From edaaa477d1a37e852bc3bf7e4240d8542f23acc0 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Sat, 3 Jul 2010 10:55:17 +0000 Subject: [PATCH] Add security : filter by accessible ledger for an user --- include/class_acc_account_ledger.php | 5 ++++- include/class_fiche.php | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/include/class_acc_account_ledger.php b/include/class_acc_account_ledger.php index 82016c791..d2af8e9b0 100644 --- a/include/class_acc_account_ledger.php +++ b/include/class_acc_account_ledger.php @@ -94,13 +94,15 @@ class Acc_Account_Ledger { * * \param $p_from date from * \param $p_to end date + *\note the data are filtered by the access of the current user * \return double array (j_date,deb_montant,cred_montant,description,jrn_name,j_debit,jr_internal) * (tot_deb,tot_credit * */ function get_row_date($p_from,$p_to) { - + $user=new User($this->db); + $filter_sql=$user->get_ledger_sql('ALL',1); $Res=$this->db->exec_sql("select jr_id,to_char(j_date,'DD.MM.YYYY') as j_date_fmt,j_date,". "case when j_debit='t' then j_montant else 0 end as deb_montant,". "case when j_debit='f' then j_montant else 0 end as cred_montant,". @@ -113,6 +115,7 @@ class Acc_Account_Ledger { " where j_poste=$1 and ". " ( to_date($2,'DD.MM.YYYY') <= j_date and ". " to_date($3,'DD.MM.YYYY') >= j_date )". + " and $filter_sql ". " order by j_date",array($this->id,$p_from,$p_to)); return $this->get_row_sql($Res); } diff --git a/include/class_fiche.php b/include/class_fiche.php index a39eebefb..a4bf196ba 100644 --- a/include/class_fiche.php +++ b/include/class_fiche.php @@ -922,6 +922,9 @@ av_text1=>'name' echo_error("class_fiche",__LINE__,"id is 0"); return; } + $user=new User($this->cn); + $filter_sql=$user->get_ledger_sql('ALL',1); + $qcode=$this->strAttribut(ATTR_DEF_QUICKCODE); $Res=$this->cn->exec_sql("select distinct j_date,to_char(j_date,'DD.MM.YYYY') as j_date_fmt,j_qcode,". "case when j_debit='t' then j_montant else 0 end as deb_montant,". @@ -933,6 +936,7 @@ av_text1=>'name' " where j_qcode=$1 and ". " ( to_date($2,'DD.MM.YYYY') <= j_date and ". " to_date($3,'DD.MM.YYYY') >= j_date )". + " and $filter_sql ". " order by j_date",array($qcode,$p_from,$p_to)); return $this->get_row_result($Res); }