admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sécurité : bloquer le changement de date des opérations,

Browse source 
Renforce mode strict : change de date impossible
This commit is contained in:
sparkyx 2024-02-03 11:08:16 +01:00
parent 1cc0137a95
commit cbdec27e33
7 changed files with 28 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
include/ajax/ajax_ledger.php
View file

@ -132,7 +132,7 @@ switch ($action) {
// remove op
///////////////////////////////////////////////////////////////////////////
case 'rmop':
if ($access == 'W' && $g_user->check_action(RMOPER) == 1) {
if ($access == 'W' && $g_user->check_action(RMOPER) == 1 && $g_parameter->MY_STRICT=='N') {
ob_start();
/* get the ledger */
try {
@ -345,7 +345,7 @@ switch ($action) {
$http = new HttpInput();
try {
$cn->start();
if ($access == "W") {
if ($access == "W" ) {
if (isset($_POST['p_ech'])) {
$ech = $http->post('p_ech');
if (trim($ech) != '' && isDate($ech) != null) {
@ -372,15 +372,20 @@ switch ($action) {
}
}
$oLedger=new Acc_Ledger($cn,$ledger);
$npj=$http->post('npj');
$npj=$http->post('npj');
// protect receipt number
if ( ($g_parameter->MY_PJ_SUGGEST == 'A'||$g_user->check_action(UPDRECEIPT)==0) && $oLedger->get_type() !='FIN') {
$npj=$cn->get_value("select jr_pj_number from jrn where jr_id=$1",[$jr_id]);
}
// protect date in strict mode
$date=$http->post("p_date");
if ( $g_parameter->MY_STRICT=='Y' && $g_user->check_action(UPDDATE)==0) {
$date=$cn->get_value("select to_char(jr_date,'DD.MM.YYYY') from jrn where jr_id=$1",[$jr_id]);
}
$cn->exec_sql("update jrn set jr_comment=$1,jr_pj_number=$2,jr_date=to_date($4,'DD.MM.YYYY'),jr_optype=$5 where jr_id=$3",
array($http->post('lib'), $npj, $jr_id, $http->post('p_date'), $http->post('jr_optype')));
array($http->post('lib'), $npj, $jr_id,$date, $http->post('jr_optype')));
$cn->exec_sql("update jrnx set j_date=to_date($1,'DD.MM.YYYY') where j_grpt in (select jr_grpt_id from jrn where jr_id=$2)",
array($http->post('p_date'), $jr_id));
array($date, $jr_id));
$cn->exec_sql('update operation_analytique set oa_date=j_date from jrnx
where
operation_analytique.j_id=jrnx.j_id and

1
include/constant.security.php
View file

@ -28,6 +28,7 @@ define ('PARCATDOC',1050); // modifier type document pour follow up
define ('RMRECEIPT',1110); // Effacer un document d'une pièce comptable
define ('RMOPER',1120); // Effacer une opération comptable
define ('UPDRECEIPT',1130); // change un numéro de pièce
define ('UPDDATE',1140); // change date operation
define ('SHARENOTE',1210); // Can share a note
define ('SHARENOTEPUBLIC',1220); // Can create public note
define ('SHARENOTEREMOVE',1230); // Can drop drop of other

3
include/template/ledger_detail_ach.php
View file

@ -21,6 +21,9 @@ global $div,$g_parameter,$cn,$access,$jr_id,$obj;
<?php
$date = new IDate('p_date');
$date->value = format_date($obj->det->jr_date);
if ( $g_parameter->MY_STRICT=='Y' && $g_user->check_action(UPDDATE)==0) {
$date->setReadOnly(true);
}
echo td(_('Date')) . td($date->input());
?>
<tr>

4
include/template/ledger_detail_fin.php
View file

@ -2,6 +2,7 @@
//This file is part of NOALYSS and is under GPL
//see licence.txt
$str_anc="";
global $g_parameter,$g_user;
?><?php require_once NOALYSS_TEMPLATE.'/ledger_detail_top.php'; ?>
<div class="content" style="padding:0;">
<?php
@ -19,6 +20,9 @@ $str_anc="";
<tr>
<?php
$date=new IDate('p_date');
if ( $g_parameter->MY_STRICT=='Y' && $g_user->check_action(UPDDATE)==0) {
$date->setReadOnly(true);
}
$date->value=format_date($obj->det->jr_date);
echo td(_('Date')).td($date->input());

3
include/template/ledger_detail_misc.php
View file

@ -27,6 +27,9 @@ $owner = new Noalyss_Parameter_Folder($cn);
<td>
<?php
$date=new IDate('p_date');
if ( $g_parameter->MY_STRICT=='Y' && $g_user->check_action(UPDDATE)==0) {
$date->setReadOnly(true);
}
$date->value=format_date($obj->det->jr_date);
echo td(_('Date')).td($date->input());

5
include/template/ledger_detail_ven.php
View file

@ -1,7 +1,7 @@
<?php
//This file is part of NOALYSS and is under GPL
//see licence.txt
global $div, $g_parameter, $cn, $access, $jr_id, $obj;
global $div, $g_parameter, $cn, $access, $jr_id, $obj,$g_user;
?>
<?php require_once NOALYSS_TEMPLATE . '/ledger_detail_top.php'; ?>
@ -31,6 +31,9 @@ $str_anc = "";
<td></td>
<?php
$date = new IDate('p_date');
if ( $g_parameter->MY_STRICT=='Y' && $g_user->check_action(UPDDATE)==0) {
$date->setReadOnly(true);
}
$date->value = format_date($obj->det->jr_date);
echo td(_('Date')) . td($date->input());
?>

3
sql/upgrade.sql
View file

@ -1,3 +1,6 @@
insert into action (ac_id,ac_description,ac_module,ac_code) values (1130,'Modifier le numéro de pièce','compta','UPDRECEIPT');
insert into action (ac_id,ac_description,ac_module,ac_code) values (1140,'Modifier la date d''une operation' ,'compta','UPDDATE');
insert into user_sec_act(ua_login,ua_act_id) select distinct ua_login,1130 from user_sec_act;
insert into user_sec_act(ua_login,ua_act_id) select distinct ua_login,1140 from user_sec_act;