Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '8.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source
This commit is contained in:
Laurent Destailleur
2018-07-03 12:33:17 +02:00
parent 63f3143718 cfb41d4329
commit 12c43d7722
24 changed files with 254 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
htdocs/core/lib/functions2.lib.php
View File

@@ -708,9 +708,10 @@ function array2table($data,$tableMarkup=1,$tableoptions='',$troptions='',$tdopti
* @param string $mode 'next' for next value or 'last' for last value
* @param bool $bentityon Activate the entity filter. Default is true (for modules not compatible with multicompany)
* @param User $objuser Object user we need data from.
* @param int $forceentity Entity id to force
* @return string New value (numeric) or error message
*/
function get_next_value($db,$mask,$table,$field,$where='',$objsoc='',$date='',$mode='next', $bentityon=true, $objuser=null)
function get_next_value($db,$mask,$table,$field,$where='',$objsoc='',$date='',$mode='next', $bentityon=true, $objuser=null, $forceentity=null)
{
global $conf,$user;
@@ -987,7 +988,8 @@ function get_next_value($db,$mask,$table,$field,$where='',$objsoc='',$date='',$m
$sql.= " AND ".$field." NOT LIKE '(PROV%)'";
if ($bentityon) // only if entity enable
$sql.= " AND entity IN (".getEntity($sharetable).")";
else if (! empty($forceentity))
$sql.= " AND entity = ".(int) $forceentity;
if ($where) $sql.=$where;
if ($sqlwhere) $sql.=' AND '.$sqlwhere;
@@ -1035,6 +1037,8 @@ function get_next_value($db,$mask,$table,$field,$where='',$objsoc='',$date='',$m
$sql.= " AND ".$field." NOT LIKE '%PROV%'";
if ($bentityon) // only if entity enable
$sql.= " AND entity IN (".getEntity($sharetable).")";
else if (! empty($forceentity))
$sql.= " AND entity = ".(int) $forceentity;
if ($where) $sql.=$where;
if ($sqlwhere) $sql.=' AND '.$sqlwhere;
@@ -1089,6 +1093,8 @@ function get_next_value($db,$mask,$table,$field,$where='',$objsoc='',$date='',$m
$maskrefclient_sql.= " WHERE ".$field." LIKE '".$maskrefclient_maskLike."'";
if ($bentityon) // only if entity enable
$maskrefclient_sql.= " AND entity IN (".getEntity($sharetable).")";
else if (! empty($forceentity))
$sql.= " AND entity = ".(int) $forceentity;
if ($where) $maskrefclient_sql.=$where; //use the same optional where as general mask
if ($sqlwhere) $maskrefclient_sql.=' AND '.$sqlwhere; //use the same sqlwhere as general mask
$maskrefclient_sql.=' AND (SUBSTRING('.$field.', '.(strpos($maskwithnocode,$maskrefclient)+1).', '.dol_strlen($maskrefclient_maskclientcode).")='".$maskrefclient_clientcode."')";

33
htdocs/core/lib/security.lib.php
View File

@@ -469,13 +469,32 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
{
$sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
if (($feature == 'user' || $feature == 'usergroup') && ! empty($conf->multicompany->enabled) && $conf->entity == 1 && $user->admin && ! $user->entity)
if (($feature == 'user' || $feature == 'usergroup') && ! empty($conf->multicompany->enabled))
{
$sql.= " AND dbt.entity IS NOT NULL";
if (! empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE))
{
if ($conf->entity == 1 && $user->admin && ! $user->entity)
{
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql.= " AND dbt.entity IS NOT NULL";
}
else
{
$sql.= ",".MAIN_DB_PREFIX."usergroup_user as ug";
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql.= " AND (ug.fk_user = dbt.rowid";
$sql.= " AND ug.entity IN (".getEntity('user')."))";
$sql.= " OR dbt.entity = 0"; // Show always superadmin
}
}
else {
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
}
}
else
{
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
}
}
@@ -509,12 +528,12 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
else if (in_array($feature,$checkother)) // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...).
{
// If external user: Check permission for external users
if ($user->societe_id > 0)
if ($user->socid > 0)
{
$sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql.= " AND dbt.fk_soc = ".$user->societe_id;
$sql.= " AND dbt.fk_soc = ".$user->socid;
}
// If internal user: Check permission for internal users that are restricted on their objects
else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
@@ -577,13 +596,13 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
else if (! in_array($feature,$nocheck)) // By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield
{
// If external user: Check permission for external users
if ($user->societe_id > 0)
if ($user->socid > 0)
{
if (empty($dbt_keyfield)) dol_print_error('','Param dbt_keyfield is required but not defined');
$sql = "SELECT COUNT(dbt.".$dbt_keyfield.") as nb";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= " WHERE dbt.rowid IN (".$objectid.")";
$sql.= " AND dbt.".$dbt_keyfield." = ".$user->societe_id;
$sql.= " AND dbt.".$dbt_keyfield." = ".$user->socid;
}
// If internal user: Check permission for internal users that are restricted on their objects
else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))