diff --git a/htdocs/.htaccess b/htdocs/.htaccess new file mode 100644 index 00000000000..5a928f6da25 --- /dev/null +++ b/htdocs/.htaccess @@ -0,0 +1 @@ +Options -Indexes diff --git a/htdocs/accountancy/admin/account.php b/htdocs/accountancy/admin/account.php index 0876dd81a19..6f510ad3706 100644 --- a/htdocs/accountancy/admin/account.php +++ b/htdocs/accountancy/admin/account.php @@ -51,6 +51,7 @@ $confirm = GETPOST('confirm', 'alpha'); $chartofaccounts = GETPOST('chartofaccounts', 'int'); +$permissiontoadd = $user->rights->accounting->chartofaccount; $permissiontodelete = $user->rights->accounting->chartofaccount; // Security check @@ -96,7 +97,6 @@ if ($conf->global->MAIN_FEATURES_LEVEL < 2) { $accounting = new AccountingAccount($db); - /* * Actions */ @@ -118,9 +118,11 @@ if (empty($reshook)) { if (!empty($cancel)) { $action = ''; } + $objectclass = 'AccountingAccount'; $uploaddir = $conf->accounting->multidir_output[$conf->entity]; include DOL_DOCUMENT_ROOT.'/core/actions_massactions.inc.php'; + if ($action == "delete") { $action = ""; } @@ -136,7 +138,7 @@ if (empty($reshook)) { } if ((GETPOST('valid_change_chart', 'alpha') && GETPOST('chartofaccounts', 'int') > 0) // explicit click on button 'Change and load' with js on || (GETPOST('chartofaccounts', 'int') > 0 && GETPOST('chartofaccounts', 'int') != $conf->global->CHARTOFACCOUNTS)) { // a submit of form is done and chartofaccounts combo has been modified - if ($chartofaccounts > 0) { + if ($chartofaccounts > 0 && $permissiontoadd) { // Get language code for this $chartofaccounts $sql = 'SELECT code FROM '.MAIN_DB_PREFIX.'c_country as c, '.MAIN_DB_PREFIX.'accounting_system as a'; $sql .= ' WHERE c.rowid = a.fk_country AND a.rowid = '.(int) $chartofaccounts; @@ -180,7 +182,7 @@ if (empty($reshook)) { } } - if ($action == 'disable') { + if ($action == 'disable' && $permissiontoadd) { if ($accounting->fetch($id)) { $mode = GETPOST('mode', 'int'); $result = $accounting->accountDeactivate($id, $mode); @@ -190,7 +192,7 @@ if (empty($reshook)) { if ($result < 0) { setEventMessages($accounting->error, $accounting->errors, 'errors'); } - } elseif ($action == 'enable') { + } elseif ($action == 'enable' && $permissiontoadd) { if ($accounting->fetch($id)) { $mode = GETPOST('mode', 'int'); $result = $accounting->account_activate($id, $mode); @@ -277,6 +279,7 @@ if (strlen(trim($search_pcgtype))) { $sql .= natural_search("aa.pcg_type", $search_pcgtype); } $sql .= $db->order($sortfield, $sortorder); +//print $sql; // Count total nb of records $nbtotalofrecords = ''; @@ -454,7 +457,7 @@ if ($resql) { $totalarray['nbfield']++; } if (!empty($arrayfields['aa.pcg_type']['checked'])) { - print_liste_field_titre($arrayfields['aa.pcg_type']['label'], $_SERVER["PHP_SELF"], 'aa.pcg_type', '', $param, '', $sortfield, $sortorder, '', $arrayfields['aa.pcg_type']['help'], 1); + print_liste_field_titre($arrayfields['aa.pcg_type']['label'], $_SERVER["PHP_SELF"], 'aa.pcg_type,aa.account_number', '', $param, '', $sortfield, $sortorder, '', $arrayfields['aa.pcg_type']['help'], 1); $totalarray['nbfield']++; } if ($conf->global->MAIN_FEATURES_LEVEL >= 2) { diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php index caf98c7d91c..b629e45cf0d 100644 --- a/htdocs/accountancy/admin/card.php +++ b/htdocs/accountancy/admin/card.php @@ -34,7 +34,6 @@ $error = 0; // Load translation files required by the page $langs->loadLangs(array("bills", "accountancy", "compta")); -$mesg = ''; $action = GETPOST('action', 'aZ09'); $backtopage = GETPOST('backtopage', 'alpha'); $id = GETPOST('id', 'int'); @@ -139,7 +138,7 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) { } else { $result = $object->fetch($id); - $sql = 'SELECT pcg_version FROM ' . MAIN_DB_PREFIX . 'accounting_system WHERE rowid=' . $conf->global->CHARTOFACCOUNTS; + $sql = 'SELECT pcg_version FROM '.MAIN_DB_PREFIX.'accounting_system WHERE rowid='.((int) $conf->global->CHARTOFACCOUNTS); dol_syslog('accountancy/admin/card.php:: $sql=' . $sql); $result2 = $db->query($sql); @@ -148,7 +147,7 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) { // Clean code // To manage zero or not at the end of the accounting account - if ($conf->global->ACCOUNTING_MANAGE_ZERO == 1) { + if (isset($conf->global->ACCOUNTING_MANAGE_ZERO) && $conf->global->ACCOUNTING_MANAGE_ZERO == 1) { $account_number = $account_number; } else { $account_number = clean_account($account_number); @@ -169,13 +168,12 @@ if ($action == 'add' && $user->rights->accounting->chartofaccount) { $object->labelshort = GETPOST('labelshort', 'alpha'); $result = $object->update($user); - if ($result > 0) { $urltogo = $backtopage ? $backtopage : ($_SERVER["PHP_SELF"] . "?id=" . $id); header("Location: " . $urltogo); exit(); } else { - $mesg = $object->error; + setEventMessages($object->error, null, 'errors'); } } } else { @@ -255,13 +253,17 @@ if ($action == 'create') { print ''; // Chart of accounts type - print '
| '.$langs->trans("Search").' | ||
| : | '; - if ($i == 0) { - $searchbox .=' | '; - } - $searchbox .=' |