admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Improve security

Browse source
This commit is contained in:
sparkyx 2006-07-03 20:35:38 +00:00
parent 136781a8a1
commit d6f330344d
15 changed files with 149 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

5
html/admin/sql/patch/upgrade13.sql
View file

@ -548,5 +548,10 @@ alter table action_gestion add ag_ref text;
create unique index k_ag_ref on action_gestion(ag_ref);
update version set val=14;
insert into action values(28,'Module Suivi Document');
insert into action values(22,'Module Client');
insert into action (24,'Module Fournisseur');
insert into action (26,'Module Administration');
insert into action values (30,'Module Gestion');
commit;

3
html/commercial.php
View file

@ -36,12 +36,14 @@ if ( isset ($_REQUEST['dos'] ) ) {
}
include_once ("postgres.php");
/* Admin. Dossier */
$rep=DbConnect($_SESSION['g_dossier']);
require_once ("class_user.php");
$User=new cl_user($rep);
$User->Check();
//-----------------------------------------------------
// update preference
//-----------------------------------------------------
@ -94,6 +96,7 @@ echo ShowItem(array(
echo '</div>';
$cn=DbConnect($_SESSION['g_dossier']);
$User->AccessRequest($cn,SEC_GESTION);
//-----------------------------------------------------
// p_action == pref
//-----------------------------------------------------

4
html/fiche_search.php
View file

@ -160,6 +160,8 @@ if ( isset ( $_POST['search']) ) {
$class="odd";
$text=FormatString($row['vw_name']);
$r.="<span class=\"$class\">";
$qcode= $row['quick_code'] ;
$r.=sprintf ('<input name="%s" type="button" onClick="'."SetData('%s','%s','%s','%s','%s','%s','%s')".'" value="%s">',
"select" . $i,
$e_name,
@ -169,7 +171,7 @@ if ( isset ( $_POST['search']) ) {
$row['vw_buy'],
$row['tva_id'],
$row['tva_label'] ,
$row['quick_code']
$qcode
);
$r.="&nbsp;".$row['vw_name'];
if ( $row['vw_addr'] !="")

12
include/ac_common.php
View file

@ -189,13 +189,11 @@ function html_button_logout() {
*/
function NoAccess() {
echo "<BR><BR><BR><BR><BR><BR>";
echo "<P ALIGN=center><BLINK>
<FONT size=+12 COLOR=RED>
You haven't access
</FONT></BLINK></P></BODY></HTML>";
function NoAccess()
{
echo "<script>";
echo "alert ('Cette action ne vous est pas autorisée Contactez votre responsable');";
echo "</script>";
exit -1;
}
/*!

3
include/action.inc.php
View file

@ -21,7 +21,8 @@
/*! \file
* \brief Page who manage the different action (meeting, letter)
*/
var_dump($_POST);
$User->AccessRequest($cn,SEC_ACTION);
//-----------------------------------------------------
// Action
//-----------------------------------------------------

1
include/admin.inc.php
View file

@ -20,6 +20,7 @@
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
require_once("class_admin.php");
$sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
$User->AccessRequest($cn,ADMIN);
/*! \file
* \brief Called from the module "Gestion" to manage the customer

41
include/bank.inc.php
View file

@ -24,6 +24,7 @@ require_once('jrn.php');
require_once("class_document.php");
require_once("class_fiche.php");
require_once("class_parm_code.php");
require_once("check_priv.php");
/*!\file
* \brief the purpose off this file encode expense and to record them
*
@ -41,6 +42,12 @@ if ( ! isset ($_REQUEST['p_jrn'])) {
{
$p_jrn=$_REQUEST['p_jrn'];
}
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
// for the back button
$retour="";
$h_url="";
@ -56,6 +63,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
// ask the saldo of the bank
if ( $sub_action == "solde" )
{
// Check privilege
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
echo '<div class="u_subtmenu">';
echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="cell"><A class="mtitle" HREF="commercial.php?liste&p_action=bank&sa=list">Liste</A></td>'.
@ -103,7 +115,11 @@ echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="cell"><A class="
//
if ( $sub_action == "list")
{
// Check privilege
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
// show the menu with the list item selected
echo '<div class="u_subtmenu">';
echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="selectedcell">Liste</td>');
@ -185,13 +201,18 @@ echo '</div>';
// or if we ask to correct the invoice
if ( isset ($_POST['add_item']) || isset ($_POST['correct']) )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
$nb_item=$_POST['nb_item'];
if ( isset ($_POST['add_item']))
$nb_item++;
// Submit button in the form
$submit='<INPUT TYPE="SUBMIT" NAME="add_item" VALUE="Ajout article">
<INPUT TYPE="SUBMIT" NAME="view_invoice" VALUE="Sauver" ID="SubmitButton">';
$form=FormFin($cn,$_GET['p_jrn'],$User->GetPeriode(),$submit,$_POST,false, $nb_item);
$form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false, $nb_item);
//$form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false, $nb_number);
echo '<div class="u_redcontent">';
@ -205,6 +226,11 @@ if ( isset ($_POST['add_item']) || isset ($_POST['correct']) )
//
if ( isset($_POST['save']))
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
// we save the expense
$r=RecordFin($cn,$_POST,$User,$p_jrn);
$nb_number=$_POST['nb_item'];
@ -217,7 +243,7 @@ if ( isset($_POST['save']))
echo $form;
echo '<hr>';
echo '</form>';
echo '<A href="commercial.php?p_action=bank&p_jrn='.$_GET['p_jrn'].'">
echo '<A href="commercial.php?p_action=bank&p_jrn='.$p_jrn.'">
<input type="button" Value="Nouveau"></A>';
exit();
}
@ -226,6 +252,11 @@ if ( isset($_POST['save']))
//
if ( isset ($_POST['view_invoice']) )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
$nb_number=$_POST["nb_item"];
$submit='<INPUT TYPE="SUBMIT" name="save" value="Confirmer">';
$submit.='<INPUT TYPE="SUBMIT" name="correct" value="Corriger">';
@ -254,6 +285,10 @@ if ( isset ($_POST['view_invoice']) )
// By default we add a new invoice
if ( $p_jrn != -1 )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
exit -1;
}
$jrn=new jrn($cn, $p_jrn);
echo_debug('depense.inc.php',__LINE__,"Blank form");
// Submit button in the form

20
include/class_user.php
View file

@ -226,8 +226,7 @@ function GetPreferences ()
/*!
* \brief Check if an user is allowed to do an action
*
* \param p_dossier dossier id
* \param p_login user's login
* \param p_cn Database connx
* \param p_action_id
* \return
* - 0 no priv
@ -350,6 +349,21 @@ function getExercice()
$r=pg_fetch_array($Ret,0);
return $r['p_exercice'];
}
/*!\brief Check if the user can access
* otherwise warn and exit
* \param $p_cn database connx
* \param $action_id
* \return nothing the program exits automatically
*/
function AccessRequest($p_cn,$p_action)
{
if ( $this->CheckAction($p_cn,$p_action)==0 )
{
echo "<script>";
echo "alert ('Cette action ne vous est pas autorisée. Contactez votre responsable');";
echo "</script>";
exit(-1);
}
}
}
?>

7
include/client.inc.php
View file

@ -24,6 +24,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
/*! \file
* \brief Called from the module "Gestion" to manage the customer
*/
$User->AccessRequest($cn,CLIENT);
?>
@ -32,6 +33,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
// Remove a card
if ( isset ($_POST['delete']) )
{
echo 'delete';
$f_id=$_REQUEST['f_id'];
@ -43,6 +45,7 @@ if ( isset ($_POST['delete']) )
// Add card
if ( $sub_action=="insert" )
{
$retour=sprintf('<A class="two" HREF="%s"><input type="button" value="Retour"></A>',
urldecode($_REQUEST['url']));
@ -59,6 +62,7 @@ if ( $sub_action=="insert" )
// Save modification
if ( isset ($_POST['mod']))
{
// modification is asked
$f_id=$_REQUEST['f_id'];
@ -72,6 +76,7 @@ if ( $sub_action == "" )
//Display a blank card
if ( $sub_action=="blank")
{
$retour=sprintf('<A class="two" HREF="%s"><input type="button" value="Retour"></A>',
"commercial.php?p_action=client");
echo '<div class="u_redcontent">';
@ -153,9 +158,11 @@ if ( $sub_action == 'detail' )
$w->value=$f_id;
echo $w->IOValue();
echo $w->Submit('mod','Sauver les modifications');
echo $w->Reset("Annuler");
echo $w->Submit('delete','Effacer cette fiche');
echo '</form>';
echo $retour;
echo '<div>';

9
include/constant.php
View file

@ -60,6 +60,13 @@ define ("VEN",11);
define ("BQE",12);
define ("ODS",13);
//!\enum Security
define("SEC_ACTION", 28); // Module Suivi Document
define("CLIENT",22); // Module Client
define("SUPPL",24); // Module Fournisseur
define("ADMIN",26); // Module Administration
define("SEC_GESTION",30); // Module Gestion
define ("FICHE_WRITE",15);
define ("STOCK_WRITE",16);
define ("STOCK_READ",17);
@ -82,7 +89,7 @@ define ("LAST",1);
define ("FIRST",0);
define ("ERROR",12);
//\enum ACTION defines document_type for action
//!\enum ACTION defines document_type for action
define('ACTION','1,5,6,7,8');
//valeurs standardd

31
include/depense.inc.php
View file

@ -23,6 +23,7 @@ require_once('user_form_ach.php');
require_once('jrn.php');
require_once("class_document.php");
require_once("class_fiche.php");
require_once("check_priv.php");
/*!\brief the purpose off this file encode expense and to record them
*
*/
@ -55,7 +56,10 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
//
if ( $sub_action == "list")
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
// show the menu with the list item selected
echo '<div class="u_subtmenu">';
echo ShowMenuJrnUser($_SESSION['g_dossier'],'ACH',0,'<td class="selectedcell">Liste</td>');
@ -159,6 +163,11 @@ echo '</div>';
// or if we ask to correct the invoice
if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
$nb_item=$_POST['nb_item'];
if ( isset ($_POST['add_item']))
$nb_item++;
@ -166,7 +175,7 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) )
$submit='<INPUT TYPE="SUBMIT" NAME="add_item" VALUE="Ajout article">
<INPUT TYPE="SUBMIT" NAME="view_invoice" VALUE="Sauver" ID="SubmitButton">';
$form=FormAchInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$submit,false,$nb_item);
$form=FormAchInput($cn,$p_jrn,$User->GetPeriode(),$_POST,$submit,false,$nb_item);
echo '<div class="u_redcontent">';
echo $form;
echo JS_CALC_LINE;
@ -179,18 +188,23 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) )
//
if ( isset($_POST['save']))
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
// we save the expense
list ($internal,$c)=RecordSell($cn,$_POST,$User,$p_jrn);
$form=FormAchView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false);
$form=FormAchView($cn,$p_jrn,$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false);
echo '<div class="u_redcontent">';
echo '<h2 class="info"> Op&eacute;ration '.$internal.' enregistr&eacute;</h2>';
echo $form;
echo '<hr>';
echo '</form>';
echo '<A href="commercial.php?p_action=depense&p_jrn='.$_GET['p_jrn'].'">
echo '<A href="commercial.php?p_action=depense&p_jrn='.$p_jrn.'">
<input type="button" Value="Nouveau"></A>';
exit();
}
@ -199,6 +213,11 @@ if ( isset($_POST['save']))
//
if ( isset ($_POST['view_invoice']) )
{
// Check privilege
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
$nb_number=$_POST["nb_item"];
$submit='<INPUT TYPE="SUBMIT" name="save" value="Confirmer">';
$submit.='<INPUT TYPE="SUBMIT" name="correct" value="Corriger">';
@ -226,6 +245,10 @@ if ( isset ($_POST['view_invoice']) )
// By default we add a new invoice
if ( $p_jrn != -1 )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
exit -1;
}
$jrn=new jrn($cn, $p_jrn);
echo_debug('depense.inc.php',__LINE__,"Blank form");
// Submit button in the form

36
include/facture.inc.php
View file

@ -23,6 +23,7 @@ require_once('user_form_ven.php');
require_once('jrn.php');
require_once("class_document.php");
require_once("class_fiche.php");
require_once("check_priv.php");
/*!\file
* \brief the purpose off this file is to create invoices, to record them and to generate
* them, and of course to save them into the database
@ -56,7 +57,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
//
if ( $sub_action == "list")
{
// Check privilege
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
// show the menu with the list item selected
echo '<div class="u_subtmenu">';
echo ShowMenuJrnUser($_SESSION['g_dossier'],'VEN',0,'<td class="selectedcell">Liste</td>');
@ -160,10 +165,15 @@ echo '</div>';
// or if we ask to correct the invoice
if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
$nb_item=$_POST['nb_item'];
if ( isset ($_POST['add_item']))
$nb_item++;
$form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,false,$nb_item);
$form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$_POST,false,$nb_item);
echo '<div class="u_redcontent">';
echo $form;
echo '</div>';
@ -174,12 +184,17 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) )
//
if ( isset($_POST['record_and_print_invoice']))
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
NoAccess();
exit -1;
}
// First we save the invoice, the internal code will be used to change the description
// and upload the file
list ($internal,$e)=RecordInvoice($cn,$_POST,$User,$p_jrn);
$form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform','');
$form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform','');
echo '<div class="u_redcontent">';
echo '<h2 class="info"> Op&eacute;ration '.$internal.' enregistr&eacute;</h2>';
@ -210,15 +225,20 @@ if ( isset($_POST['record_and_print_invoice']))
// invoice
if ( isset ($_POST['view_invoice']) )
{
// Check privilege
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) {
NoAccess();
exit -1;
}
$nb_number=$_POST["nb_item"];
if ( form_verify_input($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true)
if ( form_verify_input($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true)
{
$form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number);
$form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number);
} else {
// Check failed : invalid date or quantity
echo_error("Cannot validate ");
$form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number);
$form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number);
}
echo '<div class="u_redcontent">';
@ -234,6 +254,10 @@ if ( isset ($_POST['view_invoice']) )
// By default we add a new invoice
if ( $p_jrn != -1 )
{
if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) {
exit -1;
}
$jrn=new jrn($cn, $p_jrn);
echo_debug('facture.inc.php.php',__LINE__,"Blank form");
// Show an empty form of invoice

1
include/supplier.inc.php
View file

@ -25,6 +25,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
* \brief Called from the module "Gestion" to manage the customer
*/
$User->AccessRequest($cn,SUPPL);
?>
<?

3
include/user_menu.php
View file

@ -190,7 +190,8 @@ function GetFirstJrnIdForJrnType($p_dossier,$p_type)
//get db connection
$Cn=DbConnect($p_dossier);
//execute query
$Ret=ExecSql($Cn,"select min(jrn_def_id) from jrn_def where jrn_def_type='".$p_type."';");
$Ret=ExecSql($Cn,"select min(jrn_def_id) from jrn_def ".
"where jrn_def_type='".$p_type."';");
$l_line=pg_fetch_array($Ret,0);
return $l_line[0];
//return 0;

11
sql/upgrade.sql
View file

@ -1,14 +1,3 @@
begin;
alter table action_gestion add column ag_ref_ag_id int4;
alter table action_gestion add column f_id_dest int4;
alter table action_gestion add column f_id_exp int4;
update action_gestion set f_id_dest=f_id;
update action_gestion set f_id_exp=0;
alter table action_gestion drop column f_id;
alter table action_gestion alter f_id_dest set not null;
alter table action_gestion alter f_id_exp set not null;
commit;