Skip to content

Commit

Permalink
Fix missing tests on permissions
Browse files Browse the repository at this point in the history
  • Loading branch information
@eldy
eldy committed Sep 3, 2024
1 parent 6240ac9 commit e7c0913
Show file tree
Hide file tree
Showing 7 changed files with 56 additions and 48 deletions.
12 changes: 9 additions & 3 deletions htdocs/core/ajax/security.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
define('NOREQUIRETRAN', '1');
}*/

// Load Dolibarr environment
// Load Dolibarr environment and check user is logged.
require '../../main.inc.php';

$action = GETPOST('action');
Expand All @@ -50,18 +50,24 @@
// None. This is public component with no access and effect on data.


/*
* Action
*/

// None


/*
* View
*/

//top_htmlhead("", "", 1); // Replaced with top_httphead. An ajax page does not need html header.
top_httphead();

//print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";

// Return a new generated password
if ($action) {
if ($action == 'getrandompassword') {
if ($action == 'getrandompassword') { // Test on permission not required here. Endpoint can be called by anu logged user.
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
$generic = GETPOST('generic') ? true : false;
echo getRandomPassword($generic);
Expand Down
10 changes: 4 additions & 6 deletions htdocs/ecm/index_auto.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@

$result = restrictedArea($user, 'ecm', 0);


/*
* Actions
*/
Expand All @@ -102,9 +103,6 @@
$search_doc_ref = '';
}




// Add directory
if ($action == 'add' && $user->hasRight('ecm', 'setup')) {
$ecmdir->ref = 'NOTUSEDYET';
Expand All @@ -124,7 +122,7 @@
}

// Remove file
if ($action == 'confirm_deletefile') {
if ($action == 'confirm_deletefile' && $user->hasRight('ecm', 'upload')) {
if (GETPOST('confirm') == 'yes') {
$langs->load("other");
if ($section) {
Expand Down Expand Up @@ -155,7 +153,7 @@
}

// Remove directory
if ($action == 'confirm_deletesection' && GETPOST('confirm') == 'yes') {
if ($action == 'confirm_deletesection' && GETPOST('confirm') == 'yes' && $user->hasRight('ecm', 'setup')) {
$result = $ecmdir->delete($user);
setEventMessages($langs->trans("ECMSectionWasRemoved", $ecmdir->label), null, 'mesgs');

Expand All @@ -165,7 +163,7 @@
// Refresh directory view
// This refresh list of dirs, not list of files (for performance reason). List of files is refresh only if dir was not synchronized.
// To refresh content of dir with cache, just open the dir in edit mode.
if ($action == 'refreshmanual') {
if ($action == 'refreshmanual' && $user->hasRight('ecm', 'read')) {
$ecmdirtmp = new EcmDirectory($db);

// This part of code is same than into file ecm/ajax/ecmdatabase.php TODO Remove duplicate
Expand Down
16 changes: 8 additions & 8 deletions htdocs/expensereport/card.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';

if (!empty(GETPOST('sendit', 'alpha'))) { // If we just submit a file
if ($action == 'updateline') {
if ($action == 'updateline') { // Test on permission not required here
$action = 'editline'; // To avoid to make the updateline now
} else {
$action = ''; // To avoid to make the addline now
Expand All @@ -220,7 +220,7 @@
include DOL_DOCUMENT_ROOT.'/core/actions_lineupdown.inc.php'; // Must be 'include', not 'include_once'

// Action clone object
if ($action == 'confirm_clone' && $confirm == 'yes' && $user->hasRight('expensereport', 'creer')) {
if ($action == 'confirm_clone' && $confirm == 'yes' && $permissiontoadd) {
if (1 == 0 && !GETPOST('clone_content', 'alpha') && !GETPOST('clone_receivers', 'alpha')) {
setEventMessages($langs->trans("NoCloneOptionsSpecified"), null, 'errors');
} else {
Expand Down Expand Up @@ -253,7 +253,7 @@
}
}

if ($action == 'add' && $user->hasRight('expensereport', 'creer')) {
if ($action == 'add' && $permissiontoadd) {
$error = 0;

$object = new ExpenseReport($db);
Expand Down Expand Up @@ -327,7 +327,7 @@
}
}

if (($action == 'update' || $action == 'updateFromRefuse') && $user->hasRight('expensereport', 'creer')) {
if (($action == 'update' || $action == 'updateFromRefuse') && $permissiontoadd) {
$object = new ExpenseReport($db);
$object->fetch($id);

Expand All @@ -352,7 +352,7 @@
}
}

if ($action == 'update_extras' && $user->hasRight('expensereport', 'creer')) {
if ($action == 'update_extras' && $permissiontoadd) {
$object->oldcopy = dol_clone($object, 2);

// Fill array 'array_options' with data from update form
Expand All @@ -375,7 +375,7 @@
}
}

if ($action == "confirm_validate" && GETPOST("confirm", 'alpha') == "yes" && $id > 0 && $user->hasRight('expensereport', 'creer')) {
if ($action == "confirm_validate" && GETPOST("confirm", 'alpha') == "yes" && $id > 0 && $permissiontoadd) {
$error = 0;

$db->begin();
Expand Down Expand Up @@ -492,7 +492,7 @@
}
}

if ($action == "confirm_save_from_refuse" && GETPOST("confirm", 'alpha') == "yes" && $id > 0 && $user->hasRight('expensereport', 'creer')) {
if ($action == "confirm_save_from_refuse" && GETPOST("confirm", 'alpha') == "yes" && $id > 0 && $permissiontoadd) {
$object = new ExpenseReport($db);
$object->fetch($id);
$result = $object->set_save_from_refuse($user);
Expand Down Expand Up @@ -1285,7 +1285,7 @@
}
}

if ($action == "updateline" && $user->hasRight('expensereport', 'creer')) {
if ($action == "updateline" && $permissiontoadd) {
$object = new ExpenseReport($db);
$object->fetch($id);

Expand Down
51 changes: 26 additions & 25 deletions htdocs/fichinter/card.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@
$permissionnote = $user->hasRight('ficheinter', 'creer'); // Used by the include of actions_setnotes.inc.php
$permissiondellink = $user->hasRight('ficheinter', 'creer'); // Used by the include of actions_dellink.inc.php
$permissiontodelete = (($object->statut == Fichinter::STATUS_DRAFT && $user->hasRight('ficheinter', 'creer')) || $user->hasRight('ficheinter', 'supprimer'));
$permissiontoadd = $user->hasRight('ficheinter', 'creer');

$usercancreate = $user->hasRight('ficheinter', 'creer');

Expand Down Expand Up @@ -154,7 +155,7 @@
include DOL_DOCUMENT_ROOT.'/core/actions_dellink.inc.php'; // Must be 'include', not 'include_once'

// Action clone object
if ($action == 'confirm_clone' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
if ($action == 'confirm_clone' && $confirm == 'yes' && $permissiontoadd) {
if (1 == 0 && !GETPOST('clone_content') && !GETPOST('clone_receivers')) {
setEventMessages($langs->trans("NoCloneOptionsSpecified"), null, 'errors');
} else {
Expand All @@ -175,7 +176,7 @@
}
}

if ($action == 'confirm_validate' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
if ($action == 'confirm_validate' && $confirm == 'yes' && $permissiontoadd) {
$result = $object->setValid($user);

if ($result >= 0) {
Expand All @@ -201,7 +202,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'confirm_sign' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_sign' && $confirm == 'yes' && $permissiontoadd) {
$result = $object->setSignedStatus($user, GETPOSTINT('signed_status'), 0, 'FICHINTER_MODIFY');
if ($result >= 0) {
if (!getDolGlobalString('MAIN_DISABLE_PDF_AUTOUPDATE')) {
Expand All @@ -226,7 +227,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'confirm_unsign' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_unsign' && $confirm == 'yes' && $permissiontoadd) {
$result = $object->setSignedStatus($user, $object::SIGNED_STATUSES['STATUS_NO_SIGNATURE'], 0, 'FICHINTER_MODIFY');
if ($result >= 0) {
if (!getDolGlobalString('MAIN_DISABLE_PDF_AUTOUPDATE')) {
Expand All @@ -251,7 +252,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'confirm_modify' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_modify' && $confirm == 'yes' && $permissiontoadd) {
$result = $object->setDraft($user);
if ($result >= 0) {
if (!getDolGlobalString('MAIN_DISABLE_PDF_AUTOUPDATE')) {
Expand All @@ -276,7 +277,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'confirm_done' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_done' && $confirm == 'yes' && $permissiontoadd) {
$result = $object->setClose($user);

if ($result >= 0) {
Expand All @@ -302,7 +303,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'add' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'add' && $permissiontoadd) {
$selectedLines = GETPOST('toselect', 'array');
$object->socid = $socid;
$object->duration = GETPOSTINT('duration');
Expand Down Expand Up @@ -522,7 +523,7 @@
$action = 'create';
$error++;
}
} elseif ($action == 'update' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'update' && $permissiontoadd) {
$object->socid = $socid;
$object->fk_project = GETPOSTINT('projectid');
$object->fk_contrat = GETPOSTINT('contratid');
Expand All @@ -535,19 +536,19 @@
if ($result < 0) {
setEventMessages($object->error, $object->errors, 'errors');
}
} elseif ($action == 'classin' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'classin' && $permissiontoadd) {
// Set into a project
$result = $object->setProject(GETPOSTINT('projectid'));
if ($result < 0) {
dol_print_error($db, $object->error);
}
} elseif ($action == 'setcontract' && $user->hasRight('contrat', 'creer')) {
} elseif ($action == 'setcontract' && $permissiontoadd) {
// Set into a contract
$result = $object->set_contrat($user, GETPOSTINT('contratid'));
if ($result < 0) {
dol_print_error($db, $object->error);
}
} elseif ($action == 'setref_client' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'setref_client' && $permissiontoadd) {
// Positionne ref client
$result = $object->setRefClient($user, GETPOST('ref_client', 'alpha'));
if ($result < 0) {
Expand All @@ -561,12 +562,12 @@

header('Location: '.DOL_URL_ROOT.'/fichinter/list.php?leftmenu=ficheinter&restore_lastsearch_values=1');
exit;
} elseif ($action == 'setdescription' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'setdescription' && $permissiontoadd) {
$result = $object->set_description($user, GETPOST('description'));
if ($result < 0) {
dol_print_error($db, $object->error);
}
} elseif ($action == "addline" && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == "addline" && $permissiontoadd) {
// Add line
if (!GETPOST('np_desc', 'restricthtml') && !getDolGlobalString('FICHINTER_EMPTY_LINE_DESC')) {
$mesg = $langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("Description"));
Expand Down Expand Up @@ -627,7 +628,7 @@
$db->rollback();
}
}
} elseif ($action == 'classifybilled' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'classifybilled' && $permissiontoadd) {
// Classify Billed
$result = $object->setStatut(Fichinter::STATUS_BILLED);
if ($result > 0) {
Expand All @@ -636,7 +637,7 @@
} else {
setEventMessages($object->error, $object->errors, 'errors');
}
} elseif ($action == 'classifyunbilled' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'classifyunbilled' && $permissiontoadd) {
// Classify unbilled
$result = $object->setStatut(Fichinter::STATUS_VALIDATED);
if ($result > 0) {
Expand All @@ -645,7 +646,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'confirm_reopen' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_reopen' && $permissiontoadd) {
// Reopen
$result = $object->setStatut(Fichinter::STATUS_VALIDATED);
if ($result > 0) {
Expand All @@ -654,7 +655,7 @@
} else {
$mesg = $object->error;
}
} elseif ($action == 'updateline' && $user->hasRight('ficheinter', 'creer') && GETPOST('save', 'alpha')) {
} elseif ($action == 'updateline' && $permissiontoadd && GETPOST('save', 'alpha')) {
// Mise a jour d'une ligne d'intervention
$objectline = new FichinterLigne($db);
if ($objectline->fetch($lineid) <= 0) {
Expand Down Expand Up @@ -708,7 +709,7 @@

header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id);
exit;
} elseif ($action == 'confirm_deleteline' && $confirm == 'yes' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'confirm_deleteline' && $confirm == 'yes' && $permissiontoadd) {
// Supprime une ligne d'intervention AVEC confirmation
$objectline = new FichinterLigne($db);
if ($objectline->fetch($lineid) <= 0) {
Expand Down Expand Up @@ -738,7 +739,7 @@
if (!getDolGlobalString('MAIN_DISABLE_PDF_AUTOUPDATE')) {
fichinter_create($db, $object, $object->model_pdf, $outputlangs);
}
} elseif ($action == 'up' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'up' && $permissiontoadd) {
// Set position of lines
$object->line_up($lineid);

Expand All @@ -761,7 +762,7 @@

header('Location: '.$_SERVER["PHP_SELF"].'?id='.$object->id.'#'.$lineid);
exit;
} elseif ($action == 'down' && $user->hasRight('ficheinter', 'creer')) {
} elseif ($action == 'down' && $permissiontoadd) {
$object->line_down($lineid);

// Define output language
Expand Down Expand Up @@ -799,7 +800,7 @@
$permissiontoadd = $user->hasRight('ficheinter', 'creer');
include DOL_DOCUMENT_ROOT.'/core/actions_builddoc.inc.php';

if ($action == 'update_extras' && $user->hasRight('ficheinter', 'creer')) {
if ($action == 'update_extras' && $permissiontoadd) {
$object->oldcopy = dol_clone($object, 2);
$attribute_name = GETPOST('attribute', 'restricthtml');

Expand All @@ -823,8 +824,8 @@
}
}

if (getDolGlobalString('MAIN_DISABLE_CONTACTS_TAB') && $user->hasRight('ficheinter', 'creer')) {
if ($action == 'addcontact') {
if (getDolGlobalString('MAIN_DISABLE_CONTACTS_TAB')) {
if ($action == 'addcontact' && $permissiontoadd) {
if ($result > 0 && $id > 0) {
$contactid = (GETPOSTINT('userid') ? GETPOSTINT('userid') : GETPOSTINT('contactid'));
$typeid = (GETPOST('typecontact') ? GETPOST('typecontact') : GETPOST('type'));
Expand All @@ -842,10 +843,10 @@
$mesg = $object->error;
}
}
} elseif ($action == 'swapstatut') {
} elseif ($action == 'swapstatut' && $permissiontoadd) {
// bascule du statut d'un contact
$result = $object->swapContactStatus(GETPOSTINT('ligne'));
} elseif ($action == 'deletecontact') {
} elseif ($action == 'deletecontact' && $permissiontoadd) {
// Efface un contact
$result = $object->delete_contact(GETPOSTINT('lineid'));

Expand Down
2 changes: 1 addition & 1 deletion htdocs/fourn/commande/card.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -340,7 +340,7 @@
}
}

if ($action == 'reopen') { // no test on permission here, permission to use will depends on status
if ($action == 'reopen' && $permissiontoadd) { // no test on permission here, permission to use will depends on status
if (in_array($object->statut, array(1, 2, 3, 4, 5, 6, 7, 9))) {
if ($object->statut == 1) {
$newstatus = 0; // Validated->Draft
Expand Down
Loading

0 comments on commit e7c0913

Please sign in to comment.