From 1d233ea1b72cb791e18a8cf8bf61f50bd552d7f8 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Tue, 15 Nov 2011 10:41:26 +0000 Subject: [PATCH] =?UTF-8?q?#450=20s=C3=A9curit=C3=A9=20ajax=20:=20ajout=20?= =?UTF-8?q?d'action=20code=20cleaning=20:=20renommage=20de=20fichier=20pou?= =?UTF-8?q?r=20ajax?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- html/{todo_list.php => ajax_todo_list.php} | 9 +++++++-- html/js/todo_list.js | 4 ++-- html/show_document.php | 22 ++++++++++++++-------- include/class_calendar.php | 18 +++++++++++++++--- include/class_database.php | 4 ++-- include/class_todo_list.php | 8 ++++---- include/constant.security.php | 2 ++ include/template/security_list_action.php | 3 +++ sql/upgrade.sql | 3 ++- 9 files changed, 51 insertions(+), 22 deletions(-) rename html/{todo_list.php => ajax_todo_list.php} (92%) diff --git a/html/todo_list.php b/html/ajax_todo_list.php similarity index 92% rename from html/todo_list.php rename to html/ajax_todo_list.php index 5ddfd7308..c7dca33c0 100644 --- a/html/todo_list.php +++ b/html/ajax_todo_list.php @@ -38,7 +38,12 @@ require_once ('class_dossier.php'); require_once ('class_todo_list.php'); require_once ('class_database.php'); -/*!\todo needs security for the users */ +$cn=new Database($gDossier); +$user=new User($cn); +$user->check(true); +$user->check_dossier($gDossier,true); +ajax_disconnected('add_todo_list'); + if (isset($_REQUEST['show'])) { $cn=new Database(dossier::id()); @@ -50,7 +55,7 @@ if (isset($_REQUEST['show'])) echo $todo->toXML(); exit(); } -/*!\todo needs security for the users */ + if (isset($_REQUEST['del'])) { $cn=new Database(dossier::id()); diff --git a/html/js/todo_list.js b/html/js/todo_list.js index 1317cb210..972d44313 100644 --- a/html/js/todo_list.js +++ b/html/js/todo_list.js @@ -34,7 +34,7 @@ function todo_list_show(p_id) try { var action=new Ajax.Request( - 'todo_list.php', + 'ajax_todo_list.php', { method:'get', parameters: @@ -107,7 +107,7 @@ function todo_list_remove(p_ctl) var gDossier=$('gDossier').value; var action=new Ajax.Request( - 'todo_list.php', + 'ajax_todo_list.php', { method:'get', parameters: diff --git a/html/show_document.php b/html/show_document.php index eb342a3fd..8510841da 100644 --- a/html/show_document.php +++ b/html/show_document.php @@ -39,16 +39,22 @@ $User->check_dossier($gDossier); /* Show the document */ if ( $action == 'sh') { - // retrieve the document - $doc=new Document($cn,$_REQUEST['d_id']); - $doc->Send(); + if ( $User->check_action(VIEWDOC)==1) + { + // retrieve the document + $doc=new Document($cn,$_REQUEST['d_id']); + $doc->Send(); + } } /* remove the document */ if ( $action == 'rm' ) { - $doc=new Document($cn,$_REQUEST['d_id']); - $doc->remove(); - $json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']); - header("Content-type: text/html; charset: utf8",true); - print $json; + if ($User->check_action(RMDOC)==1) + { + $doc=new Document($cn,$_REQUEST['d_id']); + $doc->remove(); + $json=sprintf('{"d_id":"%s"}',$_REQUEST['d_id']); + header("Content-type: text/html; charset: utf8",true); + print $json; + } } diff --git a/include/class_calendar.php b/include/class_calendar.php index 8e664fd22..e55419ed3 100644 --- a/include/class_calendar.php +++ b/include/class_calendar.php @@ -135,9 +135,21 @@ class Calendar function get_preference() { $cn=new Database(dossier::id()); - $user=new User($cn); - $this->default_periode=$user->get_periode(); - return $this->default_periode; + $today=date('d.m.Y'); + $p_id=$cn->get_value(" + select p_id from parm_periode + where + p_start <= to_date($1,'DD.MM.YYYY') + and + p_end >= to_date($1,'DD.MM.YYYY')", + array($today)); + if ( $p_id == '') + { + $user=new User($cn); + $this->default_periode=$user->get_periode(); + $p_id=$this->default_periode; + } + return $p_id; } /** *@brief set the periode to the parameter, change the value of $this->default_periode diff --git a/include/class_database.php b/include/class_database.php index 6d3622f02..54458a29c 100644 --- a/include/class_database.php +++ b/include/class_database.php @@ -160,8 +160,8 @@ class Database print_r($p_array); echo $a->getMessage(); echo $a->getTrace(); - echo $a->getTraceAsString(); - echo pg_last_error($this->db); + echo $a->getTraceAsString(); + echo pg_last_error($this->db); } throw ($a); } diff --git a/include/class_todo_list.php b/include/class_todo_list.php index 0595661c5..7a3e48181 100644 --- a/include/class_todo_list.php +++ b/include/class_todo_list.php @@ -198,11 +198,11 @@ class Todo_List { $sql="select tl_id,tl_title,tl_desc,to_char( tl_date,'DD.MM.YYYY') as tl_date - from todo_list where tl_id=$1"; + from todo_list where tl_id=$1 and use_login=$2"; $res=$this->cn->exec_sql( $sql, - array($this->tl_id) + array($this->tl_id,$_SESSION['g_user']) ); if ( Database::num_row($res) == 0 ) return; @@ -215,8 +215,8 @@ class Todo_List } public function delete() { - $sql="delete from todo_list where tl_id=$1"; - $res=$this->cn->exec_sql($sql,array($this->tl_id)); + $sql="delete from todo_list where tl_id=$1 and use_login=$2"; + $res=$this->cn->exec_sql($sql,array($this->tl_id,$_SESSION['g_user'])); } /** diff --git a/include/constant.security.php b/include/constant.security.php index 3d8039fd3..d5d077db5 100644 --- a/include/constant.security.php +++ b/include/constant.security.php @@ -2,5 +2,7 @@ define ('FICADD',800); /* Ajout de fiche */ define ("FIC",805); //Création, modification et effacement de fiche define ("FICCAT",910); //création, modification et effacement de catégorie de fiche +define ('RMDOC',1020); // Effacement de document pour follow up +define ('VIEWDOC',1010); // Voir document pour follow up global $audit; $audit=true; ?> diff --git a/include/template/security_list_action.php b/include/template/security_list_action.php index bfae79a20..9ba11715b 100644 --- a/include/template/security_list_action.php +++ b/include/template/security_list_action.php @@ -49,3 +49,6 @@ get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ", array(800,1000)); display_security_fieldset(_('Fiche'),$array,$sec_User); ?> + get_array("select ac_id, ac_description from action where ac_id >=$1 and ac_id <=$2 order by ac_id ", + array(1050,1100)); + display_security_fieldset(_('Suivi'),$array,$sec_User); ?> diff --git a/sql/upgrade.sql b/sql/upgrade.sql index ad6562fa9..2a937f9eb 100644 --- a/sql/upgrade.sql +++ b/sql/upgrade.sql @@ -6,7 +6,8 @@ drop table public.import_tmp; drop table public.format_csv_banque; insert into parameter values ('MY_ALPHANUM','N'); delete from action where ac_id not in (800,805,910); - +insert into action (ac_id,ac_description, ac_module, ac_code) values(1020,'Effacer les documents du suivi','followup','RMDOC'); +insert into action (ac_id,ac_description, ac_module, ac_code) values(1010,'Voir les documents du suivi','followup','VIEWDOC'); /* script SQL to run */