admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Operation details HTML

Browse source 
======================
Add security for RO
Cosmetic change for IE8
This commit is contained in:
Dany De Bontridder 2010-06-27 09:58:58 +00:00
parent c7c5452435
commit 9614756560
7 changed files with 97 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

78
html/ajax_ledger.php
View file

@ -51,7 +51,22 @@ $cn=new Database(dossier::id());
// check if the user is valid and can access this folder
$User=new User($cn);
$User->check();
if ( $User->check_dossier(dossier::id(),true)=='X' ) exit();
if ( $User->check_dossier(dossier::id(),true)=='X' ) {
ob_start();
require_once ('template/ledger_detail_forbidden.php');
$html=ob_get_contents();
ob_clean();
$html=escape_xml($html);
header('Content-type: text/xml; charset=UTF-8');
echo <<<EOF
<?xml version="1.0" encoding="UTF-8"?>
<data>
<ctl>$div</ctl>
<code>$html</code>
</data>
EOF;
exit();
}
// check if the user can access the ledger where the operation is (view) and
@ -60,7 +75,23 @@ $op=new Acc_Operation($cn);
$op->jr_id=$_GET['jr_id'];
$ledger=$op->get_ledger();
$access=$User->get_ledger_access($ledger);
if ( $access == 'X' ) exit();
if ( $access == 'X' ) {
ob_start();
require_once ('template/ledger_detail_forbidden.php');
$html=ob_get_contents();
ob_clean();
$html=escape_xml($html);
header('Content-type: text/xml; charset=UTF-8');
echo <<<EOF
<?xml version="1.0" encoding="UTF-8"?>
<data>
<ctl>$div</ctl>
<code>$html</code>
</data>
EOF;
exit();
}
$html=var_export($_REQUEST,true);
switch ($action) {
@ -102,14 +133,21 @@ case 'de':
$op->get(); $obj=$op->get_quant(); /* return an obj. ACH / FIN or VEN or null if nothing is found*/
if ( $obj->det->jr_pj_name=='') {
echo '<FORM METHOD="POST" ENCTYPE="multipart/form-data" id="form_file">';
echo HtmlInput::hidden('act','loadfile');
echo dossier::hidden();
echo HtmlInput::hidden('jr_id',$jr_id);
echo HtmlInput::hidden('div',$div);
if ( $access=='W') {
echo '<FORM METHOD="POST" ENCTYPE="multipart/form-data" id="form_file">';
$sp=new ISpan('file'.$div);$sp->style="display:none;width:155;height:15;background-color:red;color:white;font-size:14";
$sp->value="Chargement";
echo $sp->input();
echo HtmlInput::hidden('act','loadfile');
echo dossier::hidden();
echo HtmlInput::hidden('jr_id',$jr_id);
echo HtmlInput::hidden('div',$div);
echo '<INPUT TYPE="FILE" name="pj" onchange="submit(this)">';
echo '</FORM>';
echo '<INPUT TYPE="FILE" name="pj" onchange="getElementById(\'file'.$div.'\').style.display=\'block\';submit(this);">';
echo '</FORM>';
} else {
echo _('Aucun fichier');
}
exit();
} else {
echo "<html><head>";
@ -121,6 +159,8 @@ case 'de':
$h=sprintf('<a class="mtitle" href="show_pj.php?gDossier=%d&jrn=%d&jr_grpt_id=%d">%s</a>',
$gDossier,$ledger,$obj->det->jr_grpt_id,h( $obj->det->jr_pj_name));
echo $h;
$x='';
if ($access=='W')
$x=sprintf('<a class="mtitle" href="ajax_ledger.php?gDossier=%d&div=%s&jr_id=%s&act=rmf" onclick="return confirm(\'Effacer le document ?\')">enlever</a>',
$gDossier,$div,$jr_id);
echo $x;
@ -131,7 +171,7 @@ case 'de':
// load a file
/////////////////////////////////////////////////////////////////////////////
case 'loadfile':
if ( isset ($_FILES)) {
if ( $access == 'W' && isset ($_FILES)) {
$cn->start();
// remove the file
$grpt=$cn->get_value('select jr_grpt_id from jrn where jr_id=$1',array($jr_id));
@ -160,13 +200,18 @@ case 'de':
// remove a file
/////////////////////////////////////////////////////////////////////////////
case 'rmf':
if ( $access == 'W' ){
echo '<FORM METHOD="POST" ENCTYPE="multipart/form-data" id="form_file">';
$sp=new ISpan('file'.$div);$sp->style="display:none;width:155;height:15;background-color:red;color:white;font-size:14";
$sp->value="Chargement";
echo $sp->input();
echo HtmlInput::hidden('act','loadfile');
echo dossier::hidden();
echo HtmlInput::hidden('jr_id',$jr_id);
echo HtmlInput::hidden('div',$div);
echo '<INPUT TYPE="FILE" name="pj" onchange="submit(this)">';
echo '<INPUT TYPE="FILE" name="pj" onchange="getElementById(\'file'.$div.'\').style.display=\'block\';submit(this);">';
echo '</FORM>';
$ret=$cn->exec_sql("select jr_pj from jrn where jr_id=$1",array($jr_id));
if (Database::num_row($ret) != 0) {
@ -182,11 +227,13 @@ case 'rmf':
$cn->exec_sql("update jrn set jr_pj=null, jr_pj_name=null, ".
"jr_pj_type=null where jr_id=$1",array($jr_id));
}
}
exit();
/////////////////////////////////////////////////////////////////////////////
// Save operation detail
/////////////////////////////////////////////////////////////////////////////
case 'save':
if ( $access=="W") {
$cn->exec_sql('update jrn set jr_comment=$1,jr_pj_number=$2 where jr_id=$3',
array($_GET['lib'],$_GET['npj'],$jr_id));
$rapt=$_GET['rapt'];
@ -210,14 +257,17 @@ case 'rmf':
$rec->insert($rapt);
}
}
}
break;
/////////////////////////////////////////////////////////////////////////////
// remove a reconciliation
/////////////////////////////////////////////////////////////////////////////
case 'rmr':
$rec=new Acc_Reconciliation($cn);
$rec->set_jr_id($jr_id);
$rec->remove($_GET['jr_id2']);
if ( $access=='W') {
$rec=new Acc_Reconciliation($cn);
$rec->set_jr_id($jr_id);
$rec->remove($_GET['jr_id2']);
}
break;
}
$html=escape_xml($html);

2
html/js/scripts.js
View file

@ -472,7 +472,7 @@ function success_box(req,json)
code_html=unescape_xml(code_html);
g(name_ctl).innerHTML=code_html;
g(name_ctl).style.height='auto';
g(name_ctl).style.width='auto';
/* g(name_ctl).style.width='auto';*/
}
catch (e) {
alert("success_box"+e.message);}

6
html/style-color.css
View file

@ -834,14 +834,16 @@ h2.gest_name {
}
div.op_detail {
background-color:#EDF3FF;
background-color:#e4e7ed;
font-size:10;
font-family:helvetica,arial,sans-serif;
padding:0;
margin:0;
overflow:none;
z-index:3;
position:fixed;width:500;height:200;left:20%;
position:absolute;width:500;height:200;left:200;
border:1px solid darkblue;
}
div.op_detail_title {

21
include/template/ledger_detail_bottom.php
View file

@ -24,16 +24,22 @@ if ($aRap != null ) {
$aRap[$e],
$tableid
);
echo tr (td('<a href="#" onclick="'.$str.'" >'.$internal.'</A>').td($amount).td($rmReconciliation->input()));
if ( $access=='W')
$remove=$rmReconciliation->input();
else
$remove='';
echo tr (td('<a href="#" onclick="'.$str.'" >'.$internal.'</A>').td($amount).td($remove));
}
echo '</table>';
}
?>
</legend>
<?
$search='<INPUT TYPE="BUTTON" class="button" VALUE="Cherche" OnClick="SearchJrn('.$gDossier.",'rapt".$div."','".$obj->det->jr_montant."')\">";
$rapt=new IText('rapt'.$div);
echo $rapt->input().$search;
if ( $access=='W') {
$search='<INPUT TYPE="BUTTON" class="button" VALUE="Cherche" OnClick="SearchJrn('.$gDossier.",'rapt".$div."','".$obj->det->jr_montant."')\">";
$rapt=new IText('rapt'.$div);
echo $rapt->input().$search;
}
?>
</fieldset>
<?
@ -45,5 +51,8 @@ $a->label="Fermer";
$a->javascript="removeDiv('".$div."')";
echo $a->input();
?>
<? echo HtmlInput::submit('save','Sauver'); ?>
</form>
<?if ( $access=='W') {
echo HtmlInput::submit('save','Sauver');
echo '</form>';
}
?>

2
include/template/ledger_detail_file.php
View file

@ -6,4 +6,4 @@
*/
$str='?'.dossier::get()."&div=$div&act=file&jr_id=$jr_id";
?>
<iframe style="border:0;width:500;height:50;overflow:hidden" src="<? echo 'ajax_ledger.php'.$str; ?>"> </iframe>
<iframe frameborder=0 style="border:0;width:500;height:60;overflow:hidden" src="<? echo 'ajax_ledger.php'.$str; ?>"> </iframe>

17
include/template/ledger_detail_fin.php
View file

@ -1,7 +1,10 @@
<? require_once('template/ledger_detail_top.php'); ?>
<div class="content" style="padding:0">
<? if ( $access=='W') : ?>
<form onsubmit="return op_save(this);">
<? endif; ?>
<? echo HtmlInput::hidden('whatdiv',$div).HtmlInput::hidden('jr_id',$jr_id).dossier::hidden();?>
<table>
<tr>
@ -20,7 +23,7 @@ echo td($bk->get_quick_code());
* et celui qui est ni client ni fournisseur est forcément le compte banque, insérer.
*@todo Ajouter une clef unique sur quant_fin.jr_id, quant_purchase.j_id et quant_sold.j_id
*/
echo td($bk->getName());
echo td(h($bk->getName()));
?>
</tr>
<tr>
@ -29,16 +32,16 @@ echo td($bk->getName());
$bk=new Fiche($cn,$obj->det->array[0]['qf_other']);
echo td($bk->get_quick_code());
echo td($bk->getName());
echo td(h($bk->getName()));
?>
</tr>
<tr>
<?
$itext=new IText('lib');
$itext->value=$obj->det->jr_comment;
$itext->size=40;
echo td(_('Libellé')).td($itext->input());
$itext=new IText('lib');
$itext->value=$obj->det->jr_comment;
$itext->size=40;
echo td(_('Libellé')).td($itext->input());
?>
@ -77,7 +80,7 @@ $detail->get();
} else {
// libellé du compte
$name=$cn->get_value('select pcm_lib from tmp_pcmn where pcm_val=$1',array($q[$e]['j_poste']));
$row.=td($name);
$row.=td(h($name));
}
$montant=td($q[$e]['j_montant'],'class="num"');
$row.=($q[$e]['j_debit']=='t')?$montant:td('');

4
include/template/ledger_detail_top.php
View file

@ -1,7 +1,7 @@
<div style="text-align:right;height:13px">
<?
echo '<A style="background-color:blue;color:white;text-decoration:none" HREF="#" onclick="removeDiv(\''.$div.'\');">Fermer</A>';
echo '<A style="background-color:blue;color:white;text-decoration:none" HREF="javascript:void(0)" onclick="removeDiv(\''.$div.'\');">Fermer</A>';
?>
</div>
<? echo h2info($oLedger->get_name()); ?>
<? echo "Opération ID=".$obj->det->jr_internal; ?>
<? echo "Opération ID=".hb($obj->det->jr_internal); ?>