admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Task #1127 - Ajout évenement depuis tableau de bord ou agenda

Browse source 
#1127 add security
This commit is contained in:
Dany De Bontridder 2015-08-15 08:41:47 +02:00
parent a04bccd5d5
commit 36b21ccde4
4 changed files with 44 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
include/action.common.inc.php
View file

@ -203,8 +203,8 @@ if ($sub_action == 'detail')
echo $act->Display('UPD', false, $base, $retour);
echo '<input type="hidden" name="sa" value="update">';
echo HtmlInput::submit("save", "Sauve");
echo HtmlInput::submit("add_action_here", _("Ajoute une action à celle-ci"));
echo HtmlInput::submit("delete", _("Efface cette action"), ' onclick="return confirm(\'' . _("Vous confirmez l\'effacement") . '\')" ');
echo HtmlInput::submit("add_action_here", _("Ajoute un événement à celui-ci"));
echo HtmlInput::submit("delete", _("Efface cet événement "), ' onclick="return confirm(\'' . _("Vous confirmez l\'effacement") . '\')" ');
echo $retour;
echo '</form>';
}
@ -269,11 +269,11 @@ if ($sub_action == "save_action_st2")
// insert into action_gestion
echo $act->save();
$url = "?$base&sa=detail&ag_id=" . $act->ag_id . '&' . dossier::get();
echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Action Sauvée').' : ' . $act->ag_ref) . '</a></p>';
echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Evènement Sauvée').' : ' . $act->ag_ref) . '</a></p>';
Follow_Up::show_action_list($cn,$base);
$url = "?$base&sa=detail&ag_id=" . $act->ag_id . '&' . dossier::get();
echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Action Sauvée').' : ' . $act->ag_ref) . '</a></p>';
echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Evènement Sauvée').' : ' . $act->ag_ref) . '</a></p>';
} catch (Exception $e)
{
echo '<span class="notice">';

10
include/ajax_gestion.php
View file

@ -106,7 +106,15 @@ if ($op=='action_save')
$gestion->dt_id=$type_event;
$gestion->ag_comment=h($summary);
$gestion->ag_timestamp=$date_event;
$gestion->save_short();
$content=_('Sauvé');
$status='OK';
try {
$gestion->save_short();
} catch (Exception $ex)
{
$content=$ex->getMessage();
$status='NOK';
}
header('Content-type: text/xml; charset=UTF-8');
$dom=new DOMDocument('1.0', 'UTF-8');
$xml_content=$dom->createElement('content', _("Sauvé"));

12
include/class_follow_up.php
View file

@ -1765,10 +1765,20 @@ class Follow_Up
include 'template/action_display_short.php';
}
/**
*
* Add an event , with the minimum of informations,
* used in Dashboard and Scheduler
*/
function save_short()
{
global $g_user;
// check if we can add
if ($g_user->can_add_action($this->ag_dest) == FALSE )
{
throw new Exception(_('SECURITE : Ajout impossible'));
}
// Get The sequence id,
$seq_name="seq_doc_type_".$this->dt_id;
$str_file="";

21
include/class_user.php
View file

@ -1113,6 +1113,25 @@ class User
user_name=$1", array($this->login));
return $profile;
}
/**
* Check if the current user can add an action in the profile given
* in parameter
* @param type $p_profile profile.p_id = action_gestion.ag_dest
* @return boolean
*/
function can_add_action($p_profile)
{
$r=$this->db->get_value (' select count(*)
from user_sec_action_profile
where p_granted=$1
and p_id=$2',
array($this->get_profile(),$p_profile));
if ($r == 0 )
{
return false;
}
return true;
}
/**
*Check if the profile of the user can write for this profile
* @param $dtoc action_gestion.ag_id
@ -1122,7 +1141,7 @@ class User
{
if ( $this->Admin() == 1 ) return true;
$profile = $this->get_profile();
$r = $this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
$r = $this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
(select p_granted from user_sec_action_profile where ua_right='W' and p_id=$2) ", array($dtoc, $profile));
if ($r == 0)
return false;