diff --git a/build/doxygen/doxygen_header.html b/build/doxygen/doxygen_header.html index 235797bb6c9..f60f4829d76 100644 --- a/build/doxygen/doxygen_header.html +++ b/build/doxygen/doxygen_header.html @@ -2,7 +2,7 @@ -$title +Dolibarr source code documentation '; if (empty($obj->reconcilable)) { - print ''; + print ''; print img_picto($langs->trans("Disabled"), 'switch_off'); print ''; } else { - print ''; + print ''; print img_picto($langs->trans("Activated"), 'switch_on'); print ''; } @@ -548,11 +548,11 @@ if ($resql) { if (!empty($arrayfields['aa.active']['checked'])) { print ''; if (empty($obj->active)) { - print ''; + print ''; print img_picto($langs->trans("Disabled"), 'switch_off'); print ''; } else { - print ''; + print ''; print img_picto($langs->trans("Activated"), 'switch_on'); print ''; } diff --git a/htdocs/accountancy/admin/card.php b/htdocs/accountancy/admin/card.php index 253c320bde0..caf98c7d91c 100644 --- a/htdocs/accountancy/admin/card.php +++ b/htdocs/accountancy/admin/card.php @@ -212,8 +212,10 @@ $accountsystem = new AccountancySystem($db); $accountsystem->fetch($conf->global->CHARTOFACCOUNTS); $title = $langs->trans('AccountAccounting')." - ".$langs->trans('Card'); -$helpurl = ''; -llxheader('', $title, $helpurl); + +$help_url = 'EN:Category:Accounting'; + +llxheader('', $title, $help_url); // Create mode diff --git a/htdocs/accountancy/admin/subaccount.php b/htdocs/accountancy/admin/subaccount.php index 341fddf113c..ad1804048c3 100644 --- a/htdocs/accountancy/admin/subaccount.php +++ b/htdocs/accountancy/admin/subaccount.php @@ -419,11 +419,11 @@ if ($resql) { if (!empty($arrayfields['reconcilable']['checked'])) { print ''; if (empty($obj->reconcilable)) { - print ''; + print ''; print img_picto($langs->trans("Disabled"), 'switch_off'); print ''; } else { - print ''; + print ''; print img_picto($langs->trans("Activated"), 'switch_on'); print ''; } diff --git a/htdocs/accountancy/bookkeeping/balance.php b/htdocs/accountancy/bookkeeping/balance.php index 35473c6329e..e03790a8995 100644 --- a/htdocs/accountancy/bookkeeping/balance.php +++ b/htdocs/accountancy/bookkeeping/balance.php @@ -135,6 +135,18 @@ if (!empty($search_accountancy_code_end)) { $param .= '&search_accountancy_code_end='.$search_accountancy_code_end; } +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + + + /* * Action */ diff --git a/htdocs/accountancy/bookkeeping/card.php b/htdocs/accountancy/bookkeeping/card.php index 3ab9ed0a702..e3cac139c08 100644 --- a/htdocs/accountancy/bookkeeping/card.php +++ b/htdocs/accountancy/bookkeeping/card.php @@ -44,13 +44,6 @@ $id = GETPOST('id', 'int'); // id of record $mode = GETPOST('mode', 'aZ09'); // '' or '_tmp' $piece_num = GETPOST("piece_num", 'int'); // id of transaction (several lines share the same transaction id) -// Security check -if ($user->socid > 0) { - accessforbidden(); -} - -$mesg = ''; - $accountingaccount = new AccountingAccount($db); $accountingjournal = new AccountingJournal($db); @@ -83,6 +76,17 @@ if (!empty($update)) { $object = new BookKeeping($db); +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Actions @@ -539,11 +543,11 @@ if ($action == 'create') { print '' . $langs->trans("Status") . ''; print ''; if (empty($object->validated)) { - print ''; + print ''; print img_picto($langs->trans("Disabled"), 'switch_off'); print ''; } else { - print ''; + print ''; print img_picto($langs->trans("Activated"), 'switch_on'); print ''; } diff --git a/htdocs/accountancy/bookkeeping/list.php b/htdocs/accountancy/bookkeeping/list.php index 39906b09bb3..40a8284adc4 100644 --- a/htdocs/accountancy/bookkeeping/list.php +++ b/htdocs/accountancy/bookkeeping/list.php @@ -171,6 +171,16 @@ if (empty($listofformat[$formatexportset])) { $error = 0; +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Actions diff --git a/htdocs/accountancy/bookkeeping/listbyaccount.php b/htdocs/accountancy/bookkeeping/listbyaccount.php index 99b644d1e0a..24bcc4706c1 100644 --- a/htdocs/accountancy/bookkeeping/listbyaccount.php +++ b/htdocs/accountancy/bookkeeping/listbyaccount.php @@ -163,6 +163,16 @@ if ($search_date_end && empty($search_date_endyear)) { $search_date_endday = $tmparray['mday']; } +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Action diff --git a/htdocs/accountancy/bookkeeping/listbysubaccount.php b/htdocs/accountancy/bookkeeping/listbysubaccount.php index 72b6574bea5..129e695de3c 100644 --- a/htdocs/accountancy/bookkeeping/listbysubaccount.php +++ b/htdocs/accountancy/bookkeeping/listbysubaccount.php @@ -163,10 +163,21 @@ if ($search_date_end && empty($search_date_endyear)) { $search_date_endday = $tmparray['mday']; } +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Action */ + if (GETPOST('cancel', 'alpha')) { $action = 'list'; $massaction = ''; } diff --git a/htdocs/accountancy/bookkeeping/thirdparty_lettering_customer.php b/htdocs/accountancy/bookkeeping/thirdparty_lettering_customer.php index fa5302919d5..0064e8c4715 100644 --- a/htdocs/accountancy/bookkeeping/thirdparty_lettering_customer.php +++ b/htdocs/accountancy/bookkeeping/thirdparty_lettering_customer.php @@ -94,6 +94,16 @@ if ($result < 0) { setEventMessages($object->error, $object->errors, 'errors'); } +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Action diff --git a/htdocs/accountancy/bookkeeping/thirdparty_lettering_supplier.php b/htdocs/accountancy/bookkeeping/thirdparty_lettering_supplier.php index e31479f10cd..a73f711e15a 100644 --- a/htdocs/accountancy/bookkeeping/thirdparty_lettering_supplier.php +++ b/htdocs/accountancy/bookkeeping/thirdparty_lettering_supplier.php @@ -94,10 +94,21 @@ if ($result < 0) { setEventMessages($object->error, $object->errors, 'errors'); } +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Action */ + if ($action == 'lettering') { $result = $lettering->updateLettering($toselect); diff --git a/htdocs/accountancy/closure/index.php b/htdocs/accountancy/closure/index.php index 94e59de1812..3ba552cdfa4 100644 --- a/htdocs/accountancy/closure/index.php +++ b/htdocs/accountancy/closure/index.php @@ -35,17 +35,6 @@ $socid = GETPOST('socid', 'int'); $action = GETPOST('action', 'aZ09'); -// Security check -if (empty($conf->accounting->enabled)) { - accessforbidden(); -} -if ($user->socid > 0) { - accessforbidden(); -} -if (!$user->rights->accounting->fiscalyear->write) { - accessforbidden(); -} - $object = new BookKeeping($db); $month_start = ($conf->global->SOCIETE_FISCAL_MONTH_START ? ($conf->global->SOCIETE_FISCAL_MONTH_START) : 1); @@ -67,10 +56,23 @@ $search_date_start = dol_mktime(0, 0, 0, $month_start, 1, $year_start); $search_date_end = dol_get_last_day($year_end, $month_end); $year_current = $year_start; +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (!$user->rights->accounting->fiscalyear->write) { + accessforbidden(); +} + + /* * Actions */ -if ($action == 'validate_movements_confirm' && $user->rights->accounting->fiscalyear->write) { + +if ($action == 'validate_movements_confirm' && !empty($user->rights->accounting->fiscalyear->write)) { $result = $object->fetchAll(); if ($result < 0) { diff --git a/htdocs/accountancy/customer/card.php b/htdocs/accountancy/customer/card.php index 7b8855a1d62..104d4f5d343 100644 --- a/htdocs/accountancy/customer/card.php +++ b/htdocs/accountancy/customer/card.php @@ -38,9 +38,16 @@ $codeventil = GETPOST('codeventil', 'int'); $id = GETPOST('id', 'int'); // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* diff --git a/htdocs/accountancy/customer/lines.php b/htdocs/accountancy/customer/lines.php index 68aae4b76c3..8d2a9c525d9 100644 --- a/htdocs/accountancy/customer/lines.php +++ b/htdocs/accountancy/customer/lines.php @@ -80,13 +80,17 @@ if (!$sortorder) { } // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } -if (!$user->rights->accounting->bind->write) { +if (empty($user->rights->accounting->mouvements->lire)) { accessforbidden(); } + $formaccounting = new FormAccounting($db); @@ -112,7 +116,7 @@ if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter.x' $search_tvaintra = ''; } -if (is_array($changeaccount) && count($changeaccount) > 0) { +if (is_array($changeaccount) && count($changeaccount) > 0 && $user->rights->accounting->bind->write) { $error = 0; if (!(GETPOST('account_parent', 'int') >= 0)) { diff --git a/htdocs/accountancy/customer/list.php b/htdocs/accountancy/customer/list.php index 220794bc71f..5fdbf25f4d9 100644 --- a/htdocs/accountancy/customer/list.php +++ b/htdocs/accountancy/customer/list.php @@ -88,10 +88,13 @@ if (!$sortorder) { } // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } -if (!$user->rights->accounting->bind->write) { +if (empty($user->rights->accounting->mouvements->lire)) { accessforbidden(); } @@ -148,7 +151,7 @@ if (empty($reshook)) { } -if ($massaction == 'ventil') { +if ($massaction == 'ventil' && $user->rights->accounting->bind->write) { $msg = ''; //print '
' . $langs->trans("Processing") . '...
'; diff --git a/htdocs/accountancy/expensereport/card.php b/htdocs/accountancy/expensereport/card.php index f997f666e6e..200a493cfed 100644 --- a/htdocs/accountancy/expensereport/card.php +++ b/htdocs/accountancy/expensereport/card.php @@ -42,9 +42,15 @@ $codeventil = GETPOST('codeventil', 'int'); $id = GETPOST('id', 'int'); // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} /* diff --git a/htdocs/accountancy/expensereport/index.php b/htdocs/accountancy/expensereport/index.php index ffa0bfcc07d..38f7f596932 100644 --- a/htdocs/accountancy/expensereport/index.php +++ b/htdocs/accountancy/expensereport/index.php @@ -32,17 +32,6 @@ require_once DOL_DOCUMENT_ROOT.'/expensereport/class/expensereport.class.php'; // Load translation files required by the page $langs->loadLangs(array("compta", "bills", "other", "main", "accountancy")); -// Security check -if (empty($conf->accounting->enabled)) { - accessforbidden(); -} -if ($user->socid > 0) { - accessforbidden(); -} -if (!$user->rights->accounting->bind->write) { - accessforbidden(); -} - $month_start = ($conf->global->SOCIETE_FISCAL_MONTH_START ? ($conf->global->SOCIETE_FISCAL_MONTH_START) : 1); if (GETPOST("year", 'int')) { $year_start = GETPOST("year", 'int'); @@ -65,13 +54,23 @@ $year_current = $year_start; // Validate History $action = GETPOST('action', 'aZ09'); +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} /* * Actions */ -if ($action == 'clean' || $action == 'validatehistory') { +if (($action == 'clean' || $action == 'validatehistory') && $user->rights->accounting->bind->write) { // Clean database $db->begin(); $sql1 = "UPDATE ".MAIN_DB_PREFIX."expensereport_det as erd"; diff --git a/htdocs/accountancy/expensereport/lines.php b/htdocs/accountancy/expensereport/lines.php index 3c4760b3730..d29e39d7f37 100644 --- a/htdocs/accountancy/expensereport/lines.php +++ b/htdocs/accountancy/expensereport/lines.php @@ -74,13 +74,17 @@ if (!$sortorder) { } // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } -if (!$user->rights->accounting->bind->write) { +if (empty($user->rights->accounting->mouvements->lire)) { accessforbidden(); } + $formaccounting = new FormAccounting($db); @@ -102,7 +106,7 @@ if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter.x' $search_year = ''; } -if (is_array($changeaccount) && count($changeaccount) > 0) { +if (is_array($changeaccount) && count($changeaccount) > 0 && $user->rights->accounting->bind->write) { $error = 0; if (!(GETPOST('account_parent', 'int') >= 0)) { diff --git a/htdocs/accountancy/expensereport/list.php b/htdocs/accountancy/expensereport/list.php index 05476756531..84cd64bb44f 100644 --- a/htdocs/accountancy/expensereport/list.php +++ b/htdocs/accountancy/expensereport/list.php @@ -83,19 +83,22 @@ if (!$sortorder) { } } -// Security check -if ($user->socid > 0) { - accessforbidden(); -} -if (!$user->rights->accounting->bind->write) { - accessforbidden(); -} - $formaccounting = new FormAccounting($db); $accounting = new AccountingAccount($db); $chartaccountcode = dol_getIdFromCode($db, $conf->global->CHARTOFACCOUNTS, 'accounting_system', 'rowid', 'pcg_version'); +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Action @@ -130,7 +133,7 @@ $permissiontodelete = $user->rights->expensereport->delete; $uploaddir = $conf->expensereport->dir_output; include DOL_DOCUMENT_ROOT.'/core/actions_massactions.inc.php'; -if ($massaction == 'ventil') { +if ($massaction == 'ventil' && $user->rights->accounting->bind->write) { $msg = ''; //print '
' . $langs->trans("Processing") . '...
'; if (!empty($mesCasesCochees)) { diff --git a/htdocs/accountancy/index.php b/htdocs/accountancy/index.php index 242fc71d80c..94dc6aa05c9 100644 --- a/htdocs/accountancy/index.php +++ b/htdocs/accountancy/index.php @@ -31,13 +31,20 @@ require_once DOL_DOCUMENT_ROOT.'/core/class/html.formother.class.php'; // Load translation files required by the page $langs->loadLangs(array("compta", "bills", "other", "accountancy", "loans", "banks", "admin", "dict")); +// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array of hooks +$hookmanager->initHooks(array('accountancyindex')); + // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} -// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array of hooks -$hookmanager->initHooks(array('accountancyindex')); /* diff --git a/htdocs/accountancy/journal/bankjournal.php b/htdocs/accountancy/journal/bankjournal.php index b79b8433c03..9093721bff6 100644 --- a/htdocs/accountancy/journal/bankjournal.php +++ b/htdocs/accountancy/journal/bankjournal.php @@ -7,7 +7,7 @@ * Copyright (C) 2013-2019 Alexandre Spangaro * Copyright (C) 2013-2014 Florian Henry * Copyright (C) 2013-2014 Olivier Geffroy - * Copyright (C) 2017-2020 Frédéric France + * Copyright (C) 2017-2021 Frédéric France * Copyright (C) 2018 Ferran Marcet * Copyright (C) 2018 Eric Seigne * Copyright (C) 2021 Gauthier VERDOL @@ -83,7 +83,13 @@ $now = dol_now(); $action = GETPOST('action', 'aZ09'); // Security check -if ($user->socid > 0 && empty($id_journal)) { +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { accessforbidden(); } @@ -954,13 +960,18 @@ if (empty($action) || $action == 'view') { $nom = $langs->trans("FinanceJournal").' | '.$accountingjournalstatic->getNomUrl(0, 1, 1, '', 1); $builddate = dol_now(); //$description = $langs->trans("DescFinanceJournal") . '
'; - $description .= $langs->trans("DescJournalOnlyBindedVisible").'
'; + $description = $langs->trans("DescJournalOnlyBindedVisible").'
'; - $listofchoices = array('notyet'=>$langs->trans("NotYetInGeneralLedger"), 'already'=>$langs->trans("AlreadyInGeneralLedger")); + $listofchoices = array( + 'notyet'=>$langs->trans("NotYetInGeneralLedger"), + 'already'=>$langs->trans("AlreadyInGeneralLedger") + ); $period = $form->selectDate($date_start ? $date_start : -1, 'date_start', 0, 0, 0, '', 1, 0).' - '.$form->selectDate($date_end ? $date_end : -1, 'date_end', 0, 0, 0, '', 1, 0); $period .= ' - '.$langs->trans("JournalizationInLedgerStatus").' '.$form->selectarray('in_bookkeeping', $listofchoices, $in_bookkeeping, 1); $varlink = 'id_journal='.$id_journal; + $periodlink = ''; + $exportlink = ''; journalHead($nom, '', $period, $periodlink, $description, $builddate, $exportlink, array('action' => ''), '', $varlink); diff --git a/htdocs/accountancy/journal/expensereportsjournal.php b/htdocs/accountancy/journal/expensereportsjournal.php index 9010261dbe0..2f7569ab152 100644 --- a/htdocs/accountancy/journal/expensereportsjournal.php +++ b/htdocs/accountancy/journal/expensereportsjournal.php @@ -58,13 +58,21 @@ if ($in_bookkeeping == '') { $now = dol_now(); // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Actions */ + $accountingaccount = new AccountingAccount($db); // Get informations of journal diff --git a/htdocs/accountancy/journal/purchasesjournal.php b/htdocs/accountancy/journal/purchasesjournal.php index 46363fb3a09..f6fa5c4b76a 100644 --- a/htdocs/accountancy/journal/purchasesjournal.php +++ b/htdocs/accountancy/journal/purchasesjournal.php @@ -57,17 +57,25 @@ if ($in_bookkeeping == '') { $now = dol_now(); +$hookmanager->initHooks(array('purchasesjournal')); +$parameters = array(); + // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} -$hookmanager->initHooks(array('purchasesjournal')); -$parameters = array(); /* * Actions */ + $reshook = $hookmanager->executeHooks('doActions', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks $accountingaccount = new AccountingAccount($db); diff --git a/htdocs/accountancy/journal/sellsjournal.php b/htdocs/accountancy/journal/sellsjournal.php index 06c1a4b07ed..ff81fc7e951 100644 --- a/htdocs/accountancy/journal/sellsjournal.php +++ b/htdocs/accountancy/journal/sellsjournal.php @@ -8,7 +8,7 @@ * Copyright (C) 2013-2016 Florian Henry * Copyright (C) 2013-2016 Olivier Geffroy * Copyright (C) 2014 Raphaël Doursenaud - * Copyright (C) 2018 Frédéric France + * Copyright (C) 2018-2021 Frédéric France * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -59,13 +59,20 @@ if ($in_bookkeeping == '') { $now = dol_now(); +$hookmanager->initHooks(array('sellsjournal')); +$parameters = array(); + // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} -$hookmanager->initHooks(array('sellsjournal')); -$parameters = array(); /* * Actions @@ -663,7 +670,7 @@ if (empty($action) || $action == 'view') { $periodlink = ''; $exportlink = ''; $builddate = dol_now(); - $description .= $langs->trans("DescJournalOnlyBindedVisible").'
'; + $description = $langs->trans("DescJournalOnlyBindedVisible").'
'; if (!empty($conf->global->FACTURE_DEPOSITS_ARE_JUST_PAYMENTS)) { $description .= $langs->trans("DepositsAreNotIncluded"); } else { diff --git a/htdocs/accountancy/supplier/card.php b/htdocs/accountancy/supplier/card.php index 0d86b928a26..eee2059c660 100644 --- a/htdocs/accountancy/supplier/card.php +++ b/htdocs/accountancy/supplier/card.php @@ -42,9 +42,15 @@ $codeventil = GETPOST('codeventil', 'int'); $id = GETPOST('id', 'int'); // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} /* diff --git a/htdocs/accountancy/supplier/index.php b/htdocs/accountancy/supplier/index.php index 937173fc1e6..7ef09acf91a 100644 --- a/htdocs/accountancy/supplier/index.php +++ b/htdocs/accountancy/supplier/index.php @@ -69,12 +69,23 @@ $action = GETPOST('action', 'aZ09'); $chartaccountcode = dol_getIdFromCode($db, $conf->global->CHARTOFACCOUNTS, 'accounting_system', 'rowid', 'pcg_version'); +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Actions */ -if ($action == 'clean' || $action == 'validatehistory') { +if (($action == 'clean' || $action == 'validatehistory') && $user->rights->accounting->bind->write) { // Clean database $db->begin(); $sql1 = "UPDATE ".MAIN_DB_PREFIX."facture_fourn_det as fd"; diff --git a/htdocs/accountancy/supplier/lines.php b/htdocs/accountancy/supplier/lines.php index 6bdc714ec4c..f661ba42ce9 100644 --- a/htdocs/accountancy/supplier/lines.php +++ b/htdocs/accountancy/supplier/lines.php @@ -80,16 +80,19 @@ if (!$sortorder) { } } +$formaccounting = new FormAccounting($db); + // Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} if ($user->socid > 0) { accessforbidden(); } -if (!$user->rights->accounting->bind->write) { +if (empty($user->rights->accounting->mouvements->lire)) { accessforbidden(); } -$formaccounting = new FormAccounting($db); - /* * Actions diff --git a/htdocs/accountancy/supplier/list.php b/htdocs/accountancy/supplier/list.php index 18b8d9c449f..d2cf2bfd645 100644 --- a/htdocs/accountancy/supplier/list.php +++ b/htdocs/accountancy/supplier/list.php @@ -88,14 +88,6 @@ if (!$sortorder) { } } -// Security check -if ($user->socid > 0) { - accessforbidden(); -} -if (!$user->rights->accounting->bind->write) { - accessforbidden(); -} - // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('accountancysupplierlist')); @@ -107,6 +99,17 @@ $aarowid_p = $accounting->fetch('', $conf->global->ACCOUNTING_PRODUCT_BUY_ACCOUN $chartaccountcode = dol_getIdFromCode($db, $conf->global->CHARTOFACCOUNTS, 'accounting_system', 'rowid', 'pcg_version'); +// Security check +if (empty($conf->accounting->enabled)) { + accessforbidden(); +} +if ($user->socid > 0) { + accessforbidden(); +} +if (empty($user->rights->accounting->mouvements->lire)) { + accessforbidden(); +} + /* * Actions diff --git a/htdocs/adherents/admin/adherent.php b/htdocs/adherents/admin/adherent.php index 092d9b0de38..3d40f8d758b 100644 --- a/htdocs/adherents/admin/adherent.php +++ b/htdocs/adherents/admin/adherent.php @@ -8,7 +8,7 @@ * Copyright (C) 2011-2012 Juanjo Menent * Copyright (C) 2012 J. Fernando Lagrange * Copyright (C) 2015 Jean-François Ferry - * Copyright (C) 2020 Frédéric France + * Copyright (C) 2020-2021 Frédéric France * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -254,7 +254,8 @@ if ($conf->facture->enabled) { if (!empty($conf->product->enabled) || !empty($conf->service->enabled)) { print ''.$langs->trans("ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS").''; print ''; - $form->select_produits($conf->global->ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS, 'ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS', '', 0); + $selected = (empty($conf->global->ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS) ? '' : $conf->global->ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS); + $form->select_produits($selected, 'ADHERENT_PRODUCT_ID_FOR_SUBSCRIPTIONS', '', 0); print ''; } print "\n"; diff --git a/htdocs/adherents/card.php b/htdocs/adherents/card.php index 1286e19b416..b34e39872ac 100644 --- a/htdocs/adherents/card.php +++ b/htdocs/adherents/card.php @@ -1691,6 +1691,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) { */ print '
'; + $isinspip = 0; $parameters = array(); $reshook = $hookmanager->executeHooks('addMoreActionsButtons', $parameters, $object, $action); // Note that $action and $object may have been if (empty($reshook)) { @@ -1827,7 +1828,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) { $genallowed = $user->rights->adherent->lire; $delallowed = $user->rights->adherent->creer; - print $formfile->showdocuments('member', $filename, $filedir, $urlsource, $genallowed, $delallowed, $object->model_pdf, 1, 0, 0, 28, 0, '', '', '', $object->default_lang, '', $object); + print $formfile->showdocuments('member', $filename, $filedir, $urlsource, $genallowed, $delallowed, $object->model_pdf, 1, 0, 0, 28, 0, '', '', '', (empty($object->default_lang) ? '' : $object->default_lang), '', $object); $somethingshown = $formfile->numoffiles; // Show links to link elements diff --git a/htdocs/adherents/cartes/carte.php b/htdocs/adherents/cartes/carte.php index 9d403d88320..be9c654941a 100644 --- a/htdocs/adherents/cartes/carte.php +++ b/htdocs/adherents/cartes/carte.php @@ -50,6 +50,9 @@ $extrafields = new ExtraFields($db); // Fetch optionals attributes and labels $extrafields->fetch_name_optionals_label($object->table_element); +// Security check +$result = restrictedArea($user, 'adherent'); + /* * Actions diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php index c37e9e325cf..cebd634fa56 100644 --- a/htdocs/adherents/list.php +++ b/htdocs/adherents/list.php @@ -41,9 +41,6 @@ $confirm = GETPOST('confirm', 'alpha'); $toselect = GETPOST('toselect', 'array'); $contextpage = GETPOST('contextpage', 'aZ') ?GETPOST('contextpage', 'aZ') : 'memberslist'; // To manage different context of search -// Security check -$result = restrictedArea($user, 'adherent'); - $search = GETPOST("search", 'alpha'); $search_ref = GETPOST("search_ref", 'alpha'); $search_lastname = GETPOST("search_lastname", 'alpha'); @@ -162,6 +159,9 @@ $arrayfields = array( // Extra fields include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_array_fields.tpl.php'; +// Security check +$result = restrictedArea($user, 'adherent'); + /* * Actions diff --git a/htdocs/adherents/type.php b/htdocs/adherents/type.php index d2b46e96610..a867a884775 100644 --- a/htdocs/adherents/type.php +++ b/htdocs/adherents/type.php @@ -213,7 +213,8 @@ if ($action == 'confirm_delete' && $user->rights->adherent->configurer) { $form = new Form($db); $formproduct = new FormProduct($db); -$help_url = 'EN:Module_Foundations|FR:Module_Adhérents|ES:Módulo_Miembros'; +$help_url = 'EN:Module_Foundations|FR:Module_Adhérents|ES:Módulo_Miembros|DE:Modul_Mitglieder'; + llxHeader('', $langs->trans("MembersTypeSetup"), $help_url); // List of members type diff --git a/htdocs/admin/confexped.php b/htdocs/admin/confexped.php index fbf347a45a9..b218a245c99 100644 --- a/htdocs/admin/confexped.php +++ b/htdocs/admin/confexped.php @@ -110,11 +110,11 @@ print ''; print $langs->trans("Required"); /*if (empty($conf->global->MAIN_SUBMODULE_EXPEDITION)) { - print ''.img_picto($langs->trans("Disabled"),'switch_off').''; + print ''.img_picto($langs->trans("Disabled"),'switch_off').''; } else { - print ''.img_picto($langs->trans("Enabled"),'switch_on').''; + print ''.img_picto($langs->trans("Enabled"),'switch_on').''; }*/ print ""; print ''; @@ -130,9 +130,9 @@ print ''; print ''; if (empty($conf->global->MAIN_SUBMODULE_DELIVERY)) { - print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; + print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; } else { - print ''.img_picto($langs->trans("Enabled"), 'switch_on').''; + print ''.img_picto($langs->trans("Enabled"), 'switch_on').''; } print ""; diff --git a/htdocs/admin/fckeditor.php b/htdocs/admin/fckeditor.php index 0671783615c..65029a9246a 100644 --- a/htdocs/admin/fckeditor.php +++ b/htdocs/admin/fckeditor.php @@ -89,7 +89,7 @@ $picto = array( */ foreach ($modules as $const => $desc) { - if ($action == 'activate_'.strtolower($const)) { + if ($action == 'enable_'.strtolower($const)) { dolibarr_set_const($db, "FCKEDITOR_ENABLE_".$const, "1", 'chaine', 0, '', $conf->entity); // If fckeditor is active in the product/service description, it is activated in the forms if ($const == 'PRODUCTDESC' && !empty($conf->global->PRODUIT_DESC_IN_FORM)) { @@ -166,9 +166,9 @@ if (empty($conf->use_javascript_ajax)) { $constante = 'FCKEDITOR_ENABLE_'.$const; $value = (isset($conf->global->$constante) ? $conf->global->$constante : 0); if ($value == 0) { - print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; + print ''.img_picto($langs->trans("Disabled"), 'switch_off').''; } elseif ($value == 1) { - print ''.img_picto($langs->trans("Enabled"), 'switch_on').''; + print ''.img_picto($langs->trans("Enabled"), 'switch_on').''; } print ""; diff --git a/htdocs/admin/mails_senderprofile_list.php b/htdocs/admin/mails_senderprofile_list.php index 9f766d76266..8f781318995 100644 --- a/htdocs/admin/mails_senderprofile_list.php +++ b/htdocs/admin/mails_senderprofile_list.php @@ -76,14 +76,6 @@ if (!$sortorder) { $sortorder = "ASC"; } -// Security check -$socid = 0; -if ($user->socid > 0) { // Protection if external user - //$socid = $user->socid; - accessforbidden(); -} -//$result = restrictedArea($user, 'mymodule', $id, ''); - // Initialize array of search criterias $search_all = GETPOST("search_all", 'alpha'); $search = array(); @@ -133,6 +125,19 @@ if ($id > 0) { $object->fetch($id); } +// Security check +$socid = 0; +if ($user->socid > 0) { // Protection if external user + //$socid = $user->socid; + accessforbidden(); +} +// A non admin user can see profiles but limited to its own user +if (!$user->admin) { + if ($object->id > 0 && $object->private != $user->id) { + accessforbidden(); + } +} + /* * Actions @@ -261,6 +266,10 @@ foreach ($search as $key => $val) { if ($search_all) { $sql .= natural_search(array_keys($fieldstosearchall), $search_all); } +// If non admin, restrict list to itself +if (empty($user->admin)) { + $sql .= " AND private = ".((int) $user->id); +} //$sql.= dolSqlDateFilter("t.field", $search_xxxday, $search_xxxmonth, $search_xxxyear); // Add where from extra fields include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php'; @@ -315,32 +324,10 @@ if (is_numeric($nbtotalofrecords) && ($limit > $nbtotalofrecords || empty($limit $num = $db->num_rows($resql); } -// Direct jump if only one record found -if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $search_all && !$page) { - $obj = $db->fetch_object($resql); - $id = $obj->rowid; - header("Location: ".DOL_URL_ROOT.'/monmodule/emailsenderprofile_card.php?id='.$id); - exit; -} // Output page // -------------------------------------------------------------------- -// Example : Adding jquery code -print ''; - $arrayofselected = is_array($toselect) ? $toselect : array(); $param = ''; diff --git a/htdocs/admin/mails_ticket.php b/htdocs/admin/mails_ticket.php index 1d3faf71f1b..14960db11d7 100644 --- a/htdocs/admin/mails_ticket.php +++ b/htdocs/admin/mails_ticket.php @@ -32,10 +32,6 @@ $langs->loadLangs(array('companies', 'products', 'admin', 'mails', 'other', 'err $action = GETPOST('action', 'aZ09'); -if (!$user->admin) { - accessforbidden(); -} - $usersignature = $user->signature; // For action = test or send, we ensure that content is not html, even for signature, because this we want a test with NO html. if ($action == 'test' || $action == 'send') { @@ -53,6 +49,10 @@ $substitutionarrayfortest = array( ); complete_substitutions_array($substitutionarrayfortest, $langs); +// Security check +if (!$user->admin) { + accessforbidden(); +} /* diff --git a/htdocs/admin/security.php b/htdocs/admin/security.php index 011b28e7421..98b6c996181 100644 --- a/htdocs/admin/security.php +++ b/htdocs/admin/security.php @@ -406,7 +406,7 @@ if (!empty($conf->global->DATABASE_PWD_ENCRYPTED)) { if ($allow_disable_encryption) { //On n'autorise pas l'annulation de l'encryption car les mots de passe ne peuvent pas etre decodes //Do not allow "disable encryption" as passwords cannot be decrypted - print ''.$langs->trans("Disable").''; + print ''.$langs->trans("Disable").''; } else { print '-'; } @@ -432,10 +432,10 @@ if (empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) { print img_warning($langs->trans("WarningPassIsEmpty")); } else { if (empty($dolibarr_main_db_encrypted_pass)) { - print ''.$langs->trans("Activate").''; + print ''.$langs->trans("Activate").''; } if (!empty($dolibarr_main_db_encrypted_pass)) { - print ''.$langs->trans("Disable").''; + print ''.$langs->trans("Disable").''; } } print ""; @@ -455,12 +455,12 @@ if (!empty($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)) { print ''; if (empty($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)) { print ''; - print ''.$langs->trans("Activate").''; + print ''.$langs->trans("Activate").''; print ""; } if (!empty($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK)) { print ''; - print ''.$langs->trans("Disable").''; + print ''.$langs->trans("Disable").''; print ""; } print ""; diff --git a/htdocs/admin/system/dolibarr.php b/htdocs/admin/system/dolibarr.php index 92b60cce4e2..cfdc196d79d 100644 --- a/htdocs/admin/system/dolibarr.php +++ b/htdocs/admin/system/dolibarr.php @@ -442,7 +442,7 @@ foreach ($configfileparameters as $key => $value) { print img_warning($langs->trans('SwitchThisForABetterSecurity', 0)); } } else { - print ${$newkey}; + print (empty(${$newkey}) ? '' : ${$newkey}); } if ($newkey == 'dolibarr_main_url_root' && ${$newkey} != DOL_MAIN_URL_ROOT) { print ' (currently overwritten by autodetected value: '.DOL_MAIN_URL_ROOT.')'; diff --git a/htdocs/barcode/printsheet.php b/htdocs/barcode/printsheet.php index a8033cf1c7a..ff57587d1b4 100644 --- a/htdocs/barcode/printsheet.php +++ b/htdocs/barcode/printsheet.php @@ -286,7 +286,7 @@ print '
'; // Sheet format print '
'; -print '
'; +print '
'; print $langs->trans("DescADHERENT_ETIQUETTE_TYPE").'   '; print '
'; // List of possible labels (defined into $_Avery_Labels variable set into core/lib/format_cards.lib.php) @@ -302,7 +302,7 @@ print '
'; // Number of stickers to print print '
'; -print '
'; +print '
'; print $langs->trans("NumberOfStickers").'   '; print '
'; print ''; diff --git a/htdocs/bom/bom_agenda.php b/htdocs/bom/bom_agenda.php index 2cf66d9c3f5..6a86f1c2258 100644 --- a/htdocs/bom/bom_agenda.php +++ b/htdocs/bom/bom_agenda.php @@ -51,11 +51,6 @@ if (GETPOST('actioncode', 'array')) { } $search_agenda_label = GETPOST('search_agenda_label'); -// Security check - Protection if external user -//if ($user->socid > 0) accessforbidden(); -//if ($user->socid > 0) $socid = $user->socid; -//$result = restrictedArea($user, 'bom', $id); - $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; $sortfield = GETPOST("sortfield", 'alpha'); $sortorder = GETPOST("sortorder", 'alpha'); @@ -87,6 +82,11 @@ if ($id > 0 || !empty($ref)) { $upload_dir = $conf->bom->multidir_output[$object->entity]."/".$object->id; } +// Security check - Protection if external user +//if ($user->socid > 0) accessforbidden(); +//if ($user->socid > 0) $socid = $user->socid; +$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); +restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); /* diff --git a/htdocs/bom/bom_card.php b/htdocs/bom/bom_card.php index 5547c21faab..fa2ef014d17 100644 --- a/htdocs/bom/bom_card.php +++ b/htdocs/bom/bom_card.php @@ -75,8 +75,8 @@ include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be includ // Security check - Protection if external user //if ($user->socid > 0) accessforbidden(); //if ($user->socid > 0) $socid = $user->socid; -//$isdraft = (($object->statut == $object::STATUS_DRAFT) ? 1 : 0); -//$result = restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); +$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); +$result = restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); $permissionnote = $user->rights->bom->write; // Used by the include of actions_setnotes.inc.php $permissiondellink = $user->rights->bom->write; // Used by the include of actions_dellink.inc.php @@ -656,11 +656,11 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea { if ($object->status == 1) { - print ''.$langs->trans("Disable").''."\n"; + print ''.$langs->trans("Disable").''."\n"; } else { - print ''.$langs->trans("Enable").''."\n"; + print ''.$langs->trans("Enable").''."\n"; } } */ diff --git a/htdocs/bom/bom_document.php b/htdocs/bom/bom_document.php index 92babe87003..520dd8bb9d7 100644 --- a/htdocs/bom/bom_document.php +++ b/htdocs/bom/bom_document.php @@ -79,6 +79,12 @@ if ($id > 0 || !empty($ref)) { $upload_dir = $conf->bom->multidir_output[$object->entity ? $object->entity : 1]."/bom/".get_exdir(0, 0, 0, 1, $object); } +// Security check - Protection if external user +//if ($user->socid > 0) accessforbidden(); +//if ($user->socid > 0) $socid = $user->socid; +$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); +restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); + /* * Actions diff --git a/htdocs/bom/bom_list.php b/htdocs/bom/bom_list.php index eb1852699c0..62fb6002760 100644 --- a/htdocs/bom/bom_list.php +++ b/htdocs/bom/bom_list.php @@ -76,18 +76,6 @@ if (!$sortorder) { $sortorder = "ASC"; } -// Security check -if (empty($conf->bom->enabled)) { - accessforbidden('Module not enabled'); -} -$socid = 0; -if ($user->socid > 0) { - // Protection if external user - //$socid = $user->socid; - accessforbidden(); -} -//$result = restrictedArea($user, 'bom', $id, ''); - // Initialize array of search criterias $search_all = GETPOST("search_all", 'alpha'); $search = array(); @@ -133,6 +121,13 @@ $permissiontoread = $user->rights->bom->read; $permissiontoadd = $user->rights->bom->write; $permissiontodelete = $user->rights->bom->delete; +// Security check +if ($user->socid > 0) { + // Protection if external user + accessforbidden(); +} +$result = restrictedArea($user, 'bom'); + /* * Actions diff --git a/htdocs/bom/bom_note.php b/htdocs/bom/bom_note.php index cd288a3be3c..244bcfd7a49 100644 --- a/htdocs/bom/bom_note.php +++ b/htdocs/bom/bom_note.php @@ -57,9 +57,13 @@ if ($id > 0 || !empty($ref)) { $upload_dir = $conf->bom->multidir_output[$object->entity]."/".$object->id; } -$permissionnote = 1; -//$permissionnote=$user->rights->bom->creer; // Used by the include of actions_setnotes.inc.php +$permissionnote = $user->rights->bom->write; // Used by the include of actions_setnotes.inc.php +// Security check - Protection if external user +//if ($user->socid > 0) accessforbidden(); +//if ($user->socid > 0) $socid = $user->socid; +$isdraft = (($object->status == $object::STATUS_DRAFT) ? 1 : 0); +restrictedArea($user, 'bom', $object->id, '', '', 'fk_soc', 'rowid', $isdraft); /* diff --git a/htdocs/comm/propal/stats/index.php b/htdocs/comm/propal/stats/index.php index e18891f3c60..3cb6de90a8d 100644 --- a/htdocs/comm/propal/stats/index.php +++ b/htdocs/comm/propal/stats/index.php @@ -81,7 +81,7 @@ $langs->loadLangs(array('propal', 'other', 'companies')); if ($mode == 'customer') { $picto = 'propal'; $title = $langs->trans("ProposalsStatistics"); - $dir = $conf->propale->dir_temp; + $dir = $conf->propal->dir_temp; $cat_type = Categorie::TYPE_CUSTOMER; $cat_label = $langs->trans("Category").' '.lcfirst($langs->trans("Customer")); } diff --git a/htdocs/compta/accounting-files.php b/htdocs/compta/accounting-files.php index 596abdf0e97..fed0e025f4c 100644 --- a/htdocs/compta/accounting-files.php +++ b/htdocs/compta/accounting-files.php @@ -34,6 +34,7 @@ if ((array_key_exists('action', $_GET) && $_GET['action'] == 'dl') || (array_key require '../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php'; require_once DOL_DOCUMENT_ROOT.'/compta/facture/class/facture.class.php'; require_once DOL_DOCUMENT_ROOT.'/compta/paiement/class/paiement.class.php'; require_once DOL_DOCUMENT_ROOT.'/salaries/class/paymentsalary.class.php'; @@ -56,13 +57,12 @@ $date_start = GETPOST('date_start', 'alpha'); $date_startDay = GETPOST('date_startday', 'int'); $date_startMonth = GETPOST('date_startmonth', 'int'); $date_startYear = GETPOST('date_startyear', 'int'); -$date_start = ($date_startDay) ?dol_mktime(0, 0, 0, $date_startMonth, $date_startDay, $date_startYear) : strtotime($date_start); +$date_start = ($date_startDay ? dol_mktime(0, 0, 0, $date_startMonth, $date_startDay, $date_startYear, 'tzuserrel') : dol_stringtotime($date_start)); $date_stop = GETPOST('date_stop', 'alpha'); $date_stopDay = GETPOST('date_stopday', 'int'); $date_stopMonth = GETPOST('date_stopmonth', 'int'); $date_stopYear = GETPOST('date_stopyear', 'int'); -//FIXME doldate -$date_stop = ($date_stopDay) ?dol_mktime(23, 59, 59, $date_stopMonth, $date_stopDay, $date_stopYear) : strtotime($date_stop); +$date_stop = ($date_stopDay ? dol_mktime(23, 59, 59, $date_stopMonth, $date_stopDay, $date_stopYear, 'tzuserrel') : dol_stringtotime($date_stop)); $action = GETPOST('action', 'aZ09'); // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context @@ -126,6 +126,17 @@ if (empty($entity)) { $error = 0; +$listofchoices = array( + 'selectinvoices'=>array('label'=>'Invoices', 'lang'=>'bills', 'enabled' => !empty($conf->facture->enabled), 'perms' => !empty($user->rights->facture->lire)), + 'selectsupplierinvoices'=>array('label'=>'BillsSuppliers', 'lang'=>'bills', 'enabled' => !empty($conf->supplier_invoice->enabled), 'perms' => !empty($user->rights->fournisseur->facture->lire)), + 'selectexpensereports'=>array('label'=>'ExpenseReports', 'lang'=>'trips', 'enabled' => !empty($conf->expensereport->enabled), 'perms' => !empty($user->rights->expensereport->lire)), + 'selectdonations'=>array('label'=>'Donations', 'lang'=>'donation', 'enabled' => !empty($conf->don->enabled), 'perms' => !empty($user->rights->don->lire)), + 'selectsocialcontributions'=>array('label'=>'SocialContributions', 'enabled' => !empty($conf->tax->enabled), 'perms' => !empty($user->rights->tax->charges->lire)), + 'selectpaymentsofsalaries'=>array('label'=>'SalariesPayments', 'lang'=>'salaries', 'enabled' => !empty($conf->salaries->enabled), 'perms' => !empty($user->rights->salaries->read)), + 'selectvariouspayment'=>array('label'=>'VariousPayment', 'enabled' => !empty($conf->banque->enabled), 'perms' => !empty($user->rights->banque->lire)), + 'selectloanspayment'=>array('label'=>'PaymentLoan', 'enabled' => !empty($conf->loan->enabled), 'perms' => !empty($user->rights->loan->read)), +); + /* @@ -155,7 +166,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $wheretail = " '".$db->idate($date_start)."' AND '".$db->idate($date_stop)."'"; // Customer invoices - if (GETPOST('selectinvoices')) { + if (GETPOST('selectinvoices') && !empty($listofchoices['selectinvoices']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -166,7 +177,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $sql .= " AND t.fk_statut <> ".Facture::STATUS_DRAFT; } // Vendor invoices - if (GETPOST('selectsupplierinvoices')) { + if (GETPOST('selectsupplierinvoices') && !empty($listofchoices['selectsupplierinvoices']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -177,7 +188,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $sql .= " AND t.fk_statut <> ".FactureFournisseur::STATUS_DRAFT; } // Expense reports - if (GETPOST('selectexpensereports')) { + if (GETPOST('selectexpensereports') && !empty($listofchoices['selectexpensereports']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -188,7 +199,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $sql .= " AND t.fk_statut <> ".ExpenseReport::STATUS_DRAFT; } // Donations - if (GETPOST('selectdonations')) { + if (GETPOST('selectdonations') && !empty($listofchoices['selectdonations']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -199,7 +210,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $sql .= " AND t.fk_statut <> ".Don::STATUS_DRAFT; } // Payments of salaries - if (GETPOST('selectpaymentsofsalaries')) { + if (GETPOST('selectpaymentsofsalaries') && !empty($listofchoices['selectpaymentsofsalaries']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -210,7 +221,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { //$sql.=" AND fk_statut <> ".PaymentSalary::STATUS_DRAFT; } // Social contributions - if (GETPOST('selectsocialcontributions')) { + if (GETPOST('selectsocialcontributions') && !empty($listofchoices['selectsocialcontributions']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -221,7 +232,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { //$sql.=" AND fk_statut <> ".ChargeSociales::STATUS_DRAFT; } // Various payments - if (GETPOST('selectvariouspayment')) { + if (GETPOST('selectvariouspayment') && !empty($listofchoices['selectvariouspayment']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -231,7 +242,7 @@ if (($action == 'searchfiles' || $action == 'dl')) { $sql .= " AND t.entity IN (".($entity == 1 ? '0,1' : $entity).')'; } // Loan payments - if (GETPOST('selectloanspayment')) { + if (GETPOST('selectloanspayment') && !empty($listofchoices['selectloanspayment']['perms'])) { if (!empty($sql)) { $sql .= " UNION ALL"; } @@ -539,8 +550,11 @@ print ''; print ''.$langs->trans("ExportAccountingSourceDocHelp", $langs->transnoentitiesnoconv("Accounting"), $langs->transnoentitiesnoconv("Journals")).'
'; print '
'; -print $langs->trans("ReportPeriod").': '.$form->selectDate($date_start, 'date_start', 0, 0, 0, "", 1, 1, 0); -print ' - '.$form->selectDate($date_stop, 'date_stop', 0, 0, 0, "", 1, 1, 0)."\n"; +print $langs->trans("ReportPeriod").': '; +print $form->selectDate($date_start, 'date_start', 0, 0, 0, "", 1, 1, 0, '', '', '', '', 1, '', '', 'tzuserrel'); +print ' - '; +print $form->selectDate($date_stop, 'date_stop', 0, 0, 0, "", 1, 1, 0, '', '', '', '', 1, '', '', 'tzuserrel'); +print "\n"; // Export is for current company only if (!empty($conf->multicompany->enabled) && is_object($mc)) { @@ -558,22 +572,16 @@ if (!empty($conf->multicompany->enabled) && is_object($mc)) { print '
'; -$listofchoices = array( - 'selectinvoices'=>array('label'=>'Invoices', 'lang'=>'bills', 'enabled' => !empty($conf->facture->enabled)), - 'selectsupplierinvoices'=>array('label'=>'BillsSuppliers', 'lang'=>'bills', 'enabled' => !empty($conf->supplier_invoice->enabled)), - 'selectexpensereports'=>array('label'=>'ExpenseReports', 'lang'=>'trips', 'enabled' => !empty($conf->expensereport->enabled)), - 'selectdonations'=>array('label'=>'Donations', 'lang'=>'donation', 'enabled' => !empty($conf->don->enabled)), - 'selectsocialcontributions'=>array('label'=>'SocialContributions', 'enabled' => !empty($conf->tax->enabled)), - 'selectpaymentsofsalaries'=>array('label'=>'SalariesPayments', 'lang'=>'salaries', 'enabled' => !empty($conf->salaries->enabled)), - 'selectvariouspayment'=>array('label'=>'VariousPayment', 'enabled' => !empty($conf->banque->enabled)), - 'selectloanspayment'=>array('label'=>'PaymentLoan', 'enabled' => !empty($conf->loan->enabled)), -); foreach ($listofchoices as $choice => $val) { if (empty($val['enabled'])) { continue; // list not qualified } + $disabled = ''; + if (empty($val['perms'])) { + $disabled = ' disabled'; + } $checked = (((!GETPOSTISSET('search') && $action != 'searchfiles') || GETPOST($choice)) ? ' checked="checked"' : ''); - print '
'; + print '
'; } print ''; diff --git a/htdocs/compta/bank/bankentries_list.php b/htdocs/compta/bank/bankentries_list.php index b621ad9752f..37ef8a5da76 100644 --- a/htdocs/compta/bank/bankentries_list.php +++ b/htdocs/compta/bank/bankentries_list.php @@ -898,18 +898,21 @@ if ($resql) { print '
'; } - /// ajax to adjust value date with plus and less picto + // Code to adjust value date with plus and less picto using an Ajax call instead of a full reload of page + $urlajax = DOL_URL_ROOT.'/core/ajax/bankconciliate.php?token='.currentToken(); print ' + '; + */ print '
'; print dol_get_fiche_end(); diff --git a/htdocs/compta/bank/releve.php b/htdocs/compta/bank/releve.php index 53d43583a9c..be91d475d4d 100644 --- a/htdocs/compta/bank/releve.php +++ b/htdocs/compta/bank/releve.php @@ -454,11 +454,14 @@ if (empty($numref)) { // Date de valeur print ''; - print dol_print_date($db->jdate($objp->dv), "day").' '; - print ''; + print ''.dol_print_date($db->jdate($objp->dv), "day").''; + print ' '; + print ''; + print ''; print img_edit_remove()." "; - print ''; + print ''; print img_edit_add().""; + print ''; print "\n"; // Type and num @@ -656,6 +659,29 @@ if (empty($numref)) { print "\n"; print ""; + // Code to adjust value date with plus and less picto using an Ajax call instead of a full reload of page + $urlajax = DOL_URL_ROOT.'/core/ajax/bankconciliate.php?token='.currentToken(); + print ' + + '; + print "
"; print "\n"; diff --git a/htdocs/compta/bank/transfer.php b/htdocs/compta/bank/transfer.php index 0533a04c12f..c94f8810cd8 100644 --- a/htdocs/compta/bank/transfer.php +++ b/htdocs/compta/bank/transfer.php @@ -233,6 +233,7 @@ $account_from = ''; $account_to = ''; $label = ''; $amount = ''; +$amountto = ''; if ($error) { $account_from = GETPOST('account_from', 'int'); diff --git a/htdocs/compta/bank/treso.php b/htdocs/compta/bank/treso.php index b1dac2858b0..6ccd953a68b 100644 --- a/htdocs/compta/bank/treso.php +++ b/htdocs/compta/bank/treso.php @@ -37,22 +37,23 @@ require_once DOL_DOCUMENT_ROOT.'/compta/bank/class/account.class.php'; $langs->loadLangs(array('banks', 'categories', 'bills', 'companies')); // Security check -if (isset($_GET["account"]) || isset($_GET["ref"])) { - $id = isset($_GET["account"]) ? $_GET["account"] : (isset($_GET["ref"]) ? $_GET["ref"] : ''); +if (GETPOSTISSET("account") || GETPOSTISSET("ref")) { + $id = GETPOSTISSET("account") ? GETPOST("account") : (GETPOSTISSET("ref") ? GETPOST("ref") : ''); } -$fieldid = isset($_GET["ref"]) ? 'ref' : 'rowid'; +$fieldid = GETPOSTISSET("ref") ? 'ref' : 'rowid'; if ($user->socid) { $socid = $user->socid; } $result = restrictedArea($user, 'banque', $id, 'bank_account&bank_account', '', '', $fieldid); -$vline = isset($_GET["vline"]) ? $_GET["vline"] : $_POST["vline"]; -$page = isset($_GET["page"]) ? $_GET["page"] : 0; +$vline = GETPOST('vline'); +$page = GETPOSTISSET("page") ? GETPOST("page") : 0; // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('banktreso', 'globalcard')); + /* * View */ @@ -68,7 +69,7 @@ $socialcontribstatic = new ChargeSociales($db); $form = new Form($db); -if ($_REQUEST["account"] || $_REQUEST["ref"]) { +if (GETPOST("account") || GETPOST("ref")) { if ($vline) { $viewline = $vline; } else { @@ -76,11 +77,11 @@ if ($_REQUEST["account"] || $_REQUEST["ref"]) { } $object = new Account($db); - if ($_GET["account"]) { - $result = $object->fetch($_GET["account"]); + if (GETPOST("account", 'int')) { + $result = $object->fetch(GETPOST("account", 'int')); } - if ($_GET["ref"]) { - $result = $object->fetch(0, $_GET["ref"]); + if (GETPOST("ref")) { + $result = $object->fetch(0, GETPOST("ref")); $_GET["account"] = $object->id; } @@ -91,6 +92,8 @@ if ($_REQUEST["account"] || $_REQUEST["ref"]) { $linkback = ''.$langs->trans("BackToList").''; + $morehtmlref = ''; + dol_banner_tab($object, 'ref', $linkback, 1, 'ref', 'ref', $morehtmlref, '', 0, '', '', 1); print dol_get_fiche_end(); diff --git a/htdocs/compta/cashcontrol/cashcontrol_card.php b/htdocs/compta/cashcontrol/cashcontrol_card.php index da018dd1f06..ccaa0158af2 100644 --- a/htdocs/compta/cashcontrol/cashcontrol_card.php +++ b/htdocs/compta/cashcontrol/cashcontrol_card.php @@ -67,11 +67,6 @@ if ($contextpage == 'takepos') { $_GET['optioncss'] = 'print'; } -// Security check -if (!$user->rights->cashdesk->run && !$user->rights->takepos->run) { - accessforbidden(); -} - $arrayofpaymentmode = array('cash'=>'Cash', 'cheque'=>'Cheque', 'card'=>'CreditCard'); $arrayofposavailable = array(); @@ -95,6 +90,15 @@ $hookmanager->initHooks(array('cashcontrolcard', 'globalcard')); // Load object include DOL_DOCUMENT_ROOT.'/core/actions_fetchobject.inc.php'; // Must be include, not include_once. +// Security check +if ($user->socid > 0) { // Protection if external user + //$socid = $user->socid; + accessforbidden(); +} +if (!$user->rights->cashdesk->run && !$user->rights->takepos->run) { + accessforbidden(); +} + /* * Actions diff --git a/htdocs/compta/cashcontrol/cashcontrol_list.php b/htdocs/compta/cashcontrol/cashcontrol_list.php index 6c4141e4b6a..3b97b967208 100644 --- a/htdocs/compta/cashcontrol/cashcontrol_list.php +++ b/htdocs/compta/cashcontrol/cashcontrol_list.php @@ -94,14 +94,6 @@ if (!$sortorder) { $sortorder = "ASC"; } -// Security check -$socid = 0; -if ($user->socid > 0) { // Protection if external user - //$socid = $user->socid; - accessforbidden(); -} -//$result = restrictedArea($user, 'monmodule', $id, ''); - // Initialize array of search criterias $search_all = GETPOST("search_all", 'alpha'); $search = array(); @@ -133,6 +125,14 @@ include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_array_fields.tpl.php'; $object->fields = dol_sort_array($object->fields, 'position'); $arrayfields = dol_sort_array($arrayfields, 'position'); +// Security check +if ($user->socid > 0) { // Protection if external user + //$socid = $user->socid; + accessforbidden(); +} +if (!$user->rights->cashdesk->run && !$user->rights->takepos->run) { + accessforbidden(); +} /* diff --git a/htdocs/compta/cashcontrol/report.php b/htdocs/compta/cashcontrol/report.php index f6c58aa858c..95c18dbf261 100644 --- a/htdocs/compta/cashcontrol/report.php +++ b/htdocs/compta/cashcontrol/report.php @@ -72,6 +72,15 @@ $sday = $cashcontrol->day_close; $posmodule = $cashcontrol->posmodule; $terminalid = $cashcontrol->posnumber; +// Security check +if ($user->socid > 0) { // Protection if external user + //$socid = $user->socid; + accessforbidden(); +} +if (!$user->rights->cashdesk->run && !$user->rights->takepos->run) { + accessforbidden(); +} + /* * View diff --git a/htdocs/compta/facture/card-rec.php b/htdocs/compta/facture/card-rec.php index c1c0f83cecb..4f0148a05a1 100644 --- a/htdocs/compta/facture/card-rec.php +++ b/htdocs/compta/facture/card-rec.php @@ -65,7 +65,6 @@ $objecttype = 'facture_rec'; if ($action == "create" || $action == "add") { $objecttype = ''; } -$result = restrictedArea($user, 'facture', $id, $objecttype); $projectid = GETPOST('projectid', 'int'); $year_date_when = GETPOST('year_date_when'); @@ -127,6 +126,8 @@ $now = dol_now(); $error = 0; +$result = restrictedArea($user, 'facture', $object->id, $objecttype); + /* * Actions @@ -1657,15 +1658,15 @@ if ($action == 'create') { if ($user->rights->facture->creer) { if (empty($object->suspended)) { - print '
'.$langs->trans("Disable").'
'; + print '
id.'&token='.newToken().'">'.$langs->trans("Disable").'
'; } else { - print '
'.$langs->trans("Enable").'
'; + print '
id.'&token='.newToken().'">'.$langs->trans("Enable").'
'; } } //if ($object->statut == Facture::STATUS_DRAFT && $user->rights->facture->supprimer) if ($user->rights->facture->supprimer) { - print '
'.$langs->trans('Delete').'
'; + print '
'.$langs->trans('Delete').'
'; } print '
'; diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php index 0433d9eb746..cd1905f528f 100644 --- a/htdocs/compta/facture/card.php +++ b/htdocs/compta/facture/card.php @@ -138,19 +138,19 @@ $permissiondellink = $usercancreate; // Used by the include of actions_dellink.i $permissiontoedit = $usercancreate; // Used by the include of actions_lineupdonw.inc.php $permissiontoadd = $usercancreate; // Used by the include of actions_addupdatedelete.inc.php +// retained warranty invoice available type +$retainedWarrantyInvoiceAvailableType = array(); +if (!empty($conf->global->INVOICE_USE_RETAINED_WARRANTY)) { + $retainedWarrantyInvoiceAvailableType = explode('+', $conf->global->INVOICE_USE_RETAINED_WARRANTY); +} + // Security check $fieldid = (!empty($ref) ? 'ref' : 'rowid'); if ($user->socid) { $socid = $user->socid; } $isdraft = (($object->statut == Facture::STATUS_DRAFT) ? 1 : 0); -$result = restrictedArea($user, 'facture', $id, '', '', 'fk_soc', $fieldid, $isdraft); - -// retained warranty invoice available type -$retainedWarrantyInvoiceAvailableType = array(); -if (!empty($conf->global->INVOICE_USE_RETAINED_WARRANTY)) { - $retainedWarrantyInvoiceAvailableType = explode('+', $conf->global->INVOICE_USE_RETAINED_WARRANTY); -} +$result = restrictedArea($user, 'facture', $object->id, '', '', 'fk_soc', $fieldid, $isdraft); /* diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index 69356287288..b0690675b53 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -1543,6 +1543,13 @@ class Facture extends CommonInvoice } } + global $action, $hookmanager; + $hookmanager->initHooks(array('invoicedao')); + $parameters = array('id'=>$this->id, 'getnomurl'=>$result, 'notooltip' => $notooltip, 'addlinktonotes' => $addlinktonotes, 'save_lastsearch_value'=> $save_lastsearch_value, 'target' => $target); + $reshook = $hookmanager->executeHooks('getNomUrl', $parameters, $this, $action); // Note that $action and $object may have been modified by some hooks + if ($reshook > 0) $result = $hookmanager->resPrint; + else $result .= $hookmanager->resPrint; + return $result; } @@ -1553,7 +1560,7 @@ class Facture extends CommonInvoice * @param string $ref Reference of invoice * @param string $ref_ext External reference of invoice * @param int $notused Not used - * @param bool $fetch_situation Fetch the previous and next situation in $tab_previous_situation_invoice and $tab_next_situation_invoice + * @param bool $fetch_situation Load also the previous and next situation invoice into $tab_previous_situation_invoice and $tab_next_situation_invoice * @return int >0 if OK, <0 if KO, 0 if not found */ public function fetch($rowid, $ref = '', $ref_ext = '', $notused = '', $fetch_situation = false) diff --git a/htdocs/compta/facture/contact.php b/htdocs/compta/facture/contact.php index dc1fe1e7c45..19e76b15c5c 100644 --- a/htdocs/compta/facture/contact.php +++ b/htdocs/compta/facture/contact.php @@ -48,9 +48,14 @@ $action = GETPOST('action', 'aZ09'); if ($user->socid) { $socid = $user->socid; } -$result = restrictedArea($user, 'facture', $id); $object = new Facture($db); +// Load object +if ($id > 0 || !empty($ref)) { + $ret = $object->fetch($id, $ref, '', '', $conf->global->INVOICE_USE_SITUATION); +} + +$result = restrictedArea($user, 'facture', $object->id); /* @@ -58,8 +63,6 @@ $object = new Facture($db); */ if ($action == 'addcontact' && $user->rights->facture->creer) { - $result = $object->fetch($id); - if ($result > 0 && $id > 0) { $contactid = (GETPOST('userid') ? GETPOST('userid', 'int') : GETPOST('contactid', 'int')); $typeid = (GETPOST('typecontact') ? GETPOST('typecontact') : GETPOST('type')); @@ -79,14 +82,9 @@ if ($action == 'addcontact' && $user->rights->facture->creer) { } } elseif ($action == 'swapstatut' && $user->rights->facture->creer) { // Toggle the status of a contact - if ($object->fetch($id)) { - $result = $object->swapContactStatus(GETPOST('ligne')); - } else { - dol_print_error($db); - } + $result = $object->swapContactStatus(GETPOST('ligne')); } elseif ($action == 'deletecontact' && $user->rights->facture->creer) { // Deletes a contact - $object->fetch($id); $result = $object->delete_contact($lineid); if ($result >= 0) { diff --git a/htdocs/compta/facture/document.php b/htdocs/compta/facture/document.php index c44aeae67ca..4c0544e3810 100644 --- a/htdocs/compta/facture/document.php +++ b/htdocs/compta/facture/document.php @@ -48,12 +48,6 @@ $socid = GETPOST('socid', 'int'); $action = GETPOST('action', 'aZ09'); $confirm = GETPOST('confirm', 'alpha'); -// Security check -if ($user->socid) { - $socid = $user->socid; -} -$result = restrictedArea($user, 'facture', $id, ''); - // Get parameters $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit; $sortfield = GETPOST("sortfield", 'alpha'); @@ -73,11 +67,17 @@ if (!$sortfield) { } $object = new Facture($db); -if ($object->fetch($id)) { +if ($object->fetch($id, $ref)) { $object->fetch_thirdparty(); $upload_dir = $conf->facture->dir_output."/".dol_sanitizeFileName($object->ref); } +// Security check +if ($user->socid) { + $socid = $user->socid; +} +$result = restrictedArea($user, 'facture', $object->id, ''); + /* * Actions diff --git a/htdocs/compta/facture/info.php b/htdocs/compta/facture/info.php index 97646d56103..5b9b7fc4316 100644 --- a/htdocs/compta/facture/info.php +++ b/htdocs/compta/facture/info.php @@ -38,6 +38,25 @@ $langs->loadLangs(array('companies', 'bills')); $id = GETPOST("facid", "int"); $ref = GETPOST("ref", 'alpha'); +$object = new Facture($db); +$extrafields = new ExtraFields($db); + +// Fetch optionals attributes and labels +$extrafields->fetch_name_optionals_label($object->table_element); + +// Load object +if ($id > 0 || !empty($ref)) { + $ret = $object->fetch($id, $ref, '', '', $conf->global->INVOICE_USE_SITUATION); +} + +// Security check +$fieldid = (!empty($ref) ? 'ref' : 'rowid'); +if ($user->socid) { + $socid = $user->socid; +} +$isdraft = (($object->statut == Facture::STATUS_DRAFT) ? 1 : 0); +$result = restrictedArea($user, 'facture', $object->id, '', '', 'fk_soc', $fieldid, $isdraft); + /* * View @@ -46,11 +65,10 @@ $ref = GETPOST("ref", 'alpha'); $form = new Form($db); $title = $langs->trans('InvoiceCustomer')." - ".$langs->trans('Info'); -$helpurl = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes"; -llxHeader('', $title, $helpurl); +$help_url = "EN:Customers_Invoices|FR:Factures_Clients|ES:Facturas_a_clientes"; + +llxHeader('', $title, $help_url); -$object = new Facture($db); -$object->fetch($id, $ref); $object->fetch_thirdparty(); $object->info($object->id); diff --git a/htdocs/compta/facture/invoicetemplate_list.php b/htdocs/compta/facture/invoicetemplate_list.php index e419ed9260b..5d511aa6cd6 100644 --- a/htdocs/compta/facture/invoicetemplate_list.php +++ b/htdocs/compta/facture/invoicetemplate_list.php @@ -165,6 +165,11 @@ if ($socid > 0) { } } +$objecttype = 'facture_rec'; + +$result = restrictedArea($user, 'facture', $object->id, $objecttype); + + /* * Actions */ diff --git a/htdocs/compta/facture/list.php b/htdocs/compta/facture/list.php index 9b3dce589fb..31365b33b58 100644 --- a/htdocs/compta/facture/list.php +++ b/htdocs/compta/facture/list.php @@ -493,6 +493,10 @@ if ($search_user > 0) { $sql .= ", ".MAIN_DB_PREFIX."element_contact as ec"; $sql .= ", ".MAIN_DB_PREFIX."c_type_contact as tc"; } +// Add table from hooks +$parameters = array(); +$reshook = $hookmanager->executeHooks('printFieldListFrom', $parameters, $object); // Note that $action and $object may have been modified by hook +$sql .= $hookmanager->resPrint; $sql .= ' WHERE f.fk_soc = s.rowid'; $sql .= ' AND f.entity IN ('.getEntity('invoice').')'; @@ -689,10 +693,19 @@ if (!$sall) { $sql .= ($extrafields->attributes[$object->table_element]['type'][$key] != 'separate' ? ", ef.".$key : ''); } } + // Add GroupBy from hooks + $parameters = array('all' => $all, 'fieldstosearchall' => $fieldstosearchall); + $reshook = $hookmanager->executeHooks('printFieldListGroupBy', $parameters, $object); // Note that $action and $object may have been modified by hook + $sql .= $hookmanager->resPrint; } else { $sql .= natural_search(array_keys($fieldstosearchall), $sall); } +// Add HAVING from hooks +$parameters = array(); +$reshook = $hookmanager->executeHooks('printFieldListHaving', $parameters, $object); // Note that $action and $object may have been modified by hook +$sql .= !empty($hookmanager->resPrint) ? (' HAVING 1=1 ' . $hookmanager->resPrint) : ''; + $sql .= ' ORDER BY '; $listfield = explode(',', $sortfield); $listorder = explode(',', $sortorder); @@ -865,6 +878,10 @@ if ($resql) { // Add $param from extra fields include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_param.tpl.php'; + // Add $param from hooks + $parameters = array(); + $reshook = $hookmanager->executeHooks('printFieldListSearchParam', $parameters, $object); // Note that $action and $object may have been modified by hook + $param .= $hookmanager->resPrint; $arrayofmassactions = array( 'validate'=>$langs->trans("Validate"), diff --git a/htdocs/compta/facture/note.php b/htdocs/compta/facture/note.php index 23d4afb0417..f019d822529 100644 --- a/htdocs/compta/facture/note.php +++ b/htdocs/compta/facture/note.php @@ -41,6 +41,14 @@ $ref = GETPOST('ref', 'alpha'); $socid = GETPOST('socid', 'int'); $action = GETPOST('action', 'aZ09'); +$object = new Facture($db); +// Load object +if ($id > 0 || !empty($ref)) { + $object->fetch($id, $ref, '', '', $conf->global->INVOICE_USE_SITUATION); +} + +$permissionnote = $user->rights->facture->creer; // Used by the include of actions_setnotes.inc.php + // Security check $socid = 0; if ($user->socid) { @@ -48,11 +56,6 @@ if ($user->socid) { } $result = restrictedArea($user, 'facture', $id, ''); -$object = new Facture($db); -$object->fetch($id); - -$permissionnote = $user->rights->facture->creer; // Used by the include of actions_setnotes.inc.php - /* * Actions diff --git a/htdocs/compta/resultat/clientfourn.php b/htdocs/compta/resultat/clientfourn.php index 9c700f509f9..a22c0c51b73 100644 --- a/htdocs/compta/resultat/clientfourn.php +++ b/htdocs/compta/resultat/clientfourn.php @@ -49,18 +49,6 @@ $date_endday = GETPOST('date_endday', 'int'); $date_endyear = GETPOST('date_endyear', 'int'); $showaccountdetail = GETPOST('showaccountdetail', 'aZ09') ?GETPOST('showaccountdetail', 'aZ09') : 'no'; -// Security check -$socid = GETPOST('socid', 'int'); -if ($user->socid > 0) { - $socid = $user->socid; -} -if (!empty($conf->comptabilite->enabled)) { - $result = restrictedArea($user, 'compta', '', '', 'resultat'); -} -if (!empty($conf->accounting->enabled)) { - $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); -} - $limit = GETPOST('limit', 'int') ?GETPOST('limit', 'int') : $conf->liste_limit; $sortfield = GETPOST("sortfield", 'alpha'); $sortorder = GETPOST("sortorder", 'alpha'); @@ -151,6 +139,17 @@ if (GETPOST("modecompta", 'alpha')) { $AccCat = new AccountancyCategory($db); +// Security check +$socid = GETPOST('socid', 'int'); +if ($user->socid > 0) { + $socid = $user->socid; +} +if (!empty($conf->comptabilite->enabled)) { + $result = restrictedArea($user, 'compta', '', '', 'resultat'); +} +if (!empty($conf->accounting->enabled)) { + $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); +} /* diff --git a/htdocs/compta/resultat/index.php b/htdocs/compta/resultat/index.php index 228269d135e..e5b86ba762e 100644 --- a/htdocs/compta/resultat/index.php +++ b/htdocs/compta/resultat/index.php @@ -108,6 +108,14 @@ $year_end = $tmpe['year']; $nbofyear = ($year_end - $year_start) + 1; //var_dump("year_start=".$year_start." year_end=".$year_end." nbofyear=".$nbofyear." date_start=".dol_print_date($date_start, 'dayhour')." date_end=".dol_print_date($date_end, 'dayhour')); +// Define modecompta ('CREANCES-DETTES' or 'RECETTES-DEPENSES' or 'BOOKKEEPING') +$modecompta = $conf->global->ACCOUNTING_MODE; +if (!empty($conf->accounting->enabled)) { + $modecompta = 'BOOKKEEPING'; +} +if (GETPOST("modecompta", 'alpha')) { + $modecompta = GETPOST("modecompta", 'alpha'); +} // Security check $socid = GETPOST('socid', 'int'); @@ -121,15 +129,6 @@ if (!empty($conf->accounting->enabled)) { $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); } -// Define modecompta ('CREANCES-DETTES' or 'RECETTES-DEPENSES' or 'BOOKKEEPING') -$modecompta = $conf->global->ACCOUNTING_MODE; -if (!empty($conf->accounting->enabled)) { - $modecompta = 'BOOKKEEPING'; -} -if (GETPOST("modecompta", 'alpha')) { - $modecompta = GETPOST("modecompta", 'alpha'); -} - /* * View diff --git a/htdocs/compta/resultat/result.php b/htdocs/compta/resultat/result.php index df3a82a4b7f..91932100565 100644 --- a/htdocs/compta/resultat/result.php +++ b/htdocs/compta/resultat/result.php @@ -144,16 +144,20 @@ if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta", 'alpha'); } -// Security check -if ($user->socid > 0) { - accessforbidden(); -} -if (!$user->rights->accounting->comptarapport->lire) { - accessforbidden(); -} - $AccCat = new AccountancyCategory($db); +// Security check +$socid = GETPOST('socid', 'int'); +if ($user->socid > 0) { + $socid = $user->socid; +} +if (!empty($conf->comptabilite->enabled)) { + $result = restrictedArea($user, 'compta', '', '', 'resultat'); +} +if (!empty($conf->accounting->enabled)) { + $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); +} + /* * View diff --git a/htdocs/compta/stats/byratecountry.php b/htdocs/compta/stats/byratecountry.php index 79379ee0b24..1644a4ee5e3 100644 --- a/htdocs/compta/stats/byratecountry.php +++ b/htdocs/compta/stats/byratecountry.php @@ -44,16 +44,16 @@ $modecompta = (GETPOST('modecompta', 'alpha') ? GETPOST('modecompta', 'alpha') : $year = GETPOST("year", 'int'); $month = GETPOST("month", 'int'); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear")); -$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear")); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q", "int"); diff --git a/htdocs/compta/stats/cabyprodserv.php b/htdocs/compta/stats/cabyprodserv.php index c6c0e8e0816..25d9d4b9460 100644 --- a/htdocs/compta/stats/cabyprodserv.php +++ b/htdocs/compta/stats/cabyprodserv.php @@ -52,8 +52,8 @@ if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta"); } -$sortorder = isset($_GET["sortorder"]) ? $_GET["sortorder"] : $_POST["sortorder"]; -$sortfield = isset($_GET["sortfield"]) ? $_GET["sortfield"] : $_POST["sortfield"]; +$sortorder = GETPOST("sortorder", 'aZ09'); +$sortfield = GETPOST("sortfield", 'aZ09'); if (!$sortorder) { $sortorder = "asc"; } @@ -89,16 +89,16 @@ $date_endyear = GETPOST("date_endyear"); $date_endmonth = GETPOST("date_endmonth"); $date_endday = GETPOST("date_endday"); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear")); -$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear")); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q", "int"); diff --git a/htdocs/compta/stats/cabyuser.php b/htdocs/compta/stats/cabyuser.php index 62e6fb3135d..feae1f83594 100644 --- a/htdocs/compta/stats/cabyuser.php +++ b/htdocs/compta/stats/cabyuser.php @@ -51,8 +51,8 @@ if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta"); } -$sortorder = isset($_GET["sortorder"]) ? $_GET["sortorder"] : $_POST["sortorder"]; -$sortfield = isset($_GET["sortfield"]) ? $_GET["sortfield"] : $_POST["sortfield"]; +$sortorder = GETPOST("sortorder", 'aZ09'); +$sortfield = GETPOST("sortfield", 'aZ09'); if (!$sortorder) { $sortorder = "asc"; } @@ -61,25 +61,25 @@ if (!$sortfield) { } // Date range -$year = GETPOST("year"); -$month = GETPOST("month"); -$date_startyear = GETPOST("date_startyear"); -$date_startmonth = GETPOST("date_startmonth"); -$date_startday = GETPOST("date_startday"); -$date_endyear = GETPOST("date_endyear"); -$date_endmonth = GETPOST("date_endmonth"); -$date_endday = GETPOST("date_endday"); +$year = GETPOST("year", 'int'); +$month = GETPOST("month", 'int'); +$date_startyear = GETPOST("date_startyear", 'int'); +$date_startmonth = GETPOST("date_startmonth", 'int'); +$date_startday = GETPOST("date_startday", 'int'); +$date_endyear = GETPOST("date_endyear", 'int'); +$date_endmonth = GETPOST("date_endmonth", 'int'); +$date_endday = GETPOST("date_endday", 'int'); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, $_REQUEST["date_startmonth"], $_REQUEST["date_startday"], $_REQUEST["date_startyear"]); -$date_end = dol_mktime(23, 59, 59, $_REQUEST["date_endmonth"], $_REQUEST["date_endday"], $_REQUEST["date_endyear"]); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q") ?GETPOST("q") : 0; diff --git a/htdocs/compta/stats/casoc.php b/htdocs/compta/stats/casoc.php index c8c13ca8b27..aedae20b8f0 100644 --- a/htdocs/compta/stats/casoc.php +++ b/htdocs/compta/stats/casoc.php @@ -44,8 +44,8 @@ if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta"); } -$sortorder = isset($_GET["sortorder"]) ? $_GET["sortorder"] : $_POST["sortorder"]; -$sortfield = isset($_GET["sortfield"]) ? $_GET["sortfield"] : $_POST["sortfield"]; +$sortorder = GETPOST("sortorder", 'aZ09'); +$sortfield = GETPOST("sortfield", 'aZ09'); if (!$sortorder) { $sortorder = "asc"; } @@ -83,23 +83,23 @@ $search_societe = GETPOST("search_societe", 'alpha'); $search_zip = GETPOST("search_zip", 'alpha'); $search_town = GETPOST("search_town", 'alpha'); $search_country = GETPOST("search_country", 'alpha'); -$date_startyear = GETPOST("date_startyear", 'alpha'); -$date_startmonth = GETPOST("date_startmonth", 'alpha'); -$date_startday = GETPOST("date_startday", 'alpha'); -$date_endyear = GETPOST("date_endyear", 'alpha'); -$date_endmonth = GETPOST("date_endmonth", 'alpha'); -$date_endday = GETPOST("date_endday", 'alpha'); +$date_startyear = GETPOST("date_startyear", 'int'); +$date_startmonth = GETPOST("date_startmonth", 'int'); +$date_startday = GETPOST("date_startday", 'int'); +$date_endyear = GETPOST("date_endyear", 'int'); +$date_endmonth = GETPOST("date_endmonth", 'int'); +$date_endday = GETPOST("date_endday", 'int'); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear")); -$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear")); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q", "int") ?GETPOST("q", "int") : 0; diff --git a/htdocs/compta/stats/index.php b/htdocs/compta/stats/index.php index 083230da668..74589d2e391 100644 --- a/htdocs/compta/stats/index.php +++ b/htdocs/compta/stats/index.php @@ -51,8 +51,8 @@ if (empty($year)) { $month_current = dol_print_date(dol_now(), "%m"); $year_start = $year - ($nbofyear - 1); } -$date_start = dol_mktime(0, 0, 0, $date_startmonth, $date_startday, $date_startyear); -$date_end = dol_mktime(23, 59, 59, $date_endmonth, $date_endday, $date_endyear); +$date_start = dol_mktime(0, 0, 0, $date_startmonth, $date_startday, $date_startyear, 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, $date_endmonth, $date_endday, $date_endyear, 'tzuserrel'); // We define date_start and date_end if (empty($date_start) || empty($date_end)) { // We define date_start and date_end diff --git a/htdocs/compta/stats/supplier_turnover.php b/htdocs/compta/stats/supplier_turnover.php index b199dcbeb9c..141db21b73e 100644 --- a/htdocs/compta/stats/supplier_turnover.php +++ b/htdocs/compta/stats/supplier_turnover.php @@ -47,8 +47,8 @@ if (empty($year)) { $month_current = strftime("%m", dol_now()); $year_start = $year - ($nbofyear - 1); } -$date_start = dol_mktime(0, 0, 0, $date_startmonth, $date_startday, $date_startyear); -$date_end = dol_mktime(23, 59, 59, $date_endmonth, $date_endday, $date_endyear); +$date_start = dol_mktime(0, 0, 0, $date_startmonth, $date_startday, $date_startyear, 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, $date_endmonth, $date_endday, $date_endyear, 'tzuserrel'); // We define date_start and date_end if (empty($date_start) || empty($date_end)) { // We define date_start and date_end @@ -120,8 +120,6 @@ if (!empty($conf->accounting->enabled)) { } - - /* * View */ diff --git a/htdocs/compta/stats/supplier_turnover_by_prodserv.php b/htdocs/compta/stats/supplier_turnover_by_prodserv.php index bdf4e5e0f85..26659c851f9 100644 --- a/htdocs/compta/stats/supplier_turnover_by_prodserv.php +++ b/htdocs/compta/stats/supplier_turnover_by_prodserv.php @@ -30,27 +30,14 @@ require_once DOL_DOCUMENT_ROOT.'/categories/class/categorie.class.php'; // Load translation files required by the page $langs->loadLangs(array("products", "categories", "errors", 'accountancy')); -// Security pack (data & check) -$socid = GETPOST('socid', 'int'); - -if ($user->socid > 0) { - $socid = $user->socid; -} -if (!empty($conf->comptabilite->enabled)) { - $result = restrictedArea($user, 'compta', '', '', 'resultat'); -} -if (!empty($conf->accounting->enabled)) { - $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); -} - // Define modecompta ('CREANCES-DETTES' or 'RECETTES-DEPENSES') $modecompta = $conf->global->ACCOUNTING_MODE; if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta"); } -$sortorder = isset($_GET["sortorder"]) ? $_GET["sortorder"] : $_POST["sortorder"]; -$sortfield = isset($_GET["sortfield"]) ? $_GET["sortfield"] : $_POST["sortfield"]; +$sortorder = GETPOST("sortorder", 'aZ09'); +$sortfield = GETPOST("sortfield", 'aZ09'); if (!$sortorder) { $sortorder = "asc"; } @@ -84,16 +71,16 @@ $date_endyear = GETPOST("date_endyear"); $date_endmonth = GETPOST("date_endmonth"); $date_endday = GETPOST("date_endday"); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear")); -$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear")); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q", "int"); @@ -204,6 +191,19 @@ foreach ($allparams as $key => $value) { $paramslink .= '&'.$key.'='.$value; } +// Security pack (data & check) +$socid = GETPOST('socid', 'int'); + +if ($user->socid > 0) { + $socid = $user->socid; +} +if (!empty($conf->comptabilite->enabled)) { + $result = restrictedArea($user, 'compta', '', '', 'resultat'); +} +if (!empty($conf->accounting->enabled)) { + $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); +} + /* * View diff --git a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php index fbfb0994e4a..0530d58ee87 100644 --- a/htdocs/compta/stats/supplier_turnover_by_thirdparty.php +++ b/htdocs/compta/stats/supplier_turnover_by_thirdparty.php @@ -38,8 +38,8 @@ if (GETPOST("modecompta")) { $modecompta = GETPOST("modecompta"); } -$sortorder = isset($_GET["sortorder"]) ? $_GET["sortorder"] : $_POST["sortorder"]; -$sortfield = isset($_GET["sortfield"]) ? $_GET["sortfield"] : $_POST["sortfield"]; +$sortorder = GETPOST("sortorder", 'aZ09'); +$sortfield = GETPOST("sortfield", 'aZ09'); if (!$sortorder) { $sortorder = "asc"; } @@ -59,17 +59,6 @@ if (GETPOST('subcat', 'alpha') === 'yes') { // Hook $hookmanager->initHooks(array('supplierturnoverbythirdpartylist')); -// Security check -if ($user->socid > 0) { - $socid = $user->socid; -} -if (!empty($conf->comptabilite->enabled)) { - $result = restrictedArea($user, 'compta', '', '', 'resultat'); -} -if (!empty($conf->accounting->enabled)) { - $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); -} - // Date range $year = GETPOST("year", 'int'); $month = GETPOST("month", 'int'); @@ -84,16 +73,16 @@ $date_endyear = GETPOST("date_endyear", 'alpha'); $date_endmonth = GETPOST("date_endmonth", 'alpha'); $date_endday = GETPOST("date_endday", 'alpha'); if (empty($year)) { - $year_current = strftime("%Y", dol_now()); - $month_current = strftime("%m", dol_now()); + $year_current = dol_print_date(dol_now(), '%Y'); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year_current; } else { $year_current = $year; - $month_current = strftime("%m", dol_now()); + $month_current = dol_print_date(dol_now(), '%m'); $year_start = $year; } -$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear")); -$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear")); +$date_start = dol_mktime(0, 0, 0, GETPOST("date_startmonth"), GETPOST("date_startday"), GETPOST("date_startyear"), 'tzuserrel'); +$date_end = dol_mktime(23, 59, 59, GETPOST("date_endmonth"), GETPOST("date_endday"), GETPOST("date_endyear"), 'tzuserrel'); // Quarter if (empty($date_start) || empty($date_end)) { // We define date_start and date_end $q = GETPOST("q", "int") ?GETPOST("q", "int") : 0; @@ -175,6 +164,17 @@ foreach ($allparams as $key => $value) { $paramslink .= '&'.$key.'='.$value; } +// Security check +if ($user->socid > 0) { + $socid = $user->socid; +} +if (!empty($conf->comptabilite->enabled)) { + $result = restrictedArea($user, 'compta', '', '', 'resultat'); +} +if (!empty($conf->accounting->enabled)) { + $result = restrictedArea($user, 'accounting', '', '', 'comptarapport'); +} + /* * View diff --git a/htdocs/contact/card.php b/htdocs/contact/card.php index 0ee4cb10637..421b88ea6b8 100644 --- a/htdocs/contact/card.php +++ b/htdocs/contact/card.php @@ -8,7 +8,7 @@ * Copyright (C) 2013-2016 Alexandre Spangaro * Copyright (C) 2014 Juanjo Menent * Copyright (C) 2015 Jean-François Ferry - * Copyright (C) 2018-2020 Frédéric France + * Copyright (C) 2018-2021 Frédéric France * Copyright (C) 2019 Josep Lluís Amador * Copyright (C) 2020 Open-Dsi * @@ -1035,7 +1035,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) { // Unsubscribe if (!empty($conf->mailing->enabled)) { - if ($conf->use_javascript_ajax && $conf->global->MAILING_CONTACT_DEFAULT_BULK_STATUS==-1) { + if ($conf->use_javascript_ajax && isset($conf->global->MAILING_CONTACT_DEFAULT_BULK_STATUS) && $conf->global->MAILING_CONTACT_DEFAULT_BULK_STATUS == -1) { print "\n".'