admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix bug set security for ledgers

Browse source
This commit is contained in:
sparkyx 2025-06-24 16:32:46 +02:00
parent b05b5e4204
commit a231e18b44
4 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/ajax/ajax_user_security.php
View file

@ -30,8 +30,10 @@ if (!defined('ALLOWED'))
*
*/
global $g_user;
if ( $g_user->check_module("C0SEC") == 0)
throw new Exception(_("Non autorisé"));
if ($g_user->check_module("C0SEC") == 0) {
record_log("UNAUTHORIZED ACCESS");
return;
}
$n_dossier_id=Dossier::id();
//-----------------------------------------------------------------------------

2
include/lib/itva_popup.class.php
View file

@ -216,7 +216,7 @@ list="dl_tva_%s" autocomplete="off">';
public function display()
{
$cn = Dossier::connect();
$tva = new Acc_Tva($cn, $this->value);
$tva = Acc_Tva::build($cn, $this->value);
$comment = ($tva->load() != "-1") ? $tva->tva_label : "";
$res = sprintf('<input type="text" name="%s" size="6" class="input_text_ro" value="%s" id="%s" readonly="">%s', $this->name, $this->value, $this->name, $comment);

13
include/param_sec.inc.php
View file

@ -193,9 +193,15 @@ if ( $action == "view" )
// Show access for journal
//--------------------------------------------------------------------------------
$Res=$cn->exec_sql("select jrn_def_id,jrn_def_name from jrn_def ".
" order by jrn_def_name");
$sec_User=new Noalyss_user($cn,$user_id);
$Res=$cn->exec_sql("
select jrn_def_id
,jrn_def_name
,coalesce(usr1.uj_priv,'X') priv
from jrn_def jrn1
left join user_sec_jrn usr1 on (usr1.uj_jrn_id=jrn1.jrn_def_id and usr1.uj_login=$1)
order by jrn_def_name",[$sec_User->login]);
$n_dossier_id=Dossier::id();
$sHref=http_build_query(["act"=>"PDF:sec","user_id"=>$user_id,"gDossier"=>$n_dossier_id]);
@ -269,6 +275,7 @@ if ( $action == "view" )
/* set the widget */
$l_line=Database::fetch_array($Res,$i);
$jrn_priv->value=$array;
$jrn_priv->selected=$l_line['priv'];
$jrn_priv->id="ledas".uniqid();
$ie_input=new Inplace_Edit($jrn_priv);
$ie_input->set_callback("ajax_misc.php");
@ -276,7 +283,7 @@ if ( $action == "view" )
$ie_input->add_json_param("op", "ledger_access");
$ie_input->add_json_param("gDossier", $n_dossier_id);
$ie_input->add_json_param("user_id", $user_id);
$ie_input->set_value($sec_User->get_ledger_access($l_line['jrn_def_id']));
$ie_input->set_value($l_line['priv']);
echo '<TR> ';
if ( $i == 0 ) echo '<TD class="num"> <B> Journal </B> </TD>';
else echo "<TD></TD>";

2
include/template/ledger_detail_ach.php
View file

@ -209,7 +209,7 @@ global $div,$g_parameter,$cn,$access,$jr_id,$obj;
if ($owner->MY_TVA_USE == 'Y' && $q['qp_vat_code'] != '')
{
/* retrieve TVA symbol */
$tva = new Acc_Tva($cn, $q['qp_vat_code']);
$tva = Acc_Tva::build($cn, $q['qp_vat_code']);
$tva->load();
$sym_tva = h($tva->get_parameter('label'));
$x=($g_user->get_vat_code_preference()==1)?$tva->get_parameter('tva_code'):$tva->get_parameter('id');