lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: preventing XSS injections and uniform code

Browse Source
This commit is contained in:
Regis Houssin 2011-11-27 18:44:27 +01:00
parent 0e4d70d664
commit 98c60c1412
5 changed files with 121 additions and 121 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
dev/skeletons/skeleton_page.php
View File

@ -52,8 +52,9 @@ $langs->load("companies");
$langs->load("other"); $langs->load("other");
// Get parameters // Get parameters
$action = GETPOST('action'); $id = GETPOST('id','int');
$myparam = GETPOST('myparam'); $action = GETPOST('action','alpha');
$myparam = GETPOST('myparam','alpha');
// Protection if external user // Protection if external user
if ($user->societe_id > 0) if ($user->societe_id > 0)

151
htdocs/adherents/type.php
View File

@ -30,11 +30,18 @@ require_once(DOL_DOCUMENT_ROOT."/adherents/class/adherent_type.class.php");
$langs->load("members"); $langs->load("members");
$rowid=GETPOST("rowid"); $rowid = GETPOST('rowid','int');
$action = GETPOST('action','alpha');
$sortfield = GETPOST("sortfield",'alpha'); $search_lastname = GETPOST('search_nom','alpha');
$sortorder = GETPOST("sortorder",'alpha'); $search_login = GETPOST('search_login','alpha');
$page = GETPOST("page",'int'); $search_email = GETPOST('search_email','alpha');
$type = GETPOST('type','alpha');
$status = GETPOST('status','alpha');
$sortfield = GETPOST('sortfield','alpha');
$sortorder = GETPOST('sortorder','alpha');
$page = GETPOST('page','int');
if ($page == -1) { $page = 0 ; } if ($page == -1) { $page = 0 ; }
$offset = $conf->liste_limit * $page ; $offset = $conf->liste_limit * $page ;
$pageprev = $page - 1; $pageprev = $page - 1;
@ -45,16 +52,12 @@ if (! $sortfield) { $sortfield="d.nom"; }
// Security check // Security check
if (! $user->rights->adherent->lire) accessforbidden(); if (! $user->rights->adherent->lire) accessforbidden();
if ($_REQUEST["button_removefilter"]) if (GETPOST('button_removefilter'))
{ {
$_GET["search_nom"]=""; $search_lastname="";
$_REQUEST["search_nom"]=""; $search_login="";
$_GET["search_prenom"]=""; $search_email="";
$_REQUEST["search_prenom"]=""; $type="";
$_GET["type"]="";
$_REQUEST["type"]="";
$_GET["search_email"]="";
$_REQUEST["search_email"]="";
$sall=""; $sall="";
} }
@ -63,7 +66,7 @@ if ($_REQUEST["button_removefilter"])
/* /*
* Actions * Actions
*/ */
if ($user->rights->adherent->configurer && $_POST["action"] == 'add') if ($action == 'add' && $user->rights->adherent->configurer)
{ {
if ($_POST["button"] != $langs->trans("Cancel")) if ($_POST["button"] != $langs->trans("Cancel"))
{ {
@ -80,24 +83,24 @@ if ($user->rights->adherent->configurer && $_POST["action"] == 'add')
$id=$adht->create($user->id); $id=$adht->create($user->id);
if ($id > 0) if ($id > 0)
{ {
Header("Location: type.php"); Header("Location: ".$_SERVER["PHP_SELF"]);
exit; exit;
} }
else else
{ {
$mesg=$adht->error; $mesg=$adht->error;
$_GET["action"] = 'create'; $action = 'create';
} }
} }
else else
{ {
$mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentities("Label")); $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentities("Label"));
$_GET["action"] = 'create'; $action = 'create';
} }
} }
} }
if ($user->rights->adherent->configurer && $_POST["action"] == 'update') if ($action == 'update' && $user->rights->adherent->configurer)
{ {
if ($_POST["button"] != $langs->trans("Cancel")) if ($_POST["button"] != $langs->trans("Cancel"))
{ {
@ -111,12 +114,12 @@ if ($user->rights->adherent->configurer && $_POST["action"] == 'update')
$adht->update($user->id); $adht->update($user->id);
Header("Location: type.php?rowid=".$_POST["rowid"]); Header("Location: ".$_SERVER["PHP_SELF"]."?rowid=".$_POST["rowid"]);
exit; exit;
} }
} }
if ($user->rights->adherent->configurer && $_GET["action"] == 'delete') if ($action == 'delete' && $user->rights->adherent->configurer)
{ {
$adht = new AdherentType($db); $adht = new AdherentType($db);
$adht->delete($rowid); $adht->delete($rowid);
@ -124,7 +127,7 @@ if ($user->rights->adherent->configurer && $_GET["action"] == 'delete')
exit; exit;
} }
if ($user->rights->adherent->configurer && $_GET["action"] == 'commentaire') if ($action == 'commentaire' && $user->rights->adherent->configurer)
{ {
$don = new Don($db); $don = new Don($db);
$don->fetch($rowid); $don->fetch($rowid);
@ -143,7 +146,7 @@ $form=new Form($db);
// Liste of members type // Liste of members type
if (! $rowid && $_GET["action"] != 'create' && $_GET["action"] != 'edit') if (! $rowid && $action != 'create' && $action != 'edit')
{ {
print_fiche_titre($langs->trans("MembersTypes")); print_fiche_titre($langs->trans("MembersTypes"));
@ -199,7 +202,7 @@ if (! $rowid && $_GET["action"] != 'create' && $_GET["action"] != 'edit')
// New type // New type
if ($user->rights->adherent->configurer) if ($user->rights->adherent->configurer)
{ {
print "<a class=\"butAction\" href=\"type.php?action=create\">".$langs->trans("NewType")."</a>"; print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=create">'.$langs->trans("NewType").'</a>';
} }
print "</div>"; print "</div>";
@ -212,7 +215,7 @@ if (! $rowid && $_GET["action"] != 'create' && $_GET["action"] != 'edit')
/* Creation d'un type adherent */ /* Creation d'un type adherent */
/* */ /* */
/* ************************************************************************** */ /* ************************************************************************** */
if ($_GET["action"] == 'create') if ($action == 'create')
{ {
$form = new Form($db); $form = new Form($db);
@ -220,7 +223,7 @@ if ($_GET["action"] == 'create')
if ($mesg) print '<div class="error">'.$mesg.'</div>'; if ($mesg) print '<div class="error">'.$mesg.'</div>';
print "<form action=\"type.php\" method=\"post\">"; print '<form action="'.$_SERVER['PHP_SELF'].'" method="POST">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'; print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<table class="border" width="100%">'; print '<table class="border" width="100%">';
@ -237,7 +240,7 @@ if ($_GET["action"] == 'create')
print '</td></tr>'; print '</td></tr>';
print '<tr><td valign="top">'.$langs->trans("Description").'</td><td>'; print '<tr><td valign="top">'.$langs->trans("Description").'</td><td>';
print "<textarea name=\"comment\" wrap=\"soft\" cols=\"60\" rows=\"3\"></textarea></td></tr>"; print '<textarea name="comment" wrap="soft" cols="60" rows="3"></textarea></td></tr>';
print '<tr><td valign="top">'.$langs->trans("WelcomeEMail").'</td><td>'; print '<tr><td valign="top">'.$langs->trans("WelcomeEMail").'</td><td>';
require_once(DOL_DOCUMENT_ROOT."/core/class/doleditor.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/doleditor.class.php");
@ -261,7 +264,7 @@ if ($_GET["action"] == 'create')
/* ************************************************************************** */ /* ************************************************************************** */
if ($rowid > 0) if ($rowid > 0)
{ {
if ($_GET["action"] != 'edit') if ($action != 'edit')
{ {
$adht = new AdherentType($db); $adht = new AdherentType($db);
$adht->id = $rowid; $adht->id = $rowid;
@ -316,16 +319,16 @@ if ($rowid > 0)
// Edit // Edit
if ($user->rights->adherent->configurer) if ($user->rights->adherent->configurer)
{ {
print "<a class=\"butAction\" href=\"type.php?action=edit&amp;rowid=".$adht->id."\">".$langs->trans("Modify")."</a>"; print '<a class="butAction" href="'.$_SERVER['PHP_SELF'].'?action=edit&amp;rowid='.$adht->id.'">'.$langs->trans("Modify").'</a>';
} }
// Add // Add
print "<a class=\"butAction\" href=\"fiche.php?action=create&typeid=".$adht->id."\">".$langs->trans("AddMember")."</a>"; print '<a class="butAction" href="fiche.php?action=create&typeid='.$adht->id.'">'.$langs->trans("AddMember").'</a>';
// Delete // Delete
if ($user->rights->adherent->configurer) if ($user->rights->adherent->configurer)
{ {
print "<a class=\"butActionDelete\" href=\"type.php?action=delete&rowid=".$adht->id."\">".$langs->trans("DeleteType")."</a>"; print '<a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=delete&rowid='.$adht->id.'">'.$langs->trans("DeleteType").'</a>';
} }
print "</div>"; print "</div>";
@ -342,38 +345,35 @@ if ($rowid > 0)
$sql.= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."adherent_type as t"; $sql.= " FROM ".MAIN_DB_PREFIX."adherent as d, ".MAIN_DB_PREFIX."adherent_type as t";
$sql.= " WHERE d.fk_adherent_type = t.rowid "; $sql.= " WHERE d.fk_adherent_type = t.rowid ";
$sql.= " AND d.entity = ".$conf->entity; $sql.= " AND d.entity = ".$conf->entity;
$sql.= " AND t.rowid = ".$adht->id;
if ($sall) if ($sall)
{ {
$sql.=" AND (d.prenom like '%".$sall."%' OR d.nom like '%".$sall."%' OR d.societe like '%".$sall."%'"; $sql.= " AND (d.prenom LIKE '%".$sall."%' OR d.nom LIKE '%".$sall."%' OR d.societe LIKE '%".$sall."%'";
$sql.=" OR d.email like '%".$sall."%' OR d.login like '%".$sall."%' OR d.adresse like '%".$sall."%'"; $sql.= " OR d.email LIKE '%".$sall."%' OR d.login LIKE '%".$sall."%' OR d.adresse LIKE '%".$sall."%'";
$sql.=" OR d.ville like '%".$sall."%' OR d.note like '%".$sall."%')"; $sql.= " OR d.ville LIKE '%".$sall."%' OR d.note LIKE '%".$sall."%')";
} }
//if ($_REQUEST["type"] > 0) if ($status != '')
//{
//$sql.=" AND t.rowid=".$_REQUEST["type"];
$sql.=" AND t.rowid=".$adht->id;
//}
if (isset($_GET["statut"]))
{ {
$sql.=" AND d.statut in ($statut)"; // Peut valoir un nombre ou liste de nombre separes par virgules $sql.= " AND d.statut IN (".$status.")"; // Peut valoir un nombre ou liste de nombre separes par virgules
} }
if ( $_POST["action"] == 'search') if ($action == 'search')
{ {
if (isset($_POST['search']) && $_POST['search'] != ''){ if (isset($_POST['search']) && $_POST['search'] != '')
{
$sql.= " AND (d.prenom LIKE '%".$_POST['search']."%' OR d.nom LIKE '%".$_POST['search']."%')"; $sql.= " AND (d.prenom LIKE '%".$_POST['search']."%' OR d.nom LIKE '%".$_POST['search']."%')";
} }
} }
if ($_GET["search_nom"]) if (! empty($search_lastname))
{ {
$sql.= " AND (d.prenom LIKE '%".$_GET["search_nom"]."%' OR d.nom LIKE '%".$_GET["search_nom"]."%')"; $sql.= " AND (d.prenom LIKE '%".$search_lastname."%' OR d.nom LIKE '%".$search_lastname."%')";
} }
if ($_GET["search_login"]) if (! empty($search_login))
{ {
$sql.= " AND d.login LIKE '%".$_GET["search_login"]."%'"; $sql.= " AND d.login LIKE '%".$search_login."%'";
} }
if ($_GET["search_email"]) if (! empty($search_email))
{ {
$sql.= " AND (d.email LIKE '%".$_GET["search_email"]."%')"; $sql.= " AND d.email LIKE '%".$search_email."%'";
} }
if ($filter == 'uptodate') if ($filter == 'uptodate')
{ {
@ -402,32 +402,34 @@ if ($rowid > 0)
$i = 0; $i = 0;
$titre=$langs->trans("MembersList"); $titre=$langs->trans("MembersList");
if (isset($_GET["statut"])) if ($status != '')
{ {
if ($statut == '-1,1') { $titre=$langs->trans("MembersListQualified"); } if ($status == '-1,1') { $titre=$langs->trans("MembersListQualified"); }
if ($statut == '-1') { $titre=$langs->trans("MembersListToValid"); } else if ($status == '-1') { $titre=$langs->trans("MembersListToValid"); }
if ($statut == '1' && ! $filter) { $titre=$langs->trans("MembersListValid"); } else if ($status == '1' && ! $filter) { $titre=$langs->trans("MembersListValid"); }
if ($statut == '1' && $filter=='uptodate') { $titre=$langs->trans("MembersListUpToDate"); } else if ($status == '1' && $filter=='uptodate') { $titre=$langs->trans("MembersListUpToDate"); }
if ($statut == '1' && $filter=='outofdate') { $titre=$langs->trans("MembersListNotUpToDate"); } else if ($status == '1' && $filter=='outofdate') { $titre=$langs->trans("MembersListNotUpToDate"); }
if ($statut == '0') { $titre=$langs->trans("MembersListResiliated"); } else if ($status == '0') { $titre=$langs->trans("MembersListResiliated"); }
} }
elseif ($_POST["action"] == 'search') { elseif ($action == 'search')
{
$titre=$langs->trans("MembersListQualified"); $titre=$langs->trans("MembersListQualified");
} }
if ($_REQUEST["type"] > 0) if ($type > 0)
{ {
$membertype=new AdherentType($db); $membertype=new AdherentType($db);
$result=$membertype->fetch($_REQUEST["type"]); $result=$membertype->fetch($type);
$titre.=" (".$membertype->libelle.")"; $titre.=" (".$membertype->libelle.")";
} }
$param="&rowid=".$rowid; $param="&rowid=".$rowid;
if (isset($_GET["statut"])) $param.="&statut=".$_GET["statut"]; if (! empty($status)) $param.="&status=".$status;
if (isset($_GET["search_nom"])) $param.="&search_nom=".$_GET["search_nom"]; if (! empty($search_lastname)) $param.="&search_nom=".$search_lastname;
if (isset($_GET["search_login"])) $param.="&search_login=".$_GET["search_login"]; if (! empty($search_firstname)) $param.="&search_prenom=".$search_firstname;
if (isset($_GET["search_email"])) $param.="&search_email=".$_GET["search_email"]; if (! empty($search_login)) $param.="&search_login=".$search_login;
if (isset($_GET["filter"])) $param.="&filter=".$_GET["filter"]; if (! empty($search_email)) $param.="&search_email=".$search_email;
if (! empty($filter)) $param.="&filter=".$filter;
if ($sall) if ($sall)
{ {
@ -436,7 +438,7 @@ if ($rowid > 0)
print '<br>'; print '<br>';
print_barre_liste('',$page,$_SERVER["PHP_SELF"],$param,$sortfield,$sortorder,'',$num,$nbtotalofrecords); print_barre_liste('',$page,$_SERVER["PHP_SELF"],$param,$sortfield,$sortorder,'',$num,$nbtotalofrecords);
print "<table class=\"noborder\" width=\"100%\">"; print '<table class="noborder" width="100%">';
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print_liste_field_titre($langs->trans("Name")." / ".$langs->trans("Company"),$_SERVER["PHP_SELF"],"d.nom",$param,"","",$sortfield,$sortorder); print_liste_field_titre($langs->trans("Name")." / ".$langs->trans("Company"),$_SERVER["PHP_SELF"],"d.nom",$param,"","",$sortfield,$sortorder);
@ -455,15 +457,15 @@ if ($rowid > 0)
print '<tr class="liste_titre">'; print '<tr class="liste_titre">';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_nom" value="'.$_REQUEST["search_nom"].'" size="12"></td>'; print '<input class="flat" type="text" name="search_nom" value="'.$search_lastname.'" size="12"></td>';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_login" value="'.$_REQUEST["search_login"].'" size="7"></td>'; print '<input class="flat" type="text" name="search_login" value="'.$search_login.'" size="7"></td>';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';
print '<td class="liste_titre" align="left">'; print '<td class="liste_titre" align="left">';
print '<input class="flat" type="text" name="search_email" value="'.$_REQUEST["search_email"].'" size="12"></td>'; print '<input class="flat" type="text" name="search_email" value="'.$search_email.'" size="12"></td>';
print '<td class="liste_titre">&nbsp;</td>'; print '<td class="liste_titre">&nbsp;</td>';
@ -487,14 +489,14 @@ if ($rowid > 0)
// Nom // Nom
$var=!$var; $var=!$var;
print "<tr $bc[$var]>"; print '<tr '.$bc[$var].'>';
if ($objp->societe != '') if ($objp->societe != '')
{ {
print "<td><a href=\"fiche.php?rowid=$objp->rowid\">".img_object($langs->trans("ShowMember"),"user").' '.$objp->prenom." ".dol_trunc($objp->nom,12)." / ".dol_trunc($objp->societe,12)."</a></td>\n"; print '<td><a href="fiche.php?rowid='.$objp->rowid.'">'.img_object($langs->trans("ShowMember"),"user").' '.$objp->prenom.' '.dol_trunc($objp->nom,12).' / '.dol_trunc($objp->societe,12).'</a></td>'."\n";
} }
else else
{ {
print "<td><a href=\"fiche.php?rowid=$objp->rowid\">".img_object($langs->trans("ShowMember"),"user").' '.$objp->prenom." ".dol_trunc($objp->nom)."</a></td>\n"; print '<td><a href="fiche.php?rowid='.$objp->rowid.'">'.img_object($langs->trans("ShowMember"),"user").' '.$objp->prenom.' '.dol_trunc($objp->nom).'</a></td>'."\n";
} }
// Login // Login
@ -552,12 +554,12 @@ if ($rowid > 0)
print '<td align="center">'; print '<td align="center">';
if ($user->rights->adherent->creer) if ($user->rights->adherent->creer)
{ {
print "<a href=\"fiche.php?rowid=$objp->rowid&action=edit&return=liste.php\">".img_edit()."</a>"; print '<a href="fiche.php?rowid='.$objp->rowid.'&action=edit&return=liste.php">'.img_edit().'</a>';
} }
print '&nbsp;'; print '&nbsp;';
if ($user->rights->adherent->supprimer) if ($user->rights->adherent->supprimer)
{ {
print "<a href=\"fiche.php?rowid=$objp->rowid&action=resign&return=liste.php\">".img_picto($langs->trans("Resiliate"),'disable.png')."</a>"; print '<a href="fiche.php?rowid='.$objp->rowid.'&action=resign&return=liste.php">'.img_picto($langs->trans("Resiliate"),'disable.png').'</a>';
} }
print "</td>"; print "</td>";
@ -579,7 +581,7 @@ if ($rowid > 0)
} }
if ($_GET["action"] == 'edit') if ($action == 'edit')
{ {
$form = new Form($db); $form = new Form($db);
@ -597,7 +599,6 @@ if ($rowid > 0)
dol_fiche_head($head, 'card', $langs->trans("MemberType"), 0, 'group'); dol_fiche_head($head, 'card', $langs->trans("MemberType"), 0, 'group');
print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?rowid='.$rowid.'">'; print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?rowid='.$rowid.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'; print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="rowid" value="'.$rowid.'">'; print '<input type="hidden" name="rowid" value="'.$rowid.'">';
@ -617,7 +618,7 @@ if ($rowid > 0)
print '</td></tr>'; print '</td></tr>';
print '<tr><td valign="top">'.$langs->trans("Description").'</td><td>'; print '<tr><td valign="top">'.$langs->trans("Description").'</td><td>';
print "<textarea name=\"comment\" wrap=\"soft\" cols=\"90\" rows=\"3\">".$adht->note."</textarea></td></tr>"; print '<textarea name="comment" wrap="soft" cols="90" rows="3">'.$adht->note.'</textarea></td></tr>';
print '<tr><td valign="top">'.$langs->trans("WelcomeEMail").'</td><td>'; print '<tr><td valign="top">'.$langs->trans("WelcomeEMail").'</td><td>';
require_once(DOL_DOCUMENT_ROOT."/core/class/doleditor.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/doleditor.class.php");

6
htdocs/core/class/html.formbarcode.class.php
View File

@ -1,6 +1,6 @@
<?php <?php
/* Copyright (C) 2007-2009 Regis Houssin <regis@dolibarr.fr> /* Copyright (C) 2007-2011 Regis Houssin <regis@dolibarr.fr>
* Copyright (C) 2008-2010 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2008-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -18,7 +18,7 @@
*/ */
/** /**
* \file htdocs/includes/barcode/html.formbarcode.class.php * \file htdocs/core/class/html.formbarcode.class.php
* \brief Fichier de la classe des fonctions predefinie de composants html * \brief Fichier de la classe des fonctions predefinie de composants html
*/ */

2
htdocs/product/admin/produit.php
View File

@ -28,7 +28,7 @@
require("../../main.inc.php"); require("../../main.inc.php");
require_once(DOL_DOCUMENT_ROOT."/core/lib/admin.lib.php"); require_once(DOL_DOCUMENT_ROOT."/core/lib/admin.lib.php");
require_once(DOL_DOCUMENT_ROOT."/includes/barcode/html.formbarcode.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/html.formbarcode.class.php");
$langs->load("admin"); $langs->load("admin");

78
htdocs/product/barcode.php
View File

@ -1,7 +1,7 @@
<?php <?php
/* Copyright (C) 2001-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2001-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2010 Regis Houssin <regis@dolibarr.fr> * Copyright (C) 2005-2011 Regis Houssin <regis@dolibarr.fr>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -26,44 +26,44 @@
require("../main.inc.php"); require("../main.inc.php");
require_once(DOL_DOCUMENT_ROOT."/core/lib/product.lib.php"); require_once(DOL_DOCUMENT_ROOT."/core/lib/product.lib.php");
require_once(DOL_DOCUMENT_ROOT."/product/class/product.class.php"); require_once(DOL_DOCUMENT_ROOT."/product/class/product.class.php");
require_once(DOL_DOCUMENT_ROOT."/includes/barcode/html.formbarcode.class.php"); require_once(DOL_DOCUMENT_ROOT."/core/class/html.formbarcode.class.php");
$langs->load("products"); $langs->load("products");
$langs->load("bills"); $langs->load("bills");
// Security check $id = GETPOST('id','int');
if (isset($_GET["id"]) || isset($_GET["ref"])) $ref = GETPOST('ref','alpha');
{ $action = GETPOST('action','alpha');
$id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
}
$fieldid = isset($_GET["ref"])?'ref':'rowid';
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit|service&barcode',$id,'product','','',$fieldid);
// Security check
$fieldvalue = (! empty($id) ? $id : $ref);
$fieldname = (! empty($ref) ? 'ref' : 'rowid');
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit|service&barcode',$fieldvalue,'product','','',$fieldname);
$object = new Product($db);
/* /*
* Actions * Actions
*/ */
// Modification du type de code barre // Modification du type de code barre
if ($_POST['action'] == 'setbarcodetype' && $user->rights->barcode->creer) if ($action == 'setbarcodetype' && $user->rights->barcode->creer)
{ {
$product = new Product($db); $object->fetch($id);
$product->fetch($_GET["id"]); $object->barcode_type = $_POST['barcodetype_id'];
$product->barcode_type = $_POST['barcodetype_id']; $result = $object->update_barcode_type($user);
$result = $product->update_barcode_type($user); Header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
Header("Location: barcode.php?id=".$_GET["id"]);
exit; exit;
} }
// Modification du code barre // Modification du code barre
if ($_POST['action'] == 'setbarcode' && $user->rights->barcode->creer) if ($action == 'setbarcode' && $user->rights->barcode->creer)
{ {
$product = new Product($db); $object->fetch($id);
$product->fetch($_GET["id"]); $object->barcode = $_POST['barcode']; //Todo: ajout verification de la validite du code barre en fonction du type
$product->barcode = $_POST['barcode']; //Todo: ajout verification de la validite du code barre en fonction du type $result = $object->update_barcode($user);
$result = $product->update_barcode($user); Header("Location: ".$_SERVER['PHP_SELF']."?id=".$id);
Header("Location: barcode.php?id=".$_GET["id"]);
exit; exit;
} }
@ -77,13 +77,11 @@ llxHeader("","",$langs->trans("BarCode"));
$form = new Form($db); $form = new Form($db);
$formbarcode = new FormBarCode($db); $formbarcode = new FormBarCode($db);
$product = new Product($db); $result = $object->fetch($id,$ref);
if ($_GET["ref"]) $result = $product->fetch('',$_GET["ref"]);
if ($_GET["id"]) $result = $product->fetch($_GET["id"]);
$head=product_prepare_head($product, $user); $head=product_prepare_head($object, $user);
$titre=$langs->trans("CardProduct".$product->type); $titre=$langs->trans("CardProduct".$object->type);
$picto=($product->type==1?'service':'product'); $picto=($object->type==1?'service':'product');
dol_fiche_head($head, 'barcode', $titre, 0, $picto); dol_fiche_head($head, 'barcode', $titre, 0, $picto);
@ -92,15 +90,15 @@ print '<table class="border" width="100%">'."\n";
// Reference // Reference
print '<tr>'; print '<tr>';
print '<td width="15%">'.$langs->trans("Ref").'</td><td colspan="3">'; print '<td width="15%">'.$langs->trans("Ref").'</td><td colspan="3">';
print $form->showrefnav($product,'ref','',1,'ref'); print $form->showrefnav($object,'ref','',1,'ref');
print '</td>'; print '</td>';
print '</tr>'."\n"; print '</tr>'."\n";
// Libelle // Libelle
print '<tr><td>'.$langs->trans("Label").'</td><td colspan="2">'.$product->libelle.'</td>'; print '<tr><td>'.$langs->trans("Label").'</td><td colspan="2">'.$object->libelle.'</td>';
// Barcode image // Barcode image
$url=DOL_URL_ROOT.'/viewimage.php?modulepart=barcode&generator='.urlencode($product->barcode_type_coder).'&code='.urlencode($product->barcode).'&encoding='.urlencode($product->barcode_type_code); $url=DOL_URL_ROOT.'/viewimage.php?modulepart=barcode&generator='.urlencode($object->barcode_type_coder).'&code='.urlencode($object->barcode).'&encoding='.urlencode($object->barcode_type_code);
print '<td width="300" align="center" rowspan="5">'; print '<td width="300" align="center" rowspan="5">';
print '<!-- url barcode = '.$url.' -->'; print '<!-- url barcode = '.$url.' -->';
print '<img src="'.$url.'">'; print '<img src="'.$url.'">';
@ -110,12 +108,12 @@ print '</tr>'."\n";
// Status (to sell) // Status (to sell)
print '<tr><td>'.$langs->trans("Status").' ('.$langs->trans("Sell").')'.'</td><td>'; print '<tr><td>'.$langs->trans("Status").' ('.$langs->trans("Sell").')'.'</td><td>';
print $product->getLibStatut(2,0); print $object->getLibStatut(2,0);
print '</td></tr>'; print '</td></tr>';
// Status (to buy) // Status (to buy)
print '<tr><td>'.$langs->trans("Status").' ('.$langs->trans("Buy").')'.'</td><td>'; print '<tr><td>'.$langs->trans("Status").' ('.$langs->trans("Buy").')'.'</td><td>';
print $product->getLibStatut(2,1); print $object->getLibStatut(2,1);
print '</td></tr>'; print '</td></tr>';
// Barcode type // Barcode type
@ -123,16 +121,16 @@ print '<tr><td nowrap>';
print '<table width="100%" class="nobordernopadding"><tr><td nowrap>'; print '<table width="100%" class="nobordernopadding"><tr><td nowrap>';
print $langs->trans("BarcodeType"); print $langs->trans("BarcodeType");
print '<td>'; print '<td>';
if (($_GET['action'] != 'editbarcodetype') && $user->rights->barcode->creer) print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=editbarcodetype&amp;id='.$product->id.'">'.img_edit($langs->trans('SetBarcodeType'),1).'</a></td>'; if (($_GET['action'] != 'editbarcodetype') && $user->rights->barcode->creer) print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=editbarcodetype&amp;id='.$object->id.'">'.img_edit($langs->trans('SetBarcodeType'),1).'</a></td>';
print '</tr></table>'; print '</tr></table>';
print '</td><td colspan="2">'; print '</td><td colspan="2">';
if ($_GET['action'] == 'editbarcodetype') if ($_GET['action'] == 'editbarcodetype')
{ {
$formbarcode->form_barcode_type($_SERVER['PHP_SELF'].'?id='.$product->id,$product->barcode_type,'barcodetype_id'); $formbarcode->form_barcode_type($_SERVER['PHP_SELF'].'?id='.$object->id,$object->barcode_type,'barcodetype_id');
} }
else else
{ {
print $product->barcode_type_label?$product->barcode_type_label:'<div class="warning">'.$langs->trans("SetDefaultBarcodeType").'<div>'; print $object->barcode_type_label?$object->barcode_type_label:'<div class="warning">'.$langs->trans("SetDefaultBarcodeType").'<div>';
} }
print '</td></tr>'."\n"; print '</td></tr>'."\n";
@ -141,20 +139,20 @@ print '<tr><td nowrap>';
print '<table width="100%" class="nobordernopadding"><tr><td nowrap>'; print '<table width="100%" class="nobordernopadding"><tr><td nowrap>';
print $langs->trans("BarcodeValue"); print $langs->trans("BarcodeValue");
print '<td>'; print '<td>';
if (($_GET['action'] != 'editbarcode') && $user->rights->barcode->creer) print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=editbarcode&amp;id='.$product->id.'">'.img_edit($langs->trans('SetBarcode'),1).'</a></td>'; if (($_GET['action'] != 'editbarcode') && $user->rights->barcode->creer) print '<td align="right"><a href="'.$_SERVER["PHP_SELF"].'?action=editbarcode&amp;id='.$object->id.'">'.img_edit($langs->trans('SetBarcode'),1).'</a></td>';
print '</tr></table>'; print '</tr></table>';
print '</td><td colspan="2">'; print '</td><td colspan="2">';
if ($_GET['action'] == 'editbarcode') if ($_GET['action'] == 'editbarcode')
{ {
print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$product->id.'">'; print '<form method="post" action="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'; print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
print '<input type="hidden" name="action" value="setbarcode">'; print '<input type="hidden" name="action" value="setbarcode">';
print '<input size="40" type="text" name="barcode" value="'.$product->barcode.'">'; print '<input size="40" type="text" name="barcode" value="'.$object->barcode.'">';
print '&nbsp;<input type="submit" class="button" value="'.$langs->trans("Modify").'">'; print '&nbsp;<input type="submit" class="button" value="'.$langs->trans("Modify").'">';
} }
else else
{ {
print $product->barcode; print $object->barcode;
} }
print '</td></tr>'."\n"; print '</td></tr>'."\n";