lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #yogosha13939

Browse Source
This commit is contained in:
Laurent Destailleur 2022-12-24 14:18:58 +01:00
parent da37ad43bf
commit 99d5c4ebf3
8 changed files with 58 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/partnership/admin/setup.php
View File

@ -31,17 +31,16 @@ require_once '../lib/partnership.lib.php';
// Translations
$langs->loadLangs(array("admin", "partnership"));
$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$error = 0;
// Security check
if (!$user->admin) {
accessforbidden();
}
$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$error = 0;
/*
* Actions

4
htdocs/partnership/admin/website.php
View File

@ -37,12 +37,12 @@ $langs->loadLangs(array("admin", "partnership"));
$action = GETPOST('action', 'aZ09');
$error = 0;
if (!$user->admin) {
accessforbidden();
}
$error = 0;
/*
* Actions

9
htdocs/partnership/partnership_agenda.php
View File

@ -84,12 +84,19 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id;
}
$permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
/*

4
htdocs/partnership/partnership_card.php
View File

@ -81,6 +81,10 @@ $permissiondellink = $user->rights->partnership->write; // Used by the include
$upload_dir = $conf->partnership->multidir_output[isset($object->entity) ? $object->entity : 1];
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();

12
htdocs/partnership/partnership_contact.php
View File

@ -51,15 +51,23 @@ $extrafields->fetch_name_optionals_label($object->table_element);
// Load object
include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be include, not include_once // Must be include, not include_once. Include fetch and fetch_thirdparty but not fetch_optionals
$permissiontoread = $user->rights->partnership->read;
$permission = $user->rights->partnership->write;
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
$permission = $user->rights->partnership->write;
/*
* Add a new contact
* Actions
*/
if ($action == 'addcontact' && $permission) {

10
htdocs/partnership/partnership_document.php
View File

@ -75,12 +75,18 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity ? $object->entity : $conf->entity]."/partnership/".get_exdir(0, 0, 0, 1, $object);
}
$permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();

22
htdocs/partnership/partnership_list.php
View File

@ -85,6 +85,8 @@ $extrafields->fetch_name_optionals_label($object->table_element);
$search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_');
$error = 0;
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
if ($managedfor != 'member' && $sortfield == 'd.datefin') $sortfield = '';
@ -149,18 +151,14 @@ $permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write;
$permissiontodelete = $user->rights->partnership->delete;
// Security check
if (empty($conf->partnership->enabled)) {
accessforbidden('Module not enabled');
}
if ($user->socid > 0) { // Protection if external user
//$socid = $user->socid;
accessforbidden();
}
//$result = restrictedArea($user, 'partnership');
//if (!$permissiontoread) accessforbidden();
$error = 0;
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
/*

11
htdocs/partnership/partnership_note.php
View File

@ -57,14 +57,25 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id;
}
$permissiontoread = $user->rights->partnership->read;
$permissionnote = $user->rights->partnership->write; // Used by the include of actions_setnotes.inc.php
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
/*
* Actions
*/
$reshook = $hookmanager->executeHooks('doActions', array(), $object, $action); // Note that $action and $object may have been modified by some hooks
if ($reshook < 0) {
setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');