diff --git a/html/ajax_misc.php b/html/ajax_misc.php index 293829c8e..869676e3c 100644 --- a/html/ajax_misc.php +++ b/html/ajax_misc.php @@ -521,4 +521,7 @@ EOF; $new=false; require_once 'template/plugin_detail.php'; break; -} + case 'saldo': + require_once 'ajax_bank_saldo.inc.php'; + break; +} \ No newline at end of file diff --git a/html/get_saldo.php b/html/get_saldo.php index 10ffea552..03b5e97c2 100644 --- a/html/get_saldo.php +++ b/html/get_saldo.php @@ -60,7 +60,6 @@ if ( empty($res) ) return '{"saldo":"0"}'; $solde=$res['solde']; if ( $res['debit'] < $res['credit'] ) $solde=$solde*(-1); -//header("Content-type: text/html; charset: utf8",true); echo '{"saldo":"'.$solde.'"}'; diff --git a/html/js/ajax_fiche.js b/html/js/ajax_fiche.js index 7b4ccec3d..84449fcd2 100644 --- a/html/js/ajax_fiche.js +++ b/html/js/ajax_fiche.js @@ -187,12 +187,12 @@ function ajax_saldo(p_ctl) var gDossier=$('gDossier').value; var ctl_value=trim($(p_ctl).value); var jrn=$('p_jrn').value; - queryString="FID="+ctl_value; + queryString="FID="+ctl_value+"&op=saldo"; queryString=queryString+'&gDossier='+gDossier+'&j='+jrn; queryString=queryString+'&ctl='+ctl_value; /* alert(queryString); */ var action=new Ajax.Request ( - "get_saldo.php", + "ajax_misc.php", { method:'get', parameters:queryString, diff --git a/html/show_document_modele.php b/html/show_document_modele.php index 6d2d20fea..af7b2726f 100644 --- a/html/show_document_modele.php +++ b/html/show_document_modele.php @@ -32,10 +32,11 @@ $cn=new Database($gDossier); require_once ('class_user.php'); -$User=new User(new Database()); +$User=new User($cn); /*!\todo Add security here */ $User->Check(); +if ( $User->check_module("CFGDOCUMENT") == 0 ) exit(); // retrieve the document $r=$cn->exec_sql("select md_id,md_lob,md_filename,md_mimetype from document_modele where md_id=$1",array($_REQUEST['md_id'])); diff --git a/html/get_pj.php b/include/ajax_bank_saldo.inc.php.php similarity index 100% rename from html/get_pj.php rename to include/ajax_bank_saldo.inc.php.php diff --git a/include/class_dossier.php b/include/class_dossier.php index 12dbf9642..442c38779 100644 --- a/include/class_dossier.php +++ b/include/class_dossier.php @@ -104,18 +104,35 @@ class dossier * \brief Return all the users * as an array */ - function get_user() + function get_user_folder($sql="") { - $sql="select * from ac_users where use_login!='phpcompta'"; - $Res=$this->cn->exec_sql($sql); - $Num=$this->cn->size(); - if ( $Num == 0 ) return null; - for ($i=0;$i < $Num; $i++) - { - $User[]=$this->cn->fetch($i); + + $sql=" + select + use_id, + use_first_name, + use_name, + use_login, + use_active, + use_admin, + ag_dossier + from + ac_users as ac + left join (select array_to_string(array_agg(dos_name),',') as ag_dossier,jt.use_id as jt_use_id + from ac_dossier as ds + join jnt_use_dos as jt on (jt.dos_id=ds.dos_id) + join priv_user as pu on (pu.priv_jnt=jt.jnt_id) + where + pu.priv_priv != 'X' + group by jt.use_id) as dossier_name on (jt_use_id=ac.use_id) + where + use_login!='phpcompta' + $sql + "; + + $res=$this->cn->get_array($sql); + return $res; } - return $User; - } /*!\brief check if gDossier is set */ static function check() diff --git a/include/class_html_input.php b/include/class_html_input.php index b7559618d..2a94dfdb4 100755 --- a/include/class_html_input.php +++ b/include/class_html_input.php @@ -595,4 +595,25 @@ class HtmlInput $r.=h2info($name); return $r; } + /** + *Return a simple anchor with a url or a javascript + * if $p_js is not null then p_url will be javascript:void(0) + * we don't add the event onclick. You must give p_url OR p_js + * default CSS class=line + * @param string $p_text text of the anchor + * @param string $p_url url + * @param string $p_js javascript + */ + static function anchor($p_text,$p_url="",$p_js="") + { + if ($p_js != "") + { + $p_url="javascript:void(0)"; + } + + + $str=sprintf('%s', + $p_url,$p_js,$p_text); + return $str; + } } \ No newline at end of file diff --git a/include/class_user.php b/include/class_user.php index 4ec543c9d..c573d3003 100644 --- a/include/class_user.php +++ b/include/class_user.php @@ -123,9 +123,9 @@ class User { $Sql = "update ac_users set use_first_name=$1, use_name=$2 - ,use_active=$3,use_admin=$4 where use_id=$5"; + ,use_active=$3,use_admin=$4,use_pass=$5 where use_id=$6"; $cn = new Database(); - $Res = $cn->exec_sql($Sql, array($this->first_name, $this->last_name, $this->active, $this->admin, $this->id)); + $Res = $cn->exec_sql($Sql, array($this->first_name, $this->last_name, $this->active, $this->admin, $this->pass,$this->id)); } /* ! @@ -503,7 +503,23 @@ class User return $l_array; } - + /** + * Check if an user can access a module, return 1 if yes, otherwise 0 + * record in audit log + * @param string $p_module menu_ref.me_code + */ + function check_module($p_module) + { + $acc=$this->db->get_value("select count(*) from v_all_menu where user_name = $1 + and me_code=$2", array($this->login,$p_module)); + if ($acc == 0) + { + $this->audit("FAIL",$p_module); + return 0; + } + $this->audit("SUCCESS",$p_module); + return 1; + } /* ! * \brief Check if an user is allowed to do an action * \param p_action_id @@ -964,14 +980,24 @@ class User } return $array; } - function audit() + function audit($action='AUDIT',$p_module="") { global $audit; + if ($p_module=="") + { + $p_module=$_REQUEST['ac']; + } $cn = new Database(); $sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)"; if ($audit) { - $cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $_REQUEST['ac'], $_SERVER['REQUEST_URI'], 'AUDIT')); + $cn->exec_sql($sql, + array( + $_SESSION['g_user'], + $_SERVER["REMOTE_ADDR"], + $p_module, + $_SERVER['REQUEST_URI'], + $action)); } } diff --git a/include/user.inc.php b/include/user.inc.php index 42b711989..8a1a1d1b2 100644 --- a/include/user.inc.php +++ b/include/user.inc.php @@ -23,11 +23,14 @@ /*!\file * * - * \brief user managemnt + * \brief user managemnt, included from admin_repo, + * action=user_mgt * */ - +require_once 'class_sort_table.php'; +/******************************************************/ // Add user +/******************************************************/ if ( isset ($_POST["LOGIN"]) ) { $cn=new Database(); @@ -46,10 +49,6 @@ if ( isset ($_POST["LOGIN"]) ) array($first_name,$last_name,$login,$pass5)); } //SET login -// Show all the existing user on 7 columns -$repo=new Dossier(0); -$cn=$repo->get_user(); -$compteur=0; ?>

Gestion Utilisateurs

@@ -68,33 +67,69 @@ echo ''; ?> - -add("Login", $url," order by use_login asc", "order by use_login desc","la", "ld"); +$header->add("Nom", $url," order by use_login asc", "order by use_login desc","la", "ld"); +$header->add('Dossier',$url,' order by dossier_ag asc','order by dossier_ag desc', + 'da','dd'); +$ord=(isset($_REQUEST['ord']))?$_REQUEST['ord']:'la'; +$sql=$header->get_sql_order($ord); + +$a_user=$repo->get_user_folder($sql); + +if ( !empty ($a_user) ) +{ + echo '
'; + echo ''; + echo ''; + echo ''; + echo th("Prénom"); + echo th("Actif"); + echo ''; + echo ''; + + foreach ( $a_user as $r_user) { $compteur++; - if ( $compteur==0 ) echo ""; - if ( $compteur%3 == 0) echo ""; + $class=($compteur%2==0)?"odd":"even"; + + echo ""; if ( $rUser['use_active'] == 0 ) { - $Active="not actif"; + $Active="non actif"; } else { - $Active=""; + $Active="Actif"; } - printf('', - $rUser['use_id'], - $rUser['use_first_name'], - $rUser['use_name'], - $rUser['use_login'], - $Active); + $det_url=$url."&det&use_id=".$r_user['use_id']; + echo ""; + + echo td($r_user['use_name']); + echo td($r_user['use_first_name']); + echo td($Active); + echo ''; }// foreach + echo '
'.$header->get_header(0).''.$header->get_header(1).''.$header->get_header(2).'
%s %s ( %s ) %s "; + echo HtmlInput::anchor($r_user['use_login'],$det_url); + echo "
'; } // $cn != null ?> -
\ No newline at end of file diff --git a/include/user_detail.inc.php b/include/user_detail.inc.php index d8b42c1c5..322f67da0 100644 --- a/include/user_detail.inc.php +++ b/include/user_detail.inc.php @@ -15,244 +15,212 @@ * You should have received a copy of the GNU General Public License * along with PhpCompta; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -*/ + */ // Copyright Author Dany De Bontridder ddebontridder@yahoo.fr -/*! \file +/* ! \file * \brief Users Security */ include_once("ac_common.php"); require_once('class_database.php'); include_once("user_menu.php"); -html_page_start($_SESSION['g_theme']); - -$rep=new Database(); include_once ("class_user.php"); -$User=new User($rep); -$User->Check(); -/* only the global admin can modify something here - */ -if ($User->admin != 1) -{ - html_page_stop(); - return; -} -if (! isset ($_REQUEST['UID']) ) +$rep = new Database(); + +if (!isset($_REQUEST['use_id'])) { html_page_stop(); exit(); } -$uid=$_REQUEST['UID']; -$UserChange=new User($rep,$uid); +$uid = $_REQUEST['use_id']; +$UserChange = new User($rep, $uid); -$r_UID=$UserChange->id; -if ( $r_UID == false ) +if ($UserChange->id == false) { // Message d'erreur html_page_stop(); } -echo '

Administration Globale

'; -echo "
".MenuAdmin()."
"; - -echo '
'; - -echo '

Gestion Utilisateurs

'; - -// User is valid and you're an admin - - -?> - - - -exec_sql( "update ac_users set use_pass=$1 where use_id=$2",array($l_pass,$uid)); - echo '

Password remis à phpcompta

'; - } -} /* Save the changes */ -if ( isset ($_POST['SAVE']) ) +if (isset($_POST['SAVE'])) { $uid = $_POST['UID']; // Update User - $cn=new Database(); - $last_name=$_POST['fname']; - $first_name=$_POST['lname']; - $UserChange=new User($cn,$uid); - if ( $UserChange->load()==-1) + $cn = new Database(); + $UserChange = new User($cn, $uid); + if ($UserChange->load() == -1) { alert("Cet utilisateur n'existe pas"); } else { - $UserChange->first_name=$first_name; - $UserChange->last_name=$last_name; - $UserChange->active=$_POST['Actif']; - $UserChange->admin=$_POST['Admin']; + $UserChange->first_name = $_POST['fname']; + $UserChange->last_name = $_POST['lname']; + $UserChange->active = $_POST['Actif']; + $UserChange->admin = $_POST['Admin']; + if ( trim($_POST['password'])<>'') + { + $UserChange->pass = md5($_POST['pass']); + } $UserChange->save(); // Update Priv on Folder - foreach ($_POST as $name=>$elem) + foreach ($_POST as $name => $elem) { - if ( substr_count($name,'PRIV')!=0 ) + if (substr_count($name, 'PRIV') != 0) { - $db_id=substr($name,4); - $cn=new Database(); - $UserChange->set_folder_access($db_id,$elem); - + $db_id = substr($name, 4); + $cn = new Database(); + $UserChange->set_folder_access($db_id, $elem); } - } } } else { - if ( isset ($_POST["DELETE"]) ) + if (isset($_POST["DELETE"])) { - $cn=new Database(); - $Res=$cn->exec_sql("delete from priv_user where priv_jnt in ( select jnt_id from jnt_use_dos where use_id=$1",array($uid)); - $Res=$cn->exec_sql("delete from jnt_use_dos where use_id=$1",array($uid)); - $Res=$cn->exec_sql("delete from ac_users where use_id=$1",array($uid)); + $cn = new Database(); + $Res = $cn->exec_sql("delete from priv_user where priv_jnt in ( select jnt_id from jnt_use_dos where use_id=$1", array($uid)); + $Res = $cn->exec_sql("delete from jnt_use_dos where use_id=$1", array($uid)); + $Res = $cn->exec_sql("delete from ac_users where use_id=$1", array($uid)); - echo "

User ".h($_POST['fname'])." ".h($_POST['lname'])." (". - h($_POST['login']).") est effacé

"; + echo "

User " . h($_POST['fname']) . " " . h($_POST['lname']) . " (" . + h($_POST['login']) . ") est effacé

"; require_once("class_iselect.php"); require_once("user.inc.php"); return; } } $UserChange->load(); +$it_pass=new IText('password'); +$it_pass->value=""; ?> -
+ - ',$uid); -?> - - + +
+ - login',$UserChange->login); -?> - - -prénom - -
%s
- ',$UserChange->name); -?> -
- ',$UserChange->first_name); -?> -
+login %s', $UserChange->login); ?> + + + + + ', $UserChange->name); ?> + + + + prénom + ', $UserChange->first_name); + ?> + + + + + Mot de passe :Laisser à VIDE pour ne PAS le changer + + + input();?> + + + - +
active == 1 ) +if ($UserChange->active == 1) { - $ACT="CHECKED"; - $NACT="UNCHECKED"; + $ACT = "CHECKED"; + $NACT = "UNCHECKED"; } else { - $ACT="UNCHECKED"; - $NACT="CHECKED"; + $ACT = "UNCHECKED"; + $NACT = "CHECKED"; } echo ""; ?> -
"; -printf(' Actif',$ACT); +printf(' Actif', $ACT); echo ""; -printf(' Non Actif',$NACT); +printf(' Non Actif', $NACT); echo "
+ - +
admin == 1 ) +if ($UserChange->admin == 1) { - $ACT="CHECKED"; - $NACT="UNCHECKED"; + $ACT = "CHECKED"; + $NACT = "UNCHECKED"; } else { - $ACT="UNCHECKED"; - $NACT="CHECKED"; + $ACT = "UNCHECKED"; + $NACT = "CHECKED"; } echo ""; ?> -
"; -printf(' Administrateur global',$ACT); +printf(' Administrateur global', $ACT); echo ""; -printf(' Pas administrateur global ',$NACT); +printf(' Pas administrateur global ', $NACT); echo "
+ - - -

Droit sur les dossiers pour les utilisateurs normaux

-

- Les autres droits doivent être réglés dans les dossiers (paramètre->sécurité) -

- - 'X','label'=>'Aucun Accès'), - array('value'=>'R','label'=>'Utilisateur normal'), - array('value'=>'P','label'=>'Utilisateur uniquement extension'), - array('value'=>'L','label'=>'Administrateur local(Tous les droits)') - ); -$repo=new Dossier(0); +
+ +

Droit sur les dossiers pour les utilisateurs normaux

+

+ Les autres droits doivent être réglés dans les dossiers (paramètre->sécurité) +

+ + 'X', 'label' => 'Aucun Accès'), + array('value' => 'R', 'label' => 'Utilisateur normal'), + array('value' => 'L', 'label' => 'Administrateur local(Tous les droits)') +); +$repo = new Dossier(0); -$Dossier=$repo->show_dossier('all',1,0); -if ( empty ( $Dossier )) +$Dossier = $repo->show_dossier('all', 1, 0); +if (empty($Dossier)) { echo hb('* Aucun Dossier *'); echo ''; exit(); } -$mod_user=new User(new Database(),$uid); -foreach ( $Dossier as $rDossier) +$mod_user = new User(new Database(), $uid); +foreach ($Dossier as $rDossier) { - $priv=$mod_user->get_folder_access($rDossier['dos_id']); - printf("",h($rDossier['dos_name'])); + $priv = $mod_user->get_folder_access($rDossier['dos_id']); + printf("", h($rDossier['dos_name'])); - $select=new ISelect(); - $select->table=1; - $select->name=sprintf('PRIV%s',$rDossier['dos_id']); - $select->value=$array; - $select->selected=$priv; + $select = new ISelect(); + $select->table = 1; + $select->name = sprintf('PRIV%s', $rDossier['dos_id']); + $select->value = $array; + $select->selected = $priv; echo $select->input(); echo ""; } - -?> -
Dossier : %s
Dossier : %s
- - +
- - -
- + + + + + +