diff --git a/html/export.php b/html/export.php
index 9dc4a8356..e3818a176 100644
--- a/html/export.php
+++ b/html/export.php
@@ -32,144 +32,127 @@ require_once('class_user.php');
$gDossier=dossier::id();
$cn=new Database($gDossier);
-/**
- *@todo check the security here
- */
-
$user=new User($cn);
$user->Check();
$act=$user->check_dossier($gDossier);
-if ( $act=='X' || ! isset($_GET['act']) )
+if ( $act=='X' || ! isset($_GET['act']) || $user->check_print($_GET['act'])==0 )
{
echo alert('Accès interdit');
+ redirect("do.php?".dossier::get());
exit();
}
-switch( $_GET['act'])
+
+ switch( $_GET['act'])
{
- case 'CSV/histo':
- $user->can_request(IMPJRN,0);
+ case 'CSV:histo':
require_once('export_histo_csv.php');
exit();
break;
- case 'CSV/ledger':
- $user->can_request(IMPJRN,0);
+ case 'CSV:ledger':
require_once('export_ledger_csv.php');
exit();
break;
- case 'PDF/ledger':
- $user->can_request(IMPJRN,0);
+ case 'PDF:ledger':
require_once('export_ledger_pdf.php');
exit();
break;
- case 'CSV/postedetail':
- $user->can_request(IMPPOSTE,0);
+ case 'CSV:postedetail':
require_once('export_poste_detail_csv.php');
exit();
break;
- case 'PDF/postedetail':
- $user->can_request(IMPPOSTE,0);
+ case 'PDF:postedetail':
require_once('export_poste_detail_pdf.php');
exit();
break;
- case 'CSV/fichedetail':
- $user->can_request(IMPPOSTE,0);
+ case 'CSV:fichedetail':
require_once('export_fiche_detail_csv.php');
exit();
break;
- case 'PDF/fichedetail':
- $user->can_request(IMPPOSTE,0);
+ case 'PDF:fichedetail':
require_once('export_fiche_detail_pdf.php');
exit();
break;
- case 'CSV/fiche_balance':
- $user->can_request(IMPFIC,0);
+ case 'CSV:fiche_balance':
require_once('export_fiche_balance_csv.php');
exit();
break;
- case 'PDF/fiche_balance':
- $user->can_request(IMPFIC,0);
+ case 'PDF:fiche_balance':
require_once('export_fiche_balance_pdf.php');
exit();
break;
- case 'CSV/report':
+ case 'CSV:report':
require_once('export_form_csv.php');
exit();
break;
- case 'PDF/report':
+ case 'PDF:report':
require_once('export_form_pdf.php');
exit();
break;
- case 'CSV/fiche':
- $user->can_request(IMPFIC,0);
+ case 'CSV:fiche':
require_once('export_fiche_csv.php');
exit();
break;
- case 'PDF/fiche':
- $user->can_request(IMPFIC,0);
+ case 'PDF:fiche':
require_once('export_fiche_pdf.php');
exit();
break;
- case 'CSV/glcompte':
- $user->can_request(IMPBIL,0);
+ case 'CSV:glcompte':
require_once('export_gl_csv.php');
exit();
break;
- case 'PDF/glcompte':
- $user->can_request(IMPBIL,0);
+ case 'PDF:glcompte':
require_once('export_gl_pdf.php');
exit();
break;
- case 'PDF/sec':
- $user->can_request(PARSEC,1);
+ case 'PDF:sec':
require_once('export_security_pdf.php');
exit();
break;
- case 'CSV/AncList':
+ case 'CSV:AncList':
require_once('export_anc_list_csv.php');
exit();
break;
- case 'CSV/AncBalSimple':
+ case 'CSV:AncBalSimple':
require_once('export_anc_balance_simple_csv.php');
exit();
break;
- case 'PDF/AncBalSimple':
+ case 'PDF:AncBalSimple':
require_once('export_anc_balance_simple_pdf.php');
exit();
break;
- case 'CSV/AncBalDouble':
+ case 'CSV:AncBalDouble':
require_once('export_anc_balance_double_csv.php');
exit();
break;
- case 'PDF/AncBalDouble':
+ case 'PDF:AncBalDouble':
require_once('export_anc_balance_double_pdf.php');
exit();
break;
- case 'CSV/balance':
+ case 'CSV:balance':
require_once('export_balance_csv.php');
exit();
break;
- case 'PDF/balance':
+ case 'PDF:balance':
require_once('export_balance_pdf.php');
exit();
break;
- case 'CSV/AncTable':
+ case 'CSV:AncTable':
require_once('export_anc_table_csv.php');
exit();
break;
- case 'CSV/AncAccList':
+ case 'CSV:AncAccList':
require_once('export_anc_acc_list_csv.php');
exit();
break;
- case 'CSV/AncBalGroup':
+ case 'CSV:AncBalGroup':
require_once('export_anc_balance_group_csv.php');
exit();
break;
- case 'OTH/Bilan':
- $user->can_request(IMPBIL);
+ case 'OTH:Bilan':
require_once 'export_bilan_oth.php';
exit();
break;
diff --git a/html/popup.php b/html/popup.php
index 9ee8d8f05..c370cf18a 100644
--- a/html/popup.php
+++ b/html/popup.php
@@ -42,13 +42,13 @@ if ( basename($_GET['ajax']) == 'ajax_history.php' )
if (isset($_GET['pcm_val']) )
{
- $href_csv="export.php?".$href.'&poste_id='.$_GET['pcm_val'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=CSV/postedetail";
- $href_pdf="export.php?".$href.'&poste_id='.$_GET['pcm_val'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=PDF/postedetail";;
+ $href_csv="export.php?".$href.'&poste_id='.$_GET['pcm_val'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=CSV:postedetail";
+ $href_pdf="export.php?".$href.'&poste_id='.$_GET['pcm_val'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=PDF:postedetail";;
}
else
{
- $href_csv="export.php?".$href.'&f_id='.$_GET['f_id'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=CSV/fichedetail";
- $href_pdf="export.php?".$href.'&f_id='.$_GET['f_id'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=PDF/fichedetail";
+ $href_csv="export.php?".$href.'&f_id='.$_GET['f_id'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=CSV:fichedetail";
+ $href_pdf="export.php?".$href.'&f_id='.$_GET['f_id'].'&ople=0&type=poste&'.$from_periode.'&'.$to_periode."&act=PDF:fichedetail";
}
echo 'Export CSV';
diff --git a/html/recherche.php b/html/recherche.php
index a59106b00..f68ccbdd9 100644
--- a/html/recherche.php
+++ b/html/recherche.php
@@ -99,7 +99,7 @@ if ( isset ($_GET['viewsearch']))
}
echo '';
diff --git a/include/ac_common.php b/include/ac_common.php
index f0aae9e26..98b74b189 100644
--- a/include/ac_common.php
+++ b/include/ac_common.php
@@ -737,7 +737,7 @@ function show_module($selected)
global $g_user;
$cn = Dossier::connect();
$amodule = $cn->get_array("select
- me_code,me_menu,me_url
+ me_code,me_menu,me_url,me_javascript,p_order
from v_all_menu
where
user_name=$1
@@ -826,7 +826,7 @@ function show_menu($module, $idx)
global $g_user;
$cn = Dossier::connect();
$amenu = $cn->get_array("select
- me_menu,me_code
+ me_menu,me_code,me_url,me_javascript
from v_all_menu
where
me_code_dep=$1 and user_name=$2 order by p_order", array($module[$idx], $g_user->login));
@@ -852,7 +852,7 @@ function show_menu($module, $idx)
$file = $cn->get_array("select me_file,me_parameter,me_javascript
from menu_ref
where
- me_code=$1 and
+ me_code=$1 and
(me_file is not null or trim(me_file) <>'' or
me_javascript is not null or trim (me_javascript) <> '')", array($module[$idx]));
diff --git a/include/balance.inc.php b/include/balance.inc.php
index a12d473e8..d189cd4c6 100644
--- a/include/balance.inc.php
+++ b/include/balance.inc.php
@@ -179,7 +179,7 @@ if ( isset ($_GET['view'] ) )
dossier::hidden().
HtmlInput::submit('bt_pdf',"Export PDF").
HtmlInput::hidden("ac",$_REQUEST['ac']).
- HtmlInput::hidden("act","PDF/balance").
+ HtmlInput::hidden("act","PDF:balance").
HtmlInput::hidden("from_periode",$_GET['from_periode']).
HtmlInput::hidden("to_periode",$_GET['to_periode']);
@@ -200,7 +200,7 @@ if ( isset ($_GET['view'] ) )
echo '| ';
$r.= ' |