Fix: All output page must include main.inc.php

htdocs/main.inc.php

@@ -252,7 +252,9 @@ if (sizeof($conf->need_smarty) > 0 || $conf->global->MAIN_SMARTY)
 /*
  * Phase authentication / login
  */
-
+$login='';
+if (! defined('NOLOGIN'))
+{
 	// $authmode contient la liste des differents modes d'identification a tester par ordre de preference.
 	// Example: 'http'
 	// Example: 'dolibarr'
@@ -278,7 +280,6 @@ if (! sizeof($authmode))
 	// Si la demande du login a deja eu lieu, on le recupere depuis la session
 	// sinon appel du module qui realise sa demande.
 	// A l'issu de cette phase, la variable $login sera definie.
-$login='';
 	$resultFetchUser='';
 	$test=true;
 	if (! isset($_SESSION["dol_login"]))
@@ -545,6 +546,7 @@ if (! isset($_SESSION["dol_login"]))
 		}
 	}
 	
+
 	// Si user admin, on force droits sur les modules base
 	if ($user->admin)
 	{
@@ -569,6 +571,19 @@ if (isset($user->conf->PRODUIT_LIMIT_SIZE))		// Can be 0
 	{
 		$conf->produit->limit_size = $user->conf->PRODUIT_LIMIT_SIZE;
 	}
+	// Replace conf->css by personalized value
+	if (isset($user->conf->MAIN_THEME) && $user->conf->MAIN_THEME)
+	{
+		$conf->theme=$user->conf->MAIN_THEME;
+		$conf->css  = "theme/".$conf->theme."/".$conf->theme.".css";
+	}
+	// Set javascript option
+	if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
+	{
+		$conf->use_javascript_ajax=! $user->conf->MAIN_DISABLE_JAVASCRIPT;
+	}
+}
+
 
 
 if (empty($_GET["lang"]))	// If language was not forced on URL
@@ -590,12 +605,6 @@ else	// If language was forced on URL
 }
 
 
-// Replace conf->css by personalized value
-if (isset($user->conf->MAIN_THEME) && $user->conf->MAIN_THEME)
-{
-	$conf->theme=$user->conf->MAIN_THEME;
-	$conf->css  = "theme/".$conf->theme."/".$conf->theme.".css";
-}
 // Cas de forcage du style depuis url
 if (! empty($_GET["theme"]))
 {
@@ -605,13 +614,8 @@ if (! empty($_GET["theme"]))
 // Style sheet must be a php file
 $conf->css.=".php";
 
-if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
-{
-	$conf->use_javascript_ajax=! $user->conf->MAIN_DISABLE_JAVASCRIPT;
-}
-
 // Define menu manager to use
-if (! $user->societe_id)    // Si utilisateur interne
+if (empty($user->societe_id))    // Si utilisateur interne ou non defini
 {
 	$conf->top_menu=$conf->global->MAIN_MENU_BARRETOP;
 	$conf->left_menu=$conf->global->MAIN_MENU_BARRELEFT;
@@ -624,31 +628,9 @@ else                        // Si utilisateur externe
 	$conf->left_menu=$conf->global->MAIN_MENUFRONT_BARRELEFT;
 }
 
-/*
-// If there is at least one module using Smarty
-if (sizeof($conf->need_smarty) > 0)
-{
-	// Usage of constats in conf.php file is no more required.
-	if (empty($dolibarr_smarty_libs_dir)) $dolibarr_smarty_libs_dir=DOL_DOCUMENT_ROOT.'/includes/smarty/libs/';
-	if (empty($dolibarr_smarty_compile))  $dolibarr_smarty_compile=DOL_DATA_ROOT.'/smarty/templates/temp';
-	if (empty($dolibarr_smarty_cache))    $dolibarr_smarty_cache=DOL_DATA_ROOT.'/smarty/cache/temp';
 
-	$smarty_libs = $dolibarr_smarty_libs_dir. "Smarty.class.php";
+if (! defined('NOLOGIN'))
-	if (file_exists ($smarty_libs))
 {
-		require_once($smarty_libs);
-		$smarty = new Smarty();
-		$smarty->compile_dir = $dolibarr_smarty_compile;
-		$smarty->cache_dir = $dolibarr_smarty_cache;
-		//$smarty->config_dir = '/web/www.domain.com/smarty/configs';
-	}
-	else
-	{
-		dol_print_error('',"Library Smarty ".$smarty_libs." not found. Check parameter dolibarr_smarty_libs_dir in conf file.");
-	}
-}
-*/
-
 	// Si le login n'a pu etre recupere, on est identifie avec un compte qui n'existe pas.
 	// Tentative de hacking ?
 	if (! $user->login) accessforbidden();
@@ -658,11 +640,14 @@ if ($user->statut < 1)
 	{
 		// Si non actif, on delogue le user
 		$langs->load("other");
-	dol_syslog ("Authentification ko as login is disbaled");
+		dol_syslog ("Authentification ko as login is disabled");
 		accessforbidden($langs->trans("ErrorLoginDisabled"));
 		exit;
 	}
 
+	// Load permissions
+	$user->getrights();
+}
 
 dol_syslog("Access to ".$_SERVER["PHP_SELF"]);
 //Another call for easy debugg
@@ -675,9 +660,6 @@ if (! defined('MAIN_INFO_SOCIETE_PAYS')) define('MAIN_INFO_SOCIETE_PAYS','1');
 $langs->load("main");
 $langs->load("dict");
 
-// Load permissions
-$user->getrights();
-
 // Define some constants used for style of arrays
 $bc[0]="class=\"impair\"";
 $bc[1]="class=\"pair\"";

htdocs/user/passwordforgotten.php

@@ -22,32 +22,19 @@
  *       \version    $Id$
  */
 
-// This is to make Dolibarr working with Plesk
+define("NOLOGIN",1);	// This means this output page does not require to be logged.
-set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
 
-// Init session. Name of session is specific to Dolibarr instance.
+require("../main.inc.php");
-$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
-$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
-if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]);
-session_name($sessionname);
-session_start();
-
-require("../master.inc.php");
 require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
 require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
 require_once(DOL_DOCUMENT_ROOT."/lib/usergroups.lib.php");
 
-$langcode=(empty($_GET["lang"])?'auto':$_GET["lang"]);
-$langs->setDefaultLang($langcode);
-
-$user->getrights('user');
-
-$langs->load("main");
 $langs->load("other");
 $langs->load("users");
 $langs->load("companies");
 $langs->load("ldap");
 
+// Security check
 if ($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)
 	accessforbidden();
 
@@ -59,6 +46,7 @@ $login = isset($_POST["username"])?$_POST["username"]:'';
 $conf->entity = isset($_POST["entity"])?$_POST["entity"]:1;
 
 
+
 /**
  * Actions
  */