admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix bug set security for ledgers

Browse source
This commit is contained in:
sparkyx 2025-06-24 16:32:46 +02:00
parent b05b5e4204
commit a231e18b44
4 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
include/ajax/ajax_user_security.php
View file

@ -30,9 +30,11 @@ if (!defined('ALLOWED'))
* *
*/ */
global $g_user; global $g_user;
if ( $g_user->check_module("C0SEC") == 0) if ($g_user->check_module("C0SEC") == 0) {
throw new Exception(_("Non autorisé")); record_log("UNAUTHORIZED ACCESS");
return;
}
$n_dossier_id=Dossier::id(); $n_dossier_id=Dossier::id();
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Manage the user's access to ledgers // Manage the user's access to ledgers

2
include/lib/itva_popup.class.php
View file

@ -216,7 +216,7 @@ list="dl_tva_%s" autocomplete="off">';
public function display() public function display()
{ {
$cn = Dossier::connect(); $cn = Dossier::connect();
$tva = new Acc_Tva($cn, $this->value); $tva = Acc_Tva::build($cn, $this->value);
$comment = ($tva->load() != "-1") ? $tva->tva_label : ""; $comment = ($tva->load() != "-1") ? $tva->tva_label : "";
$res = sprintf('<input type="text" name="%s" size="6" class="input_text_ro" value="%s" id="%s" readonly="">%s', $this->name, $this->value, $this->name, $comment); $res = sprintf('<input type="text" name="%s" size="6" class="input_text_ro" value="%s" id="%s" readonly="">%s', $this->name, $this->value, $this->name, $comment);

13
include/param_sec.inc.php
View file

@ -193,9 +193,15 @@ if ( $action == "view" )
// Show access for journal // Show access for journal
//-------------------------------------------------------------------------------- //--------------------------------------------------------------------------------
$Res=$cn->exec_sql("select jrn_def_id,jrn_def_name from jrn_def ".
" order by jrn_def_name");
$sec_User=new Noalyss_user($cn,$user_id); $sec_User=new Noalyss_user($cn,$user_id);
$Res=$cn->exec_sql("
select jrn_def_id
,jrn_def_name
,coalesce(usr1.uj_priv,'X') priv
from jrn_def jrn1
left join user_sec_jrn usr1 on (usr1.uj_jrn_id=jrn1.jrn_def_id and usr1.uj_login=$1)
order by jrn_def_name",[$sec_User->login]);
$n_dossier_id=Dossier::id(); $n_dossier_id=Dossier::id();
$sHref=http_build_query(["act"=>"PDF:sec","user_id"=>$user_id,"gDossier"=>$n_dossier_id]); $sHref=http_build_query(["act"=>"PDF:sec","user_id"=>$user_id,"gDossier"=>$n_dossier_id]);
@ -269,6 +275,7 @@ if ( $action == "view" )
/* set the widget */ /* set the widget */
$l_line=Database::fetch_array($Res,$i); $l_line=Database::fetch_array($Res,$i);
$jrn_priv->value=$array; $jrn_priv->value=$array;
$jrn_priv->selected=$l_line['priv'];
$jrn_priv->id="ledas".uniqid(); $jrn_priv->id="ledas".uniqid();
$ie_input=new Inplace_Edit($jrn_priv); $ie_input=new Inplace_Edit($jrn_priv);
$ie_input->set_callback("ajax_misc.php"); $ie_input->set_callback("ajax_misc.php");
@ -276,7 +283,7 @@ if ( $action == "view" )
$ie_input->add_json_param("op", "ledger_access"); $ie_input->add_json_param("op", "ledger_access");
$ie_input->add_json_param("gDossier", $n_dossier_id); $ie_input->add_json_param("gDossier", $n_dossier_id);
$ie_input->add_json_param("user_id", $user_id); $ie_input->add_json_param("user_id", $user_id);
$ie_input->set_value($sec_User->get_ledger_access($l_line['jrn_def_id'])); $ie_input->set_value($l_line['priv']);
echo '<TR> '; echo '<TR> ';
if ( $i == 0 ) echo '<TD class="num"> <B> Journal </B> </TD>'; if ( $i == 0 ) echo '<TD class="num"> <B> Journal </B> </TD>';
else echo "<TD></TD>"; else echo "<TD></TD>";

2
include/template/ledger_detail_ach.php
View file

@ -209,7 +209,7 @@ global $div,$g_parameter,$cn,$access,$jr_id,$obj;
if ($owner->MY_TVA_USE == 'Y' && $q['qp_vat_code'] != '') if ($owner->MY_TVA_USE == 'Y' && $q['qp_vat_code'] != '')
{ {
/* retrieve TVA symbol */ /* retrieve TVA symbol */
$tva = new Acc_Tva($cn, $q['qp_vat_code']); $tva = Acc_Tva::build($cn, $q['qp_vat_code']);
$tva->load(); $tva->load();
$sym_tva = h($tva->get_parameter('label')); $sym_tva = h($tva->get_parameter('label'));
$x=($g_user->get_vat_code_preference()==1)?$tva->get_parameter('tva_code'):$tva->get_parameter('id'); $x=($g_user->get_vat_code_preference()==1)?$tva->get_parameter('tva_code'):$tva->get_parameter('id');