lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX Security access problem with external users on projects/tasks

Browse Source
This commit is contained in:
Laurent Destailleur 2017-01-12 15:23:30 +01:00
parent 8d5c853267
commit f185a09693
18 changed files with 26 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/langs/en_US/admin.lang
View File

@ -560,7 +560,7 @@ Permission34=Delete products
Permission36=See/manage hidden products
Permission38=Export products
Permission41=Read projects and tasks (shared project and projects i'm contact for). Can also enter time consumed on assigned tasks (timesheet)
Permission42=Create/modify projects (shared project and projects i'm contact for)
Permission42=Create/modify projects (shared project and projects i'm contact for). Can also create tasks and assign users to project and tasks
Permission44=Delete projects (shared project and projects i'm contact for)
Permission45=Export projects
Permission61=Read interventions
@ -663,7 +663,7 @@ PermissionAdvanced253=Create/modify internal/external users and permissions
Permission254=Create/modify external users only
Permission255=Modify other users password
Permission256=Delete or disable other users
Permission262=Extend access to all third parties (not only those linked to user). Not effective for external users (always limited to themselves).
Permission262=Extend access to all third parties (not only third parties that user is a sale representative). Not effective for external users (always limited to themselves for proposals, orders, invoices, contracts, etc). Not effective for projects (only rules on project permissions, visibility and assignement matters).
Permission271=Read CA
Permission272=Read invoices
Permission273=Issue invoices

1
htdocs/langs/en_US/errors.lang
View File

@ -176,6 +176,7 @@ ErrorStockIsNotEnoughToAddProductOnShipment=Stock is not enough for product %s t
ErrorStockIsNotEnoughToAddProductOnProposal=Stock is not enough for product %s to add it into a new proposal.
ErrorFailedToLoadLoginFileForMode=Failed to get the login key for mode '%s'.
ErrorPhpMailDelivery=Check that you don't use a too high number of recipients and that your email content is not similar to a Spam. Ask also your administrator to check firewall and server logs files for a more complete information.
ErrorUserNotAssignedToTask=User must be assigned to task to be able to enter time consumed.
# Warnings
WarningPasswordSetWithNoAccount=A password was set for this member. However, no user account was created. So this password is stored but can't be used to login to Dolibarr. It may be used by an external module/interface but if you don't need to define any login nor password for a member, you can disable option "Manage a login for each member" from Member module setup. If you need to manage a login but don't need any password, you can keep this field empty to avoid this warning. Note: Email can also be used as a login if the member is linked to a user.

2
htdocs/projet/card.php
View File

@ -68,7 +68,7 @@ if ($id > 0 || ! empty($ref))
// Security check
$socid=GETPOST('socid');
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $object->id,'projet&project');
// fetch optionals attributes and labels

2
htdocs/projet/contact.php
View File

@ -46,7 +46,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $id,'projet&project');

2
htdocs/projet/document.php
View File

@ -42,7 +42,7 @@ $mine = (GETPOST('mode','alpha') == 'mine' ? 1 : 0);
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result=restrictedArea($user,'projet',$id,'projet&project');
$object = new Project($db);

2
htdocs/projet/element.php
View File

@ -92,7 +92,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu
// Security check
$socid=$object->socid;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $projectid, 'projet&project');

2
htdocs/projet/ganttview.php
View File

@ -43,7 +43,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $id,'projet&project');
$langs->load("users");

2
htdocs/projet/index.php
View File

@ -37,7 +37,7 @@ $mine = GETPOST('mode')=='mine' ? 1 : 0;
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if (!$user->rights->projet->lire) accessforbidden();
$sortfield = GETPOST("sortfield",'alpha');

2
htdocs/projet/info.php
View File

@ -34,7 +34,7 @@ $langs->load("projects");
// Security check
$socid=0;
$id = GETPOST("id",'int');
if ($user->societe_id) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result=restrictedArea($user,'projet',$id,'');

9
htdocs/projet/list.php
View File

@ -40,7 +40,7 @@ $title = $langs->trans("Projects");
// Security check
$socid = (is_numeric($_GET["socid"]) ? $_GET["socid"] : 0 );
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if ($socid > 0)
{
$soc = new Societe($db);
@ -220,7 +220,9 @@ if (is_array($extrafields->attribute_label) && count($extrafields->attribute_lab
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s on p.fk_soc = s.rowid";
$sql.= " LEFT JOIN ".MAIN_DB_PREFIX."c_lead_status as cls on p.fk_opp_status = cls.rowid";
// We'll need this table joined to the select in order to filter by sale
if ($search_sale > 0 || (! $user->rights->societe->client->voir && ! $socid)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid";
// For external user, no check is done on company permission because readability is managed by public status of project and assignement.
//if ($search_sale > 0 || (! $user->rights->societe->client->voir && ! $socid)) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid";
if ($search_sale > 0) $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = s.rowid";
if ($search_user > 0)
{
$sql.=", ".MAIN_DB_PREFIX."element_contact as ecp";
@ -271,7 +273,8 @@ if ($search_opp_status)
}
if ($search_public!='') $sql .= " AND p.public = ".$db->escape($search_public);
if ($search_sale > 0) $sql.= " AND sc.fk_user = " .$search_sale;
if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND ((s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id.") OR (s.rowid IS NULL))";
// For external user, no check is done on company permission because readability is managed by public status of project and assignement.
//if (! $user->rights->societe->client->voir && ! $socid) $sql.= " AND ((s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id.") OR (s.rowid IS NULL))";
if ($search_user > 0) $sql.= " AND ecp.fk_c_type_contact IN (".join(',',array_keys($listofprojectcontacttype)).") AND ecp.element_id = p.rowid AND ecp.fk_socpeople = ".$search_user;
if ($search_opp_amount != '') $sql .= natural_search('p.opp_amount', $search_opp_amount, 1);
if ($search_budget_amount != '') $sql .= natural_search('p.budget_amount', $search_budget_amount, 1);

2
htdocs/projet/note.php
View File

@ -41,7 +41,7 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be inclu
// Security check
$socid=0;
if ($user->societe_id > 0) $socid=$user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $id,'projet&project');
$permissionnote=$user->rights->projet->creer; // Used by the include of actions_setnotes.inc.php

5
htdocs/projet/tasks.php
View File

@ -61,7 +61,7 @@ $extralabels_task=$extrafields_task->fetch_name_optionals_label($taskstatic->tab
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
$result = restrictedArea($user, 'projet', $id,'projet&project');
// Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array
@ -413,7 +413,8 @@ else if ($id > 0 || ! empty($ref))
// Get list of tasks in tasksarray and taskarrayfiltered
// We need all tasks (even not limited to a user because a task to user can have a parent that is not affected to him).
$tasksarray=$taskstatic->getTasksArray(0, 0, $object->id, $socid, 0);
$filteronthirdpartyid = $socid;
$tasksarray=$taskstatic->getTasksArray(0, 0, $object->id, $filteronthirdpartyid, 0);
// We load also tasks limited to a particular user
$tasksrole=($mode=='mine' ? $taskstatic->getUserRolesForProjectsOrTasks(0,$user,$object->id,0) : '');
//var_dump($tasksarray);

2
htdocs/projet/tasks/contact.php
View File

@ -42,7 +42,7 @@ $project_ref=GETPOST('project_ref','alpha');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
//$result = restrictedArea($user, 'projet', $id, 'projet_task');
if (! $user->rights->projet->lire) accessforbidden();

2
htdocs/projet/tasks/document.php
View File

@ -47,7 +47,7 @@ $project_ref = GETPOST('project_ref','alpha');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
//$result=restrictedArea($user,'projet',$id,'');
if (!$user->rights->projet->lire) accessforbidden();

2
htdocs/projet/tasks/list.php
View File

@ -75,7 +75,7 @@ $search_array_options=$extrafields->getOptionalsFromPost($extralabels,'','search
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if (!$user->rights->projet->lire) accessforbidden();
$limit = GETPOST("limit")?GETPOST("limit","int"):$conf->liste_limit;

2
htdocs/projet/tasks/note.php
View File

@ -39,7 +39,7 @@ $project_ref = GETPOST('project_ref','alpha');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if (!$user->rights->projet->lire) accessforbidden();
//$result = restrictedArea($user, 'projet', $id, '', 'task'); // TODO ameliorer la verification

2
htdocs/projet/tasks/task.php
View File

@ -47,7 +47,7 @@ $planned_workload=((GETPOST('planned_workloadhour')!='' && GETPOST('planned_work
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if (! $user->rights->projet->lire) accessforbidden();
// Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array

2
htdocs/projet/tasks/time.php
View File

@ -43,7 +43,7 @@ $project_ref=GETPOST('project_ref','alpha');
// Security check
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
//if ($user->societe_id > 0) $socid = $user->societe_id; // For external user, no check is done on company because readability is managed by public status of project and assignement.
if (!$user->rights->projet->lire) accessforbidden();
// Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array