diff --git a/html/admin/sql/patch/upgrade4.sql b/html/admin/sql/patch/upgrade4.sql index 045349a22..c7a484bd1 100644 --- a/html/admin/sql/patch/upgrade4.sql +++ b/html/admin/sql/patch/upgrade4.sql @@ -49,5 +49,12 @@ alter table jrn add jr_pj oid ; alter table jrn add jr_pj_name text; alter table jrn add jr_pj_type text; +-- task 3858 +delete from user_sec_act WHERE ua_act_id =14; +delete from action where ac_id=14; +insert into action values (18,'Devise'); +insert into action values (19,'Période'); +insert into action values (20,'Voir la balance des comptes'); + -- always last line update version set val=5; diff --git a/html/bal_csv.php b/html/bal_csv.php index 15ad88352..4a38ece14 100644 --- a/html/bal_csv.php +++ b/html/bal_csv.php @@ -29,9 +29,13 @@ $cn=DbConnect($_SESSION['g_dossier']); include ('class_user.php'); -$User=new cl_user($cn); +$User=new cl_user(DbConnect()); $User->Check(); - +if ( $User->CheckAction($cn,BALANCE) == 0) + { + NoAccess(); + exit; + } $bal=new Balance($cn); $t_cent=""; diff --git a/html/central.php b/html/central.php index 6e9eb971d..d4e701fa2 100644 --- a/html/central.php +++ b/html/central.php @@ -40,20 +40,18 @@ include_once("preference.php"); include_once ("user_menu.php"); ShowMenuCompta($_SESSION['g_dossier']); -if ( $_SESSION['use_admin']==0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],CENTRALIZE); - if ($r == 0 ){ +$cn=DbConnect($_SESSION['g_dossier']); +if ( $User->CheckAction($cn,CENTRALIZE)==0 ) { /* Cannot Access */ NoAccess(); - } } + include_once("central_inc.php"); echo '
'; echo ShowMenuAdvanced(); echo '
'; -$cn=DbConnect($_SESSION['g_dossier']); echo '
'; echo '

Centralise


'; diff --git a/html/dossier_prefs.php b/html/dossier_prefs.php index fb8283934..8dc29f6a9 100644 --- a/html/dossier_prefs.php +++ b/html/dossier_prefs.php @@ -40,18 +40,17 @@ ShowMenuCompta($_SESSION['g_dossier']); include_once ("check_priv.php"); -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],PARM); - if ($r == 0 ){ +$cn=DbConnect($_SESSION['g_dossier']); + +if ( $User->CheckAction($cn,PARM) == 0 ) { /* Cannot Access */ NoAccess(); exit -1; - } } + echo ShowMenuParam(); $p_action=""; -$cn=DbConnect($_SESSION['g_dossier']); if ( isset($_GET["p_action"]) ) { $p_action=$_GET["p_action"]; } diff --git a/html/fiche.php b/html/fiche.php index 466de6335..1f1e20b90 100644 --- a/html/fiche.php +++ b/html/fiche.php @@ -51,21 +51,14 @@ include_once("fiche_inc.php"); $cn=DbConnect($_SESSION['g_dossier']); - - - - -// ShowMenuComptaRight($g_dossier,$g_UserProperty); -if ( $User->admin == 0 ) { - $read=CheckAction($_SESSION['g_dossier'],$User->id,FICHE_READ); - $write=CheckAction($_SESSION['g_dossier'],$User->id,FICHE_WRITE); - if ($read+$write == 0 ){ - /* Cannot Access */ - NoAccess(); - } -}else { - $write=1; +// Security check +$read=$User->CheckAction($cn,FICHE_READ); +$write=$User->CheckAction($cn,FICHE_WRITE); +if ($read+$write == 0 ){ + /* Cannot Access */ + NoAccess(); } + // Creation of a new model of card // in the database if ( isset($_POST['add_modele']) and $write != 0) { diff --git a/html/fiche_csv.php b/html/fiche_csv.php index c6665e290..2b2088999 100644 --- a/html/fiche_csv.php +++ b/html/fiche_csv.php @@ -27,17 +27,17 @@ include_once("check_priv.php"); $cn=DbConnect($_SESSION['g_dossier']); - +$rep=DbConnect(); include ('class_user.php'); -$User=new cl_user($cn); +$User=new cl_user($rep); $User->Check(); -if ( $_SESSION['use_admin'] == 0 ) { - if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_READ) == 0 ) - { - /* Cannot Access */ - NoAccess(); - } -} + +if ($User->CheckAction($cn,FICHE_READ) == 0 ) + { + /* Cannot Access */ + NoAccess(); + } + if ( isset ($_POST['fd_id'])) { $fiche_def=new fiche_def($cn,$_POST['fd_id']); $fiche=new fiche($cn); diff --git a/html/fiche_new.php b/html/fiche_new.php index d4644fef1..59f1623d2 100644 --- a/html/fiche_new.php +++ b/html/fiche_new.php @@ -35,18 +35,16 @@ if ( ! isset ( $_SESSION['g_dossier'] ) ) { exit -2; } +$cn=DbConnect($_SESSION['g_dossier']); // TODO add security here // Get The priv on the selected folder -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_WRITE); - if ($r == 0 ){ +if ( $User->CheckAction($cn,FICHE_WRITE)== 0) { /* Cannot Access */ echo '

Vous ne pouvez pas ajouter de fiche

'; return; - } } + include_once("fiche_inc.php"); -$cn=DbConnect($_SESSION['g_dossier']); foreach ($HTTP_GET_VARS as $key=>$element) { // The value are e_name e_type e_PHPSESSID ${"e_$key"}=$element; diff --git a/html/fiche_search.php b/html/fiche_search.php index a47d16902..6ecd5d4ce 100644 --- a/html/fiche_search.php +++ b/html/fiche_search.php @@ -37,14 +37,12 @@ if ( ! isset ( $_SESSION['g_dossier'] ) ) { } include_once ("check_priv.php"); +$cn=DbConnect($_SESSION['g_dossier']); // Get The priv on the selected folder -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],FICHE_READ); - if ($r == 0 ){ +if ( $User->CheckAction(FICHE_READ)){ /* Cannot Access */ echo '

Vous n\' avez pas accès

'; return; - } } function get_list_fiche($p_cn,$get,$p_jrn) diff --git a/html/form.php b/html/form.php index 913cd86b6..236032137 100644 --- a/html/form.php +++ b/html/form.php @@ -21,9 +21,9 @@ /* $Revision$ */ include_once ("ac_common.php"); -html_page_start($g_UserProperty['use_theme']); +html_page_start($_SESSION['use_theme']); -if ( ! isset ( $g_dossier ) ) { +if ( ! isset ( $_SESSION['g_dossier'] ) ) { echo "You must choose a Dossier "; exit -2; } @@ -37,22 +37,20 @@ $User->Check(); include_once("form_inc.php"); include_once ("user_menu.php"); -ShowMenuCompta($g_dossier,$g_UserProperty); +ShowMenuCompta($_SESSION['$g_dossier']); include ("check_priv.php"); -ShowMenuComptaRight($g_dossier,$g_UserProperty); +ShowMenuComptaRight($_SESSION['g_dossier'],$User->admin); -if ( $g_UserProperty['use_admin'] == 0 ) { - $r=CheckAction($g_dossier,$g_user,FORM); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); - } -} -ShowMenuComptaForm($g_dossier); +$cn=DbConnect($_SESSION['g_dossier']); +if ( $User->CheckAction($cn,FORM)){ + /* Cannot Access */ + NoAccess(); + } + +ShowMenuComptaForm($_SESSION['g_dossier']); -$cn=DbConnect($g_dossier); if ( isset($_GET["PHPSESSID"] )) { $sessid=$_GET["PHPSESSID"]; } diff --git a/html/jrn_add.php b/html/jrn_add.php index d2905176b..acded68ef 100644 --- a/html/jrn_add.php +++ b/html/jrn_add.php @@ -37,20 +37,16 @@ include_once ("user_menu.php"); ShowMenuCompta($_SESSION['g_dossier']); -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); +$cn=DbConnect($_SESSION['g_dossier']); +if ($User->CheckAction($cn,GJRN)){ + /* Cannot Access */ + NoAccess(); exit -1; - - } - -} + + } //echo ''; echo JS_SEARCH_POSTE; -$cn=DbConnect($_SESSION['g_dossier']); If ( isset ($_POST["JRN_ADD"]) ) { if ( !isset($_POST["p_jrn_name"]) || ! isset($_POST["p_jrn_type"] )) { diff --git a/html/jrn_csv.php b/html/jrn_csv.php index 3953a765b..247282eee 100644 --- a/html/jrn_csv.php +++ b/html/jrn_csv.php @@ -26,25 +26,22 @@ include_once ("postgres.php"); include_once("check_priv.php"); include("class_jrn.php"); $cn=DbConnect($_SESSION['g_dossier']); - +$rep=DbConnect(); include ('class_user.php'); -$User=new cl_user($cn); +$User=new cl_user($rep); $User->Check(); -if ( $User->admin == 0 ) { - if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],IMP) == 0 || - $User->AccessJrn($_POST['jrn_id']) == false){ +if ( $User->CheckAction($cn,IMP) == 0 || + $User->AccessJrn($cn,$_POST['jrn_id']) == false){ /* Cannot Access */ NoAccess(); } -} - $p_cent=( isset ( $_POST['central']) )?'on':'off'; $Jrn=new jrn($cn,$_POST['jrn_id']); -// $Jrn->Access(); + $Jrn->GetName(); $Jrn->GetRow( $_POST['from_periode'], $_POST['to_periode'], diff --git a/html/jrn_detail.php b/html/jrn_detail.php index 4cf0be75a..b363b6648 100644 --- a/html/jrn_detail.php +++ b/html/jrn_detail.php @@ -37,16 +37,11 @@ ShowMenuCompta($_SESSION['g_dossier']); include_once("check_priv.php"); -if ( $_SESSION['use_admin'] == 0 ) { - include_once("check_priv.php"); - - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); +$cn=DbConnect($_SESSION['g_dossier']); +if ( $User->CheckAction($cn,GJRN) == 0 ){ + /* Cannot Access */ + NoAccess(); exit -1; - - } } // Javascript echo JS_SEARCH_POSTE; @@ -57,7 +52,6 @@ if ( isset( $_GET['p_jrn'] )) { } -$cn=DbConnect($_SESSION['g_dossier']); If ( isset ($_POST["JRN_UPD"] )) { if ( !isset($_POST["p_jrn_name"]) ) { diff --git a/html/jrn_pdf.php b/html/jrn_pdf.php index e0413cb4a..7cce0c242 100644 --- a/html/jrn_pdf.php +++ b/html/jrn_pdf.php @@ -48,16 +48,15 @@ if ($_POST['central'] == 'on' ) { $Jrn=new jrn($cn,$_POST['jrn_id']); $Jrn->GetName(); -$User=new cl_user($cn); +$User=new cl_user(DbConnect()); $User->Check(); -if ( $User->admin == 0 ) { - if (CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],IMP) == 0 || - $User->AccessJrn($_POST['jrn_id']) == false){ + +// Security +if ($User->CheckAction($cn,IMP) == 0 || + $User->AccessJrn($cn,$_POST['jrn_id']) == false){ /* Cannot Access */ NoAccess(); - } - -} + } $ret=""; $pdf=& new Cezpdf("A4"); diff --git a/html/jrn_update.php b/html/jrn_update.php index 544e52af7..29669b538 100644 --- a/html/jrn_update.php +++ b/html/jrn_update.php @@ -36,16 +36,12 @@ include_once ("check_priv.php"); include_once ("user_menu.php"); ShowMenuCompta($_SESSION['g_dossier']); - -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],GJRN); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); +$cn=DbConnect($_SESSION['g_dossier']); +if ( $User->CheckAction($cn,GJRN) == 0 ) { + /* Cannot Access */ + NoAccess(); exit -1; - - } -} + } echo '
'; echo ShowMenuAdvanced(); diff --git a/html/line_update.php b/html/line_update.php index 8935c2c17..d372e2b38 100644 --- a/html/line_update.php +++ b/html/line_update.php @@ -34,16 +34,11 @@ include_once ("class_user.php"); $User=new cl_user($rep); $User->Check(); -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); +if ( $User->CheckAction(DbConnect($_SESSION['g_dossier']),MPCMN) == 0 ) { + /* Cannot Access */ + NoAccess(); exit -1; - - } - -} + } include ("user_menu.php"); ShowMenuComptaRight($_SESSION['g_dossier'],$User->admin); diff --git a/html/pcmn_update.php b/html/pcmn_update.php index 96dfe7703..63e7ef4c5 100644 --- a/html/pcmn_update.php +++ b/html/pcmn_update.php @@ -38,16 +38,12 @@ include_once ("check_priv.php"); ShowMenuCompta($_SESSION['g_dossier']); -if ( $User->admin == 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],MPCMN); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); - exit -1; - - } - -} +$cn=DbConnect($_SESSION['g_dossier']); +if ( $User->CheckAction($cn,MPCMN) == 0 ) { + /* Cannot Access */ + NoAccess(); + exit -1; + } /* Store the p_start parameter */ if ( ! isset ( $_SESSION['g_start']) ) { @@ -64,7 +60,6 @@ echo '
'; echo ShowMenuAdvanced(); ShowMenuPcmn($_SESSION['g_start']); echo '
'; -$cn=DbConnect($_SESSION['g_dossier']); echo '
'; /* Analyse ce qui est demandé */ /* Effacement d'une ligne */ diff --git a/html/print_balance.php b/html/print_balance.php index 8a7b4581d..bc2c152f6 100644 --- a/html/print_balance.php +++ b/html/print_balance.php @@ -38,9 +38,17 @@ include_once("class_balance.php"); include_once("preference.php"); $cn=DbConnect($_SESSION['g_dossier']); +$rep=DbConnect(); +include ('class_user.php'); +$User=new cl_user($rep); +$User->Check(); $bal=new Balance($cn); - +if ( $User->CheckAction($cn,BALANCE) == 0) + { + NoAccess(); + exit; + } echo_debug(__FILE__,__LINE__,"imp pdf journaux"); foreach ($HTTP_POST_VARS as $key=>$element) { ${"$key"}=$element; diff --git a/html/recherche.php b/html/recherche.php index 71ee904b4..fe8549f7f 100644 --- a/html/recherche.php +++ b/html/recherche.php @@ -40,13 +40,14 @@ $User->Check(); ShowMenuCompta($_SESSION['g_dossier']); -if ( $User->admin == 0 ) { - // check if user can access - if (CheckAction($_SESSION['g_dossier'],$User->id,ENCJRN) == 0 ){ - /* Cannot Access */ - NoAccess(); - } -} +// if ( $User->admin == 0 ) { +// // check if user can access +// if (CheckAction($_SESSION['g_dossier'],$User->id,ENCJRN) == 0 ){ +// /* Cannot Access */ +// NoAccess(); +// } +// } +// Security in ListJrn // PhpSessid $sessid=$_REQUEST['PHPSESSID']; diff --git a/html/show_document.php b/html/show_document.php index e3b810e1e..5deaf90c8 100644 --- a/html/show_document.php +++ b/html/show_document.php @@ -27,7 +27,7 @@ if ( !isset ($_GET['jrn'] ) || include_once ("postgres.php"); -$jrn=$_GET['jrn'] ; + $jr_grpt_id=$_GET['jr_grpt_id']; $cn=DbConnect($_SESSION['g_dossier']); @@ -36,14 +36,20 @@ $cn=DbConnect($_SESSION['g_dossier']); include ('class_user.php'); $User=new cl_user($cn); $User->Check(); +// retrieve the jrn +$r=ExecSql($cn,"select jr_def_id from jrn where jr_grpt_id=$jr_grpt_id"); +if ( pg_num_rows($r) == 0 ) { + echo_error("Invalid operation id jr_grpt_id=$jr_grpt_id"); + exit; + } +$a=pg_fetch_array($r,0); +$jrn=$a['jr_def_id']; -if ( $User->admin == 0 ) { - if (CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$jrn) == 0 ){ - /* Cannot Access */ - NoAccess(); - exit -1; - } -} +if ($User->AccessJrn($jrn) == false ){ + /* Cannot Access */ + NoAccess(); + exit -1; + } StartSql($cn); $ret=ExecSql($cn,"select jr_pj,jr_pj_name,jr_pj_type from jrn where jr_grpt_id=$jr_grpt_id"); diff --git a/html/user_sec.php b/html/user_sec.php index 4ab7394e5..e866e1af4 100644 --- a/html/user_sec.php +++ b/html/user_sec.php @@ -35,17 +35,13 @@ $User->Check(); include_once ("user_menu.php"); ShowMenuCompta($_SESSION['g_dossier']); +$cn_dossier=DbConnect($_SESSION['g_dossier']); -if ( $User->admin== 0 ) { - $r=CheckAction($_SESSION['g_dossier'],$_SESSION['g_user'],SECU); - if ($r == 0 ){ - /* Cannot Access */ - NoAccess(); +if ( $User->CheckAction($cn_dossier,SECU) == 0 ) { + /* Cannot Access */ + NoAccess(); exit -1; - - } - -} + } echo ShowMenuParam(); @@ -78,6 +74,11 @@ if ( isset ($_GET["action"] )) { $action=$_GET["action"]; } + +// session_register set to off, so variable are undefined +foreach ($HTTP_GET_VARS as $name=>$value) + ${"$name"}=$value; + if ( $action == "change_jrn" ) { // Check if the user can access that folder if ( CheckDossier($_GET['login'],$_SESSION['g_dossier']) == 0 ) { @@ -104,17 +105,17 @@ if ( $action == "change_jrn" ) { } if ( $action == "change_act" ) { // Check if the user can access that folder - if ( CheckDossier($User->id,$_SESSION['g_dossier']) == 0 ) { + if ( CheckDossier($_GET['login'],$_SESSION['g_dossier']) == 0 ) { echo "

he cannot access this folder

"; $action=""; return; } $l_Db=sprintf("dossier%d",$_SESSION['g_dossier']); $cn_dossier=DbConnect($_SESSION['g_dossier']); - if ( $access==0) { + if ( $_GET['access']==0) { echo_debug(__FILE__,__LINE__,"delete right"); $Res=ExecSql($cn_dossier, - "delete from user_sec_act where ua_login='$login' and ua_act_id=$act"); + "delete from user_sec_act where ua_login='".$_GET['login']."' and ua_act_id=$act"); } else { echo_debug(__FILE__,__LINE__,"insert right"); $Res=ExecSql($cn_dossier, diff --git a/include/balance.php b/include/balance.php index a86a3863e..d2a7939b6 100644 --- a/include/balance.php +++ b/include/balance.php @@ -24,6 +24,11 @@ include_once ("ac_common.php"); include_once("preference.php"); include_once ("class_widget.php"); include_once("class_balance.php"); +if ( $User->CheckAction($cn,BALANCE) == 0) + { + NoAccess(); + exit; + } echo '
'; //////////////////////////////////////////////////////////////////////////////// diff --git a/include/class_user.php b/include/class_user.php index b4f125a47..d2a930f84 100644 --- a/include/class_user.php +++ b/include/class_user.php @@ -23,6 +23,7 @@ * Purpose : * Data & function about connected users */ +include_once("constant.php"); class cl_user { var $id; @@ -40,8 +41,9 @@ class cl_user { $this->type=$_SESSION['use_usertype']; if ( isset($_SESSION['use_theme']) ) $this->theme=$_SESSION['use_theme']; - if ( isset($_SESSION['use_admin']) ) - $this->admin=$_SESSION['use_admin']; + + $this->admin=( isset($_SESSION['use_admin']) )?$_SESSION['use_admin']:0; + if ( isset($_SESSION['use_name']) ) $this->name=$_SESSION['use_name']; if ( isset($_SESSION['use_first_name']) ) @@ -137,15 +139,15 @@ class cl_user { return $this->admin; } - function AccessJrn($p_jrn_id) { + function AccessJrn($p_cn,$p_jrn_id) { $this->Admin(); if ( $this->admin==1) return true; - $sql=CountSql($this->db,"select uj_id + $sql=CountSql($p_cn,"select uj_id from user_sec_jrn where uj_priv in ('R','W') and uj_jrn_id=".$p_jrn_id. - "and uj_login = '".$this->id."'"); + " and uj_login = '".$this->id."'"); if ( $sql != 0 ) return true; return false; @@ -213,5 +215,31 @@ function GetPreferences () } return $l_array; } +/* function CheckAction + * Purpose : Check if an user is allowed to do an action + * + * parm : + * - p_dossier dossier id + * - p_login user's login + * - p_action_id + * gen : + * - + * return: + * - 0 no priv + * - 1 priv granted + * + */ + function CheckAction ( $p_cn,$p_action_id) +{ + if ( $this->admin==1 ) return 1; + + $Res=ExecSql($p_cn,"select * from user_sec_act where ua_login='".$this->id."' and ua_act_id=$p_action_id"); + $Count=pg_NumRows($Res); + if ( $Count == 0 ) return 0; + if ( $Count == 1 ) return 1; + echo "

Invalid action !!! $Count select * from user_sec_act where ua_login='$p_login' and ua_act_id=$p_action_id

"; +} + + } ?> diff --git a/include/constant.php b/include/constant.php index 9b1540b40..62e6a03b0 100644 --- a/include/constant.php +++ b/include/constant.php @@ -45,12 +45,18 @@ define ("GJRN",7); define ("PARM",8); // Gestion de la sécurité define ("SECU",9); +// gestion devise +define ("DEVISE",18); +// gestion Période +define ("PERIODE",19); +// Voir la balance des compte +define ("BALANCE",20); // Access à la centralisation define ("CENTRALIZE",10); define ("VEN",11); define ("BQE",12); define ("ODS",13); -define ("ACH",14); + define ("FICHE_WRITE",15); define ("STOCK_WRITE",16); define ("STOCK_READ",17); diff --git a/include/user_common.php b/include/user_common.php index ed360708c..dc0173aeb 100644 --- a/include/user_common.php +++ b/include/user_common.php @@ -222,7 +222,6 @@ comment = $p_comment"); function ListJrn($p_cn,$p_jrn,$p_where="",$p_array=null) { - //TODO add a print button but only if type of jrn is VEN !! include_once("central_inc.php"); if ( $p_array == null ) { $sql="select jr_id , @@ -309,6 +308,16 @@ function ListJrn($p_cn,$p_jrn,$p_where="",$p_array=null) if ( $l_poste != null ) { $sql.=$l_and." jr_grpt_id in (select j_grpt from jrnx where j_poste = $l_poste) "; + $l_and=" and "; + } + // if not admin check filter + $User=new cl_user(DbConnect()); + $User->Check(); + if ( $User->admin == 0 ) { + $sql.=$l_and." jr_def_id in ( select uj_jrn_id ". + " from user_sec_jrn where ". + " uj_login='".$_SESSION['g_user']."'". + " and uj_priv in ('R','W'))"; } $sql.=" order by jr_date_order asc"; }// p_array != null