diff --git a/html/ajax.php b/html/ajax.php index 5bf62668d..4219a4cda 100644 --- a/html/ajax.php +++ b/html/ajax.php @@ -56,7 +56,7 @@ if (isset($_REQUEST['plugin_code']) ) if ( $ext->search($_REQUEST['plugin_code']) != -1) { /* security */ - if ( !isset ($_SESSION['g_user']) || $ext->can_request($_SESSION['g_user']) == 0 ) + if ( !isset ($_SESSION[SESSION_KEY.'g_user']) || $ext->can_request($_SESSION[SESSION_KEY.'g_user']) == 0 ) { exit(); } diff --git a/html/do.php b/html/do.php index 49a2dccea..9a8641286 100644 --- a/html/do.php +++ b/html/do.php @@ -42,7 +42,7 @@ if ( ! isset($_REQUEST['gDossier'])) redirect('user_login.php'); exit(); } -if ( ! isset ($_SESSION['g_theme'])) +if ( ! isset ($_SESSION[SESSION_KEY.'g_theme'])) { echo "

"._('Vous êtes déconnecté')."

"; $backurl=$_SERVER['REQUEST_URI']; @@ -68,7 +68,7 @@ if ( ! $cn->exist_table('version')) { return; } -$style_user=$http->post("style_user","string",$_SESSION['g_theme']); +$style_user=$http->post("style_user","string",$_SESSION[SESSION_KEY.'g_theme']); html_page_start($style_user); if ( DEBUG ) { diff --git a/html/extension.raw.php b/html/extension.raw.php index d8f8abb72..99a5729dd 100644 --- a/html/extension.raw.php +++ b/html/extension.raw.php @@ -45,7 +45,7 @@ $ext=new Extension($cn); if ( $ext->search($http->request("plugin_code")) != -1 ) { /* security */ - if ( !isset ($_SESSION['g_user']) || $ext->can_request($_SESSION['g_user']) == 0 ) + if ( !isset ($_SESSION[SESSION_KEY.'g_user']) || $ext->can_request($_SESSION[SESSION_KEY.'g_user']) == 0 ) { exit(); } diff --git a/html/fid.php b/html/fid.php index 2b6c38964..471a08de9 100644 --- a/html/fid.php +++ b/html/fid.php @@ -56,7 +56,7 @@ $fTva_id=$hi->request("t","string","none"); $fPrice_sale=$hi->request("p","string","none"); $fPrice_purchase=$hi->request("b","string","none"); -if ( isset($_SESSION['isValid']) && $_SESSION['isValid'] == 1) +if ( isset($_SESSION[SESSION_KEY.'isValid']) && $_SESSION[SESSION_KEY.'isValid'] == 1) { $jrn=$hi->get('j', "number",'-1'); $d=$hi->get('d',"string", ''); diff --git a/html/install.php b/html/install.php index 821df7a8c..7e4ff5d8f 100644 --- a/html/install.php +++ b/html/install.php @@ -145,7 +145,7 @@ load_all_script(); echo '
'; if ( $_GET['lang'] == "en_US.utf8" || $_GET['lang']=='fr_FR.utf8') { - $_SESSION['g_lang']=$_GET['lang']; + $_SESSION[SESSION_KEY.'g_lang']=$_GET['lang']; set_language(); } ?> diff --git a/html/login.php b/html/login.php index 089040878..face7be1a 100644 --- a/html/login.php +++ b/html/login.php @@ -39,8 +39,8 @@ if ( isset ($_POST["p_user"] ) ) { $g_user=strtolower(sql_string($_POST["p_user"])); $g_pass=$_POST["p_pass"]; - $_SESSION['g_user']=$g_user; - $_SESSION['g_pass']=$g_pass; + $_SESSION[SESSION_KEY.'g_user']=$g_user; + $_SESSION[SESSION_KEY.'g_pass']=$g_pass; diff --git a/html/popup.php b/html/popup.php index b985af528..44bfdf57d 100644 --- a/html/popup.php +++ b/html/popup.php @@ -32,7 +32,7 @@ $http=new HttpInput(); /* * Check if the user is still connected */ -if ( ! isset ($_SESSION['g_user'] ) ) +if ( ! isset ($_SESSION[SESSION_KEY.'g_user'] ) ) { echo "

"._('Vous êtes déconnecté')."

"; $backurl=$_SERVER['REQUEST_URI']; @@ -42,7 +42,7 @@ if ( ! isset ($_SESSION['g_user'] ) ) } -html_page_start($_SESSION['g_theme']); +html_page_start($_SESSION[SESSION_KEY.'g_theme']); echo '
'; ?> '; @@ -203,7 +203,7 @@ class User else { if ($from == 'LOGIN') - $cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $from, $_SERVER['REQUEST_URI'], 'SUCCESS')); + $cn->exec_sql($sql, array($_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $from, $_SERVER['REQUEST_URI'], 'SUCCESS')); $this->valid = 1; } @@ -597,7 +597,7 @@ class User { $cn = new Database(); $sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)"; - $cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $p_action_id, $_SERVER['REQUEST_URI'], 'FAIL')); + $cn->exec_sql($sql, array($_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $p_action_id, $_SERVER['REQUEST_URI'], 'FAIL')); } return 0; } @@ -654,7 +654,7 @@ class User $this->load_global_pref(); return; } - $_SESSION[$name] = $line[$parameter]; + $_SESSION[SESSION_KEY.$name] = $line[$parameter]; } } @@ -1094,7 +1094,7 @@ class User $sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)"; $cn->exec_sql($sql, array( - $_SESSION['g_user'], + $_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $p_module, $_SERVER['REQUEST_URI'], @@ -1115,7 +1115,7 @@ class User $sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)"; $cn->exec_sql($sql, array( - $_SESSION['g_user'], + $_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $p_module, $_SERVER['REQUEST_URI'], @@ -1293,8 +1293,8 @@ class User if ($p_pass1 == $p_pass2) { $repo = new Database(); $l_pass = md5($_POST['pass_1']); - $repo->exec_sql("update ac_users set use_pass=$1 where use_login=$2", array($l_pass, $_SESSION['g_user'])); - $_SESSION['g_pass'] = $_POST['pass_1']; + $repo->exec_sql("update ac_users set use_pass=$1 where use_login=$2", array($l_pass, $_SESSION[SESSION_KEY.'g_user'])); + $_SESSION[SESSION_KEY.'g_pass'] = $_POST['pass_1']; } else { alert(_("Les mots de passe ne correspondent pas. Mot de passe inchangé")); } @@ -1306,7 +1306,7 @@ class User function save_email($p_email) { $repo=new Database(); - $repo->exec_sql("update ac_users set use_email=$1 where use_login=$2", array($p_email, $_SESSION['g_user'])); + $repo->exec_sql("update ac_users set use_email=$1 where use_login=$2", array($p_email, $_SESSION[SESSION_KEY.'g_user'])); } /** * Remove a user and all his privileges diff --git a/include/config.inc.example b/include/config.inc.example index 65650be22..e1be7d1be 100644 --- a/include/config.inc.example +++ b/include/config.inc.example @@ -69,4 +69,6 @@ define ("dbname",""); // In recent distribution linux, pdftk is a snap, you should set the path // for exporting document in PDF // $pdftk = /usr/bin/pdftk -// $pdftk = /snap/bin/pdftk +// $pdftk = /snap/bin/pdftk +// Define a random session key if you work with different version of NOALYSS +// define ('SESSION_KEY','abcde'); diff --git a/include/constant.php b/include/constant.php index 5aa3a4da6..feaf0812c 100644 --- a/include/constant.php +++ b/include/constant.php @@ -51,7 +51,9 @@ if ( !defined("FIX_BROKEN_PDF")) define ("FIX_BROKEN_PDF",'NO'); if ( !defined('NOALYSS_ADMINISTRATOR')) { define ('NOALYSS_ADMINISTRATOR','phpcompta'); } - +if (!defined ("SESSION_KEY")) { + define ("SESSION_KEY","RtYu0uu"); +} require_once NOALYSS_INCLUDE.'/constant.security.php'; if ( strpos($inc_path,";") != 0 ) { diff --git a/include/extension_choice.inc.php b/include/extension_choice.inc.php index afca41139..ba5a2484e 100644 --- a/include/extension_choice.inc.php +++ b/include/extension_choice.inc.php @@ -14,7 +14,7 @@ require_once NOALYSS_INCLUDE.'/lib/iselect.class.php'; require_once NOALYSS_INCLUDE.'/constant.security.php'; require_once NOALYSS_INCLUDE.'/class/user.class.php'; echo '
'; -@html_page_start($_SESSION['g_theme']); +@html_page_start($_SESSION[SESSION_KEY.'g_theme']); $cn=Dossier::connect(); global $g_user; diff --git a/include/fiche.inc.php b/include/fiche.inc.php index 91fa20bdb..39f118988 100644 --- a/include/fiche.inc.php +++ b/include/fiche.inc.php @@ -206,7 +206,7 @@ if ($histo->selected == -1) // Create nav bar $max = $cn->get_value("select count(*) from fiche as f " . $cond); - $step = $_SESSION['g_pagesize']; + $step = $_SESSION[SESSION_KEY.'g_pagesize']; $page = (isset($_GET['offset'])) ? $_GET['page'] : 1; $offset = (isset($_GET['offset'])) ? $_GET['offset'] : 0; $bar = navigation_bar($offset, $max, $step, $page); diff --git a/include/history_operation.inc.php b/include/history_operation.inc.php index d61658e67..ed6f5168b 100644 --- a/include/history_operation.inc.php +++ b/include/history_operation.inc.php @@ -107,7 +107,7 @@ else list($sql, $where) = $Ledger->build_search_sql($p_array); $max_line = $cn->count_sql($sql); -$step = $_SESSION['g_pagesize']; +$step = $_SESSION[SESSION_KEY.'g_pagesize']; $page = (isset($_GET['offset'])) ? $http->get('page') : 1; $offset = (isset($_GET['offset'])) ? $http->get('offset') : 0; diff --git a/include/lib/ac_common.php b/include/lib/ac_common.php index c6c30e7d1..71e85fba2 100644 --- a/include/lib/ac_common.php +++ b/include/lib/ac_common.php @@ -344,11 +344,11 @@ function html_page_start($p_theme="", $p_script="", $p_script2="") echo ' '; - if (isset($_SESSION['g_lang']) && $_SESSION['g_lang']=='fr_FR.utf8' ) + if (isset($_SESSION[SESSION_KEY.'g_lang']) && $_SESSION[SESSION_KEY.'g_lang']=='fr_FR.utf8' ) { echo ''; } - if (isset($_SESSION['g_lang']) && $_SESSION['g_lang']=='nl_NL.utf8' ) + if (isset($_SESSION[SESSION_KEY.'g_lang']) && $_SESSION[SESSION_KEY.'g_lang']=='nl_NL.utf8' ) { echo ''; } @@ -357,7 +357,7 @@ function html_page_start($p_theme="", $p_script="", $p_script2="") '; // language - if (isset($_SESSION['g_lang'])) + if (isset($_SESSION[SESSION_KEY.'g_lang'])) { set_language(); } @@ -710,7 +710,7 @@ function set_language() { // desactivate local check if ( defined("LOCALE") && LOCALE==0 ) return; - if ( ! isset ($_SESSION['g_lang'])) return; + if ( ! isset ($_SESSION[SESSION_KEY.'g_lang'])) return; /* * If translation is not supported by current @@ -721,12 +721,12 @@ function set_language() // set differently the language depending of the operating system if (what_os() == 1) { - $dir = setlocale(LC_MESSAGES, $_SESSION['g_lang']); + $dir = setlocale(LC_MESSAGES, $_SESSION[SESSION_KEY.'g_lang']); if ($dir == "") { $g_lang = 'fr_FR.utf8'; $dir = setlocale(LC_MESSAGES, $g_lang); - // echo '' . $_SESSION['g_lang'] . ' domaine non supporté'; + // echo '' . $_SESSION[SESSION_KEY.'g_lang'] . ' domaine non supporté'; } bindtextdomain('messages', NOALYSS_HOME.'/lang'); textdomain('messages'); @@ -735,8 +735,8 @@ function set_language() return; } // for windows - putenv('LANG=' . $_SESSION['g_lang']); - $dir = setlocale(LC_ALL, $_SESSION['g_lang']); + putenv('LANG=' . $_SESSION[SESSION_KEY.'g_lang']); + $dir = setlocale(LC_ALL, $_SESSION[SESSION_KEY.'g_lang']); bindtextdomain('messages', '.\\lang'); textdomain('messages'); bind_textdomain_codeset('messages', 'UTF8'); @@ -851,9 +851,9 @@ function format_date($p_date, $p_from_format = 'YYYY-MM-DD',$p_to_format='DD.MM. function ajax_disconnected($div) { /** - * if $_SESSION['g_user'] is not set : echo a warning + * if $_SESSION[SESSION_KEY.'g_user'] is not set : echo a warning */ - if (!isset($_SESSION['g_user'])) + if (!isset($_SESSION[SESSION_KEY.'g_user'])) { $script = 'var a=$("' . $div . '");a.style.height="70%";a.style.width="60%";'; $script.='a.style.top=posY-20+offsetY;a.style.left=posX+offsetX;'; diff --git a/include/lib/icard.class.php b/include/lib/icard.class.php index 9fbb74153..f1dc2367f 100644 --- a/include/lib/icard.class.php +++ b/include/lib/icard.class.php @@ -344,7 +344,7 @@ class ICard extends HtmlInput static public function test_me() { require_once NOALYSS_INCLUDE.'/lib/itext.class.php'; - $_SESSION['isValid']=1; + $_SESSION[SESSION_KEY.'isValid']=1; $a=new ICard('testme'); $a->extra="all"; $a->set_attribute('label', 'ctl_label'); diff --git a/include/lib/idate.class.php b/include/lib/idate.class.php index ea1a105d6..3deb069a9 100644 --- a/include/lib/idate.class.php +++ b/include/lib/idate.class.php @@ -18,16 +18,17 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ -// Copyright Author Dany De Bontridder danydb@aevalys.eu +// Copyright Author Dany De Bontridder danydb@noalyss.eu /** *\file - \brief Html Input + \brief Html Input Date type */ /// Html Input : Input a date format dd.mm.yyyy /// The property title should be set to indicate what it is expected +/// @see calendar-setup.js require_once NOALYSS_INCLUDE.'/lib/html_input.class.php'; class IDate extends HtmlInput @@ -74,14 +75,15 @@ class IDate extends HtmlInput ',$this->name,$this->id,$this->value,$this->placeholder,$this->title,$this->id ); - + // @see calendar-setup.js $r.=sprintf('' ,$this->id,$this->id); diff --git a/include/lib/noalyss_csv.class.php b/include/lib/noalyss_csv.class.php index 669403431..7e5675782 100644 --- a/include/lib/noalyss_csv.class.php +++ b/include/lib/noalyss_csv.class.php @@ -46,10 +46,10 @@ class Noalyss_Csv $this->size=0; $a_field=[';',',']; - $this->sep_field=$a_field[$_SESSION['csv_fieldsep']]; + $this->sep_field=$a_field[$_SESSION[SESSION_KEY.'csv_fieldsep']]; $a_field=['.',',']; - $this->sep_dec=$a_field[$_SESSION['csv_decimal']]; - $this->encoding=$_SESSION['csv_encoding']; + $this->sep_dec=$a_field[$_SESSION[SESSION_KEY.'csv_decimal']]; + $this->encoding=$_SESSION[SESSION_KEY.'csv_encoding']; } diff --git a/include/lib/user_common.php b/include/lib/user_common.php index 5c77c616c..5a2be362a 100644 --- a/include/lib/user_common.php +++ b/include/lib/user_common.php @@ -69,7 +69,7 @@ function isValid_deprecrated ($p_cn,$p_grpt_id) * \param $p_javascript javascript code to add * \note example : \verbatim - $step=$_SESSION['g_pagesize']; + $step=$_SESSION[SESSION_KEY.'g_pagesize']; $page=(isset($_GET['offset']))?$_GET['page']:1; $offset=(isset($_GET['offset']))?$_GET['offset']:0; @@ -82,10 +82,10 @@ function navigation_bar($p_offset,$p_line,$p_size=0,$p_page=1,$p_javascript="") { // if the pagesize is unlimited return "" // in that case there is no nav. bar - if ( $_SESSION['g_pagesize'] == -1 ) return ""; + if ( $_SESSION[SESSION_KEY.'g_pagesize'] == -1 ) return ""; if ( $p_size==0) { - $p_size= $_SESSION['g_pagesize']; + $p_size= $_SESSION[SESSION_KEY.'g_pagesize']; } // if there is no row return an empty string if ( $p_line == 0 ) return ""; diff --git a/include/template/module.php b/include/template/module.php index 2f792438b..09e635b23 100644 --- a/include/template/module.php +++ b/include/template/module.php @@ -11,14 +11,14 @@ get_value("select count(*) from profile join profile_user using (p_id) - where user_name=$1 and with_calc=true",array($_SESSION['g_user'])) ==1): + where user_name=$1 and with_calc=true",array($_SESSION[SESSION_KEY.'g_user'])) ==1): echo '
'; echo IButton::show_calc(); echo '
'; endif; if ( $cn->get_value("select count(*) from profile join profile_user using (p_id) - where user_name=$1 and with_direct_form=true",array($_SESSION['g_user'])) ==1): + where user_name=$1 and with_direct_form=true",array($_SESSION[SESSION_KEY.'g_user'])) ==1): ?>
diff --git a/include/template/todo_list_display.php b/include/template/todo_list_display.php index ea4844ef9..3171c183b 100644 --- a/include/template/todo_list_display.php +++ b/include/template/todo_list_display.php @@ -100,7 +100,7 @@ echo HtmlInput::title_box("Note","todo_list_div".$this->tl_id,'close',$close_sha tl_id) ?>

    - use_login == $_SESSION['g_user']) : ?> + use_login == $_SESSION[SESSION_KEY.'g_user']) : ?>
  1. diff --git a/unit-test/global.example.php b/unit-test/global.example.php index 70f4ab106..69e2a515b 100644 --- a/unit-test/global.example.php +++ b/unit-test/global.example.php @@ -28,7 +28,7 @@ define ("DOSSIER",48); $_REQUEST['gDossier'] = DOSSIER; $g_connection=new Database(DOSSIER); $g_parameter = new Noalyss_Parameter_Folder($g_connection); -$_SESSION['g_user']='phpcompta'; -$_SESSION['g_pass']='dany'; -$_SESSION['g_pagesize']='50'; +$_SESSION[SESSION_KEY.'g_user']='phpcompta'; +$_SESSION[SESSION_KEY.'g_pass']='dany'; +$_SESSION[SESSION_KEY.'g_pagesize']='50'; $g_user=new User($g_connection); diff --git a/unit-test/global.php b/unit-test/global.php index e2271a2da..0d4a00530 100644 --- a/unit-test/global.php +++ b/unit-test/global.php @@ -29,9 +29,9 @@ if (!defined("DOSSIER"))define ("DOSSIER",25); $_REQUEST['gDossier'] = DOSSIER; $g_connection=new Database(DOSSIER); $g_parameter = new Noalyss_Parameter_Folder($g_connection); -$_SESSION['g_user']='admin'; -$_SESSION['g_pass']='phpcompta'; -$_SESSION['g_pagesize']='50'; +$_SESSION[SESSION_KEY.'g_user']='admin'; +$_SESSION[SESSION_KEY.'g_pass']='phpcompta'; +$_SESSION[SESSION_KEY.'g_pagesize']='50'; $g_user=new User($g_connection); require_once __DIR__.'/facility.class.php'; \ No newline at end of file