lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix We should not be able to choose which permission to use to have

Browse Source 
access to an object.
This commit is contained in:
Laurent Destailleur 2020-01-20 14:29:02 +01:00
parent 60fd1f5156
commit d465101ae3
1 changed files with 89 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

175
htdocs/core/lib/files.lib.php
View File

@ -82,16 +82,16 @@ function dol_dir_list($path, $types = "all", $recursive = 0, $filter = "", $excl
$hookmanager->initHooks(array('fileslib')); $hookmanager->initHooks(array('fileslib'));
$parameters = array( $parameters = array(
'path' => $newpath, 'path' => $newpath,
'types'=> $types, 'types'=> $types,
'recursive' => $recursive, 'recursive' => $recursive,
'filter' => $filter, 'filter' => $filter,
'excludefilter' => $excludefilter, 'excludefilter' => $excludefilter,
'sortcriteria' => $sortcriteria, 'sortcriteria' => $sortcriteria,
'sortorder' => $sortorder, 'sortorder' => $sortorder,
'loaddate' => $loaddate, 'loaddate' => $loaddate,
'loadsize' => $loadsize, 'loadsize' => $loadsize,
'mode' => $mode 'mode' => $mode
); );
$reshook = $hookmanager->executeHooks('getDirList', $parameters, $object); $reshook = $hookmanager->executeHooks('getDirList', $parameters, $object);
} }
@ -146,14 +146,14 @@ function dol_dir_list($path, $types = "all", $recursive = 0, $filter = "", $excl
preg_match('/([^\/]+)\/[^\/]+$/', $path.'/'.$file, $reg); preg_match('/([^\/]+)\/[^\/]+$/', $path.'/'.$file, $reg);
$level1name = (isset($reg[1]) ? $reg[1] : ''); $level1name = (isset($reg[1]) ? $reg[1] : '');
$file_list[] = array( $file_list[] = array(
"name" => $file, "name" => $file,
"path" => $path, "path" => $path,
"level1name" => $level1name, "level1name" => $level1name,
"relativename" => ($relativename ? $relativename.'/' : '').$file, "relativename" => ($relativename ? $relativename.'/' : '').$file,
"fullname" => $path.'/'.$file, "fullname" => $path.'/'.$file,
"date" => $filedate, "date" => $filedate,
"size" => $filesize, "size" => $filesize,
"type" => 'dir' "type" => 'dir'
); );
} }
} }
@ -179,14 +179,14 @@ function dol_dir_list($path, $types = "all", $recursive = 0, $filter = "", $excl
preg_match('/([^\/]+)\/[^\/]+$/', $path.'/'.$file, $reg); preg_match('/([^\/]+)\/[^\/]+$/', $path.'/'.$file, $reg);
$level1name = (isset($reg[1]) ? $reg[1] : ''); $level1name = (isset($reg[1]) ? $reg[1] : '');
$file_list[] = array( $file_list[] = array(
"name" => $file, "name" => $file,
"path" => $path, "path" => $path,
"level1name" => $level1name, "level1name" => $level1name,
"relativename" => ($relativename ? $relativename.'/' : '').$file, "relativename" => ($relativename ? $relativename.'/' : '').$file,
"fullname" => $path.'/'.$file, "fullname" => $path.'/'.$file,
"date" => $filedate, "date" => $filedate,
"size" => $filesize, "size" => $filesize,
"type" => 'file' "type" => 'file'
); );
} }
} }
@ -197,7 +197,7 @@ function dol_dir_list($path, $types = "all", $recursive = 0, $filter = "", $excl
// Obtain a list of columns // Obtain a list of columns
if (! empty($sortcriteria) && $sortorder) if (! empty($sortcriteria) && $sortorder)
{ {
$file_list = dol_sort_array($file_list, $sortcriteria, ($sortorder == SORT_ASC ? 'asc' : 'desc')); $file_list = dol_sort_array($file_list, $sortcriteria, ($sortorder == SORT_ASC ? 'asc' : 'desc'));
} }
} }
} }
@ -445,8 +445,8 @@ function dol_is_dir($folder)
*/ */
function dol_is_dir_empty($dir) function dol_is_dir_empty($dir)
{ {
if (!is_readable($dir)) return false; if (!is_readable($dir)) return false;
return (count(scandir($dir)) == 2); return (count(scandir($dir)) == 2);
} }
/** /**
@ -514,7 +514,7 @@ function dol_dir_is_emtpy($folder)
else return false; else return false;
} }
else else
return true; // Dir does not exists return true; // Dir does not exists
} }
/** /**
@ -624,14 +624,14 @@ function dolReplaceInFile($srcfile, $arrayreplacement, $destfile = '', $newmask
if (empty($arrayreplacementisregex)) if (empty($arrayreplacementisregex))
{ {
$content = make_substitutions($content, $arrayreplacement, null); $content = make_substitutions($content, $arrayreplacement, null);
} }
else else
{ {
foreach ($arrayreplacement as $key => $value) foreach ($arrayreplacement as $key => $value)
{ {
$content = preg_replace($key, $value, $content); $content = preg_replace($key, $value, $content);
} }
} }
file_put_contents($newpathoftmpdestfile, $content); file_put_contents($newpathoftmpdestfile, $content);
@ -1044,8 +1044,8 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
$checkvirusarray = dolCheckVirus($src_file); $checkvirusarray = dolCheckVirus($src_file);
if (count($checkvirusarray)) if (count($checkvirusarray))
{ {
dol_syslog('Files.lib::dol_move_uploaded_file File "'.$src_file.'" (target name "'.$dest_file.'") KO with antivirus: errors='.join(',', $checkvirusarray), LOG_WARNING); dol_syslog('Files.lib::dol_move_uploaded_file File "'.$src_file.'" (target name "'.$dest_file.'") KO with antivirus: errors='.join(',', $checkvirusarray), LOG_WARNING);
return 'ErrorFileIsInfectedWithAVirus: '.join(',', $checkvirusarray); return 'ErrorFileIsInfectedWithAVirus: '.join(',', $checkvirusarray);
} }
} }
@ -1141,7 +1141,7 @@ function dol_delete_file($file, $disableglob = 0, $nophperrors = 0, $nohook = 0,
global $hookmanager; global $hookmanager;
// Load translation files required by the page // Load translation files required by the page
$langs->loadLangs(array('other', 'errors')); $langs->loadLangs(array('other', 'errors'));
dol_syslog("dol_delete_file file=".$file." disableglob=".$disableglob." nophperrors=".$nophperrors." nohook=".$nohook); dol_syslog("dol_delete_file file=".$file." disableglob=".$disableglob." nophperrors=".$nophperrors." nohook=".$nohook);
@ -1158,10 +1158,10 @@ function dol_delete_file($file, $disableglob = 0, $nophperrors = 0, $nohook = 0,
$hookmanager->initHooks(array('fileslib')); $hookmanager->initHooks(array('fileslib'));
$parameters = array( $parameters = array(
'GET' => $_GET, 'GET' => $_GET,
'file' => $file, 'file' => $file,
'disableglob'=> $disableglob, 'disableglob'=> $disableglob,
'nophperrors' => $nophperrors 'nophperrors' => $nophperrors
); );
$reshook = $hookmanager->executeHooks('deleteFile', $parameters, $object); $reshook = $hookmanager->executeHooks('deleteFile', $parameters, $object);
} }
@ -1458,9 +1458,9 @@ function dol_meta_create($object)
fputs($fp, $meta); fputs($fp, $meta);
fclose($fp); fclose($fp);
if (!empty($conf->global->MAIN_UMASK)) if (!empty($conf->global->MAIN_UMASK))
@chmod($file, octdec($conf->global->MAIN_UMASK)); @chmod($file, octdec($conf->global->MAIN_UMASK));
return 1; return 1;
} }
else else
{ {
@ -1830,19 +1830,19 @@ function dol_convert_file($fileinput, $ext = 'png', $fileoutput = '', $page = ''
global $langs; global $langs;
if (class_exists('Imagick')) if (class_exists('Imagick'))
{ {
$image = new Imagick(); $image = new Imagick();
try { try {
$filetoconvert = $fileinput.(($page != '') ? '['.$page.']' : ''); $filetoconvert = $fileinput.(($page != '') ? '['.$page.']' : '');
//var_dump($filetoconvert); //var_dump($filetoconvert);
$ret = $image->readImage($filetoconvert); $ret = $image->readImage($filetoconvert);
} catch (Exception $e) { } catch (Exception $e) {
$ext = pathinfo($fileinput, PATHINFO_EXTENSION); $ext = pathinfo($fileinput, PATHINFO_EXTENSION);
dol_syslog("Failed to read image using Imagick (Try to install package 'apt-get install php-imagick ghostscript' and check there is no policy to disable ".$ext." convertion in /etc/ImageMagick*/policy.xml): ".$e->getMessage(), LOG_WARNING); dol_syslog("Failed to read image using Imagick (Try to install package 'apt-get install php-imagick ghostscript' and check there is no policy to disable ".$ext." convertion in /etc/ImageMagick*/policy.xml): ".$e->getMessage(), LOG_WARNING);
return 0; return 0;
} }
if ($ret) if ($ret)
{ {
$ret = $image->setImageFormat($ext); $ret = $image->setImageFormat($ext);
if ($ret) if ($ret)
{ {
if (empty($fileoutput)) $fileoutput=$fileinput.".".$ext; if (empty($fileoutput)) $fileoutput=$fileinput.".".$ext;
@ -1850,13 +1850,13 @@ function dol_convert_file($fileinput, $ext = 'png', $fileoutput = '', $page = ''
$count = $image->getNumberImages(); $count = $image->getNumberImages();
if (! dol_is_file($fileoutput) || is_writeable($fileoutput)) if (! dol_is_file($fileoutput) || is_writeable($fileoutput))
{ {
try { try {
$ret = $image->writeImages($fileoutput, true); $ret = $image->writeImages($fileoutput, true);
} }
catch(Exception $e) catch(Exception $e)
{ {
dol_syslog($e->getMessage(), LOG_WARNING); dol_syslog($e->getMessage(), LOG_WARNING);
} }
} }
else else
{ {
@ -2106,16 +2106,16 @@ function dol_compress_dir($inputdir, $outputfile, $mode = "zip", $excludefiles =
elseif ($mode == 'zip') elseif ($mode == 'zip')
{ {
/*if (defined('ODTPHP_PATHTOPCLZIP')) /*if (defined('ODTPHP_PATHTOPCLZIP'))
{ {
$foundhandler=0; // TODO implement this $foundhandler=0; // TODO implement this
include_once ODTPHP_PATHTOPCLZIP.'/pclzip.lib.php'; include_once ODTPHP_PATHTOPCLZIP.'/pclzip.lib.php';
$archive = new PclZip($outputfile); $archive = new PclZip($outputfile);
$archive->add($inputfile, PCLZIP_OPT_REMOVE_PATH, dirname($inputfile)); $archive->add($inputfile, PCLZIP_OPT_REMOVE_PATH, dirname($inputfile));
//$archive->add($inputfile); //$archive->add($inputfile);
return 1; return 1;
} }
else*/ else*/
//if (class_exists('ZipArchive') && ! empty($conf->global->MAIN_USE_ZIPARCHIVE_FOR_ZIP_COMPRESS)) //if (class_exists('ZipArchive') && ! empty($conf->global->MAIN_USE_ZIPARCHIVE_FOR_ZIP_COMPRESS))
if (class_exists('ZipArchive')) if (class_exists('ZipArchive'))
{ {
@ -2532,14 +2532,14 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
} }
$original_file=$conf->commande->multidir_output[$entity].'/temp/massgeneration/'.$user->id.'/'.$original_file; $original_file=$conf->commande->multidir_output[$entity].'/temp/massgeneration/'.$user->id.'/'.$original_file;
} }
elseif ($modulepart == 'massfilesarea_sendings') elseif ($modulepart == 'massfilesarea_sendings')
{ {
if ($fuser->rights->expedition->{$lire} || preg_match('/^specimen/i', $original_file)) if ($fuser->rights->expedition->{$lire} || preg_match('/^specimen/i', $original_file))
{ {
$accessallowed=1; $accessallowed=1;
} }
$original_file=$conf->expedition->dir_output.'/sending/temp/massgeneration/'.$user->id.'/'.$original_file; $original_file=$conf->expedition->dir_output.'/sending/temp/massgeneration/'.$user->id.'/'.$original_file;
} }
elseif ($modulepart == 'massfilesarea_invoices') elseif ($modulepart == 'massfilesarea_invoices')
{ {
if ($fuser->rights->facture->{$lire} || preg_match('/^specimen/i', $original_file)) if ($fuser->rights->facture->{$lire} || preg_match('/^specimen/i', $original_file))
@ -2963,18 +2963,21 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity,
exit; exit;
} }
$perm = GETPOST('perm'); /*$perm = GETPOST('perm', 'aZ09');
$subperm = GETPOST('subperm'); $subperm = GETPOST('subperm', 'aZ09');
if ($perm || $subperm) if ($perm || $subperm)
{ {
if (($perm && !$subperm && $fuser->rights->$modulepart->$perm) || ($perm && $subperm && $fuser->rights->$modulepart->$perm->$subperm)) $accessallowed = 1; if (($perm && !$subperm && $fuser->rights->$modulepart->$perm) || ($perm && $subperm && $fuser->rights->$modulepart->$perm->$subperm)) $accessallowed = 1;
$original_file = $conf->$modulepart->dir_output.'/'.$original_file; }
} else
else {*/
{ // Check fuser->rights->modulepart->myobject->read and fuser->rights->modulepart->read
if ($fuser->rights->$modulepart->{$lire} || $fuser->rights->$modulepart->{$read}) $accessallowed = 1; $partsofdirinoriginalfile = explode('/', $original_file);
$original_file = $conf->$modulepart->dir_output.'/'.$original_file; $partofdirinoriginalfile = $partsofdirinoriginalfile[0];
} if ($partofdirinoriginalfile && ($fuser->rights->$modulepart->$partofdirinoriginalfile->{$lire} || $fuser->rights->$modulepart->$partofdirinoriginalfile->{$read})) $accessallowed = 1;
if ($fuser->rights->$modulepart->{$lire} || $fuser->rights->$modulepart->{$read}) $accessallowed = 1;
//}
$original_file = $conf->$modulepart->dir_output.'/'.$original_file;
} }
// For modules who wants to manage different levels of permissions for documents // For modules who wants to manage different levels of permissions for documents