task 3858 : revision of the security correction & improvement

html/admin/sql/patch/upgrade4.sql

@@ -49,5 +49,12 @@ alter table jrn add jr_pj oid ;
 alter table jrn add  jr_pj_name text;
 alter table jrn add  jr_pj_type text;
 
+-- task 3858
+delete from user_sec_act WHERE ua_act_id =14;
+delete from action where ac_id=14;
+insert into action values (18,'Devise');
+insert into action values (19,'Période');
+insert into action values (20,'Voir la balance des comptes');
+
 -- always last line
 update version set val=5;

html/bal_csv.php

@@ -29,9 +29,13 @@ $cn=DbConnect($_SESSION['g_dossier']);
 
 
 include ('class_user.php');
-$User=new cl_user($cn);
+$User=new cl_user(DbConnect());
 $User->Check();
-
+if ( $User->CheckAction($cn,BALANCE) == 0)
+  {
+    NoAccess();
+    exit;
+  }
 $bal=new Balance($cn);
   
 $t_cent="";

html/central.php

@@ -40,20 +40,18 @@ include_once("preference.php");
 include_once ("user_menu.php");
 ShowMenuCompta($_SESSION['g_dossier']);
 
-if ( $_SESSION['use_admin']==0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],CENTRALIZE);
-  if ($r == 0 ){
+$cn=DbConnect($_SESSION['g_dossier']);
+if ( $User->CheckAction($cn,CENTRALIZE)==0 ) {
     /* Cannot Access */
     NoAccess();
-  }
 }
+
 include_once("central_inc.php");
 
 echo '<div class="u_subtmenu">';
 echo ShowMenuAdvanced();
 echo '</div>';
 
-$cn=DbConnect($_SESSION['g_dossier']);
 
 echo '<DIV CLASS="u_subtmenu">';
 echo '<H2 CLASS="info"> Centralise </H2><BR>';

html/dossier_prefs.php

@@ -40,18 +40,17 @@ ShowMenuCompta($_SESSION['g_dossier']);
 
 include_once ("check_priv.php");
 
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],PARM);
-  if ($r == 0 ){
+$cn=DbConnect($_SESSION['g_dossier']);
+
+if ( $User->CheckAction($cn,PARM) == 0 ) {
     /* Cannot Access */
     NoAccess();
   exit -1;			
 
-  }
 }
+
 echo ShowMenuParam();
 $p_action="";
-$cn=DbConnect($_SESSION['g_dossier']);
 if ( isset($_GET["p_action"]) ) {
   $p_action=$_GET["p_action"];
 }

html/fiche.php

@@ -51,21 +51,14 @@ include_once("fiche_inc.php");
 
 $cn=DbConnect($_SESSION['g_dossier']);
 
-
-
-
-
-// ShowMenuComptaRight($g_dossier,$g_UserProperty);
-if ( $User->admin == 0 ) {
-  $read=CheckAction($_SESSION['g_dossier'],$User->id,FICHE_READ);
-  $write=CheckAction($_SESSION['g_dossier'],$User->id,FICHE_WRITE);
-  if ($read+$write == 0 ){
-    /* Cannot Access */
-    NoAccess();
-  }
-}else {
-  $write=1;
+// Security check
+$read=$User->CheckAction($cn,FICHE_READ);
+$write=$User->CheckAction($cn,FICHE_WRITE);
+if ($read+$write == 0 ){
+  /* Cannot Access */
+  NoAccess();
 }
+
 // Creation of a new model of card
 // in the database
 if ( isset($_POST['add_modele'])  and $write != 0) {

html/fiche_csv.php

@@ -27,17 +27,17 @@ include_once("check_priv.php");
 
 $cn=DbConnect($_SESSION['g_dossier']);
 
-
+$rep=DbConnect();
 include ('class_user.php');
-$User=new cl_user($cn);
+$User=new cl_user($rep);
 $User->Check();
-if ( $_SESSION['use_admin'] == 0 ) {
-  if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_READ) == 0 )
-        {
-	  /* Cannot Access */
-	  NoAccess();
-	}
-}
+
+if ($User->CheckAction($cn,FICHE_READ) == 0 )
+  {
+    /* Cannot Access */
+    NoAccess();
+  }
+
 if  ( isset ($_POST['fd_id'])) {
   $fiche_def=new fiche_def($cn,$_POST['fd_id']);
   $fiche=new fiche($cn);

html/fiche_new.php

@@ -35,18 +35,16 @@ if ( ! isset ( $_SESSION['g_dossier'] ) ) {
   exit -2;
 }
 
+$cn=DbConnect($_SESSION['g_dossier']);
 // TODO add security here
 // Get The priv on the selected folder
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_WRITE);
-  if ($r == 0 ){
+if ( $User->CheckAction($cn,FICHE_WRITE)== 0) {
     /* Cannot Access */
     echo '<h2 class="error"> Vous  ne pouvez pas ajouter de fiche</h2>';
     return;
-  }
 }
+
 include_once("fiche_inc.php");
-$cn=DbConnect($_SESSION['g_dossier']);
 foreach ($HTTP_GET_VARS as $key=>$element) {
   // The value are e_name e_type e_PHPSESSID
   ${"e_$key"}=$element;

html/fiche_search.php

@@ -37,14 +37,12 @@ if ( ! isset ( $_SESSION['g_dossier'] ) ) {
 }
 
 include_once ("check_priv.php");
+$cn=DbConnect($_SESSION['g_dossier']);
 // Get The priv on the selected folder
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_READ);
-  if ($r == 0 ){
+if ( $User->CheckAction(FICHE_READ)){
     /* Cannot Access */
     echo '<h2 class="error"> Vous n\' avez pas accès</h2>';
     return;
-  }
 }
 
 function get_list_fiche($p_cn,$get,$p_jrn)

html/form.php

@@ -21,9 +21,9 @@
 /* $Revision$ */
 
 include_once ("ac_common.php");
-html_page_start($g_UserProperty['use_theme']);
+html_page_start($_SESSION['use_theme']);
 
-if ( ! isset ( $g_dossier ) ) {
+if ( ! isset ( $_SESSION['g_dossier'] ) ) {
   echo "You must choose a Dossier ";
   exit -2;
 }
@@ -37,22 +37,20 @@ $User->Check();
 include_once("form_inc.php");
 
 include_once ("user_menu.php");
-ShowMenuCompta($g_dossier,$g_UserProperty);
+ShowMenuCompta($_SESSION['$g_dossier']);
 include ("check_priv.php");
 
-ShowMenuComptaRight($g_dossier,$g_UserProperty);
+ShowMenuComptaRight($_SESSION['g_dossier'],$User->admin);
 
-if ( $g_UserProperty['use_admin'] == 0 ) {
-  $r=CheckAction($g_dossier,$g_user,FORM);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
-  }
-}
 
-ShowMenuComptaForm($g_dossier);
+$cn=DbConnect($_SESSION['g_dossier']);
+if ( $User->CheckAction($cn,FORM)){
+  /* Cannot Access */
+  NoAccess();
+ }
+
+ShowMenuComptaForm($_SESSION['g_dossier']);
 
-$cn=DbConnect($g_dossier);
 if ( isset($_GET["PHPSESSID"] )) {
   $sessid=$_GET["PHPSESSID"];
 } 

html/jrn_add.php

@@ -37,20 +37,16 @@ include_once ("user_menu.php");
 ShowMenuCompta($_SESSION['g_dossier']);
 
 
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
+$cn=DbConnect($_SESSION['g_dossier']);
+if ($User->CheckAction($cn,GJRN)){
+  /* Cannot Access */
+  NoAccess();
   exit -1;			
-
-  }
-
-}
+  
+ }
 
 //echo '<SCRIPT LANGUAGE="javascript" SRC="win_search_poste.js"></SCRIPT>';
 echo JS_SEARCH_POSTE;
-$cn=DbConnect($_SESSION['g_dossier']);
 
 If ( isset ($_POST["JRN_ADD"]) ) {
   if (  !isset($_POST["p_jrn_name"]) || ! isset($_POST["p_jrn_type"] )) {

html/jrn_csv.php

@@ -26,25 +26,22 @@ include_once ("postgres.php");
 include_once("check_priv.php");
 include("class_jrn.php");
 $cn=DbConnect($_SESSION['g_dossier']);
-
+$rep=DbConnect();
 
 include ('class_user.php');
-$User=new cl_user($cn);
+$User=new cl_user($rep);
 $User->Check();
-if ( $User->admin == 0 ) {
-  if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],IMP) == 0 ||
-        $User->AccessJrn($_POST['jrn_id']) == false){
+if ( $User->CheckAction($cn,IMP) == 0 ||
+     $User->AccessJrn($cn,$_POST['jrn_id']) == false){
     /* Cannot Access */
     NoAccess();
   }
 
-}
-
 
  $p_cent=( isset ( $_POST['central']) )?'on':'off';
 
 $Jrn=new jrn($cn,$_POST['jrn_id']);
-// $Jrn->Access();
+
 $Jrn->GetName();
 $Jrn->GetRow( $_POST['from_periode'],
 	      $_POST['to_periode'],

html/jrn_detail.php

@@ -37,16 +37,11 @@ ShowMenuCompta($_SESSION['g_dossier']);
 
 include_once("check_priv.php");
 
-if ( $_SESSION['use_admin'] == 0 ) {
-  include_once("check_priv.php");
-
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
+$cn=DbConnect($_SESSION['g_dossier']);
+if ( $User->CheckAction($cn,GJRN) == 0 ){
+  /* Cannot Access */
+  NoAccess();
   exit -1;			
-
-  }
 }
 // Javascript
 echo JS_SEARCH_POSTE;
@@ -57,7 +52,6 @@ if ( isset( $_GET['p_jrn'] )) {
 }
 
 
-$cn=DbConnect($_SESSION['g_dossier']);
 
 If ( isset ($_POST["JRN_UPD"] )) {
   if (  !isset($_POST["p_jrn_name"])  ) {

html/jrn_pdf.php

@@ -48,16 +48,15 @@ if ($_POST['central'] == 'on' ) {
 $Jrn=new jrn($cn,$_POST['jrn_id']);
 
 $Jrn->GetName();
-$User=new cl_user($cn);
+$User=new cl_user(DbConnect());
 $User->Check();
-if ( $User->admin == 0 ) {
-  if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],IMP) == 0 ||
-        $User->AccessJrn($_POST['jrn_id']) == false){
+
+// Security
+if ($User->CheckAction($cn,IMP) == 0 ||
+    $User->AccessJrn($cn,$_POST['jrn_id']) == false){
     /* Cannot Access */
     NoAccess();
-  }
-
-}
+ }
 
 $ret="";
 $pdf=& new Cezpdf("A4");

html/jrn_update.php

@@ -36,16 +36,12 @@ include_once ("check_priv.php");
 
 include_once ("user_menu.php");
 ShowMenuCompta($_SESSION['g_dossier']);
-
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],GJRN);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
+$cn=DbConnect($_SESSION['g_dossier']);
+if ( $User->CheckAction($cn,GJRN) == 0 ) {
+  /* Cannot Access */
+  NoAccess();
   exit -1;			
-
-  }
-}
+ }
 
 echo '<div class="u_subtmenu">';
 echo ShowMenuAdvanced();

html/line_update.php

@@ -34,16 +34,11 @@ include_once ("class_user.php");
 $User=new cl_user($rep);
 $User->Check();
 
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
+if ( $User->CheckAction(DbConnect($_SESSION['g_dossier']),MPCMN) == 0 ) {
+  /* Cannot Access */
+  NoAccess();
   exit -1;			
-
-  }
-
-}
+ }
 
 include ("user_menu.php");
 ShowMenuComptaRight($_SESSION['g_dossier'],$User->admin);

html/pcmn_update.php

@@ -38,16 +38,12 @@ include_once ("check_priv.php");
 
 ShowMenuCompta($_SESSION['g_dossier']);
 
-if ( $User->admin == 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],MPCMN);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
-    exit -1;			
-
-  }
-
-}
+$cn=DbConnect($_SESSION['g_dossier']);
+if ( $User->CheckAction($cn,MPCMN) == 0 ) {
+  /* Cannot Access */
+  NoAccess();
+  exit -1;			
+ }
 
 /* Store the p_start parameter */
 if ( ! isset ( $_SESSION['g_start']) ) {
@@ -64,7 +60,6 @@ echo '<div class="u_subtmenu">';
 echo ShowMenuAdvanced();
 ShowMenuPcmn($_SESSION['g_start']);
 echo '</div>';
-$cn=DbConnect($_SESSION['g_dossier']);
 echo '<DIV CLASS="u_redcontent">';
 /* Analyse ce qui est demandé */
 /* Effacement d'une ligne */

html/print_balance.php

@@ -38,9 +38,17 @@ include_once("class_balance.php");
 include_once("preference.php");
 
 $cn=DbConnect($_SESSION['g_dossier']);
+$rep=DbConnect();
+include ('class_user.php');
+$User=new cl_user($rep);
+$User->Check();
 
 $bal=new Balance($cn);
-
+if ( $User->CheckAction($cn,BALANCE) == 0)
+  {
+    NoAccess();
+    exit;
+  }
 echo_debug(__FILE__,__LINE__,"imp pdf journaux");
 foreach ($HTTP_POST_VARS as $key=>$element) {
   ${"$key"}=$element;

html/recherche.php

@@ -40,13 +40,14 @@ $User->Check();
 
 ShowMenuCompta($_SESSION['g_dossier']);
 
-if ( $User->admin == 0 ) {
-  // check if user can access
-  if (CheckAction($_SESSION['g_dossier'],$User->id,ENCJRN) == 0 ){
-    /* Cannot Access */
-    NoAccess();
-  }
-}
+// if ( $User->admin == 0 ) {
+//   // check if user can access
+//   if (CheckAction($_SESSION['g_dossier'],$User->id,ENCJRN) == 0 ){
+//     /* Cannot Access */
+//     NoAccess();
+//   }
+// }
+// Security in ListJrn
 
    // PhpSessid
    $sessid=$_REQUEST['PHPSESSID'];

html/show_document.php

@@ -27,7 +27,7 @@ if ( !isset ($_GET['jrn'] ) ||
 
 include_once ("postgres.php");
 
-$jrn=$_GET['jrn'] ;
+
 $jr_grpt_id=$_GET['jr_grpt_id'];
 
 $cn=DbConnect($_SESSION['g_dossier']);
@@ -36,14 +36,20 @@ $cn=DbConnect($_SESSION['g_dossier']);
 include ('class_user.php');
 $User=new cl_user($cn);
 $User->Check();
+// retrieve the jrn
+$r=ExecSql($cn,"select jr_def_id from jrn where jr_grpt_id=$jr_grpt_id");
+if ( pg_num_rows($r) == 0 ) {
+  echo_error("Invalid operation id jr_grpt_id=$jr_grpt_id");
+  exit;
+ }
+$a=pg_fetch_array($r,0);
+$jrn=$a['jr_def_id'];
 
-if ( $User->admin == 0 ) {
-  if (CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$jrn) == 0 ){
-            /* Cannot Access */
-            NoAccess();
-            exit -1;
-          }
-}
+if ($User->AccessJrn($jrn) == false ){
+  /* Cannot Access */
+  NoAccess();
+  exit -1;
+ }
 
 StartSql($cn);
 $ret=ExecSql($cn,"select jr_pj,jr_pj_name,jr_pj_type from jrn where jr_grpt_id=$jr_grpt_id");

html/user_sec.php

@@ -35,17 +35,13 @@ $User->Check();
 
 include_once ("user_menu.php");
 ShowMenuCompta($_SESSION['g_dossier']);
+$cn_dossier=DbConnect($_SESSION['g_dossier']);
 
-if ( $User->admin== 0 ) {
-  $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU);
-  if ($r == 0 ){
-    /* Cannot Access */
-    NoAccess();
+if ( $User->CheckAction($cn_dossier,SECU) == 0 ) {
+  /* Cannot Access */
+  NoAccess();
   exit -1;
-
-  }
-
-}
+ }
 echo ShowMenuParam();
 
 
@@ -78,6 +74,11 @@ if ( isset ($_GET["action"] )) {
   $action=$_GET["action"];
 
 }
+
+// session_register set to off, so variable are undefined
+foreach ($HTTP_GET_VARS as $name=>$value) 
+  ${"$name"}=$value;
+
 if ( $action == "change_jrn" ) {
   // Check if the user can access that folder
   if ( CheckDossier($_GET['login'],$_SESSION['g_dossier']) == 0 ) {
@@ -104,17 +105,17 @@ if ( $action == "change_jrn" ) {
 }
 if ( $action == "change_act" ) {
   // Check if the user can access that folder
-  if ( CheckDossier($User->id,$_SESSION['g_dossier']) == 0 ) {
+  if ( CheckDossier($_GET['login'],$_SESSION['g_dossier']) == 0 ) {
     echo "<H2 class=\"error\">he cannot access this folder</H2>";
     $action="";
     return;
   }
   $l_Db=sprintf("dossier%d",$_SESSION['g_dossier']);
   $cn_dossier=DbConnect($_SESSION['g_dossier']);
-  if ( $access==0) {
+  if ( $_GET['access']==0) {
     echo_debug(__FILE__,__LINE__,"delete right");
     $Res=ExecSql($cn_dossier,
-		 "delete from user_sec_act where ua_login='$login' and ua_act_id=$act");
+		 "delete from user_sec_act where ua_login='".$_GET['login']."' and ua_act_id=$act");
   } else {
     echo_debug(__FILE__,__LINE__,"insert right");
     $Res=ExecSql($cn_dossier,

include/balance.php

@@ -24,6 +24,11 @@ include_once ("ac_common.php");
 include_once("preference.php");
 include_once ("class_widget.php");
 include_once("class_balance.php");
+if ( $User->CheckAction($cn,BALANCE) == 0)
+  {
+    NoAccess();
+    exit;
+  }
 echo '<div class="u_redcontent">';
 
 ////////////////////////////////////////////////////////////////////////////////

include/class_user.php

@@ -23,6 +23,7 @@
  * Purpose : 
  *   Data & function about connected users
  */
+include_once("constant.php");
 
 class cl_user {
   var $id;
@@ -40,8 +41,9 @@ class cl_user {
       $this->type=$_SESSION['use_usertype'];
     if ( isset($_SESSION['use_theme']) )
       $this->theme=$_SESSION['use_theme'];
-    if ( isset($_SESSION['use_admin']) )
-      $this->admin=$_SESSION['use_admin'];
+    
+    $this->admin=( isset($_SESSION['use_admin']) )?$_SESSION['use_admin']:0;
+    
     if ( isset($_SESSION['use_name']) )
       $this->name=$_SESSION['use_name'];
     if ( isset($_SESSION['use_first_name']) )
@@ -137,15 +139,15 @@ class cl_user {
     
     return $this->admin;
   }
-  function AccessJrn($p_jrn_id) {
+  function AccessJrn($p_cn,$p_jrn_id) {
     $this->Admin();
     if ( $this->admin==1) return true;
-    $sql=CountSql($this->db,"select uj_id 
+    $sql=CountSql($p_cn,"select uj_id 
                              from user_sec_jrn 
                              where
                              uj_priv in ('R','W')
                              and uj_jrn_id=".$p_jrn_id.
-		  "and uj_login = '".$this->id."'");
+		  "  and uj_login = '".$this->id."'");
     if ( $sql != 0 ) return true;
     return false;
         
@@ -213,5 +215,31 @@ function GetPreferences ()
   }
   return $l_array;
 }
+/* function CheckAction
+ * Purpose : Check if an user is allowed to do an action
+ * 
+ * parm : 
+ *	- p_dossier dossier id
+ *      - p_login   user's login
+ *      - p_action_id 
+ * gen :
+ *	-
+ * return:
+ *	- 0 no priv
+ *      - 1 priv granted
+ *
+ */ 
+ function CheckAction ( $p_cn,$p_action_id)
+{
+  if ( $this->admin==1 ) return 1;
+
+  $Res=ExecSql($p_cn,"select * from user_sec_act where ua_login='".$this->id."' and ua_act_id=$p_action_id");
+  $Count=pg_NumRows($Res);
+  if ( $Count == 0 ) return 0;
+  if ( $Count == 1 ) return 1;
+  echo "<H2 class=\"error\"> Invalid action !!! $Count select * from user_sec_act where ua_login='$p_login' and ua_act_id=$p_action_id </H2>";
+}
+
+
 }
 ?>

include/constant.php

@@ -45,12 +45,18 @@ define ("GJRN",7);
 define ("PARM",8);
 // Gestion de la sécurité
 define ("SECU",9);
+// gestion devise
+define ("DEVISE",18);
+// gestion Période
+define ("PERIODE",19);
+// Voir la balance des compte
+define ("BALANCE",20);
 // Access à la centralisation
 define ("CENTRALIZE",10);
 define ("VEN",11);
 define ("BQE",12);
 define ("ODS",13);
-define ("ACH",14);
+
 define ("FICHE_WRITE",15);
 define ("STOCK_WRITE",16);
 define ("STOCK_READ",17);

include/user_common.php

@@ -222,7 +222,6 @@ comment = $p_comment");
 function ListJrn($p_cn,$p_jrn,$p_where="",$p_array=null)
 {
 
-  //TODO add a print button but only if type of jrn is VEN !!
   include_once("central_inc.php");
   if ( $p_array == null ) {
    $sql="select jr_id	,
@@ -309,6 +308,16 @@ function ListJrn($p_cn,$p_jrn,$p_where="",$p_array=null)
     if ( $l_poste != null ) {
       $sql.=$l_and."  jr_grpt_id in (select j_grpt 
              from jrnx where j_poste = $l_poste)  ";
+      $l_and=" and ";
+    }
+    // if not admin check filter 
+    $User=new cl_user(DbConnect());
+    $User->Check();
+    if ( $User->admin == 0 ) {
+      $sql.=$l_and." jr_def_id in ( select uj_jrn_id ".
+	" from user_sec_jrn where ".
+	" uj_login='".$_SESSION['g_user']."'".
+	" and uj_priv in ('R','W'))";
     }
     $sql.=" order by jr_date_order asc";
   }// p_array != null