldap.php +++ b/htdocs/user/ldap.php @@ -41,6 +41,10 @@ $contactid = isset($_GET["id"])?$_GET["id"]:''; $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); $fuser = new User($db, $_GET["id"]); diff --git a/htdocs/user/note.php b/htdocs/user/note.php index eaed67dfafa..109d6f424d0 100644 --- a/htdocs/user/note.php +++ b/htdocs/user/note.php @@ -15,16 +15,14 @@ * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - * - * $Id$ */ /** - \file htdocs/user/note.php - \ingroup usergroup - \brief Fiche de notes sur un utilisateur Dolibarr - \version $Revision$ -*/ + * \file htdocs/user/note.php + * \ingroup usergroup + * \brief Fiche de notes sur un utilisateur Dolibarr + * \version $Id$ + */ require("./pre.inc.php"); require_once(DOL_DOCUMENT_ROOT.'/lib/usergroups.lib.php'); @@ -45,11 +43,15 @@ $fuser->fetch(); // If user is not user read and no permission to read other users, we stop if (($fuser->id != $user->id) && (! $user->rights->user->user->lire)) accessforbidden(); - + // Security check $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); diff --git a/htdocs/user/param_ihm.php b/htdocs/user/param_ihm.php index 31a98a9b56a..60ae8eb8336 100644 --- a/htdocs/user/param_ihm.php +++ b/htdocs/user/param_ihm.php @@ -17,10 +17,10 @@ */ /** - \file htdocs/user/param_ihm.php - \brief Onglet parametrage de la fiche utilisateur - \version $Id$ -*/ + * \file htdocs/user/param_ihm.php + * \brief Onglet parametrage de la fiche utilisateur + * \version $Id$ + */ require("./pre.inc.php"); require_once(DOL_DOCUMENT_ROOT."/lib/functions2.lib.php"); @@ -33,11 +33,11 @@ $langs->load("admin"); $langs->load("users"); // Defini si peux lire/modifier permisssions -$canreadperms=($user->admin || $user->rights->user->user->lire); +$canreaduser=($user->admin || $user->rights->user->user->lire); if ($_REQUEST["id"]) { - // $user est le user qui edite, $_REQUEST["id"] est l'id de l'utilisateur edité + // $user est le user qui edite, $_REQUEST["id"] est l'id de l'utilisateur edit� $caneditfield=( (($user->id == $_REQUEST["id"]) && $user->rights->user->self->creer) || (($user->id != $_REQUEST["id"]) && $user->rights->user->user->creer)); } @@ -46,8 +46,13 @@ if ($_REQUEST["id"]) $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; + $canreaduser=1; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); -if ($user->id <> $_REQUEST["id"] && ! $canreadperms) accessforbidden(); +if ($user->id <> $_REQUEST["id"] && ! $canreaduser) accessforbidden(); $id=isset($_GET["id"])?$_GET["id"]:$_POST["id"]; @@ -55,12 +60,12 @@ $dirtop = "../includes/menus/barre_top"; $dirleft = "../includes/menus/barre_left"; $dirtheme = "../theme"; -// Charge utilisateur edité +// Charge utilisateur edit� $fuser = new User($db, $id); $fuser->fetch(); $fuser->getrights(); -// Liste des zone de recherche permanantes supportées +// Liste des zone de recherche permanantes support�es $searchform=array("main_searchform_societe","main_searchform_contact","main_searchform_produitservice"); $searchformconst=array($conf->global->MAIN_SEARCHFORM_SOCIETE,$conf->global->MAIN_SEARCHFORM_CONTACT,$conf->global->MAIN_SEARCHFORM_PRODUITSERVICE); $searchformtitle=array($langs->trans("Companies"),$langs->trans("Contacts"),$langs->trans("ProductsAndServices")); @@ -227,7 +232,7 @@ else } else { - if ($caneditfield || $user->admin) // Si utilisateur édité = utilisateur courant ayant les droits de créer ou admin + if ($caneditfield || $user->admin) // Si utilisateur �dit� = utilisateur courant ayant les droits de cr�er ou admin { print ''.$langs->trans("Modify").''; } diff --git a/htdocs/user/perms.php b/htdocs/user/perms.php index 28be70cd9cc..ae9c4744b3f 100644 --- a/htdocs/user/perms.php +++ b/htdocs/user/perms.php @@ -36,6 +36,8 @@ $module=isset($_GET["module"])?$_GET["module"]:$_POST["module"]; if (! isset($_GET["id"]) || empty($_GET["id"])) accessforbidden(); +// Defini si peux lire/modifier permisssions +$canreaduser=($user->admin || $user->rights->user->user->lire); // Defini si peux modifier utilisateurs et permisssions $caneditperms=($user->admin || $user->rights->user->user->creer); @@ -44,8 +46,13 @@ $caneditperms=($user->admin || $user->rights->user->user->creer); $socid=0; if ($user->societe_id > 0) $socid = $user->societe_id; $feature2 = (($socid && $user->rights->user->self->creer)?'':'user'); +if ($user->id == $_GET["id"]) // A user can always read its own card +{ + $feature2=''; + $canreaduser=1; +} $result = restrictedArea($user, 'user', $_GET["id"], '', $feature2); -if ($user->id <> $_REQUEST["id"] && ! $canreadperms) accessforbidden(); +if ($user->id <> $_REQUEST["id"] && ! $canreaduser) accessforbidden(); /**