diff --git a/htdocs/accountancy/customer/lines.php b/htdocs/accountancy/customer/lines.php index f52bc45f635..6b025e6f3c1 100644 --- a/htdocs/accountancy/customer/lines.php +++ b/htdocs/accountancy/customer/lines.php @@ -246,11 +246,11 @@ if (strlen(trim($search_country))) { if ($search_country == 'special_allnotme') { $sql .= " AND co.code <> '".$db->escape($mysoc->country_code)."'"; } elseif ($search_country == 'special_eec') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC, 1).")"; } elseif ($search_country == 'special_eecnotme') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me, 1).")"; } elseif ($search_country == 'special_noteec') { - $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC, 1).")"; } else { $sql .= natural_search("co.code", $search_country); } diff --git a/htdocs/accountancy/customer/list.php b/htdocs/accountancy/customer/list.php index 177b33f3ded..2e28ae4b566 100644 --- a/htdocs/accountancy/customer/list.php +++ b/htdocs/accountancy/customer/list.php @@ -283,11 +283,11 @@ if (strlen(trim($search_country))) { if ($search_country == 'special_allnotme') { $sql .= " AND co.code <> '".$db->escape($mysoc->country_code)."'"; } elseif ($search_country == 'special_eec') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC, 1).")"; } elseif ($search_country == 'special_eecnotme') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me, 1).")"; } elseif ($search_country == 'special_noteec') { - $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC, 1).")"; } else { $sql .= natural_search("co.code", $search_country); } diff --git a/htdocs/accountancy/supplier/lines.php b/htdocs/accountancy/supplier/lines.php index 530ed189e19..a87280744ec 100644 --- a/htdocs/accountancy/supplier/lines.php +++ b/htdocs/accountancy/supplier/lines.php @@ -238,11 +238,11 @@ if (strlen(trim($search_country))) { if ($search_country == 'special_allnotme') { $sql .= " AND co.code <> '".$db->escape($mysoc->country_code)."'"; } elseif ($search_country == 'special_eec') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC, 1).")"; } elseif ($search_country == 'special_eecnotme') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me, 1).")"; } elseif ($search_country == 'special_noteec') { - $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC, 1).")"; } else { $sql .= natural_search("co.code", $search_country); } diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php index d74f0facfd7..aa3f8b4a403 100644 --- a/htdocs/accountancy/supplier/list.php +++ b/htdocs/accountancy/supplier/list.php @@ -288,11 +288,11 @@ if (strlen(trim($search_country))) { if ($search_country == 'special_allnotme') { $sql .= " AND co.code <> '".$db->escape($mysoc->country_code)."'"; } elseif ($search_country == 'special_eec') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC, 1).")"; } elseif ($search_country == 'special_eecnotme') { - $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me).")"; + $sql .= " AND co.code IN (".$db->sanitize($country_code_in_EEC_without_me, 1).")"; } elseif ($search_country == 'special_noteec') { - $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC).")"; + $sql .= " AND co.code NOT IN (".$db->sanitize($country_code_in_EEC, 1).")"; } else { $sql .= natural_search("co.code", $search_country); } diff --git a/htdocs/bom/bom_agenda.php b/htdocs/bom/bom_agenda.php index 6a86f1c2258..dc3421dea0c 100644 --- a/htdocs/bom/bom_agenda.php +++ b/htdocs/bom/bom_agenda.php @@ -86,7 +86,7 @@ if ($id > 0 || !empty($ref)) { //if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) $socid = $user->socid; $isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); -restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); +restrictedArea($user, 'bom', $object->id, 'bom_bom', '', '', 'rowid', $isdraft); /* diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php index fa2ef014d17..eaea02cda3a 100644 --- a/htdocs/bom/bom_card.php +++ b/htdocs/bom/bom_card.php @@ -76,7 +76,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be includ //if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) $socid = $user->socid; $isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); -$result = restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); +$result = restrictedArea($user, 'bom', $object->id, 'bom_bom', '', '', 'rowid', $isdraft); $permissionnote = $user->rights->bom->write; // Used by the include of actions_setnotes.inc.php $permissiondellink = $user->rights->bom->write; // Used by the include of actions_dellink.inc.php diff --git a/htdocs/bom/bom_document.php b/htdocs/bom/bom_document.php index 520dd8bb9d7..bac28f2ea9a 100644 --- a/htdocs/bom/bom_document.php +++ b/htdocs/bom/bom_document.php @@ -83,7 +83,7 @@ if ($id > 0 || !empty($ref)) { //if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) $socid = $user->socid; $isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); -restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); +restrictedArea($user, 'bom', $object->id, 'bom_bom', '', '', 'rowid', $isdraft); /* diff --git a/htdocs/bom/bom_note.php b/htdocs/bom/bom_note.php index 244bcfd7a49..99f6a708c05 100644 --- a/htdocs/bom/bom_note.php +++ b/htdocs/bom/bom_note.php @@ -63,7 +63,7 @@ $permissionnote = $user->rights->bom->write; // Used by the include of actions_s //if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) $socid = $user->socid; $isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); -restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); +restrictedArea($user, 'bom', $object->id, 'bom_bom', '', '', 'rowid', $isdraft); /* diff --git a/htdocs/core/ajax/row.php b/htdocs/core/ajax/row.php index 883ba664b5c..7f3d7d4cc3a 100644 --- a/htdocs/core/ajax/row.php +++ b/htdocs/core/ajax/row.php @@ -59,15 +59,52 @@ top_httphead(); print ''."\n"; // Registering the location of boxes -if (GETPOST('roworder', 'alpha') && GETPOST('table_element_line', 'alpha', 2) - && GETPOST('fk_element', 'alpha', 2) && GETPOST('element_id', 'int', 2)) { +if (GETPOST('roworder', 'alpha', 2) && GETPOST('table_element_line', 'aZ09', 2) + && GETPOST('fk_element', 'aZ09', 2) && GETPOST('element_id', 'int', 2)) { $roworder = GETPOST('roworder', 'alpha', 2); - $table_element_line = GETPOST('table_element_line', 'alpha', 2); - $fk_element = GETPOST('fk_element', 'alpha', 2); + $table_element_line = GETPOST('table_element_line', 'aZ09', 2); + $fk_element = GETPOST('fk_element', 'aZ09', 2); $element_id = GETPOST('element_id', 'int', 2); dol_syslog("AjaxRow roworder=".$roworder." table_element_line=".$table_element_line." fk_element=".$fk_element." element_id=".$element_id, LOG_DEBUG); + // Make test on pemrission + $perm = 0; + if ($table_element_line == 'propaldet' && $user->rights->propal->creer) { + $perm = 1; + } elseif ($table_element_line == 'commandedet' && $user->rights->commande->creer) { + $perm = 1; + } elseif ($table_element_line == 'facturedet' && $user->rights->facture->creer) { + $perm = 1; + } elseif ($table_element_line == 'facturerecdet' && $user->rights->facture->creer) { + $perm = 1; + } elseif ($table_element_line == 'ecm_files' && $user->rights->ecm->creer) { + $perm = 1; + } elseif ($table_element_line == 'emailcollector_emailcollectoraction' && $user->admin) { + $perm = 1; + } elseif ($table_element_line == 'bom_bomline' && $user->rights->bom->write) { + $perm = 1; + } elseif ($table_element_line == 'mrp_production' && $user->rights->mrp->write) { + $perm = 1; + } elseif ($table_element_line == 'supplier_proposaldet' && $user->rights->supplier_proposal->write) { + $perm = 1; + } elseif ($table_element_line == 'commande_fournisseurdet' && $user->rights->fourn->commande->creer) { + $perm = 1; + } elseif ($table_element_line == 'facture_fourn_det' && $user->rights->fourn->facture->creer) { + $perm = 1; + } else { + $tmparray = explode('_', $table_element_line); + $tmpmodule = $tmparray[0]; $tmpobject = preg_replace('/line$/', '', $tmparray[1]); + if (!empty($tmpmodule) && !empty($tmpobject) && !empty($conf->$tmpmodule->enabled) && !empty($user->rights->$tmpobject->read)) { + $perm = 1; + } + } + + if (! $perm) { + print 'Bad permission to modify position of lines for object in table '.$table_element_line; + accessforbidden('Bad permission to modify position of lines for object in table '.$table_element_line); + } + $rowordertab = explode(',', $roworder); $newrowordertab = array(); foreach ($rowordertab as $value) { @@ -88,4 +125,6 @@ if (GETPOST('roworder', 'alpha') && GETPOST('table_element_line', 'alpha', 2) if (in_array($fk_element, array('fk_facture', 'fk_propal', 'fk_commande'))) { $result = $row->line_order(true); } +} else { + print 'Bad parameters for row.php'; } diff --git a/htdocs/core/class/commonobject.class.php b/htdocs/core/class/commonobject.class.php index f743deaa894..e36e96f0833 100644 --- a/htdocs/core/class/commonobject.class.php +++ b/htdocs/core/class/commonobject.class.php @@ -3022,8 +3022,8 @@ abstract class CommonObject $fieldposition = 'position'; } - $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.$rang; - $sql .= ' WHERE rowid = '.$rowid; + $sql = 'UPDATE '.MAIN_DB_PREFIX.$this->table_element_line.' SET '.$fieldposition.' = '.((int) $rang); + $sql .= ' WHERE rowid = '.((int) $rowid); dol_syslog(get_class($this)."::updateRangOfLine", LOG_DEBUG); if (!$this->db->query($sql)) { diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index 3a36950608a..ac56180d3a8 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -4381,9 +4381,9 @@ class Form while ($i < $num) { $obj = $this->db->fetch_object($result); if ($selected == $obj->rowid || ($useempty == 2 && $num == 1 && empty($selected))) { - $out .= '