admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ManageTable, add an message for unauthorized access

Browse source
This commit is contained in:
sparkyx 2025-07-09 14:46:15 +02:00
parent 13803bf4da
commit 069cb9897b
10 changed files with 105 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
html/js/managetable.js
View file

@ -384,7 +384,7 @@ var ManageTable = function (p_table_name)
$(obj.id).setStyle(here.mt_style);
remove_waiting_box();
$(obj.id).update(x['html']);
Effect.SlideDown(obj.id,{duration:0.3,scaleX:false,scaleY:true,scaleContent:false});
Effect.SlideDown(obj.id,{duration:0.1,scaleX:false,scaleY:true,scaleContent:false});
} catch (e) {
smoke.alert(content[48] + e.message);
}

9
include/ajax/ajax_accounting.php
View file

@ -37,7 +37,7 @@ try {
echo $e->getMessage();
return;
}
if ( $g_user->check_module("C0PCMN") == 0) die();
$obj=new Acc_Plan_SQL($cn);
@ -48,6 +48,13 @@ $manage_table=new Acc_Plan_MTable($obj);
$manage_table->add_json_param("op","accounting");
$manage_table->set_object_name($ctl_id);
$manage_table->set_callback("ajax_misc.php");
if ( $g_user->check_module("C0PCMN") == 0)
{
header('Content-type: text/xml; charset=UTF-8');
echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
record_log("C0PCMN security ");
return;
}
if ($action=="input")
{
header('Content-type: text/xml; charset=UTF-8');

6
include/ajax/ajax_anc_plan.php
View file

@ -27,7 +27,7 @@ if (!defined('ALLOWED'))
die('Appel direct ne sont pas permis');
if ( $g_user->check_module("PLANANC ") ) die("forbidden");
$input = $http->request("input");
$action = $http->request("ieaction", "string", "display");
@ -39,6 +39,10 @@ $answer->set_callback("ajax_misc.php");
$answer->add_json_param("action","anc_updatedescription");
$answer->add_json_param("op","anc_updatedescription");
$answer->add_json_param("id",$pa_id);
if ( $g_user->check_module("PLANANC") == 0) {
record_log("PLANANC security ");
return;
}
$input=$answer->get_input();
if ($action=="display") {

25
include/ajax/ajax_cfgaction.php
View file

@ -21,16 +21,6 @@
if (!defined('ALLOWED'))
die('Appel direct ne sont pas permis');
// check right
if ($g_user->check_action(PARCATDOC)==0)
{
record_log("cfgaction01 security ");
return;
}
$http=new HttpInput();
@ -47,17 +37,28 @@ try
}
catch (Exception $ex)
{
echo $e->getMessage();
record_log($e);
return;
}
$doc_type=new Document_type_SQL($cn,$p_id);
$action_document_type=new Action_Document_Type_MTable($doc_type);
$action_document_type->set_callback("ajax_misc.php");
$action_document_type->add_json_param("op", "cfgaction");
$action_document_type->set_object_name($ctl_id);
// check right
if ( $g_user->check_module("C0ACT")==0)
{
header('Content-type: text/xml; charset=UTF-8');
echo $action_document_type->ajax_error(_('Accès non autorisé'))->saveXML();
record_log("cfgaction01 security ");
return;
}
if ($action=="input")

10
include/ajax/ajax_company.php
View file

@ -28,7 +28,7 @@ if (!defined('ALLOWED'))
*/
global $g_user;
if ($g_user->check_module("COMPANY")==0) die();
$http=new HttpInput();
@ -44,6 +44,14 @@ try {
}
$parameter_extra =Parameter_Extra_MTable::build($p_id);
$parameter_extra->set_object_name($ctl_id);
if ($g_user->check_module("COMPANY")==0)
{
header('Content-type: text/xml; charset=UTF-8');
echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
record_log("COMPANY security ");
return;
}
if ($action=="input")
{
$parameter_extra->send_header();

11
include/ajax/ajax_forecast_category.php
View file

@ -26,7 +26,7 @@ if (!defined('ALLOWED')) die('Appel direct ne sont pas permis');
global $g_user;
if ($g_user->check_module("FORECAST")==0) die();
$http=new HttpInput();
try {
@ -41,6 +41,15 @@ try {
}
$forecast_category = Forecast_Category_MTable::build($p_id);
$forecast_category->set_object_name($ctl_id);
if ($g_user->check_module("FORECAST")==0)
{
header('Content-type: text/xml; charset=UTF-8');
echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
record_log("security FORECAST");
return;
}
if ($action=="input")
{
$forecast_category->send_header();

7
include/ajax/ajax_other_tax.php
View file

@ -21,7 +21,12 @@ global $g_user;
if (!defined('ALLOWED'))
die('Appel direct ne sont pas permis');
if ( $g_user->check_module("OTAX") == 0) die("");
if ( $g_user->check_module("OTAX") == 0) {
header('Content-type: text/xml; charset=UTF-8');
echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
record_log("security OTAX");
return;
}
try {
$table=$http->request('table');

8
include/ajax/ajax_save_predf_op.php
View file

@ -39,7 +39,13 @@ try {
echo $e->getMessage();
return;
}
if ( $g_user->check_module("PREDOP") == 0) die();
if ( $g_user->check_module("PREDOP") == 0)
{
header('Content-type: text/xml; charset=UTF-8');
echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'),)->saveXML();
record_log("security PREDOP");
return;
}
$prd_op=new Op_Predef_SQL($cn);
$prd_op->set_pk_value($p_id);

2
include/ajax/ajax_user_security.php
View file

@ -32,7 +32,7 @@ if (!defined('ALLOWED'))
global $g_user;
if ($g_user->check_module("C0SEC") == 0) {
record_log("UNAUTHORIZED ACCESS");
return;
return;
}
$n_dossier_id=Dossier::id();

45
include/lib/manage_table_sql.class.php
View file

@ -1586,4 +1586,49 @@ function check()
print_r($p_row);
echo '</a></td>';
}
/**
* @brief returns an XML object for error message as unauthorized access.
* Called by ManageTable->input.
* @code
// Example if the user cannot access , displays an
// an error message and returns
if ( $g_user->check_action(PARCATDOC)==0)
{
header('Content-type: text/xml; charset=UTF-8');
echo $action_document_type->ajax_error(_('Accès non autorisé'))->saveXML();
record_log("cfgaction01 security ");
return;
}
* @endcode
* @param $p_message (string) message to display
* @return DOMDocument
*/
static function ajax_error($p_message): DOMDocument {
$xml = new DOMDocument("1.0", "UTF-8");
$s1=$xml->createElement("status", 'NOK');
$dialog_box="dtr";
$str = HtmlInput::title_box(_("ERROR"), $dialog_box, "close", "", "y", "y");
$str .= '<h2 class="error">' . h(_($p_message)) . '</h2>';
$str .= '<ul class="aligned-block">';
$str .= '<li>';
$str .= HtmlInput::button_close($dialog_box);
$str .= '</li>';
$s2 = $xml->createElement("ctl_row", "error_0");
$s4 = $xml->createElement("ctl", "error_0");
$s3 = $xml->createElement("html");
$s5 = $xml->createElement("ctl_pk_id", "0");
$t1 = $xml->createTextNode($str);
$s3->appendChild($t1);
$root = $xml->createElement("data");
$root->appendChild($s1);
$root->appendChild($s2);
$root->appendChild($s3);
$root->appendChild($s4);
$root->appendChild($s5);
$xml->appendChild($root);
return $xml;
}
}