lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

amlioration de la scurit

Browse Source
This commit is contained in:
Regis Houssin 2006-03-10 17:19:14 +00:00
parent 3c97a3c15d
commit a66844976e
5 changed files with 112 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
htdocs/projet/commandes.php
View File

@ -43,11 +43,31 @@ if (!$user->rights->projet->lire) accessforbidden();
/*
* Sécurité accés client
*/
$projetid='';
if ($_GET["id"]) { $projetid=$_GET["id"]; }
if ($projetid == '') accessforbidden();
if ($user->societe_id > 0)
{
$socidp = $user->societe_id;
}
// Protection restriction commercial
if ($projetid)
{
$sql = "SELECT sc.fk_soc, p.rowid, p.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."projet as p";
$sql .= " WHERE p.rowid = ".$projetid;
if (!$user->rights->commercial->client->voir && !$socidp) $sql .= " AND sc.fk_soc = p.fk_soc AND fk_user = ".$user->id;
if ($socidp) $sql .= " AND p.fk_soc = ".$socidp;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader("","../");

29
htdocs/projet/fiche.php
View File

@ -34,6 +34,35 @@ require_once(DOL_DOCUMENT_ROOT."/commande/commande.class.php");
if (!$user->rights->projet->lire) accessforbidden();
/*
* Sécurité accés client
*/
$projetid='';
if ($_GET["id"]) { $projetid=$_GET["id"]; }
if ($projetid == '') accessforbidden();
if ($user->societe_id > 0)
{
$socidp = $user->societe_id;
}
// Protection restriction commercial
if ($projetid)
{
$sql = "SELECT sc.fk_soc, p.rowid, p.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."projet as p";
$sql .= " WHERE p.rowid = ".$projetid;
if (!$user->rights->commercial->client->voir && !$socidp) $sql .= " AND sc.fk_soc = p.fk_soc AND fk_user = ".$user->id;
if ($socidp) $sql .= " AND p.fk_soc = ".$socidp;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
if ($_POST["action"] == 'add' && $user->rights->projet->creer)
{
$pro = new Project($db);

24
htdocs/projet/index.php
View File

@ -33,12 +33,34 @@ $langs->load("projects");
if (!$user->rights->projet->lire) accessforbidden();
// Sécurité accés client
/*
* Sécurité accés client
*/
$projetid='';
if ($_GET["id"]) { $projetid=$_GET["id"]; }
if ($projetid == '') accessforbidden();
if ($user->societe_id > 0)
{
$socidp = $user->societe_id;
}
// Protection restriction commercial
if ($projetid)
{
$sql = "SELECT sc.fk_soc, p.rowid, p.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."projet as p";
$sql .= " WHERE p.rowid = ".$projetid;
if (!$user->rights->commercial->client->voir && !$socidp) $sql .= " AND sc.fk_soc = p.fk_soc AND fk_user = ".$user->id;
if ($socidp) $sql .= " AND p.fk_soc = ".$socidp;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader("",$langs->trans("Projects"),"Projet");
print_fiche_titre($langs->trans("ProjectsArea"));

20
htdocs/projet/propal.php
View File

@ -44,11 +44,31 @@ if (!$user->rights->projet->lire) accessforbidden();
/*
* Sécurité accés client
*/
$projetid='';
if ($_GET["id"]) { $projetid=$_GET["id"]; }
if ($projetid == '') accessforbidden();
if ($user->societe_id > 0)
{
$socidp = $user->societe_id;
}
// Protection restriction commercial
if ($projetid)
{
$sql = "SELECT sc.fk_soc, p.rowid, p.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."projet as p";
$sql .= " WHERE p.rowid = ".$projetid;
if (!$user->rights->commercial->client->voir && !$socidp) $sql .= " AND sc.fk_soc = p.fk_soc AND fk_user = ".$user->id;
if ($socidp) $sql .= " AND p.fk_soc = ".$socidp;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader("","../");

21
htdocs/projet/tasks/fiche.php
View File

@ -36,12 +36,31 @@ if (!$user->rights->projet->lire) accessforbidden();
/*
* Sécurité accés client
*/
$projetid='';
if ($_GET["id"]) { $projetid=$_GET["id"]; }
if ($projetid == '') accessforbidden();
if ($user->societe_id > 0)
{
$action = '';
$socidp = $user->societe_id;
}
// Protection restriction commercial
if ($projetid)
{
$sql = "SELECT sc.fk_soc, p.rowid, p.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."projet as p";
$sql .= " WHERE p.rowid = ".$projetid;
if (!$user->rights->commercial->client->voir && !$socidp) $sql .= " AND sc.fk_soc = p.fk_soc AND fk_user = ".$user->id;
if ($socidp) $sql .= " AND p.fk_soc = ".$socidp;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
Function PLines(&$inc, $parent, $lines, &$level, $actors)
{
$form = new Form($db); // $db est null ici mais inutile pour la fonction select_date()