From 4cee45d624ecfd58fac134a2fcf8909cd1d13844 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Tue, 8 Nov 2011 19:45:07 +0000 Subject: [PATCH] Security remove all $user->can_request except for extension --- html/ajax_report.php | 1 - html/show_document.php | 1 - include/ac_common.php | 5 +- include/action.inc.php | 1 - include/adm.inc.php | 1 - include/balance.inc.php | 1 - include/company.inc.php | 1 - include/export_balance_pdf.php | 17 +++-- include/export_fiche_balance_pdf.php | 1 - include/export_fiche_pdf.php | 1 - include/export_gl_pdf.php | 5 +- include/export_ledger_csv.php | 1 - include/export_ledger_pdf.php | 1 - include/export_poste_detail.php | 1 - include/export_security_pdf.php | 4 +- include/impress.inc.php | 94 ---------------------------- include/opening.inc.php | 1 - include/param_pcmn.inc.php | 1 - include/preod.inc.php | 1 - include/report.inc.php | 3 +- include/suivi_adm.inc.php | 1 - include/suivi_supplier.inc.php | 1 - include/supplier.inc.php | 1 - 23 files changed, 16 insertions(+), 129 deletions(-) delete mode 100644 include/impress.inc.php diff --git a/html/ajax_report.php b/html/ajax_report.php index 10bfad7e2..d9f443508 100644 --- a/html/ajax_report.php +++ b/html/ajax_report.php @@ -44,7 +44,6 @@ $cn=new Database(dossier::id()); $User=new User($cn); $User->Check(); $User->check_dossier(dossier::id()); -$User->can_request('PARRAP',0); diff --git a/html/show_document.php b/html/show_document.php index 522d48808..a7484426b 100644 --- a/html/show_document.php +++ b/html/show_document.php @@ -35,7 +35,6 @@ require_once ('class_user.php'); $User=new User(new Database()); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(GECOUR); /* Show the document */ if ( $action == 'sh') { diff --git a/include/ac_common.php b/include/ac_common.php index 98b74b189..0f2198abb 100644 --- a/include/ac_common.php +++ b/include/ac_common.php @@ -766,7 +766,10 @@ function show_module($selected) $array=compute_variable($file[0]['me_parameter']); put_global($array); } - require_once $file[0]['me_file']; + if ( $file[0]['me_type'] != 'PL') + require_once $file[0]['me_file']; + else + require 'extension_get.inc.php'; exit(); } if ( $file[0]['me_javascript'] != '') diff --git a/include/action.inc.php b/include/action.inc.php index 60f117ec9..02be31458 100644 --- a/include/action.inc.php +++ b/include/action.inc.php @@ -23,7 +23,6 @@ */ require_once('class_ipopup.php'); global $g_user; -$g_user->can_request(GECOUR); $retour=HtmlInput::button_anchor(_('Retour'),'?ac='.$_REQUEST['ac'].'&my_action&'.dossier::get()); //----------------------------------------------------- diff --git a/include/adm.inc.php b/include/adm.inc.php index eeaf79066..c502e39d2 100644 --- a/include/adm.inc.php +++ b/include/adm.inc.php @@ -38,7 +38,6 @@ $low_action=(isset($_REQUEST['sb']))?$_REQUEST['sb']:"list"; /*! \file * \brief Called from the module "Gestion" to manage the customer */ -$g_user->can_request(GECUST); $href=basename($_SERVER['PHP_SELF']); // by default open liste diff --git a/include/balance.inc.php b/include/balance.inc.php index d189cd4c6..a339f7e33 100644 --- a/include/balance.inc.php +++ b/include/balance.inc.php @@ -36,7 +36,6 @@ require_once('class_periode.php'); require_once('class_exercice.php'); global $g_user; $gDossier=dossier::id(); -$g_user->can_request(IMPBAL); $exercice=(isset($_GET['exercice']))?$_GET['exercice']:$g_user->get_exercice(); diff --git a/include/company.inc.php b/include/company.inc.php index f24f674f6..7849abce0 100644 --- a/include/company.inc.php +++ b/include/company.inc.php @@ -1,6 +1,5 @@ can_request(PARCOORD,1); echo '
'; require_once("class_own.php"); if ( isset ($_POST['record_company'] )) diff --git a/include/export_balance_pdf.php b/include/export_balance_pdf.php index d2ee64bd9..4be366e0f 100644 --- a/include/export_balance_pdf.php +++ b/include/export_balance_pdf.php @@ -46,7 +46,6 @@ $User=new User($cn); $User->Check(); $bal=new Acc_Balance($cn); -$User->can_request(IMPBAL,1); extract ($_GET); $bal->jrn=null; @@ -126,12 +125,12 @@ if (! empty($array)) /* * level x */ - if ( $value['poste']=='') continue; + if ( $value['poste']=='') continue; foreach (array(3,2,1) as $ind) - { + { $r=$value; if ( ! isset($_GET['lvl'.$ind]))continue; - + if (${'lvl'.$ind.'_old'} == '') ${'lvl'.$ind.'_old'}=substr($r['poste'],0,$ind); if ( ${'lvl'.$ind.'_old'} != substr($r['poste'],0,$ind)) { @@ -157,7 +156,7 @@ if (! empty($array)) $nlvl2[$a]=bcadd($nlvl2[$a],$r[$a]); $nlvl3[$a]=bcadd($nlvl3[$a],$r[$a]); } - + if ( $i % 2 == 0 ) { $pdf->SetFillColor(220,221,255); @@ -168,7 +167,7 @@ if (! empty($array)) $pdf->SetFillColor(0,0,0); $fill=0; } - + $pdf->Cell(30,6,$value['poste'],0,0,'L',$fill); $pdf->Cell(80,6,$value['label'],0,0,'L',$fill); $pdf->Cell(20,6,nbm($value['sum_deb']),0,0,'R',$fill); @@ -183,10 +182,10 @@ if (! empty($array)) } foreach (array(3,2,1) as $ind) - { + { $r=$value; if ( ! isset($_GET['lvl'.$ind]))continue; - + if (${'lvl'.$ind.'_old'} == '') ${'lvl'.$ind.'_old'}=substr($r['poste'],0,$ind); if ( ${'lvl'.$ind.'_old'} != substr($r['poste'],0,$ind)) { @@ -206,7 +205,7 @@ if (! empty($array)) } } } - + // Totaux $pdf->SetFont('DejaVuCond','B',8); $pdf->Cell(110,6,'Totaux'); diff --git a/include/export_fiche_balance_pdf.php b/include/export_fiche_balance_pdf.php index 421b0fb9f..c8533c7ba 100644 --- a/include/export_fiche_balance_pdf.php +++ b/include/export_fiche_balance_pdf.php @@ -39,7 +39,6 @@ $cn=new Database($gDossier); $User=new User($cn); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(IMPFIC,0); $pdf=new PDF($cn); $pdf->setDossierInfo(" Periode : ".$_GET['start']." - ".$_GET['end']); diff --git a/include/export_fiche_pdf.php b/include/export_fiche_pdf.php index 57cad9b4d..c79536c8e 100644 --- a/include/export_fiche_pdf.php +++ b/include/export_fiche_pdf.php @@ -39,7 +39,6 @@ $cn=new Database($gDossier); $User=new User($cn); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(IMPFIC,0); $pdf=new PDF($cn); $pdf->setDossierInfo(" Periode : ".$_GET['start']." - ".$_GET['end']); diff --git a/include/export_gl_pdf.php b/include/export_gl_pdf.php index 1731fb4d8..93f8dbb0c 100644 --- a/include/export_gl_pdf.php +++ b/include/export_gl_pdf.php @@ -41,13 +41,12 @@ $cn=new Database($gDossier); $User=new User($cn); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(IMPBIL,0); $sql="select pcm_val from tmp_pcmn "; extract($_GET); $cond_poste=""; -if ($from_poste != '') +if ($from_poste != '') { $cond_poste = ' where '; $cond_poste .=' pcm_val >= upper (\''.Database::escape_string($from_poste).'\')'; @@ -55,7 +54,7 @@ if ($from_poste != '') if ( $to_poste != '') { - if ( $cond_poste == '') + if ( $cond_poste == '') { $cond_poste = ' where pcm_val <= upper (\''.Database::escape_string($to_poste).'\')'; } diff --git a/include/export_ledger_csv.php b/include/export_ledger_csv.php index b239a8d54..7da03f492 100644 --- a/include/export_ledger_csv.php +++ b/include/export_ledger_csv.php @@ -39,7 +39,6 @@ $cn=new Database($gDossier); require_once ('class_user.php'); $User=new User($cn); $User->Check(); -$User->can_request(IMPJRN,0); $User->check_dossier($gDossier); if ($_GET['jrn_id']!=0 && $User->check_jrn($_GET['jrn_id']) =='X') diff --git a/include/export_ledger_pdf.php b/include/export_ledger_pdf.php index fd8252815..9d44d848c 100644 --- a/include/export_ledger_pdf.php +++ b/include/export_ledger_pdf.php @@ -55,7 +55,6 @@ $Jrn->get_name(); $User=new User($cn); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(IMPJRN,0); // Security if ( $_GET['jrn_id']!=0 && $User->check_jrn($_GET['jrn_id']) == 'X' ) diff --git a/include/export_poste_detail.php b/include/export_poste_detail.php index 232e938de..14e302fd8 100644 --- a/include/export_poste_detail.php +++ b/include/export_poste_detail.php @@ -40,7 +40,6 @@ $cn=new Database($gDossier); $User=new User($cn); $User->Check(); $User->check_dossier($gDossier); -$User->can_request(IMPPOSTE,0); if ( isset ( $_REQUEST['poste_fille']) ) { //choisit de voir tous les postes diff --git a/include/export_security_pdf.php b/include/export_security_pdf.php index 0175823c0..0a2218fed 100755 --- a/include/export_security_pdf.php +++ b/include/export_security_pdf.php @@ -36,8 +36,6 @@ $cn=new Database($gDossier); $rep=new Database(); include_once ("class_user.php"); $User=new User($rep); -// Check Priv -$User->can_request(PARSEC,1); //----------------------------------------------------- // Get User's info @@ -128,7 +126,7 @@ for ($e=0;$e < Database::num_row($Res);$e++) break; case 'O': /** - *non implemente + *non implemente */ $pdf->Cell(30,6,"Opérations prédéfinies uniquement"); break; diff --git a/include/impress.inc.php b/include/impress.inc.php deleted file mode 100644 index 1df5cd90d..000000000 --- a/include/impress.inc.php +++ /dev/null @@ -1,94 +0,0 @@ -"; - -$p_array=array(array ("?p_action=impress&type=jrn&".$str_dossier,_("Historique")), - array("?p_action=impress&type=gl_comptes&".$str_dossier,_("Grand Livre")), /* AG */ - array("?p_action=impress&type=poste&".$str_dossier,_("Poste")), - array("?p_action=impress&type=fiche&".$str_dossier,_("Catégorie de fiche")), - array("?p_action=impress&type=rapport&".$str_dossier,_("Rapport")), - array("?p_action=impress&type=rec&".$str_dossier,_("Rapprochement")), - array('?p_action=impress&type=bal&'.$str_dossier,_('Balance des comptes')), - array("?p_action=impress&type=bilan&".$str_dossier,_("Bilan")) - ); -$default=( isset ($_GET['type']))?"?p_action=impress&type=".$_GET['type']."&$str_dossier":""; - - -$result=ShowItem($p_array,'H',"mtitle","mtitle",$default,' '); -echo $result; - -echo "
"; -$cn=new Database($gDossier); - - -include_once("impress_inc.php"); - - -// something is choosen -$default=( isset ($_REQUEST['type']))?$_REQUEST['type']:""; -switch ($default) -{ -case 'rec': - $User->can_request(IMPJRN,1); - require_once ("impress_rec.inc.php"); - break; -case "jrn": - $User->can_request(IMPJRN,1); - require_once ("impress_jrn.inc.php"); - break; -case "poste": - $User->can_request(IMPPOSTE,1); - require_once ("impress_poste.inc.php"); - break; -case "rapport": - $User->can_request(IMPRAP,1); - require_once ("impress_rapport.inc.php"); - break; -case "bilan": - $User->can_request(IMPBIL,1); - require_once ("impress_bilan.inc.php"); - break; -case "gl_comptes": /* AG */ - $User->can_request(IMPBIL,1); - require_once ("impress_gl_comptes.inc.php"); - break; - -case "bal": - $User->can_request(IMPBAL,1); - require_once ("balance.inc.php"); - break; -case "fiche": - $User->can_request(IMPFIC,1); - require_once ("impress_fiche.inc.php"); - break; - -} - -html_page_stop(); -?> diff --git a/include/opening.inc.php b/include/opening.inc.php index 9909ef82b..f4ecf69a8 100644 --- a/include/opening.inc.php +++ b/include/opening.inc.php @@ -28,7 +28,6 @@ require_once 'user_menu.php'; $sa=(isset($_REQUEST['sa']))?$_REQUEST['sa']:''; $User=new User(new Database(dossier::id())); $User->Check(); -$User->can_request(PAREO,1); require_once("class_iselect.php"); require_once('class_acc_ledger.php'); /* -------------------------------------------------- diff --git a/include/param_pcmn.inc.php b/include/param_pcmn.inc.php index 18a7fcba9..9c84fabc5 100644 --- a/include/param_pcmn.inc.php +++ b/include/param_pcmn.inc.php @@ -84,7 +84,6 @@ if ( isset ($_GET['p_start'])) echo '
'; echo '
'; -$User->can_request(PARPCMN); echo '
'; diff --git a/include/preod.inc.php b/include/preod.inc.php index 9c73c04f4..70a74bd16 100644 --- a/include/preod.inc.php +++ b/include/preod.inc.php @@ -30,7 +30,6 @@ require_once('class_database.php'); require_once('ac_common.php'); require_once('class_pre_operation.php'); $user=new User(new Database(dossier::id())); -$user->can_request(PARPREDE,1); echo '
'; echo '
'; $sel=new ISelect(); diff --git a/include/report.inc.php b/include/report.inc.php index 9450dfa34..719ef5b80 100644 --- a/include/report.inc.php +++ b/include/report.inc.php @@ -14,7 +14,7 @@ * * You should have received a copy of the GNU General Public License * along with PhpCompta; if not, write to the Free Software - + */ /* $Revision$ */ // Copyright Author Dany De Bontridder ddebontridder@yahoo.fr @@ -51,7 +51,6 @@ $rep=new Database($gDossier); $User=new User($rep); $User->Check(); -$User->can_request(PARRAP,1); $cn=new Database($gDossier); diff --git a/include/suivi_adm.inc.php b/include/suivi_adm.inc.php index 8f701ed94..2fbb4cbec 100644 --- a/include/suivi_adm.inc.php +++ b/include/suivi_adm.inc.php @@ -28,7 +28,6 @@ * - $cn = database connection */ require_once('class_follow_up.php'); -$g_user->can_request(GECOUR); /** *\note fix problem with ShowActionList, this function is local diff --git a/include/suivi_supplier.inc.php b/include/suivi_supplier.inc.php index ab9ad885f..f34e10cd8 100644 --- a/include/suivi_supplier.inc.php +++ b/include/suivi_supplier.inc.php @@ -28,7 +28,6 @@ * - $cn = database connection */ require_once('class_follow_up.php'); -$g_user->can_request(GECOUR); /** *\note problem with ShowActionList, this function is local diff --git a/include/supplier.inc.php b/include/supplier.inc.php index aaea58fba..02408a714 100644 --- a/include/supplier.inc.php +++ b/include/supplier.inc.php @@ -36,7 +36,6 @@ $low_action=(isset($_REQUEST['sb']))?$_REQUEST['sb']:"list"; /*! \file * \brief Called from the module "Gestion" to manage the supplier */ -$g_user->can_request(GECUST); $href=basename($_SERVER['PHP_SELF']); // by default open liste