diff --git a/html/todo_list.php b/html/ajax_todo_list.php
similarity index 92%
rename from html/todo_list.php
rename to html/ajax_todo_list.php
index 5ddfd7308..c7dca33c0 100644
--- a/html/todo_list.php
+++ b/html/ajax_todo_list.php
@@ -38,7 +38,12 @@ require_once ('class_dossier.php');
require_once ('class_todo_list.php');
require_once ('class_database.php');
-/*!\todo needs security for the users */
+$cn=new Database($gDossier);
+$user=new User($cn);
+$user->check(true);
+$user->check_dossier($gDossier,true);
+ajax_disconnected('add_todo_list');
+
if (isset($_REQUEST['show']))
{
$cn=new Database(dossier::id());
@@ -50,7 +55,7 @@ if (isset($_REQUEST['show']))
echo $todo->toXML();
exit();
}
-/*!\todo needs security for the users */
+
if (isset($_REQUEST['del']))
{
$cn=new Database(dossier::id());
diff --git a/html/js/todo_list.js b/html/js/todo_list.js
index 1317cb210..972d44313 100644
--- a/html/js/todo_list.js
+++ b/html/js/todo_list.js
@@ -34,7 +34,7 @@ function todo_list_show(p_id)
try
{
var action=new Ajax.Request(
- 'todo_list.php',
+ 'ajax_todo_list.php',
{
method:'get',
parameters:
@@ -107,7 +107,7 @@ function todo_list_remove(p_ctl)
var gDossier=$('gDossier').value;
var action=new Ajax.Request(
- 'todo_list.php',
+ 'ajax_todo_list.php',
{
method:'get',
parameters:
diff --git a/html/show_document.php b/html/show_document.php
index eb342a3fd..8510841da 100644
--- a/html/show_document.php
+++ b/html/show_document.php
@@ -39,16 +39,22 @@ $User->check_dossier($gDossier);
/* Show the document */
if ( $action == 'sh')
{
- // retrieve the document
- $doc=new Document($cn,$_REQUEST['d_id']);
- $doc->Send();
+ if ( $User->check_action(VIEWDOC)==1)
+ {
+ // retrieve the document
+ $doc=new Document($cn,$_REQUEST['d_id']);
+ $doc->Send();
+ }
}
/* remove the document */
if ( $action == 'rm' )
{
- $doc=new Document($cn,$_REQUEST['d_id']);
- $doc->remove();
- $json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']);
- header("Content-type: text/html; charset: utf8",true);
- print $json;
+ if ($User->check_action(RMDOC)==1)
+ {
+ $doc=new Document($cn,$_REQUEST['d_id']);
+ $doc->remove();
+ $json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']);
+ header("Content-type: text/html; charset: utf8",true);
+ print $json;
+ }
}
diff --git a/include/class_calendar.php b/include/class_calendar.php
index 8e664fd22..e55419ed3 100644
--- a/include/class_calendar.php
+++ b/include/class_calendar.php
@@ -135,9 +135,21 @@ class Calendar
function get_preference()
{
$cn=new Database(dossier::id());
- $user=new User($cn);
- $this->default_periode=$user->get_periode();
- return $this->default_periode;
+ $today=date('d.m.Y');
+ $p_id=$cn->get_value("
+ select p_id from parm_periode
+ where
+ p_start <= to_date($1,'DD.MM.YYYY')
+ and
+ p_end >= to_date($1,'DD.MM.YYYY')",
+ array($today));
+ if ( $p_id == '')
+ {
+ $user=new User($cn);
+ $this->default_periode=$user->get_periode();
+ $p_id=$this->default_periode;
+ }
+ return $p_id;
}
/**
*@brief set the periode to the parameter, change the value of $this->default_periode
diff --git a/include/class_database.php b/include/class_database.php
index 6d3622f02..54458a29c 100644
--- a/include/class_database.php
+++ b/include/class_database.php
@@ -160,8 +160,8 @@ class Database
print_r($p_array);
echo $a->getMessage();
echo $a->getTrace();
- echo $a->getTraceAsString();
- echo pg_last_error($this->db);
+ echo $a->getTraceAsString();
+ echo pg_last_error($this->db);
}
throw ($a);
}
diff --git a/include/class_todo_list.php b/include/class_todo_list.php
index 0595661c5..7a3e48181 100644
--- a/include/class_todo_list.php
+++ b/include/class_todo_list.php
@@ -198,11 +198,11 @@ class Todo_List
{
$sql="select tl_id,tl_title,tl_desc,to_char( tl_date,'DD.MM.YYYY') as tl_date
- from todo_list where tl_id=$1";
+ from todo_list where tl_id=$1 and use_login=$2";
$res=$this->cn->exec_sql(
$sql,
- array($this->tl_id)
+ array($this->tl_id,$_SESSION['g_user'])
);
if ( Database::num_row($res) == 0 ) return;
@@ -215,8 +215,8 @@ class Todo_List
}
public function delete()
{
- $sql="delete from todo_list where tl_id=$1";
- $res=$this->cn->exec_sql($sql,array($this->tl_id));
+ $sql="delete from todo_list where tl_id=$1 and use_login=$2";
+ $res=$this->cn->exec_sql($sql,array($this->tl_id,$_SESSION['g_user']));
}
/**
diff --git a/include/constant.security.php b/include/constant.security.php
index 3d8039fd3..d5d077db5 100644
--- a/include/constant.security.php
+++ b/include/constant.security.php
@@ -2,5 +2,7 @@
define ('FICADD',800); /* Ajout de fiche */
define ("FIC",805); //Création, modification et effacement de fiche
define ("FICCAT",910); //création, modification et effacement de catégorie de fiche
+define ('RMDOC',1020); // Effacement de document pour follow up
+define ('VIEWDOC',1010); // Voir document pour follow up
global $audit; $audit=true;
?>
diff --git a/include/template/security_list_action.php b/include/template/security_list_action.php
index bfae79a20..9ba11715b 100644
--- a/include/template/security_list_action.php
+++ b/include/template/security_list_action.php
@@ -49,3 +49,6 @@
get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ",
array(800,1000));
display_security_fieldset(_('Fiche'),$array,$sec_User); ?>
+ get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ",
+ array(1050,1100));
+ display_security_fieldset(_('Suivi'),$array,$sec_User); ?>
diff --git a/sql/upgrade.sql b/sql/upgrade.sql
index ad6562fa9..2a937f9eb 100644
--- a/sql/upgrade.sql
+++ b/sql/upgrade.sql
@@ -6,7 +6,8 @@ drop table public.import_tmp;
drop table public.format_csv_banque;
insert into parameter values ('MY_ALPHANUM','N');
delete from action where ac_id not in (800,805,910);
-
+insert into action (ac_id,ac_description, ac_module, ac_code) values(1020,'Effacer les documents du suivi','followup','RMDOC');
+insert into action (ac_id,ac_description, ac_module, ac_code) values(1010,'Voir les documents du suivi','followup','VIEWDOC');
/*
script SQL to run
*/