From d6f330344dfa3ded97b5f07338208a4f34fb7c1d Mon Sep 17 00:00:00 2001 From: sparkyx Date: Mon, 3 Jul 2006 20:35:38 +0000 Subject: [PATCH] Improve security --- html/admin/sql/patch/upgrade13.sql | 5 ++++ html/commercial.php | 3 +++ html/fiche_search.php | 4 ++- include/ac_common.php | 12 ++++----- include/action.inc.php | 3 ++- include/admin.inc.php | 1 + include/bank.inc.php | 41 +++++++++++++++++++++++++++--- include/class_user.php | 20 ++++++++++++--- include/client.inc.php | 7 +++++ include/constant.php | 9 ++++++- include/depense.inc.php | 31 +++++++++++++++++++--- include/facture.inc.php | 36 +++++++++++++++++++++----- include/supplier.inc.php | 1 + include/user_menu.php | 3 ++- sql/upgrade.sql | 11 -------- 15 files changed, 149 insertions(+), 38 deletions(-) diff --git a/html/admin/sql/patch/upgrade13.sql b/html/admin/sql/patch/upgrade13.sql index ecac05941..eb46e0d08 100644 --- a/html/admin/sql/patch/upgrade13.sql +++ b/html/admin/sql/patch/upgrade13.sql @@ -548,5 +548,10 @@ alter table action_gestion add ag_ref text; create unique index k_ag_ref on action_gestion(ag_ref); update version set val=14; +insert into action values(28,'Module Suivi Document'); +insert into action values(22,'Module Client'); +insert into action (24,'Module Fournisseur'); +insert into action (26,'Module Administration'); +insert into action values (30,'Module Gestion'); commit; diff --git a/html/commercial.php b/html/commercial.php index b66a66a1b..47553bad2 100644 --- a/html/commercial.php +++ b/html/commercial.php @@ -36,12 +36,14 @@ if ( isset ($_REQUEST['dos'] ) ) { } + include_once ("postgres.php"); /* Admin. Dossier */ $rep=DbConnect($_SESSION['g_dossier']); require_once ("class_user.php"); $User=new cl_user($rep); $User->Check(); + //----------------------------------------------------- // update preference //----------------------------------------------------- @@ -94,6 +96,7 @@ echo ShowItem(array( echo ''; $cn=DbConnect($_SESSION['g_dossier']); +$User->AccessRequest($cn,SEC_GESTION); //----------------------------------------------------- // p_action == pref //----------------------------------------------------- diff --git a/html/fiche_search.php b/html/fiche_search.php index 5ebefeed6..2712d6912 100644 --- a/html/fiche_search.php +++ b/html/fiche_search.php @@ -160,6 +160,8 @@ if ( isset ( $_POST['search']) ) { $class="odd"; $text=FormatString($row['vw_name']); $r.=""; + $qcode= $row['quick_code'] ; + $r.=sprintf ('', "select" . $i, $e_name, @@ -169,7 +171,7 @@ if ( isset ( $_POST['search']) ) { $row['vw_buy'], $row['tva_id'], $row['tva_label'] , - $row['quick_code'] + $qcode ); $r.=" ".$row['vw_name']; if ( $row['vw_addr'] !="") diff --git a/include/ac_common.php b/include/ac_common.php index 58492bc88..6ac012bde 100644 --- a/include/ac_common.php +++ b/include/ac_common.php @@ -189,13 +189,11 @@ function html_button_logout() { */ -function NoAccess() { - echo "





"; - echo "

- - You haven't access -

"; - +function NoAccess() +{ + echo ""; exit -1; } /*! diff --git a/include/action.inc.php b/include/action.inc.php index 6278c3360..f05e97174 100644 --- a/include/action.inc.php +++ b/include/action.inc.php @@ -21,7 +21,8 @@ /*! \file * \brief Page who manage the different action (meeting, letter) */ -var_dump($_POST); +$User->AccessRequest($cn,SEC_ACTION); + //----------------------------------------------------- // Action //----------------------------------------------------- diff --git a/include/admin.inc.php b/include/admin.inc.php index ff96af42c..43a1a58ca 100644 --- a/include/admin.inc.php +++ b/include/admin.inc.php @@ -20,6 +20,7 @@ // Copyright Author Dany De Bontridder ddebontridder@yahoo.fr require_once("class_admin.php"); $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; +$User->AccessRequest($cn,ADMIN); /*! \file * \brief Called from the module "Gestion" to manage the customer diff --git a/include/bank.inc.php b/include/bank.inc.php index a0de094d2..e414a8030 100644 --- a/include/bank.inc.php +++ b/include/bank.inc.php @@ -24,6 +24,7 @@ require_once('jrn.php'); require_once("class_document.php"); require_once("class_fiche.php"); require_once("class_parm_code.php"); +require_once("check_priv.php"); /*!\file * \brief the purpose off this file encode expense and to record them * @@ -41,6 +42,12 @@ if ( ! isset ($_REQUEST['p_jrn'])) { { $p_jrn=$_REQUEST['p_jrn']; } + +if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } + // for the back button $retour=""; $h_url=""; @@ -56,6 +63,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; // ask the saldo of the bank if ( $sub_action == "solde" ) { + // Check privilege + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } echo '
'; echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'Liste'. @@ -103,7 +115,11 @@ echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,''; echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'Liste'); @@ -185,13 +201,18 @@ echo '
'; // or if we ask to correct the invoice if ( isset ($_POST['add_item']) || isset ($_POST['correct']) ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + $nb_item=$_POST['nb_item']; if ( isset ($_POST['add_item'])) $nb_item++; // Submit button in the form $submit=' '; - $form=FormFin($cn,$_GET['p_jrn'],$User->GetPeriode(),$submit,$_POST,false, $nb_item); + $form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false, $nb_item); //$form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false, $nb_number); echo '
'; @@ -205,6 +226,11 @@ if ( isset ($_POST['add_item']) || isset ($_POST['correct']) ) // if ( isset($_POST['save'])) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + // we save the expense $r=RecordFin($cn,$_POST,$User,$p_jrn); $nb_number=$_POST['nb_item']; @@ -217,7 +243,7 @@ if ( isset($_POST['save'])) echo $form; echo '
'; echo ''; - echo ' + echo ' '; exit(); } @@ -226,6 +252,11 @@ if ( isset($_POST['save'])) // if ( isset ($_POST['view_invoice']) ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + $nb_number=$_POST["nb_item"]; $submit=''; $submit.=''; @@ -254,6 +285,10 @@ if ( isset ($_POST['view_invoice']) ) // By default we add a new invoice if ( $p_jrn != -1 ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + exit -1; + } + $jrn=new jrn($cn, $p_jrn); echo_debug('depense.inc.php',__LINE__,"Blank form"); // Submit button in the form diff --git a/include/class_user.php b/include/class_user.php index 81e5b2f05..43d8d09b3 100644 --- a/include/class_user.php +++ b/include/class_user.php @@ -226,8 +226,7 @@ function GetPreferences () /*! * \brief Check if an user is allowed to do an action * - * \param p_dossier dossier id - * \param p_login user's login + * \param p_cn Database connx * \param p_action_id * \return * - 0 no priv @@ -350,6 +349,21 @@ function getExercice() $r=pg_fetch_array($Ret,0); return $r['p_exercice']; } - +/*!\brief Check if the user can access + * otherwise warn and exit + * \param $p_cn database connx + * \param $action_id + * \return nothing the program exits automatically + */ +function AccessRequest($p_cn,$p_action) +{ + if ( $this->CheckAction($p_cn,$p_action)==0 ) + { + echo ""; + exit(-1); + } +} } ?> diff --git a/include/client.inc.php b/include/client.inc.php index ed173fd0c..128c00c39 100644 --- a/include/client.inc.php +++ b/include/client.inc.php @@ -24,6 +24,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; /*! \file * \brief Called from the module "Gestion" to manage the customer */ +$User->AccessRequest($cn,CLIENT); ?> @@ -32,6 +33,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; // Remove a card if ( isset ($_POST['delete']) ) { + echo 'delete'; $f_id=$_REQUEST['f_id']; @@ -43,6 +45,7 @@ if ( isset ($_POST['delete']) ) // Add card if ( $sub_action=="insert" ) { + $retour=sprintf('', urldecode($_REQUEST['url'])); @@ -59,6 +62,7 @@ if ( $sub_action=="insert" ) // Save modification if ( isset ($_POST['mod'])) { + // modification is asked $f_id=$_REQUEST['f_id']; @@ -72,6 +76,7 @@ if ( $sub_action == "" ) //Display a blank card if ( $sub_action=="blank") { + $retour=sprintf('', "commercial.php?p_action=client"); echo '
'; @@ -153,9 +158,11 @@ if ( $sub_action == 'detail' ) $w->value=$f_id; echo $w->IOValue(); + echo $w->Submit('mod','Sauver les modifications'); echo $w->Reset("Annuler"); echo $w->Submit('delete','Effacer cette fiche'); + echo ''; echo $retour; echo '
'; diff --git a/include/constant.php b/include/constant.php index 9787d6054..dad60a322 100644 --- a/include/constant.php +++ b/include/constant.php @@ -60,6 +60,13 @@ define ("VEN",11); define ("BQE",12); define ("ODS",13); +//!\enum Security +define("SEC_ACTION", 28); // Module Suivi Document +define("CLIENT",22); // Module Client +define("SUPPL",24); // Module Fournisseur +define("ADMIN",26); // Module Administration +define("SEC_GESTION",30); // Module Gestion + define ("FICHE_WRITE",15); define ("STOCK_WRITE",16); define ("STOCK_READ",17); @@ -82,7 +89,7 @@ define ("LAST",1); define ("FIRST",0); define ("ERROR",12); -//\enum ACTION defines document_type for action +//!\enum ACTION defines document_type for action define('ACTION','1,5,6,7,8'); //valeurs standardd diff --git a/include/depense.inc.php b/include/depense.inc.php index 2d7b8adb3..bbe4ba5b0 100644 --- a/include/depense.inc.php +++ b/include/depense.inc.php @@ -23,6 +23,7 @@ require_once('user_form_ach.php'); require_once('jrn.php'); require_once("class_document.php"); require_once("class_fiche.php"); +require_once("check_priv.php"); /*!\brief the purpose off this file encode expense and to record them * */ @@ -55,7 +56,10 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; // if ( $sub_action == "list") { - + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } // show the menu with the list item selected echo '
'; echo ShowMenuJrnUser($_SESSION['g_dossier'],'ACH',0,'Liste'); @@ -159,6 +163,11 @@ echo '
'; // or if we ask to correct the invoice if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + $nb_item=$_POST['nb_item']; if ( isset ($_POST['add_item'])) $nb_item++; @@ -166,7 +175,7 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) ) $submit=' '; - $form=FormAchInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$submit,false,$nb_item); + $form=FormAchInput($cn,$p_jrn,$User->GetPeriode(),$_POST,$submit,false,$nb_item); echo '
'; echo $form; echo JS_CALC_LINE; @@ -179,18 +188,23 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) ) // if ( isset($_POST['save'])) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + // we save the expense list ($internal,$c)=RecordSell($cn,$_POST,$User,$p_jrn); - $form=FormAchView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false); + $form=FormAchView($cn,$p_jrn,$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false); echo '
'; echo '

Opération '.$internal.' enregistré

'; echo $form; echo '
'; echo ''; - echo ' + echo ' '; exit(); } @@ -199,6 +213,11 @@ if ( isset($_POST['save'])) // if ( isset ($_POST['view_invoice']) ) { + // Check privilege + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } $nb_number=$_POST["nb_item"]; $submit=''; $submit.=''; @@ -226,6 +245,10 @@ if ( isset ($_POST['view_invoice']) ) // By default we add a new invoice if ( $p_jrn != -1 ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + exit -1; + } + $jrn=new jrn($cn, $p_jrn); echo_debug('depense.inc.php',__LINE__,"Blank form"); // Submit button in the form diff --git a/include/facture.inc.php b/include/facture.inc.php index 732dd6558..9f9364415 100644 --- a/include/facture.inc.php +++ b/include/facture.inc.php @@ -23,6 +23,7 @@ require_once('user_form_ven.php'); require_once('jrn.php'); require_once("class_document.php"); require_once("class_fiche.php"); +require_once("check_priv.php"); /*!\file * \brief the purpose off this file is to create invoices, to record them and to generate * them, and of course to save them into the database @@ -56,7 +57,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; // if ( $sub_action == "list") { - + // Check privilege + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } // show the menu with the list item selected echo '
'; echo ShowMenuJrnUser($_SESSION['g_dossier'],'VEN',0,'Liste'); @@ -160,10 +165,15 @@ echo '
'; // or if we ask to correct the invoice if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + $nb_item=$_POST['nb_item']; if ( isset ($_POST['add_item'])) $nb_item++; - $form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,false,$nb_item); + $form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$_POST,false,$nb_item); echo '
'; echo $form; echo '
'; @@ -174,12 +184,17 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"]) ) // if ( isset($_POST['record_and_print_invoice'])) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + NoAccess(); + exit -1; + } + // First we save the invoice, the internal code will be used to change the description // and upload the file list ($internal,$e)=RecordInvoice($cn,$_POST,$User,$p_jrn); - $form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform',''); + $form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform',''); echo '
'; echo '

Opération '.$internal.' enregistré

'; @@ -210,15 +225,20 @@ if ( isset($_POST['record_and_print_invoice'])) // invoice if ( isset ($_POST['view_invoice']) ) { + // Check privilege + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 ) { + NoAccess(); + exit -1; + } $nb_number=$_POST["nb_item"]; - if ( form_verify_input($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true) + if ( form_verify_input($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true) { - $form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number); + $form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number); } else { // Check failed : invalid date or quantity echo_error("Cannot validate "); - $form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number); + $form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number); } echo '
'; @@ -234,6 +254,10 @@ if ( isset ($_POST['view_invoice']) ) // By default we add a new invoice if ( $p_jrn != -1 ) { + if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 ) { + exit -1; + } + $jrn=new jrn($cn, $p_jrn); echo_debug('facture.inc.php.php',__LINE__,"Blank form"); // Show an empty form of invoice diff --git a/include/supplier.inc.php b/include/supplier.inc.php index f0e70e607..b27bae5fe 100644 --- a/include/supplier.inc.php +++ b/include/supplier.inc.php @@ -25,6 +25,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:""; * \brief Called from the module "Gestion" to manage the customer */ +$User->AccessRequest($cn,SUPPL); ?>