admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

move get_pj.php to include/ajax_bank_saldo.inc.php

Browse source 
Add security to show_document_modele with User::check_module
Rewriting of admin > utilisateur
This commit is contained in:
Dany De Bontridder 2011-11-11 15:42:09 +00:00
parent f9ddeed4e1
commit 8110fa8042
10 changed files with 254 additions and 184 deletions
Download patch file Download diff file Expand all files Collapse all files

5
html/ajax_misc.php
View file

@ -521,4 +521,7 @@ EOF;
$new=false;
require_once 'template/plugin_detail.php';
break;
}
case 'saldo':
require_once 'ajax_bank_saldo.inc.php';
break;
}

1
html/get_saldo.php
View file

@ -60,7 +60,6 @@ if ( empty($res) ) return '{"saldo":"0"}';
$solde=$res['solde'];
if ( $res['debit'] < $res['credit'] ) $solde=$solde*(-1);
//header("Content-type: text/html; charset: utf8",true);
echo '{"saldo":"'.$solde.'"}';

4
html/js/ajax_fiche.js
View file

@ -187,12 +187,12 @@ function ajax_saldo(p_ctl)
var gDossier=$('gDossier').value;
var ctl_value=trim($(p_ctl).value);
var jrn=$('p_jrn').value;
queryString="FID="+ctl_value;
queryString="FID="+ctl_value+"&op=saldo";
queryString=queryString+'&gDossier='+gDossier+'&j='+jrn;
queryString=queryString+'&ctl='+ctl_value;
/* alert(queryString); */
var action=new Ajax.Request (
"get_saldo.php",
"ajax_misc.php",
{
method:'get',
parameters:queryString,

3
html/show_document_modele.php
View file

@ -32,10 +32,11 @@ $cn=new Database($gDossier);
require_once ('class_user.php');
$User=new User(new Database());
$User=new User($cn);
/*!\todo Add security here
*/
$User->Check();
if ( $User->check_module("CFGDOCUMENT") == 0 ) exit();
// retrieve the document
$r=$cn->exec_sql("select md_id,md_lob,md_filename,md_mimetype
from document_modele where md_id=$1",array($_REQUEST['md_id']));

0
html/get_pj.php → include/ajax_bank_saldo.inc.php.php
View file

37
include/class_dossier.php
View file

@ -104,18 +104,35 @@ class dossier
* \brief Return all the users
* as an array
*/
function get_user()
function get_user_folder($sql="")
{
$sql="select * from ac_users where use_login!='phpcompta'";
$Res=$this->cn->exec_sql($sql);
$Num=$this->cn->size();
if ( $Num == 0 ) return null;
for ($i=0;$i < $Num; $i++)
{
$User[]=$this->cn->fetch($i);
$sql="
select
use_id,
use_first_name,
use_name,
use_login,
use_active,
use_admin,
ag_dossier
from
ac_users as ac
left join (select array_to_string(array_agg(dos_name),',') as ag_dossier,jt.use_id as jt_use_id
from ac_dossier as ds
join jnt_use_dos as jt on (jt.dos_id=ds.dos_id)
join priv_user as pu on (pu.priv_jnt=jt.jnt_id)
where
pu.priv_priv != 'X'
group by jt.use_id) as dossier_name on (jt_use_id=ac.use_id)
where
use_login!='phpcompta'
$sql
";
$res=$this->cn->get_array($sql);
return $res;
}
return $User;
}
/*!\brief check if gDossier is set */
static function check()

21
include/class_html_input.php
View file

@ -595,4 +595,25 @@ class HtmlInput
$r.=h2info($name);
return $r;
}
/**
*Return a simple anchor with a url or a javascript
* if $p_js is not null then p_url will be javascript:void(0)
* we don't add the event onclick. You must give p_url OR p_js
* default CSS class=line
* @param string $p_text text of the anchor
* @param string $p_url url
* @param string $p_js javascript
*/
static function anchor($p_text,$p_url="",$p_js="")
{
if ($p_js != "")
{
$p_url="javascript:void(0)";
}
$str=sprintf('<a class="line" href="%s" %s>%s</a>',
$p_url,$p_js,$p_text);
return $str;
}
}

36
include/class_user.php
View file

@ -123,9 +123,9 @@ class User
{
$Sql = "update ac_users set use_first_name=$1, use_name=$2
,use_active=$3,use_admin=$4 where use_id=$5";
,use_active=$3,use_admin=$4,use_pass=$5 where use_id=$6";
$cn = new Database();
$Res = $cn->exec_sql($Sql, array($this->first_name, $this->last_name, $this->active, $this->admin, $this->id));
$Res = $cn->exec_sql($Sql, array($this->first_name, $this->last_name, $this->active, $this->admin, $this->pass,$this->id));
}
/* !
@ -503,7 +503,23 @@ class User
return $l_array;
}
/**
* Check if an user can access a module, return 1 if yes, otherwise 0
* record in audit log
* @param string $p_module menu_ref.me_code
*/
function check_module($p_module)
{
$acc=$this->db->get_value("select count(*) from v_all_menu where user_name = $1
and me_code=$2", array($this->login,$p_module));
if ($acc == 0)
{
$this->audit("FAIL",$p_module);
return 0;
}
$this->audit("SUCCESS",$p_module);
return 1;
}
/* !
* \brief Check if an user is allowed to do an action
* \param p_action_id
@ -964,14 +980,24 @@ class User
}
return $array;
}
function audit()
function audit($action='AUDIT',$p_module="")
{
global $audit;
if ($p_module=="")
{
$p_module=$_REQUEST['ac'];
}
$cn = new Database();
$sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)";
if ($audit)
{
$cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $_REQUEST['ac'], $_SERVER['REQUEST_URI'], 'AUDIT'));
$cn->exec_sql($sql,
array(
$_SESSION['g_user'],
$_SERVER["REMOTE_ADDR"],
$p_module,
$_SERVER['REQUEST_URI'],
$action));
}
}

77
include/user.inc.php
View file

@ -23,11 +23,14 @@
/*!\file
*
*
* \brief user managemnt
* \brief user managemnt, included from admin_repo,
* action=user_mgt
*
*/
require_once 'class_sort_table.php';
/******************************************************/
// Add user
/******************************************************/
if ( isset ($_POST["LOGIN"]) )
{
$cn=new Database();
@ -46,10 +49,6 @@ if ( isset ($_POST["LOGIN"]) )
array($first_name,$last_name,$login,$pass5));
} //SET login
// Show all the existing user on 7 columns
$repo=new Dossier(0);
$cn=$repo->get_user();
$compteur=0;
?>
<div class="content" style="width:80%;margin-left:10%">
<h2>Gestion Utilisateurs</h2>
@ -68,33 +67,69 @@ echo '</TABLE>';
?>
</FORM>
<TABLE><TR>
<?php
if ( $cn != null )
// Show all the existing user on 7 columns
$repo=new Dossier(0);
/******************************************************/
// Detail of a user
/******************************************************/
if ( isset($_REQUEST['det']))
{
foreach ( $cn as $rUser)
require_once("user_detail.inc.php");
exit();
}
$compteur=0;
$header=new Sort_Table();
$url=basename($_SERVER['PHP_SELF'])."&action=".$_REQUEST['action'];
$header->add("Login", $url," order by use_login asc", "order by use_login desc","la", "ld");
$header->add("Nom", $url," order by use_login asc", "order by use_login desc","la", "ld");
$header->add('Dossier',$url,' order by dossier_ag asc','order by dossier_ag desc',
'da','dd');
$ord=(isset($_REQUEST['ord']))?$_REQUEST['ord']:'la';
$sql=$header->get_sql_order($ord);
$a_user=$repo->get_user_folder($sql);
if ( !empty ($a_user) )
{
echo '<table class="result">';
echo '<tr>';
echo '<th>'.$header->get_header(0).'</th>';
echo '<th>'.$header->get_header(1).'</th>';
echo th("Prénom");
echo th("Actif");
echo '<th>'.$header->get_header(2).'</th>';
echo '</tr>';
foreach ( $a_user as $r_user)
{
$compteur++;
if ( $compteur==0 ) echo "<TR>";
if ( $compteur%3 == 0) echo "</TR><TR>";
$class=($compteur%2==0)?"odd":"even";
echo "<tr $class>";
if ( $rUser['use_active'] == 0 )
{
$Active="not actif";
$Active="non actif";
}
else
{
$Active="";
$Active="Actif";
}
printf('<TD><A HREF=priv_user.php?UID=%s> %s %s ( %s )</A> %s </TD>',
$rUser['use_id'],
$rUser['use_first_name'],
$rUser['use_name'],
$rUser['use_login'],
$Active);
$det_url=$url."&det&use_id=".$r_user['use_id'];
echo "<td>";
echo HtmlInput::anchor($r_user['use_login'],$det_url);
echo "</td>";
echo td($r_user['use_name']);
echo td($r_user['use_first_name']);
echo td($Active);
echo '</tr>';
}// foreach
echo '</table>';
} // $cn != null
?>
</TABLE>
</div>

254
include/user_detail.inc.php
View file

@ -15,244 +15,212 @@
* You should have received a copy of the GNU General Public License
* along with PhpCompta; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
*/
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
/*! \file
/* ! \file
* \brief Users Security
*/
include_once("ac_common.php");
require_once('class_database.php');
include_once("user_menu.php");
html_page_start($_SESSION['g_theme']);
$rep=new Database();
include_once ("class_user.php");
$User=new User($rep);
$User->Check();
/* only the global admin can modify something here
*/
if ($User->admin != 1)
{
html_page_stop();
return;
}
if (! isset ($_REQUEST['UID']) )
$rep = new Database();
if (!isset($_REQUEST['use_id']))
{
html_page_stop();
exit();
}
$uid=$_REQUEST['UID'];
$UserChange=new User($rep,$uid);
$uid = $_REQUEST['use_id'];
$UserChange = new User($rep, $uid);
$r_UID=$UserChange->id;
if ( $r_UID == false )
if ($UserChange->id == false)
{
// Message d'erreur
html_page_stop();
}
echo '<H2 class="info"> Administration Globale</H2>';
echo "<div>".MenuAdmin()."</div>";
echo '<DIV class="content" style="width:80%;margin-left:10%">';
echo '<h2>Gestion Utilisateurs</h2>';
// User is valid and you're an admin
?>
<?php
/* Parse the changes */
if ( isset ( $_GET['reset_passwd']) )
{
$cn=new Database();
$l_pass=md5('phpcompta');
/* prevent to change the password of superadmin */
if ( $uid != '1' )
{
$Res=$cn->exec_sql( "update ac_users set use_pass=$1 where use_id=$2",array($l_pass,$uid));
echo '<H2 class="info"> Password remis à phpcompta</H2>';
}
}
/* Save the changes */
if ( isset ($_POST['SAVE']) )
if (isset($_POST['SAVE']))
{
$uid = $_POST['UID'];
// Update User
$cn=new Database();
$last_name=$_POST['fname'];
$first_name=$_POST['lname'];
$UserChange=new User($cn,$uid);
if ( $UserChange->load()==-1)
$cn = new Database();
$UserChange = new User($cn, $uid);
if ($UserChange->load() == -1)
{
alert("Cet utilisateur n'existe pas");
}
else
{
$UserChange->first_name=$first_name;
$UserChange->last_name=$last_name;
$UserChange->active=$_POST['Actif'];
$UserChange->admin=$_POST['Admin'];
$UserChange->first_name = $_POST['fname'];
$UserChange->last_name = $_POST['lname'];
$UserChange->active = $_POST['Actif'];
$UserChange->admin = $_POST['Admin'];
if ( trim($_POST['password'])<>'')
{
$UserChange->pass = md5($_POST['pass']);
}
$UserChange->save();
// Update Priv on Folder
foreach ($_POST as $name=>$elem)
foreach ($_POST as $name => $elem)
{
if ( substr_count($name,'PRIV')!=0 )
if (substr_count($name, 'PRIV') != 0)
{
$db_id=substr($name,4);
$cn=new Database();
$UserChange->set_folder_access($db_id,$elem);
$db_id = substr($name, 4);
$cn = new Database();
$UserChange->set_folder_access($db_id, $elem);
}
}
}
}
else
{
if ( isset ($_POST["DELETE"]) )
if (isset($_POST["DELETE"]))
{
$cn=new Database();
$Res=$cn->exec_sql("delete from priv_user where priv_jnt in ( select jnt_id from jnt_use_dos where use_id=$1",array($uid));
$Res=$cn->exec_sql("delete from jnt_use_dos where use_id=$1",array($uid));
$Res=$cn->exec_sql("delete from ac_users where use_id=$1",array($uid));
$cn = new Database();
$Res = $cn->exec_sql("delete from priv_user where priv_jnt in ( select jnt_id from jnt_use_dos where use_id=$1", array($uid));
$Res = $cn->exec_sql("delete from jnt_use_dos where use_id=$1", array($uid));
$Res = $cn->exec_sql("delete from ac_users where use_id=$1", array($uid));
echo "<center><H2 class=\"info\"> User ".h($_POST['fname'])." ".h($_POST['lname'])." (".
h($_POST['login']).") est effacé</H2></CENTER>";
echo "<center><H2 class=\"info\"> User " . h($_POST['fname']) . " " . h($_POST['lname']) . " (" .
h($_POST['login']) . ") est effacé</H2></CENTER>";
require_once("class_iselect.php");
require_once("user.inc.php");
return;
}
}
$UserChange->load();
$it_pass=new IText('password');
$it_pass->value="";
?>
<FORM ACTION="priv_user.php" METHOD="POST">
<FORM METHOD="POST">
<?php printf('<INPUT TYPE=HIDDEN NAME=UID VALUE="%s">',$uid);
?>
<TABLE BORDER=0>
<TR>
<?=HtmlInput::hidden('UID',$uid)?>
<TABLE BORDER=0>
<TR>
<?php printf('<td>login</td><td> %s</td>',$UserChange->login);
?>
</TD></tr>
<TR><TD>
<?php printf('Nom de famille </TD><td><INPUT class="input_text" type="text" NAME="fname" value="%s"> ',$UserChange->name);
?>
</TD></TR>
<?php printf('<td>prénom</td><td>
<INPUT class="input_text" type="text" NAME="lname" value="%s"> ',$UserChange->first_name);
?>
</TD>
</TR>
</table>
<?php printf('<td>login</td><td> %s</td>', $UserChange->login); ?>
</TD>
</tr>
<TR>
<TD>
<?php printf('Nom de famille </TD><td><INPUT class="input_text" type="text" NAME="lname" value="%s"> ', $UserChange->name); ?>
</TD>
</TR>
<TR>
<?php printf('<td>prénom</td><td>
<INPUT class="input_text" type="text" NAME="fname" value="%s"> ', $UserChange->first_name);
?>
</TD>
</TR>
<tr>
<td>
Mot de passe :<span class="info">Laisser à VIDE pour ne PAS le changer</span>
</td>
<td>
<?=$it_pass->input();?>
</td>
</tr>
</table>
<TABLE>
<TABLE>
<?php
if ( $UserChange->active == 1 )
if ($UserChange->active == 1)
{
$ACT="CHECKED";
$NACT="UNCHECKED";
$ACT = "CHECKED";
$NACT = "UNCHECKED";
}
else
{
$ACT="UNCHECKED";
$NACT="CHECKED";
$ACT = "UNCHECKED";
$NACT = "CHECKED";
}
echo "<TR><TD>";
printf('<INPUT type="RADIO" NAME="Actif" VALUE="1" %s> Actif',$ACT);
printf('<INPUT type="RADIO" NAME="Actif" VALUE="1" %s> Actif', $ACT);
echo "</TD><TD>";
printf('<INPUT type="RADIO" NAME="Actif" VALUE="0" %s> Non Actif',$NACT);
printf('<INPUT type="RADIO" NAME="Actif" VALUE="0" %s> Non Actif', $NACT);
echo "</TD></TR>";
?>
</TABLE>
</TABLE>
</TD>
<TD>
<TABLE>
<TABLE>
<?php
if ( $UserChange->admin == 1 )
if ($UserChange->admin == 1)
{
$ACT="CHECKED";
$NACT="UNCHECKED";
$ACT = "CHECKED";
$NACT = "UNCHECKED";
}
else
{
$ACT="UNCHECKED";
$NACT="CHECKED";
$ACT = "UNCHECKED";
$NACT = "CHECKED";
}
echo "<TR><TD>";
printf('<INPUT type="RADIO" NAME="Admin" VALUE="1" %s> Administrateur global',$ACT);
printf('<INPUT type="RADIO" NAME="Admin" VALUE="1" %s> Administrateur global', $ACT);
echo "</TD><TD>";
printf('<INPUT type="RADIO" NAME="Admin" VALUE="0" %s> Pas administrateur global ',$NACT);
printf('<INPUT type="RADIO" NAME="Admin" VALUE="0" %s> Pas administrateur global ', $NACT);
echo "</TD></TR>";
?>
</TABLE>
</TABLE>
</TD>
</TR>
<TR>
<TD>
<!-- Show all database and rights -->
<H2 class="info"> Droit sur les dossiers pour les utilisateurs normaux </H2>
<p class="notice">
Les autres droits doivent être réglés dans les dossiers (paramètre->sécurité)
</p>
<TABLE>
<?php
$array=array(
array('value'=>'X','label'=>'Aucun Accès'),
array('value'=>'R','label'=>'Utilisateur normal'),
array('value'=>'P','label'=>'Utilisateur uniquement extension'),
array('value'=>'L','label'=>'Administrateur local(Tous les droits)')
);
$repo=new Dossier(0);
<TD>
<!-- Show all database and rights -->
<H2 class="info"> Droit sur les dossiers pour les utilisateurs normaux </H2>
<p class="notice">
Les autres droits doivent être réglés dans les dossiers (paramètre->sécurité)
</p>
<TABLE>
<?php
$array = array(
array('value' => 'X', 'label' => 'Aucun Accès'),
array('value' => 'R', 'label' => 'Utilisateur normal'),
array('value' => 'L', 'label' => 'Administrateur local(Tous les droits)')
);
$repo = new Dossier(0);
$Dossier=$repo->show_dossier('all',1,0);
if ( empty ( $Dossier ))
$Dossier = $repo->show_dossier('all', 1, 0);
if (empty($Dossier))
{
echo hb('* Aucun Dossier *');
echo '</div>';
exit();
}
$mod_user=new User(new Database(),$uid);
foreach ( $Dossier as $rDossier)
$mod_user = new User(new Database(), $uid);
foreach ($Dossier as $rDossier)
{
$priv=$mod_user->get_folder_access($rDossier['dos_id']);
printf("<TR><TD> Dossier : %s </TD>",h($rDossier['dos_name']));
$priv = $mod_user->get_folder_access($rDossier['dos_id']);
printf("<TR><TD> Dossier : %s </TD>", h($rDossier['dos_name']));
$select=new ISelect();
$select->table=1;
$select->name=sprintf('PRIV%s',$rDossier['dos_id']);
$select->value=$array;
$select->selected=$priv;
$select = new ISelect();
$select->table = 1;
$select->name = sprintf('PRIV%s', $rDossier['dos_id']);
$select->value = $array;
$select->selected = $priv;
echo $select->input();
echo "</TD></TR>";
}
?>
</TABLE>
<?php echo HtmlInput::button_anchor('Reinitialiser le mot de passe',
sprintf('priv_user.php?reset_passwd&UID=%s',$uid));
?>
</TABLE>
<input type="Submit" class="button" NAME="SAVE" VALUE="Sauver les changements">
<input type="Submit" class="button" NAME="DELETE" VALUE="Effacer" onclick="return confirm('Confirmer effacement ?');" >
</FORM>
<? echo HtmlInput::button_anchor('Retour','admin_repo.php?action=user_mgt');
?>
<input type="Submit" class="button" NAME="SAVE" VALUE="Sauver les changements" onclick="return confirm('Confirmer changement ?');">
<input type="Submit" class="button" NAME="DELETE" VALUE="Effacer" onclick="return confirm('Confirmer effacement ?');" >
</FORM>
<? echo HtmlInput::button_anchor('Retour', 'admin_repo.php?action=user_mgt'); ?>
</DIV>