admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix security problem when seeing object

Browse source
This commit is contained in:
Dany De Bontridder 2010-07-03 14:25:04 +00:00
parent 32f2ed8693
commit 9680338daa
3 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
include/class_acc_account_ledger.php
View file

@ -102,7 +102,7 @@ class Acc_Account_Ledger {
function get_row_date($p_from,$p_to)
{
$user=new User($this->db);
$filter_sql=$user->get_ledger_sql('ALL',1);
$filter_sql=$user->get_ledger_sql('ALL',3);
$Res=$this->db->exec_sql("select jr_id,to_char(j_date,'DD.MM.YYYY') as j_date_fmt,j_date,".
"case when j_debit='t' then j_montant else 0 end as deb_montant,".
"case when j_debit='f' then j_montant else 0 end as cred_montant,".

6
include/class_acc_operation.php
View file

@ -218,9 +218,13 @@ function get_internal() {
return 0;
}
/*!\brief retrieve data from jrnx
*\note the data are filtered by the access of the current user
* \return an array
*/
function get_jrnx_detail() {
$user=new User($this->db);
$filter_sql=$user->get_ledger_sql('ALL',3);
if ( $this->jr_id==0 ) return;
$sql=" select jr_date,j_qcode,j_poste,j_montant,jr_internal,case when j_debit = 'f' then 'C' else 'D' end as debit,jr_comment as description,
vw_name,pcm_lib,j_debit,coalesce(comptaproc.get_letter_jnt(j_id),-1) as letter ".
@ -228,7 +232,7 @@ function get_internal() {
join tmp_pcmn on (j_poste=pcm_val)
left join vw_fiche_attr on (j_qcode=quick_code)
where
jr_id=$1 order by j_debit desc";
jr_id=$1 and $filter_sql order by j_debit desc";
$res=$this->db->exec_sql($sql,array($this->jr_id));
if ( Database::num_row ($res) == 0 ) return array();
$all=Database::fetch_all($res);

2
include/class_fiche.php
View file

@ -923,7 +923,7 @@ av_text1=>'name'
return;
}
$user=new User($this->cn);
$filter_sql=$user->get_ledger_sql('ALL',1);
$filter_sql=$user->get_ledger_sql('ALL',3);
$qcode=$this->strAttribut(ATTR_DEF_QUICKCODE);
$Res=$this->cn->exec_sql("select distinct j_date,to_char(j_date,'DD.MM.YYYY') as j_date_fmt,j_qcode,".