lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: bad security request

Browse Source
This commit is contained in:
Regis Houssin 2009-11-28 07:30:45 +00:00
parent 5ea37d7835
commit e9feb81c95
2 changed files with 20 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
htdocs/contact/fiche.php
View File

@ -2,7 +2,7 @@
/* Copyright (C) 2004-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2009 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2009 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be> * Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
* Copyright (C) 2005-2007 Regis Houssin <regis@dolibarr.fr> * Copyright (C) 2005-2009 Regis Houssin <regis@dolibarr.fr>
* Copyright (C) 2007 Franky Van Liedekerke <franky.van.liedekerke@telenet.be> * Copyright (C) 2007 Franky Van Liedekerke <franky.van.liedekerke@telenet.be>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
@ -23,7 +23,7 @@
/** /**
* \file htdocs/contact/fiche.php * \file htdocs/contact/fiche.php
* \ingroup societe * \ingroup societe
* \brief Onglet g<EFBFBD>n<EFBFBD>ral d'un contact * \brief Onglet general d'un contact
* \version $Id$ * \version $Id$
*/ */
@ -55,8 +55,8 @@ $result = restrictedArea($user, 'contact', $contactid, 'socpeople');
/* /*
* Actions * Actions
*/ */
// Creation utilisateur depuis contact // Creation utilisateur depuis contact
if ($_POST["action"] == 'confirm_create_user' && $_POST["confirm"] == 'yes' && $user->rights->user->user->creer) if ($_POST["action"] == 'confirm_create_user' && $_POST["confirm"] == 'yes' && $user->rights->user->user->creer)
@ -195,8 +195,8 @@ if ($_POST["action"] == 'update' && ! $_POST["cancel"] && $user->rights->societe
/* /*
* View * View
*/ */
llxHeader('',$langs->trans("Contacts"),'EN:Module_Third_Parties|FR:Module_Tiers|ES:M&oacute;dulo_Empresas'); llxHeader('',$langs->trans("Contacts"),'EN:Module_Third_Parties|FR:Module_Tiers|ES:M&oacute;dulo_Empresas');
@ -211,8 +211,8 @@ if ($socid)
/* /*
* Onglets * Onglets
*/ */
if ($_GET["id"] > 0) if ($_GET["id"] > 0)
{ {
// Si edition contact deja existant // Si edition contact deja existant
@ -234,8 +234,8 @@ if ($_GET["id"] > 0)
/* /*
* Confirmation de la suppression du contact * Confirmation de la suppression du contact
*/ */
if ($user->rights->societe->contact->supprimer) if ($user->rights->societe->contact->supprimer)
{ {
if ($_GET["action"] == 'delete') if ($_GET["action"] == 'delete')
@ -343,9 +343,9 @@ if ($user->rights->societe->contact->creer)
elseif ($_GET["action"] == 'edit' && $_GET["id"]) elseif ($_GET["action"] == 'edit' && $_GET["id"])
{ {
/* /*
* Fiche en mode edition * Fiche en mode edition
* *
*/ */
// Affiche les erreurs // Affiche les erreurs
if (sizeof($error)) if (sizeof($error))
@ -490,9 +490,9 @@ if ($_GET["id"] && $_GET["action"] != 'edit')
$objsoc = new Societe($db); $objsoc = new Societe($db);
/* /*
* Fiche en mode visualisation * Fiche en mode visualisation
* *
*/ */
if ($msg) if ($msg)
{ {
$langs->load("errors"); $langs->load("errors");

7
htdocs/lib/functions.lib.php
View File

@ -1689,10 +1689,11 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
else if (! $user->rights->societe->client->voir) else if (! $user->rights->societe->client->voir)
{ {
$sql = "SELECT sc.fk_soc"; $sql = "SELECT sc.fk_soc";
$sql.= " FROM (".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= ", ".MAIN_DB_PREFIX."societe as s)"; $sql.= ", ".MAIN_DB_PREFIX."societe as s";
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = dbt.".$dbt_keyfield; $sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql.= " WHERE dbt.rowid = ".$objectid; $sql.= " WHERE dbt.rowid = ".$objectid;
$sql.= " AND sc.fk_soc = dbt.".$dbt_keyfield;
$sql.= " AND dbt.fk_soc = s.rowid"; $sql.= " AND dbt.fk_soc = s.rowid";
$sql.= " AND s.entity = ".$conf->entity; $sql.= " AND s.entity = ".$conf->entity;
$sql.= " AND COALESCE(sc.fk_user, ".$user->id.") = ".$user->id; $sql.= " AND COALESCE(sc.fk_user, ".$user->id.") = ".$user->id;