lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Works on enhancement of project tasks

Browse Source 
Fix: security check
This commit is contained in:
Regis Houssin 2010-02-14 15:43:37 +00:00
parent 1f71ab2e39
commit d8febc7a94
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/projet/activity/list.php
View File

@ -34,6 +34,7 @@ $projectid='';
$projectid=isset($_GET["id"])?$_GET["id"]:$_POST["projectid"]; $projectid=isset($_GET["id"])?$_GET["id"]:$_POST["projectid"];
// Security check // Security check
$socid=0;
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'projet', $projectid); $result = restrictedArea($user, 'projet', $projectid);
@ -110,10 +111,10 @@ print_barre_liste($title, $page, $_SERVER["PHP_SELF"], "", $sortfield, $sortorde
if ($mesg) print $mesg; if ($mesg) print $mesg;
$tasksarray=$task->getTasksArray(0,0,$project->id,0); $tasksarray=$task->getTasksArray(0,0,$project->id,$socid);
$tasksrole=$task->getUserRolesForProjectsOrTasks($user,0,$project->id,0); $tasksrole=$task->getUserRolesForProjectsOrTasks($user,0,$project->id,0);
//var_dump($tasksarray); //var_dump($tasksarray);
var_dump($tasksrole); //var_dump($tasksrole);
print '<form name="addtime" method="POST" action="'.$_SERVER["PHP_SELF"].'?id='.$project->id.'">'; print '<form name="addtime" method="POST" action="'.$_SERVER["PHP_SELF"].'?id='.$project->id.'">';
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">'; print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';

2
htdocs/projet/tasks/index.php
View File

@ -33,8 +33,8 @@ $mode=$_REQUEST["mode"];
$langs->load('projects'); $langs->load('projects');
// Security check // Security check
if (!$user->rights->projet->lire) accessforbidden();
$socid=0; $socid=0;
if (!$user->rights->projet->lire) accessforbidden();
if ($user->societe_id > 0) $socid = $user->societe_id; if ($user->societe_id > 0) $socid = $user->societe_id;
$sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"]; $sortfield = isset($_GET["sortfield"])?$_GET["sortfield"]:$_POST["sortfield"];