Files
dolibarr/htdocs/don/document.php
Laurent Destailleur 33e2179b65 FIX SQL injection
2017-09-06 18:17:57 +02:00

198 lines
6.9 KiB
PHP

<?php
/* Copyright (C) 2003-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2016 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com>
* Copyright (C) 2005-2009 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2005 Simon TOSSER <simon@kornog-computing.com>
* Copyright (C) 2011-2012 Juanjo Menent <jmenent@2byte.es>
* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
* Copyright (C) 2015 Alexandre Spangaro <aspangaro.dolibarr@gmail.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
* or see http://www.gnu.org/
*/
/**
* \file htdocs/don/document.php
* \ingroup donation
* \brief Page of linked files onto donation
*/
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/donation.lib.php';
require_once DOL_DOCUMENT_ROOT.'/don/class/don.class.php';
if (! empty($conf->projet->enabled))
{
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php';
require_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
}
$langs->load("other");
$langs->load("donations");
$langs->load("companies");
$id = GETPOST('id','int');
$ref = GETPOST('ref', 'alpha');
$action = GETPOST('action','alpha');
$confirm = GETPOST('confirm','alpha');
$projectid = (GETPOST('projectid') ? GETPOST('projectid', 'int') : 0);
// Security check
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'don', $id, '');
// Get parameters
$sortfield = GETPOST('sortfield','alpha');
$sortorder = GETPOST('sortorder','alpha');
$page = GETPOST('page','int');
if (empty($page) || $page == -1) { $page = 0; } // If $page is not defined, or '' or -1
$offset = $conf->liste_limit * $page;
$pageprev = $page - 1;
$pagenext = $page + 1;
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="name";
$object = new Don($db);
$object->fetch($id, $ref);
$upload_dir = $conf->don->dir_output . '/' . get_exdir($filename,0,0,0,$object,'donation'). '/'. dol_sanitizeFileName($object->ref);
$modulepart='don';
/*
* Actions
*/
include_once DOL_DOCUMENT_ROOT . '/core/actions_linkedfiles.inc.php';
if ($action == 'classin' && $user->rights->don->creer)
{
$object->fetch($id);
$object->setProject($projectid);
}
/*
* View
*/
$form = new Form($db);
if (! empty($conf->projet->enabled)) { $formproject = new FormProjets($db); }
$title = $langs->trans('Donation') . " - " . $langs->trans('Documents');
$helpurl = "";
llxHeader('', $title, $helpurl);
if ($object->id)
{
$object->fetch_thirdparty();
$head=donation_prepare_head($object);
dol_fiche_head($head, 'documents', $langs->trans("Donation"), -1, 'generic');
// Construit liste des fichiers
$filearray=dol_dir_list($upload_dir,"files",0,'','(\.meta|_preview.*\.png)$',$sortfield,(strtolower($sortorder)=='desc'?SORT_DESC:SORT_ASC),1);
$totalsize=0;
foreach($filearray as $key => $file)
{
$totalsize+=$file['size'];
}
$linkback = '<a href="'.DOL_URL_ROOT.'/don/list.php'.(! empty($socid)?'?socid='.$socid:'').'">'.$langs->trans("BackToList").'</a>';
$morehtmlref='<div class="refidno">';
// Project
if (! empty($conf->projet->enabled))
{
$langs->load("projects");
$morehtmlref.=$langs->trans('Project') . ' ';
if ($user->rights->don->creer)
{
if ($action != 'classify')
// $morehtmlref.='<a href="' . $_SERVER['PHP_SELF'] . '?action=classify&amp;id=' . $object->id . '">' . img_edit($langs->transnoentitiesnoconv('SetProject')) . '</a> : ';
if ($action == 'classify') {
//$morehtmlref.=$form->form_project($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->socid, $object->fk_project, 'projectid', 0, 0, 1, 1);
$morehtmlref.='<form method="post" action="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'">';
$morehtmlref.='<input type="hidden" name="action" value="classin">';
$morehtmlref.='<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
$morehtmlref.=$formproject->select_projects($object->socid, $object->fk_project, 'projectid', $maxlength, 0, 1, 0, 1, 0, 0, '', 1);
$morehtmlref.='<input type="submit" class="button valignmiddle" value="'.$langs->trans("Modify").'">';
$morehtmlref.='</form>';
} else {
$morehtmlref.=$form->form_project($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->socid, $object->fk_project, 'none', 0, 0, 0, 1);
}
} else {
if (! empty($object->fk_project)) {
$proj = new Project($db);
$proj->fetch($object->fk_project);
$morehtmlref.='<a href="'.DOL_URL_ROOT.'/projet/card.php?id=' . $object->fk_project . '" title="' . $langs->trans('ShowProject') . '">';
$morehtmlref.=$proj->ref;
$morehtmlref.='</a>';
} else {
$morehtmlref.='';
}
}
}
$morehtmlref.='</div>';
dol_banner_tab($object, 'rowid', $linkback, 1, 'rowid', 'ref', $morehtmlref);
print '<div class="fichecenter">';
print '<div class="underbanner clearboth"></div>';
print '<table class="border" width="100%">';
// Ref
/*
print '<tr><td class="titlefield">'.$langs->trans("Ref").'</td><td>';
print $form->showrefnav($object, 'id', $linkback, 1, 'rowid', 'ref', '');
print '</td></tr>';
*/
// Societe
//print "<tr><td>".$langs->trans("Company")."</td><td>".$object->client->getNomUrl(1)."</td></tr>";
print '<tr><td class="titlefield">'.$langs->trans("NbOfAttachedFiles").'</td><td colspan="3">'.count($filearray).'</td></tr>';
print '<tr><td>'.$langs->trans("TotalSizeOfAttachedFiles").'</td><td colspan="3">'.$totalsize.' '.$langs->trans("bytes").'</td></tr>';
print '</table>';
print '</div>';
print '<div class="clearboth"></div>';
dol_fiche_end();
$modulepart = 'don';
$permission = $user->rights->don->lire;
$permtoedit = $user->rights->don->creer;
$param = '&id=' . $object->id;
include_once DOL_DOCUMENT_ROOT . '/core/tpl/document_actions_post_headers.tpl.php';
}
else
{
print $langs->trans("ErrorUnknown");
}
llxFooter();
$db->close();