diff --git a/html/fiche.php b/html/fiche.php
index abf2aae54..561d054e2 100644
--- a/html/fiche.php
+++ b/html/fiche.php
@@ -47,23 +47,26 @@ include_once("fiche_inc.php");
$l_Db=sprintf("dossier%d",$g_dossier);
$cn=DbConnect($l_Db);
-// Creation of a new model of card
-// in the database
-if ( isset($_POST['add_modele']) ) {
- // insert the model of card in database
- AddModele($cn,$HTTP_POST_VARS);
-}
ShowMenuComptaRight($g_dossier,$g_UserProperty);
if ( $g_UserProperty['use_admin'] == 0 ) {
- $r=CheckAction($g_dossier,$g_user,FICHE);
- if ($r == 0 ){
+ $read=CheckAction($g_dossier,$g_user,FICHE_READ);
+ $write=CheckAction($g_dossier,$g_user,FICHE_WRITE);
+ if ($read+$write == 0 ){
/* Cannot Access */
NoAccess();
}
+}else {
+ $write=1;
+}
+// Creation of a new model of card
+// in the database
+if ( isset($_POST['add_modele']) and $write != 0) {
+ // insert the model of card in database
+ AddModele($cn,$HTTP_POST_VARS);
}
ShowMenuComptaLeft($g_dossier,MENU_FICHE);
@@ -77,12 +80,13 @@ if ( isset ( $_GET["action"]) ) {
}// Display the detail of a card
if ($action== "detail" ) {
echo '
';
+ if ( $write == 0) echo '
Vos changements ne seront pas sauvés
';
ViewFicheDetail($cn,$_GET["fiche_id"]);
echo '';
}
// Display the form where you can enter
// the property of the card model
- if ($action == "add_modele" ) {
+ if ($action == "add_modele" and $write !=0) {
echo '';
DefModele($cn,$search);
echo '
';
@@ -90,53 +94,86 @@ if ( isset ( $_GET["action"]) ) {
// Modify a card Model
if ($action == "modifier" ) {
echo '';
- UpdateModele($cn,$_GET["fiche"],$search);
- echo '';
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ UpdateModele($cn,$_GET["fiche"],$search);
+ echo '';
}
// delete a card
- if ($action== "delete" ) {
+ if ($action== "delete" ) {
echo '';
- Remove($cn,$_GET["fiche_id"]);
-
- ViewFiche($cn,$_GET["f_fd_id"]);
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ {
+ Remove($cn,$_GET["fiche_id"]);
+
+ ViewFiche($cn,$_GET["f_fd_id"]);
+ }
echo "";
}
}
// Add a line in the card model
-if ( isset ($_GET["add_ligne"] )) {
+if ( isset ($_GET["add_ligne"]) ) {
echo '';
- SaveModeleName($cn,$_GET["fd_id"],$_GET["label"]);
- InsertModeleLine($cn,$_GET["fd_id"],$_GET["ad_id"]);
- UpdateModele($cn,$_GET["fd_id"],$search);
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ {
+ SaveModeleName($cn,$_GET["fd_id"],$_GET["label"]);
+ InsertModeleLine($cn,$_GET["fd_id"],$_GET["ad_id"]);
+ UpdateModele($cn,$_GET["fd_id"],$search);
+ }
echo '';
}
// Change the name of the card model
-if ( isset ($_GET["change_name"] )) {
+if ( isset ($_GET["change_name"] ) ) {
echo '';
- SaveModeleName($cn,$_GET["fd_id"],$_GET["label"]);
- UpdateModele($cn,$_GET["fd_id"],$search);
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ {
+ SaveModeleName($cn,$_GET["fd_id"],$_GET["label"]);
+ UpdateModele($cn,$_GET["fd_id"],$search);
+ }
echo '';
}
// Display a blank card from the selected category
-if ( isset ($_POST["fiche"]) && isset ($_POST["add"]) ) {
+if ( isset ($_POST["fiche"]) && isset ($_POST["add"] ) ) {
echo '';
- EncodeFiche($cn,$_POST["fiche"]);
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ EncodeFiche($cn,$_POST["fiche"]);
echo '';
}
// Add the data (attribute) of the card
if ( isset ($_POST["add_fiche"]) ) {
echo '';
- AddFiche($cn,$_POST["fiche"],$HTTP_POST_VARS);
- ViewFiche($cn,$_POST["fiche"]);
+
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ {
+ AddFiche($cn,$_POST["fiche"],$HTTP_POST_VARS);
+ ViewFiche($cn,$_POST["fiche"]);
+ }
echo '';
}
// Update a card
-if ( isset ($_POST["update_fiche"])) {
+if ( isset ($_POST["update_fiche"]) ) {
echo '';
- $a=UpdateFiche($cn,$HTTP_POST_VARS);
- $fd_id=GetFicheDef($cn,$_POST["f_id"]);
- ViewFiche($cn,$fd_id);
+ if ( $write ==0)
+ echo "
Pas d'accès
";
+ else
+ {
+ $a=UpdateFiche($cn,$HTTP_POST_VARS);
+ }
+ $fd_id=GetFicheDef($cn,$_POST["f_id"]);
+ ViewFiche($cn,$fd_id);
+
echo '';
}