admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security ; bug can't access ODS

Browse source
This commit is contained in:
Dany De Bontridder 2011-12-11 20:54:08 +00:00
parent 8a385f18c0
commit 467373cbbc
4 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/class_acc_ledger.php
View file

@ -2045,10 +2045,10 @@ class Acc_Ledger extends jrn_def_sql
*\param the type
*\return the j_id
*/
public function get_first($p_type)
public function get_first($p_type,$p_access=3)
{
$user=new User($this->db);
$all=$user->get_ledger($p_type);
$all=$user->get_ledger($p_type,$p_access);
return $all[0];
}

6
include/compta_ach.inc.php
View file

@ -163,7 +163,11 @@ $Ledger = new Acc_Ledger_Purchase($cn, 0);
if (!isset($_REQUEST ['p_jrn']))
{
$def_ledger = $Ledger->get_first('ach');
$def_ledger = $Ledger->get_first('ach',2);
if ( empty ($first_ledger))
{
exit('Pas de journal disponible');
}
$Ledger->id = $def_ledger['jrn_def_id'];
}
else

6
include/compta_ods.inc.php
View file

@ -43,6 +43,10 @@ $id = (isset($_REQUEST['p_jrn'])) ? $_REQUEST['p_jrn'] : -1;
$id = (isset($_REQUEST['p_jrn_predef'])) ? $_REQUEST['p_jrn_predef'] : -1;
$ledger = new Acc_Ledger($cn, $id);
$first_ledger = $ledger->get_first('ODS');
if ( empty ($first_ledger))
{
exit('Pas de journal disponible');
}
$ledger->id = ($ledger->id == -1) ? $first_ledger['jrn_def_id'] : $id;
/* !\brief show a form for quick_writing */
@ -52,7 +56,7 @@ $ledger->with_concerned = true;
if ($g_user->check_jrn($id) == 'X')
if ($g_user->check_jrn($ledger->id) == 'X')
{
NoAccess();
exit - 1;

8
include/compta_ven.inc.php
View file

@ -182,7 +182,11 @@ global $g_parameter;
if ( !isset($_REQUEST ['p_jrn']) )
{
$def_ledger=$Ledger->get_first('ven');
$def_ledger=$Ledger->get_first('ven',2);
if (empty($first_ledger))
{
exit('Pas de journal disponible');
}
$Ledger->id=$def_ledger['jrn_def_id'];
}
else
@ -190,7 +194,7 @@ global $g_parameter;
if (isset ($_REQUEST['p_jrn_predef'])){
$Ledger->id=$_REQUEST['p_jrn_predef'];
}
echo '<div id="predef_form">';
echo '<form style="display:inline" method="GET" >';
echo HtmlInput::hidden('ac',$_REQUEST['ac']);