From 948d2bc4e99205191cc597c640e069a8b467117f Mon Sep 17 00:00:00 2001 From: Adrien Raze Date: Tue, 7 Sep 2021 14:43:37 +0200 Subject: [PATCH 1/7] FIX : Add token when remove the last widget on home page --- htdocs/core/class/html.formother.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/class/html.formother.class.php b/htdocs/core/class/html.formother.class.php index 038f93d34c6..e81308faf79 100644 --- a/htdocs/core/class/html.formother.class.php +++ b/htdocs/core/class/html.formother.class.php @@ -1206,7 +1206,7 @@ class FormOther async: false }); // We force reload to be sure to get all boxes into list - window.location.search=\'mainmenu='.GETPOST("mainmenu", "aZ09").'&leftmenu='.GETPOST('leftmenu', "aZ09").'&action=delbox\'; + window.location.search=\'mainmenu='.GETPOST("mainmenu", "aZ09").'&leftmenu='.GETPOST('leftmenu', "aZ09").'&action=delbox&token='.newToken().'\'; } else { From 6c118b4dfbe2cc7a312486cdcbedd086adf28459 Mon Sep 17 00:00:00 2001 From: Alexandre SPANGARO Date: Wed, 8 Sep 2021 04:31:38 +0200 Subject: [PATCH 2/7] css --- htdocs/accountancy/journal/expensereportsjournal.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/accountancy/journal/expensereportsjournal.php b/htdocs/accountancy/journal/expensereportsjournal.php index 9633157b5b7..96ab150dd24 100644 --- a/htdocs/accountancy/journal/expensereportsjournal.php +++ b/htdocs/accountancy/journal/expensereportsjournal.php @@ -610,7 +610,7 @@ if (empty($action) || $action == 'view') { $userstatic->id = $tabuser[$key]['id']; $userstatic->name = $tabuser[$key]['name']; print "".$userstatic->getNomUrl(0, 'user', 16).' - '.$accountingaccount->label.""; - print ''.($mt >= 0 ? price($mt) : '').""; + print ''.($mt >= 0 ? price($mt) : '').""; print ''.($mt < 0 ? price(-$mt) : '').""; print ""; } From a5e670291e8cedb47d0cb10e3c81841f41236b89 Mon Sep 17 00:00:00 2001 From: lmarcouiller Date: Wed, 8 Sep 2021 15:36:51 +0200 Subject: [PATCH 3/7] Fix permission for salaries module --- htdocs/core/lib/security.lib.php | 2 +- htdocs/salaries/card.php | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php index b297c81035e..4c36244a5bf 100644 --- a/htdocs/core/lib/security.lib.php +++ b/htdocs/core/lib/security.lib.php @@ -611,7 +611,7 @@ function checkUserAccessToObject($user, array $featuresarray, $objectid = 0, $ta $feature = 'projet_task'; } - $check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salary', 'website'); // Test on entity only (Objects with no link to company) + $check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salaries', 'website'); // Test on entity only (Objects with no link to company) $checksoc = array('societe'); // Test for societe object $checkother = array('contact', 'agenda'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...). $checkproject = array('projet', 'project'); // Test for project object diff --git a/htdocs/salaries/card.php b/htdocs/salaries/card.php index d3c7ba504cb..f83f879cf8e 100755 --- a/htdocs/salaries/card.php +++ b/htdocs/salaries/card.php @@ -67,9 +67,27 @@ $fk_user = GETPOSTINT('userid'); $object = new Salary($db); $extrafields = new ExtraFields($db); +$childids = $user->getAllChildIds(1); + // fetch optionals attributes and labels $extrafields->fetch_name_optionals_label($object->table_element); +if (($id > 0) || $ref) { + $object->fetch($id, $ref); + + // Check current user can read this leave request + $canread = 0; + if (!empty($user->rights->salaries->readall)) { + $canread = 1; + } + if (!empty($user->rights->salaries->read) && in_array($object->fk_user, $childids)) { + $canread = 1; + } + if (!$canread) { + accessforbidden(); + } +} + // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('salarycard', 'globalcard')); From e9505c1109934e62b34f52e404528056ce0cd9e7 Mon Sep 17 00:00:00 2001 From: MOREAU FRANCK Date: Wed, 8 Sep 2021 18:23:44 +0200 Subject: [PATCH 4/7] Update V14 --- htdocs/core/menus/standard/eldy.lib.php | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php index 75055329add..95af5973587 100644 --- a/htdocs/core/menus/standard/eldy.lib.php +++ b/htdocs/core/menus/standard/eldy.lib.php @@ -384,10 +384,16 @@ function print_eldy_menu($db, $atarget, $type_user, &$tabMenu, &$menu, $noout = // Tickets and knwoledge base $tmpentry = array( - 'enabled'=>(!empty($conf->ticket->enabled) || !empty($conf->knwoledgemanagement->enabled)), - 'perms'=>(!empty($user->rights->ticket->read) || !empty($user->rights->knwoledgemanagement->read)), - 'module'=>'ticket|knwoledgemanagement' + 'enabled'=>(!empty($conf->ticket->enabled) || !empty($conf->knowledgemanagement->enabled)), + 'perms'=>(!empty($user->rights->ticket->read) || !empty($user->rights->knowledgemanagement->knowledgerecord->read)), + 'module'=>'ticket|knowledgemanagement' ); + $link = ''; + if(!empty($conf->ticket->enabled)){ + $link = '/ticket/index.php?mainmenu=ticket&leftmenu='; + }else{ + $link = '/knowledgemanagement/knowledgerecord_list.php?mainmenu=ticket&leftmenu='; + } $menu_arr[] = array( 'name' => 'Ticket', 'link' => '/ticket/index.php?mainmenu=ticket&leftmenu=', From 04026dd0b06f330a903a76e45d86109b7d23bc99 Mon Sep 17 00:00:00 2001 From: MOREAU FRANCK Date: Wed, 8 Sep 2021 19:51:34 +0200 Subject: [PATCH 5/7] fix Stickler CI review --- htdocs/core/menus/standard/eldy.lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php index 95af5973587..7c93cd94163 100644 --- a/htdocs/core/menus/standard/eldy.lib.php +++ b/htdocs/core/menus/standard/eldy.lib.php @@ -389,9 +389,9 @@ function print_eldy_menu($db, $atarget, $type_user, &$tabMenu, &$menu, $noout = 'module'=>'ticket|knowledgemanagement' ); $link = ''; - if(!empty($conf->ticket->enabled)){ + if (!empty($conf->ticket->enabled)) { $link = '/ticket/index.php?mainmenu=ticket&leftmenu='; - }else{ + } else { $link = '/knowledgemanagement/knowledgerecord_list.php?mainmenu=ticket&leftmenu='; } $menu_arr[] = array( From b87ac639fd4ed060e73653f9123420cfa3354c8b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 9 Sep 2021 03:02:18 +0200 Subject: [PATCH 6/7] Update card.php --- htdocs/salaries/card.php | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/htdocs/salaries/card.php b/htdocs/salaries/card.php index f83f879cf8e..6d30ae73e3d 100755 --- a/htdocs/salaries/card.php +++ b/htdocs/salaries/card.php @@ -72,28 +72,24 @@ $childids = $user->getAllChildIds(1); // fetch optionals attributes and labels $extrafields->fetch_name_optionals_label($object->table_element); -if (($id > 0) || $ref) { - $object->fetch($id, $ref); - - // Check current user can read this leave request - $canread = 0; - if (!empty($user->rights->salaries->readall)) { - $canread = 1; - } - if (!empty($user->rights->salaries->read) && in_array($object->fk_user, $childids)) { - $canread = 1; - } - if (!$canread) { - accessforbidden(); - } -} - // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('salarycard', 'globalcard')); $object = new Salary($db); if ($id > 0 || !empty($ref)) { $object->fetch($id, $ref); + + // Check current user can read this salary + $canread = 0; + if (!empty($user->rights->salaries->readall)) { + $canread = 1; + } + if (!empty($user->rights->salaries->read) && $object->fk_user > 0 && in_array($object->fk_user, $childids)) { + $canread = 1; + } + if (!$canread) { + accessforbidden(); + } } // Security check From 61d5152209cea58b04ec724639616d7a3624d1bf Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 9 Sep 2021 03:23:04 +0200 Subject: [PATCH 7/7] Update eldy.lib.php --- htdocs/core/menus/standard/eldy.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/menus/standard/eldy.lib.php b/htdocs/core/menus/standard/eldy.lib.php index 7c93cd94163..b1f625ac680 100644 --- a/htdocs/core/menus/standard/eldy.lib.php +++ b/htdocs/core/menus/standard/eldy.lib.php @@ -382,7 +382,7 @@ function print_eldy_menu($db, $atarget, $type_user, &$tabMenu, &$menu, $noout = 'submenus' => array(), ); - // Tickets and knwoledge base + // Tickets and knowledge base $tmpentry = array( 'enabled'=>(!empty($conf->ticket->enabled) || !empty($conf->knowledgemanagement->enabled)), 'perms'=>(!empty($user->rights->ticket->read) || !empty($user->rights->knowledgemanagement->knowledgerecord->read)),