diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php
index b621ad9752f..37ef8a5da76 100644
--- a/htdocs/compta/bank/bankentries_list.php
+++ b/htdocs/compta/bank/bankentries_list.php
@@ -898,18 +898,21 @@ if ($resql) {
print '
';
}
- /// ajax to adjust value date with plus and less picto
+ // Code to adjust value date with plus and less picto using an Ajax call instead of a full reload of page
+ $urlajax = DOL_URL_ROOT.'/core/ajax/bankconciliate.php?token='.currentToken();
print '
+ ';
+ */
print '';
print dol_get_fiche_end();
diff --git a/htdocs/compta/bank/releve.php b/htdocs/compta/bank/releve.php
index 53d43583a9c..be91d475d4d 100644
--- a/htdocs/compta/bank/releve.php
+++ b/htdocs/compta/bank/releve.php
@@ -454,11 +454,14 @@ if (empty($numref)) {
// Date de valeur
print '';
- print dol_print_date($db->jdate($objp->dv), "day").' ';
- print '';
+ print ''.dol_print_date($db->jdate($objp->dv), "day").'';
+ print ' ';
+ print '';
+ print '';
print img_edit_remove()." ";
- print '';
+ print '';
print img_edit_add()."";
+ print '';
print " | \n";
// Type and num
@@ -656,6 +659,29 @@ if (empty($numref)) {
print "\n";
print "";
+ // Code to adjust value date with plus and less picto using an Ajax call instead of a full reload of page
+ $urlajax = DOL_URL_ROOT.'/core/ajax/bankconciliate.php?token='.currentToken();
+ print '
+
+ ';
+
print "";
print "\n";
diff --git a/htdocs/core/ajax/bankconciliate.php b/htdocs/core/ajax/bankconciliate.php
index adcd1290fed..351903ea1f7 100644
--- a/htdocs/core/ajax/bankconciliate.php
+++ b/htdocs/core/ajax/bankconciliate.php
@@ -48,10 +48,6 @@ $action = GETPOST('action', 'aZ09');
* View
*/
-// Ajout directives pour resoudre bug IE
-//header('Cache-Control: Public, must-revalidate');
-//header('Pragma: public');
-
//top_htmlhead("", "", 1); // Replaced with top_httphead. An ajax page does not need html header.
top_httphead();
@@ -63,7 +59,7 @@ if (($user->rights->banque->modifier || $user->rights->banque->consolidate) && $
$al->datev_next(GETPOST('rowid', 'int'));
$al->fetch(GETPOST('rowid', 'int'));
- print ''.dol_print_date($db->jdate($al->datev), "day").'';
+ print ''.dol_print_date($db->jdate($al->datev), "day").'';
exit;
}
@@ -74,7 +70,7 @@ if (($user->rights->banque->modifier || $user->rights->banque->consolidate) && $
$al->datev_previous(GETPOST('rowid', 'int'));
$al->fetch(GETPOST('rowid', 'int'));
- print ''.dol_print_date($db->jdate($al->datev), "day").'';
+ print ''.dol_print_date($db->jdate($al->datev), "day").'';
exit;
}
@@ -85,7 +81,7 @@ if (($user->rights->banque->modifier || $user->rights->banque->consolidate) && $
$al->dateo_next(GETPOST('rowid', 'int'));
$al->fetch(GETPOST('rowid', 'int'));
- print ''.dol_print_date($db->jdate($al->dateo), "day").'';
+ print ''.dol_print_date($db->jdate($al->dateo), "day").'';
exit;
}
@@ -96,7 +92,7 @@ if (($user->rights->banque->modifier || $user->rights->banque->consolidate) && $
$al->dateo_previous(GETPOST('rowid', 'int'));
$al->fetch(GETPOST('rowid', 'int'));
- print ''.dol_print_date($db->jdate($al->dateo), "day").'';
+ print ''.dol_print_date($db->jdate($al->dateo), "day").'';
exit;
}
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index f6376a650b7..d77b1479102 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -427,7 +427,7 @@ if (!defined('NOTOKENRENEWAL')) {
dol_syslog("NEW TOKEN reclaimed by : " . $_SERVER['PHP_SELF'], LOG_DEBUG);
}
-//dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha').' '.$_SESSION['token']);
+//dol_syslog("aaaa - ".defined('NOCSRFCHECK')." - ".$dolibarr_nocsrfcheck." - ".$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN." - ".$_SERVER['REQUEST_METHOD']." - ".GETPOST('token', 'alpha'));
// Check validity of token, only if option MAIN_SECURITY_CSRF_WITH_TOKEN enabled or if constant CSRFCHECK_WITH_TOKEN is set into page
if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) || defined('CSRFCHECK_WITH_TOKEN')) {
@@ -457,7 +457,9 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
}
}
- if (GETPOSTISSET('token') && GETPOST('token', 'alpha') != $_SESSION['token']) {
+ $sessiontokenforthisurl = $_SESSION['token'];
+ // TODO Get the sessiontokenforthisurl into the array of session token
+ if (GETPOSTISSET('token') && GETPOST('token', 'alpha') != $sessiontokenforthisurl) {
dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]." refused due to invalid token, so we disable POST and some GET parameters - referer=".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action', 'aZ09').", _GET|POST['token']=".GETPOST('token', 'alpha').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
//print 'Unset POST by CSRF protection in main.inc.php.'; // Do not output anything because this create problems when using the BACK button on browsers.
setEventMessages('SecurityTokenHasExpiredSoActionHasBeenCanceledPleaseRetry', null, 'warnings');
@@ -1094,7 +1096,7 @@ if (!defined('NOLOGIN')) {
dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"])?'':$_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"].' - action='.GETPOST('action', 'aZ09').', massaction='.GETPOST('massaction', 'aZ09').' NOTOKENRENEWAL='.(defined('NOTOKENRENEWAL') ?constant('NOTOKENRENEWAL') : ''));
//Another call for easy debugg
-//dol_syslog("Access to ".$_SERVER["PHP_SELF"].' GET='.join(',',array_keys($_GET)).'->'.join(',',$_GET).' POST:'.join(',',array_keys($_POST)).'->'.join(',',$_POST));
+//dol_syslog("Access to ".$_SERVER["PHP_SELF"].' '.$_SERVER["HTTP_REFERER"].' GET='.join(',',array_keys($_GET)).'->'.join(',',$_GET).' POST:'.join(',',array_keys($_POST)).'->'.join(',',$_POST));
// Load main languages files
if (!defined('NOREQUIRETRAN')) {
@@ -1237,7 +1239,7 @@ if (!function_exists("llxHeader")) {
/**
- * Show HTTP header
+ * Show HTTP header. Called by top_htmlhead().
*
* @param string $contenttype Content type. For example, 'text/html'
* @param int $forcenocache Force disabling of cache for the page
@@ -1303,7 +1305,7 @@ function top_httphead($contenttype = 'text/html', $forcenocache = 0)
}
/**
- * Ouput html header of a page.
+ * Ouput html header of a page. It calls also top_httphead()
* This code is also duplicated into security2.lib.php::dol_loginfunction
*
* @param string $head Optionnal head lines