lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: mise en fonction de la vrification des droits d'accs users, clients et commerciaux

Browse Source
This commit is contained in:
Regis Houssin 2007-06-07 15:59:19 +00:00
parent 3a2ae56973
commit e74e832489
8 changed files with 22 additions and 101 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
htdocs/comm/adresse_livraison.php
View File

@ -32,49 +32,17 @@ require("pre.inc.php");
require_once(DOL_DOCUMENT_ROOT."/lib/company.lib.php"); require_once(DOL_DOCUMENT_ROOT."/lib/company.lib.php");
require_once(DOL_DOCUMENT_ROOT."/comm/adresse_livraison.class.php"); require_once(DOL_DOCUMENT_ROOT."/comm/adresse_livraison.class.php");
$user->getrights('societe');
$user->getrights('commercial');
$langs->load("companies"); $langs->load("companies");
$langs->load("commercial"); $langs->load("commercial");
if (! $user->rights->societe->creer)
{
if ($_GET["action"] == 'create' || $_POST["action"] == 'create')
{
accessforbidden();
}
}
$idl = isset($_GET["idl"])?$_GET["idl"]:''; $idl = isset($_GET["idl"])?$_GET["idl"]:'';
$origin = isset($_GET["origin"])?$_GET["origin"]:''; $origin = isset($_GET["origin"])?$_GET["origin"]:'';
$originid = isset($_GET["originid"])?$_GET["originid"]:''; $originid = isset($_GET["originid"])?$_GET["originid"]:'';
$socid = isset($_GET["socid"])?$_GET["socid"]:''; $socid = isset($_GET["socid"])?$_GET["socid"]:'';
if (! $socid && ($_REQUEST["action"] != 'create' && $_REQUEST["action"] != 'add' && $_REQUEST["action"] != 'update')) accessforbidden(); if (! $socid && ($_REQUEST["action"] != 'create' && $_REQUEST["action"] != 'add' && $_REQUEST["action"] != 'update')) accessforbidden();
// Sécurité accés client // Sécurité d'accès client et commerciaux
if ($user->societe_id > 0) $socid = restrictedArea($user, 'societe', $socid);
{
$_GET["action"] = '';
$_POST["action"] = '';
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socid && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql .= " WHERE sc.fk_soc = ".$socid." AND sc.fk_user = ".$user->id;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
/* /*
* Actions * Actions

10
htdocs/comm/clients.php
View File

@ -29,14 +29,8 @@
require("./pre.inc.php"); require("./pre.inc.php");
if (!$user->rights->societe->lire) accessforbidden(); // Sécurité d'accès client et commerciaux
$socid = restrictedArea($user, 'societe');
// Sécurité accés client
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
$page=$_GET["page"]; $page=$_GET["page"];
$sortorder=$_GET["sortorder"]; $sortorder=$_GET["sortorder"];

16
htdocs/comm/contact.php
View File

@ -41,21 +41,11 @@ if ($page < 0) { $page = 0 ; }
$limit = $conf->liste_limit; $limit = $conf->liste_limit;
$offset = $limit * $page ; $offset = $limit * $page ;
$socid=$_GET["socid"]; $socid = isset($_GET["socid"])?$_GET["socid"]:'';
$type=$_GET["type"]; $type=$_GET["type"];
// Sécurité d'accès client et commerciaux
/* $socid = restrictedArea($user, 'societe');
* Sécurité accés client
*/
if ($user->societe_id > 0)
{
$action = '';
$socid = $user->societe_id;
}
if (!$user->rights->societe->lire) accessforbidden();
llxHeader('','Contacts'); llxHeader('','Contacts');

24
htdocs/comm/fiche.php
View File

@ -44,30 +44,10 @@ $langs->load("bills");
$langs->load("contracts"); $langs->load("contracts");
if ($conf->fichinter->enabled) $langs->load("interventions"); if ($conf->fichinter->enabled) $langs->load("interventions");
$user->getrights("commercial");
if (!$user->rights->societe->lire) accessforbidden();
$socid = isset($_GET["socid"])?$_GET["socid"]:''; $socid = isset($_GET["socid"])?$_GET["socid"]:'';
if ($socid == '') accessforbidden();
// Protection quand utilisateur externe // Sécurité d'accès client et commerciaux
if ($user->societe_id > 0) $socid = restrictedArea($user, 'societe', $socid);
{
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socid && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE sc.fk_soc = ".$socid." AND sc.fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
$sortorder=$_GET["sortorder"]; $sortorder=$_GET["sortorder"];
$sortfield=$_GET["sortfield"]; $sortfield=$_GET["sortfield"];

2
htdocs/docsoc.php
View File

@ -39,7 +39,7 @@ $mesg = "";
$socid = isset($_GET["socid"])?$_GET["socid"]:''; $socid = isset($_GET["socid"])?$_GET["socid"]:'';
// Sécurité d'accès client et commerciaux // Sécurité d'accès client et commerciaux
$socid = restrictedArea($user, 'commercial', $socid, 'societe'); $socid = restrictedArea($user, 'societe', $socid);
/* /*
* Actions * Actions

10
htdocs/lib/functions.inc.php
View File

@ -1254,13 +1254,15 @@ function dol_loginfunction($notused,$pearstatus)
* \param objectid ID du document * \param objectid ID du document
* \param dbtable Table de la base correspondant au module (optionnel) * \param dbtable Table de la base correspondant au module (optionnel)
*/ */
function restrictedArea($user, $modulename, $objectid='' , $dbtablename='') function restrictedArea($user, $modulename, $objectid='', $dbtablename='', $list=0)
{ {
global $db; global $db;
$user->getrights($modulename); $user->getrights($modulename);
$user->getrights('commercial'); $user->getrights('commercial');
$socid = 0; $socid = 0;
if ($modulename == 'societe' && $objectid) $socid = $objectid;
//si dbtable non défini, même nom que le module //si dbtable non défini, même nom que le module
if (!$dbtable) $dbtablename = $modulename; if (!$dbtable) $dbtablename = $modulename;
@ -1292,7 +1294,7 @@ function dol_loginfunction($notused,$pearstatus)
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc"; $sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql .= " WHERE sc.fk_soc = ".$objectid." AND sc.fk_user = ".$user->id; $sql .= " WHERE sc.fk_soc = ".$objectid." AND sc.fk_user = ".$user->id;
} }
else if ($objectid && (!$user->rights->commercial->client->voir || $socid > 0)) else if (!$user->rights->commercial->client->voir || $socid > 0)
{ {
$sql = "SELECT sc.fk_soc, dbt.fk_soc"; $sql = "SELECT sc.fk_soc, dbt.fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX.$dbtablename." as dbt";
@ -1312,6 +1314,10 @@ function dol_loginfunction($notused,$pearstatus)
} }
} }
} }
else if (!$objectid && $modulename == 'societe' && $list==0)
{
accessforbidden();
}
return $socid; return $socid;
} }

2
htdocs/societe.php
View File

@ -37,7 +37,7 @@ $langs->load("customers");
$langs->load("suppliers"); $langs->load("suppliers");
// Sécurité d'accès client et commerciaux // Sécurité d'accès client et commerciaux
$socid = restrictedArea($user, 'societe'); $socid = restrictedArea($user, 'societe','','',1);
$search_nom=isset($_GET["search_nom"])?$_GET["search_nom"]:$_POST["search_nom"]; $search_nom=isset($_GET["search_nom"])?$_GET["search_nom"]:$_POST["search_nom"];
$search_ville=isset($_GET["search_ville"])?$_GET["search_ville"]:$_POST["search_ville"]; $search_ville=isset($_GET["search_ville"])?$_GET["search_ville"]:$_POST["search_ville"];

21
htdocs/socnote.php
View File

@ -35,28 +35,11 @@ $action = isset($_GET["action"])?$_GET["action"]:$_POST["action"];
$langs->load("companies"); $langs->load("companies");
$user->getrights('commercial');
// Protection quand utilisateur externe // Protection quand utilisateur externe
$socid = isset($_GET["socid"])?$_GET["socid"]:$_POST["socid"]; $socid = isset($_GET["socid"])?$_GET["socid"]:$_POST["socid"];
if ($user->societe_id > 0)
{
$socid = $user->societe_id;
}
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socid && !$user->societe_id > 0)
{
$sql = "SELECT sc.fk_soc, s.client";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux as sc, ".MAIN_DB_PREFIX."societe as s";
$sql .= " WHERE sc.fk_soc = ".$socid." AND sc.fk_user = ".$user->id." AND s.client = 1";
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
// Sécurité d'accès client et commerciaux
$socid = restrictedArea($user, 'societe', $socid);
if ($_POST["action"] == 'add') if ($_POST["action"] == 'add')
{ {