lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #yogosha13939

Browse Source
This commit is contained in:
Laurent Destailleur 2022-12-24 14:18:58 +01:00
parent da37ad43bf
commit 99d5c4ebf3
8 changed files with 58 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/partnership/admin/setup.php
View File

@ -31,17 +31,16 @@ require_once '../lib/partnership.lib.php';
// Translations // Translations
$langs->loadLangs(array("admin", "partnership")); $langs->loadLangs(array("admin", "partnership"));
$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$error = 0;
// Security check // Security check
if (!$user->admin) { if (!$user->admin) {
accessforbidden(); accessforbidden();
} }
$action = GETPOST('action', 'aZ09');
$value = GETPOST('value', 'alpha');
$error = 0;
/* /*
* Actions * Actions

4
htdocs/partnership/admin/website.php
View File

@ -37,12 +37,12 @@ $langs->loadLangs(array("admin", "partnership"));
$action = GETPOST('action', 'aZ09'); $action = GETPOST('action', 'aZ09');
$error = 0;
if (!$user->admin) { if (!$user->admin) {
accessforbidden(); accessforbidden();
} }
$error = 0;
/* /*
* Actions * Actions

9
htdocs/partnership/partnership_agenda.php
View File

@ -84,12 +84,19 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id; $upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id;
} }
$permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user // Security check - Protection if external user
//if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid; //if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id); //$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
/* /*

4
htdocs/partnership/partnership_card.php
View File

@ -81,6 +81,10 @@ $permissiondellink = $user->rights->partnership->write; // Used by the include
$upload_dir = $conf->partnership->multidir_output[isset($object->entity) ? $object->entity : 1]; $upload_dir = $conf->partnership->multidir_output[isset($object->entity) ? $object->entity : 1];
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty'); $managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden(); if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden(); if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden(); if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();

12
htdocs/partnership/partnership_contact.php
View File

@ -51,15 +51,23 @@ $extrafields->fetch_name_optionals_label($object->table_element);
// Load object // Load object
include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be include, not include_once // Must be include, not include_once. Include fetch and fetch_thirdparty but not fetch_optionals include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be include, not include_once // Must be include, not include_once. Include fetch and fetch_thirdparty but not fetch_optionals
$permissiontoread = $user->rights->partnership->read;
$permission = $user->rights->partnership->write;
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user // Security check - Protection if external user
//if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid; //if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id); //$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
$permission = $user->rights->partnership->write;
/* /*
* Add a new contact * Actions
*/ */
if ($action == 'addcontact' && $permission) { if ($action == 'addcontact' && $permission) {

10
htdocs/partnership/partnership_document.php
View File

@ -75,12 +75,18 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity ? $object->entity : $conf->entity]."/partnership/".get_exdir(0, 0, 0, 1, $object); $upload_dir = $conf->partnership->multidir_output[$object->entity ? $object->entity : $conf->entity]."/partnership/".get_exdir(0, 0, 0, 1, $object);
} }
$permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user // Security check - Protection if external user
//if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid; //if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id); //$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();

22
htdocs/partnership/partnership_list.php
View File

@ -85,6 +85,8 @@ $extrafields->fetch_name_optionals_label($object->table_element);
$search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_'); $search_array_options = $extrafields->getOptionalsFromPost($object->table_element, '', 'search_');
$error = 0;
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty'); $managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
if ($managedfor != 'member' && $sortfield == 'd.datefin') $sortfield = ''; if ($managedfor != 'member' && $sortfield == 'd.datefin') $sortfield = '';
@ -149,18 +151,14 @@ $permissiontoread = $user->rights->partnership->read;
$permissiontoadd = $user->rights->partnership->write; $permissiontoadd = $user->rights->partnership->write;
$permissiontodelete = $user->rights->partnership->delete; $permissiontodelete = $user->rights->partnership->delete;
// Security check // Security check - Protection if external user
if (empty($conf->partnership->enabled)) { //if ($user->socid > 0) accessforbidden();
accessforbidden('Module not enabled'); //if ($user->socid > 0) $socid = $user->socid;
} //$result = restrictedArea($user, 'partnership', $object->id);
if ($user->socid > 0) { // Protection if external user if (empty($conf->partnership->enabled)) accessforbidden();
//$socid = $user->socid; if (empty($permissiontoread)) accessforbidden();
accessforbidden(); if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
} if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
//$result = restrictedArea($user, 'partnership');
//if (!$permissiontoread) accessforbidden();
$error = 0;
/* /*

11
htdocs/partnership/partnership_note.php
View File

@ -57,14 +57,25 @@ if ($id > 0 || !empty($ref)) {
$upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id; $upload_dir = $conf->partnership->multidir_output[$object->entity]."/".$object->id;
} }
$permissiontoread = $user->rights->partnership->read;
$permissionnote = $user->rights->partnership->write; // Used by the include of actions_setnotes.inc.php $permissionnote = $user->rights->partnership->write; // Used by the include of actions_setnotes.inc.php
$permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php $permissiontoadd = $user->rights->partnership->write; // Used by the include of actions_addupdatedelete.inc.php
$managedfor = getDolGlobalString('PARTNERSHIP_IS_MANAGED_FOR', 'thirdparty');
// Security check - Protection if external user
//if ($user->socid > 0) accessforbidden();
//if ($user->socid > 0) $socid = $user->socid;
//$result = restrictedArea($user, 'partnership', $object->id);
if (empty($conf->partnership->enabled)) accessforbidden();
if (empty($permissiontoread)) accessforbidden();
if ($object->id > 0 && !($object->fk_member > 0) && $managedfor == 'member') accessforbidden();
if ($object->id > 0 && !($object->fk_soc > 0) && $managedfor == 'thirdparty') accessforbidden();
/* /*
* Actions * Actions
*/ */
$reshook = $hookmanager->executeHooks('doActions', array(), $object, $action); // Note that $action and $object may have been modified by some hooks $reshook = $hookmanager->executeHooks('doActions', array(), $object, $action); // Note that $action and $object may have been modified by some hooks
if ($reshook < 0) { if ($reshook < 0) {
setEventMessages($hookmanager->error, $hookmanager->errors, 'errors'); setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');