Fix: All output page must include main.inc.php

htdocs/main.inc.php

@@ -252,37 +252,38 @@ if (sizeof($conf->need_smarty) > 0 || $conf->global->MAIN_SMARTY)
 /*
  * Phase authentication / login
  */
-
+$login='';
-// $authmode contient la liste des differents modes d'identification a tester par ordre de preference.
+if (! defined('NOLOGIN'))
-// Example: 'http'
-// Example: 'dolibarr'
-// Example: 'ldap'
-// Example: 'http,forceuser'
-
-// Authentication mode
-if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr';
-// Authentication mode: forceuser
-if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto';
-
-// Set authmode
-$authmode=explode(',',$dolibarr_main_authentication);
-
-// No authentication mode
-if (! sizeof($authmode))
 {
+	// $authmode contient la liste des differents modes d'identification a tester par ordre de preference.
+	// Example: 'http'
+	// Example: 'dolibarr'
+	// Example: 'ldap'
+	// Example: 'http,forceuser'
+	
+	// Authentication mode
+	if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr';
+	// Authentication mode: forceuser
+	if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto';
+	
+	// Set authmode
+	$authmode=explode(',',$dolibarr_main_authentication);
+	
+	// No authentication mode
+	if (! sizeof($authmode))
+	{
 		$langs->load('main');
 		dol_print_error('',$langs->trans("ErrorConfigParameterNotDefined",'dolibarr_main_authentication'));
 		exit;
-}
+	}
 	
-// Si la demande du login a deja eu lieu, on le recupere depuis la session
+	// Si la demande du login a deja eu lieu, on le recupere depuis la session
-// sinon appel du module qui realise sa demande.
+	// sinon appel du module qui realise sa demande.
-// A l'issu de cette phase, la variable $login sera definie.
+	// A l'issu de cette phase, la variable $login sera definie.
-$login='';
+	$resultFetchUser='';
-$resultFetchUser='';
+	$test=true;
-$test=true;
+	if (! isset($_SESSION["dol_login"]))
-if (! isset($_SESSION["dol_login"]))
+	{
-{
 		// On est pas deja authentifie, on demande le login/mot de passe
 	
 		// Verification du code securite graphique
@@ -421,9 +422,9 @@ if (! isset($_SESSION["dol_login"]))
 			header('Location: '.DOL_URL_ROOT.'/index.php');
 			exit;
 		}
-}
+	}
-else
+	else
-{
+	{
 		// On est deja en session qui a sauvegarde login
 		// Remarks: On ne sauvegarde pas objet user car pose pb dans certains cas mal identifies
 		$login=$_SESSION["dol_login"];
@@ -462,11 +463,11 @@ else
 			header('Location: '.DOL_URL_ROOT.'/index.php');
 			exit;
 		}
-}
+	}
 	
-// Is it a new session ?
+	// Is it a new session ?
-if (! isset($_SESSION["dol_login"]))
+	if (! isset($_SESSION["dol_login"]))
-{
+	{
 		$error=0;
 	
 		// New session for this login
@@ -543,34 +544,48 @@ if (! isset($_SESSION["dol_login"]))
 				setcookie($conf->phenix->cookie, $user->phenix_login.":".$user->phenix_pass_crypted.":1", 0, "/", "", 0);
 			}
 		}
-}
+	}
 	
-// Si user admin, on force droits sur les modules base
+
-if ($user->admin)
+	// Si user admin, on force droits sur les modules base
-{
+	if ($user->admin)
+	{
 		$user->rights->user->user->lire=1;
 		$user->rights->user->user->creer=1;
 		$user->rights->user->user->password=1;
 		$user->rights->user->user->supprimer=1;
 		$user->rights->user->self->creer=1;
 		$user->rights->user->self->password=1;
-}
+	}
 	
-/*
+	/*
 	 * Overwrite configs global par configs perso
 	 * ------------------------------------------
 	 */
-// Set liste_limit
+	// Set liste_limit
-if (isset($user->conf->MAIN_SIZE_LISTE_LIMIT))	// Can be 0
+	if (isset($user->conf->MAIN_SIZE_LISTE_LIMIT))	// Can be 0
-{
+	{
 		$conf->liste_limit = $user->conf->MAIN_SIZE_LISTE_LIMIT;
-}
+	}
-if (isset($user->conf->PRODUIT_LIMIT_SIZE))		// Can be 0
+	if (isset($user->conf->PRODUIT_LIMIT_SIZE))		// Can be 0
-{
+	{
 		$conf->produit->limit_size = $user->conf->PRODUIT_LIMIT_SIZE;
+	}
+	// Replace conf->css by personalized value
+	if (isset($user->conf->MAIN_THEME) && $user->conf->MAIN_THEME)
+	{
+		$conf->theme=$user->conf->MAIN_THEME;
+		$conf->css  = "theme/".$conf->theme."/".$conf->theme.".css";
+	}
+	// Set javascript option
+	if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
+	{
+		$conf->use_javascript_ajax=! $user->conf->MAIN_DISABLE_JAVASCRIPT;
+	}
 }
 
 
+
 if (empty($_GET["lang"]))	// If language was not forced on URL
 {
 	// If user has choosed its own language
@@ -590,12 +605,6 @@ else	// If language was forced on URL
 }
 
 
-// Replace conf->css by personalized value
-if (isset($user->conf->MAIN_THEME) && $user->conf->MAIN_THEME)
-{
-	$conf->theme=$user->conf->MAIN_THEME;
-	$conf->css  = "theme/".$conf->theme."/".$conf->theme.".css";
-}
 // Cas de forcage du style depuis url
 if (! empty($_GET["theme"]))
 {
@@ -605,13 +614,8 @@ if (! empty($_GET["theme"]))
 // Style sheet must be a php file
 $conf->css.=".php";
 
-if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
-{
-	$conf->use_javascript_ajax=! $user->conf->MAIN_DISABLE_JAVASCRIPT;
-}
-
 // Define menu manager to use
-if (! $user->societe_id)    // Si utilisateur interne
+if (empty($user->societe_id))    // Si utilisateur interne ou non defini
 {
 	$conf->top_menu=$conf->global->MAIN_MENU_BARRETOP;
 	$conf->left_menu=$conf->global->MAIN_MENU_BARRELEFT;
@@ -624,45 +628,26 @@ else                        // Si utilisateur externe
 	$conf->left_menu=$conf->global->MAIN_MENUFRONT_BARRELEFT;
 }
 
-/*
+
-// If there is at least one module using Smarty
+if (! defined('NOLOGIN'))
-if (sizeof($conf->need_smarty) > 0)
 {
-	// Usage of constats in conf.php file is no more required.
+	// Si le login n'a pu etre recupere, on est identifie avec un compte qui n'existe pas.
-	if (empty($dolibarr_smarty_libs_dir)) $dolibarr_smarty_libs_dir=DOL_DOCUMENT_ROOT.'/includes/smarty/libs/';
+	// Tentative de hacking ?
-	if (empty($dolibarr_smarty_compile))  $dolibarr_smarty_compile=DOL_DATA_ROOT.'/smarty/templates/temp';
+	if (! $user->login) accessforbidden();
-	if (empty($dolibarr_smarty_cache))    $dolibarr_smarty_cache=DOL_DATA_ROOT.'/smarty/cache/temp';
 	
-	$smarty_libs = $dolibarr_smarty_libs_dir. "Smarty.class.php";
+	// Check if user is active
-	if (file_exists ($smarty_libs))
+	if ($user->statut < 1)
 	{
-		require_once($smarty_libs);
-		$smarty = new Smarty();
-		$smarty->compile_dir = $dolibarr_smarty_compile;
-		$smarty->cache_dir = $dolibarr_smarty_cache;
-		//$smarty->config_dir = '/web/www.domain.com/smarty/configs';
-	}
-	else
-	{
-		dol_print_error('',"Library Smarty ".$smarty_libs." not found. Check parameter dolibarr_smarty_libs_dir in conf file.");
-	}
-}
-*/
-
-// Si le login n'a pu etre recupere, on est identifie avec un compte qui n'existe pas.
-// Tentative de hacking ?
-if (! $user->login) accessforbidden();
-
-// Check if user is active
-if ($user->statut < 1)
-{
 		// Si non actif, on delogue le user
 		$langs->load("other");
-	dol_syslog ("Authentification ko as login is disbaled");
+		dol_syslog ("Authentification ko as login is disabled");
 		accessforbidden($langs->trans("ErrorLoginDisabled"));
 		exit;
-}
+	}
 
+	// Load permissions
+	$user->getrights();
+}
 
 dol_syslog("Access to ".$_SERVER["PHP_SELF"]);
 //Another call for easy debugg
@@ -675,9 +660,6 @@ if (! defined('MAIN_INFO_SOCIETE_PAYS')) define('MAIN_INFO_SOCIETE_PAYS','1');
 $langs->load("main");
 $langs->load("dict");
 
-// Load permissions
-$user->getrights();
-
 // Define some constants used for style of arrays
 $bc[0]="class=\"impair\"";
 $bc[1]="class=\"pair\"";

htdocs/user/passwordforgotten.php

@@ -22,32 +22,19 @@
  *       \version    $Id$
  */
 
-// This is to make Dolibarr working with Plesk
+define("NOLOGIN",1);	// This means this output page does not require to be logged.
-set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
 
-// Init session. Name of session is specific to Dolibarr instance.
+require("../main.inc.php");
-$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
-$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
-if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]);
-session_name($sessionname);
-session_start();
-
-require("../master.inc.php");
 require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
 require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
 require_once(DOL_DOCUMENT_ROOT."/lib/usergroups.lib.php");
 
-$langcode=(empty($_GET["lang"])?'auto':$_GET["lang"]);
-$langs->setDefaultLang($langcode);
-
-$user->getrights('user');
-
-$langs->load("main");
 $langs->load("other");
 $langs->load("users");
 $langs->load("companies");
 $langs->load("ldap");
 
+// Security check
 if ($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)
 	accessforbidden();
 
@@ -59,6 +46,7 @@ $login = isset($_POST["username"])?$_POST["username"]:'';
 $conf->entity = isset($_POST["entity"])?$_POST["entity"]:1;
 
 
+
 /**
  * Actions
  */