From 36b21ccde4ebe244a14d5e7d4bf7c3264a4ef486 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Sat, 15 Aug 2015 08:41:47 +0200
Subject: [PATCH] =?UTF-8?q?Task=20#1127=20-=20Ajout=20=C3=A9venement=20dep?=
 =?UTF-8?q?uis=20tableau=20de=20bord=20ou=20agenda=20#1127=20add=20securit?=
 =?UTF-8?q?y?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 include/action.common.inc.php |  8 ++++----
 include/ajax_gestion.php      | 10 +++++++++-
 include/class_follow_up.php   | 12 +++++++++++-
 include/class_user.php        | 21 ++++++++++++++++++++-
 4 files changed, 44 insertions(+), 7 deletions(-)

diff --git a/include/action.common.inc.php b/include/action.common.inc.php
index 9e29f9abb..df9943e44 100644
--- a/include/action.common.inc.php
+++ b/include/action.common.inc.php
@@ -203,8 +203,8 @@ if ($sub_action == 'detail')
 		echo $act->Display('UPD', false, $base, $retour);
 		echo '<input type="hidden" name="sa" value="update">';
 		echo HtmlInput::submit("save", "Sauve");
-		echo HtmlInput::submit("add_action_here", _("Ajoute une action à celle-ci"));
-		echo HtmlInput::submit("delete", _("Efface cette action"), ' onclick="return confirm(\'' . _("Vous confirmez l\'effacement") . '\')" ');
+		echo HtmlInput::submit("add_action_here", _("Ajoute un événement à celui-ci"));
+		echo HtmlInput::submit("delete", _("Efface cet événement "), ' onclick="return confirm(\'' . _("Vous confirmez l\'effacement") . '\')" ');
 		echo $retour;
 		echo '</form>';
 	}
@@ -269,11 +269,11 @@ if ($sub_action == "save_action_st2")
 	// insert into action_gestion
 	echo $act->save();
 	$url = "?$base&sa=detail&ag_id=" . $act->ag_id . '&' . dossier::get();
-	echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Action Sauvée').'  : ' . $act->ag_ref) . '</a></p>';
+	echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Evènement Sauvée').'  : ' . $act->ag_ref) . '</a></p>';
 
 	Follow_Up::show_action_list($cn,$base);
 	$url = "?$base&sa=detail&ag_id=" . $act->ag_id . '&' . dossier::get();
-	echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Action Sauvée').'  : ' . $act->ag_ref) . '</a></p>';
+	echo '<p><a class="mtitle" href="' . $url . '">' . hb(_('Evènement Sauvée').'  : ' . $act->ag_ref) . '</a></p>';
     } catch (Exception $e)
     {
         echo '<span class="notice">';
diff --git a/include/ajax_gestion.php b/include/ajax_gestion.php
index 67aee1fd0..830acd97e 100644
--- a/include/ajax_gestion.php
+++ b/include/ajax_gestion.php
@@ -106,7 +106,15 @@ if ($op=='action_save')
     $gestion->dt_id=$type_event;
     $gestion->ag_comment=h($summary);
     $gestion->ag_timestamp=$date_event;
-    $gestion->save_short();
+    $content=_('Sauvé');
+    $status='OK';
+    try {
+        $gestion->save_short();
+    } catch (Exception $ex)
+    {
+        $content=$ex->getMessage();
+        $status='NOK';
+    }
     header('Content-type: text/xml; charset=UTF-8');
     $dom=new DOMDocument('1.0', 'UTF-8');
     $xml_content=$dom->createElement('content', _("Sauvé"));
diff --git a/include/class_follow_up.php b/include/class_follow_up.php
index bb6608243..474ea1fd2 100644
--- a/include/class_follow_up.php
+++ b/include/class_follow_up.php
@@ -1765,10 +1765,20 @@ class Follow_Up
         include 'template/action_display_short.php'; 
     }
     /**
-     * 
+     * Add an event , with the minimum of informations, 
+     * used in Dashboard and Scheduler
      */
     function save_short()
     {
+        global $g_user;
+        // check if we can add
+        if ($g_user->can_add_action($this->ag_dest) == FALSE ) 
+        {
+                throw new Exception(_('SECURITE : Ajout impossible'));
+        }
+        
+            
+        
         // Get The sequence id,
         $seq_name="seq_doc_type_".$this->dt_id;
         $str_file="";
diff --git a/include/class_user.php b/include/class_user.php
index 30a3f5c42..8852440fb 100644
--- a/include/class_user.php
+++ b/include/class_user.php
@@ -1113,6 +1113,25 @@ class User
 				user_name=$1", array($this->login));
 		return $profile;
 	}
+        /**
+         * Check if the current user can add an action in the profile given
+         * in parameter
+         * @param type $p_profile profile.p_id = action_gestion.ag_dest
+         * @return boolean
+         */
+        function can_add_action($p_profile)
+        {
+            $r=$this->db->get_value (' select count(*) 
+                from user_sec_action_profile
+                where p_granted=$1
+                and p_id=$2',
+                    array($this->get_profile(),$p_profile));
+            if ($r == 0 ) 
+            {
+                return false;
+            } 
+            return true;
+        }
         /**
          *Check if the profile of the user can write for this profile
          * @param  $dtoc action_gestion.ag_id
@@ -1122,7 +1141,7 @@ class User
 	{
             if ( $this->Admin() == 1 ) return true;
 		$profile = $this->get_profile();
-		$r = $this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
+                    $r = $this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
 				(select p_granted from user_sec_action_profile where ua_right='W' and p_id=$2) ", array($dtoc, $profile));
 		if ($r == 0)
 			return false;