admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

#450 sécurité ajax : ajout d'action

Browse source 
code cleaning : renommage de fichier pour ajax
This commit is contained in:
Dany De Bontridder 2011-11-15 10:41:26 +00:00
parent 2bed86c6f8
commit 1d233ea1b7
9 changed files with 51 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

9
html/todo_list.php → html/ajax_todo_list.php
View file

@ -38,7 +38,12 @@ require_once ('class_dossier.php');
require_once ('class_todo_list.php');
require_once ('class_database.php');
/*!\todo needs security for the users */
$cn=new Database($gDossier);
$user=new User($cn);
$user->check(true);
$user->check_dossier($gDossier,true);
ajax_disconnected('add_todo_list');
if (isset($_REQUEST['show']))
{
$cn=new Database(dossier::id());
@ -50,7 +55,7 @@ if (isset($_REQUEST['show']))
echo $todo->toXML();
exit();
}
/*!\todo needs security for the users */
if (isset($_REQUEST['del']))
{
$cn=new Database(dossier::id());

4
html/js/todo_list.js
View file

@ -34,7 +34,7 @@ function todo_list_show(p_id)
try
{
var action=new Ajax.Request(
'todo_list.php',
'ajax_todo_list.php',
{
method:'get',
parameters:
@ -107,7 +107,7 @@ function todo_list_remove(p_ctl)
var gDossier=$('gDossier').value;
var action=new Ajax.Request(
'todo_list.php',
'ajax_todo_list.php',
{
method:'get',
parameters:

22
html/show_document.php
View file

@ -39,16 +39,22 @@ $User->check_dossier($gDossier);
/* Show the document */
if ( $action == 'sh')
{
// retrieve the document
$doc=new Document($cn,$_REQUEST['d_id']);
$doc->Send();
if ( $User->check_action(VIEWDOC)==1)
{
// retrieve the document
$doc=new Document($cn,$_REQUEST['d_id']);
$doc->Send();
}
}
/* remove the document */
if ( $action == 'rm' )
{
$doc=new Document($cn,$_REQUEST['d_id']);
$doc->remove();
$json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']);
header("Content-type: text/html; charset: utf8",true);
print $json;
if ($User->check_action(RMDOC)==1)
{
$doc=new Document($cn,$_REQUEST['d_id']);
$doc->remove();
$json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']);
header("Content-type: text/html; charset: utf8",true);
print $json;
}
}

18
include/class_calendar.php
View file

@ -135,9 +135,21 @@ class Calendar
function get_preference()
{
$cn=new Database(dossier::id());
$user=new User($cn);
$this->default_periode=$user->get_periode();
return $this->default_periode;
$today=date('d.m.Y');
$p_id=$cn->get_value("
select p_id from parm_periode
where
p_start <= to_date($1,'DD.MM.YYYY')
and
p_end >= to_date($1,'DD.MM.YYYY')",
array($today));
if ( $p_id == '')
{
$user=new User($cn);
$this->default_periode=$user->get_periode();
$p_id=$this->default_periode;
}
return $p_id;
}
/**
*@brief set the periode to the parameter, change the value of $this->default_periode

4
include/class_database.php
View file

@ -160,8 +160,8 @@ class Database
print_r($p_array);
echo $a->getMessage();
echo $a->getTrace();
echo $a->getTraceAsString();
echo pg_last_error($this->db);
echo $a->getTraceAsString();
echo pg_last_error($this->db);
}
throw ($a);
}

8
include/class_todo_list.php
View file

@ -198,11 +198,11 @@ class Todo_List
{
$sql="select tl_id,tl_title,tl_desc,to_char( tl_date,'DD.MM.YYYY') as tl_date
from todo_list where tl_id=$1";
from todo_list where tl_id=$1 and use_login=$2";
$res=$this->cn->exec_sql(
$sql,
array($this->tl_id)
array($this->tl_id,$_SESSION['g_user'])
);
if ( Database::num_row($res) == 0 ) return;
@ -215,8 +215,8 @@ class Todo_List
}
public function delete()
{
$sql="delete from todo_list where tl_id=$1";
$res=$this->cn->exec_sql($sql,array($this->tl_id));
$sql="delete from todo_list where tl_id=$1 and use_login=$2";
$res=$this->cn->exec_sql($sql,array($this->tl_id,$_SESSION['g_user']));
}
/**

2
include/constant.security.php
View file

@ -2,5 +2,7 @@
define ('FICADD',800); /* Ajout de fiche */
define ("FIC",805); //Création, modification et effacement de fiche
define ("FICCAT",910); //création, modification et effacement de catégorie de fiche
define ('RMDOC',1020); // Effacement de document pour follow up
define ('VIEWDOC',1010); // Voir document pour follow up
global $audit; $audit=true;
?>

3
include/template/security_list_action.php
View file

@ -49,3 +49,6 @@
<?php $array=$cn->get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ",
array(800,1000));
display_security_fieldset(_('Fiche'),$array,$sec_User); ?>
<?php $array=$cn->get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ",
array(1050,1100));
display_security_fieldset(_('Suivi'),$array,$sec_User); ?>

3
sql/upgrade.sql
View file

@ -6,7 +6,8 @@ drop table public.import_tmp;
drop table public.format_csv_banque;
insert into parameter values ('MY_ALPHANUM','N');
delete from action where ac_id not in (800,805,910);
insert into action (ac_id,ac_description, ac_module, ac_code) values(1020,'Effacer les documents du suivi','followup','RMDOC');
insert into action (ac_id,ac_description, ac_module, ac_code) values(1010,'Voir les documents du suivi','followup','VIEWDOC');
/*
script SQL to run
*/