From a231e18b447bc52eeed7cbae16a4479648cf1603 Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Tue, 24 Jun 2025 16:32:46 +0200
Subject: [PATCH] Fix bug set security for ledgers

---
 include/ajax/ajax_user_security.php    |  8 +++++---
 include/lib/itva_popup.class.php       |  2 +-
 include/param_sec.inc.php              | 13 ++++++++++---
 include/template/ledger_detail_ach.php |  2 +-
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/include/ajax/ajax_user_security.php b/include/ajax/ajax_user_security.php
index 1274a1301..4a0636dd1 100644
--- a/include/ajax/ajax_user_security.php
+++ b/include/ajax/ajax_user_security.php
@@ -30,9 +30,11 @@ if (!defined('ALLOWED'))
  * 
  */
  global $g_user;
-if ( $g_user->check_module("C0SEC") == 0)        
-        throw new Exception(_("Non autorisé"));
-    
+ if ($g_user->check_module("C0SEC") == 0) {
+     record_log("UNAUTHORIZED ACCESS");
+     return;
+}
+
 $n_dossier_id=Dossier::id();
 //-----------------------------------------------------------------------------
 // Manage the user's access to ledgers
diff --git a/include/lib/itva_popup.class.php b/include/lib/itva_popup.class.php
index 8b373afa6..4a0e20c25 100644
--- a/include/lib/itva_popup.class.php
+++ b/include/lib/itva_popup.class.php
@@ -216,7 +216,7 @@ list="dl_tva_%s" autocomplete="off">';
     public function display()
     {
         $cn = Dossier::connect();
-        $tva = new Acc_Tva($cn, $this->value);
+        $tva = Acc_Tva::build($cn, $this->value);
 
         $comment = ($tva->load() != "-1") ? $tva->tva_label : "";
         $res = sprintf('<input type="text" name="%s" size="6" class="input_text_ro" value="%s" id="%s" readonly="">%s', $this->name, $this->value, $this->name, $comment);
diff --git a/include/param_sec.inc.php b/include/param_sec.inc.php
index 9daaca5c8..fbcb9b77e 100644
--- a/include/param_sec.inc.php
+++ b/include/param_sec.inc.php
@@ -193,9 +193,15 @@ if ( $action == "view" )
     // Show access for journal
     //--------------------------------------------------------------------------------
 
-    $Res=$cn->exec_sql("select jrn_def_id,jrn_def_name  from jrn_def ".
-                               " order by jrn_def_name");
     $sec_User=new Noalyss_user($cn,$user_id);
+    $Res=$cn->exec_sql("
+        select jrn_def_id
+            ,jrn_def_name  
+            ,coalesce(usr1.uj_priv,'X') priv
+        from jrn_def jrn1
+        left join user_sec_jrn usr1 on (usr1.uj_jrn_id=jrn1.jrn_def_id and usr1.uj_login=$1)        
+        order by jrn_def_name",[$sec_User->login]);
+    
     $n_dossier_id=Dossier::id();
     $sHref=http_build_query(["act"=>"PDF:sec","user_id"=>$user_id,"gDossier"=>$n_dossier_id]);
 
@@ -269,6 +275,7 @@ if ( $action == "view" )
         /* set the widget */
         $l_line=Database::fetch_array($Res,$i);
         $jrn_priv->value=$array;
+        $jrn_priv->selected=$l_line['priv'];
         $jrn_priv->id="ledas".uniqid();
         $ie_input=new Inplace_Edit($jrn_priv);
         $ie_input->set_callback("ajax_misc.php");
@@ -276,7 +283,7 @@ if ( $action == "view" )
         $ie_input->add_json_param("op", "ledger_access");
         $ie_input->add_json_param("gDossier", $n_dossier_id);
         $ie_input->add_json_param("user_id", $user_id);
-        $ie_input->set_value($sec_User->get_ledger_access($l_line['jrn_def_id']));
+        $ie_input->set_value($l_line['priv']);
         echo '<TR> ';
         if ( $i == 0 ) echo '<TD class="num"> <B> Journal </B> </TD>';
         else echo "<TD></TD>";
diff --git a/include/template/ledger_detail_ach.php b/include/template/ledger_detail_ach.php
index be96bc5cc..b03d4abca 100644
--- a/include/template/ledger_detail_ach.php
+++ b/include/template/ledger_detail_ach.php
@@ -209,7 +209,7 @@ global $div,$g_parameter,$cn,$access,$jr_id,$obj;
                     if ($owner->MY_TVA_USE == 'Y' && $q['qp_vat_code'] != '')
                     {
                         /* retrieve TVA symbol */
-                        $tva = new Acc_Tva($cn, $q['qp_vat_code']);
+                        $tva = Acc_Tva::build($cn, $q['qp_vat_code']);
                         $tva->load();
                         $sym_tva = h($tva->get_parameter('label'));
                         $x=($g_user->get_vat_code_preference()==1)?$tva->get_parameter('tva_code'):$tva->get_parameter('id');