From 3257f8405c824a3821d1d7e63a5f8989ee362121 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20FRANCE?= Date: Fri, 22 Mar 2024 14:47:25 +0100 Subject: [PATCH 01/16] add inithook --- htdocs/margin/checkMargins.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/htdocs/margin/checkMargins.php b/htdocs/margin/checkMargins.php index 5cdee16619b..f913582de28 100644 --- a/htdocs/margin/checkMargins.php +++ b/htdocs/margin/checkMargins.php @@ -64,6 +64,8 @@ $enddate = dol_mktime(23, 59, 59, GETPOSTINT('enddatemonth'), GETPOSTINT('enddat $search_ref = GETPOST('search_ref', 'alpha'); +$hookmanager->initHooks(array('checkmarginlist')); + // Security check $result = restrictedArea($user, 'margins'); From 7054f90d761174d21804d68872aabb32ce975a3b Mon Sep 17 00:00:00 2001 From: Hystepik Date: Fri, 22 Mar 2024 15:38:10 +0100 Subject: [PATCH 02/16] Fix expensereport bad search_user --- htdocs/expensereport/list.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/expensereport/list.php b/htdocs/expensereport/list.php index 6cc403e87d5..0a78143fb06 100644 --- a/htdocs/expensereport/list.php +++ b/htdocs/expensereport/list.php @@ -103,7 +103,7 @@ if (!$sortfield) { $sall = trim((GETPOST('search_all', 'alphanohtml') != '') ? GETPOST('search_all', 'alphanohtml') : GETPOST('sall', 'alphanohtml')); $search_ref = GETPOST('search_ref', 'alpha'); -$search_user = GETPOSTINT('search_user'); +$search_user = GETPOST('search_user', 'int'); $search_amount_ht = GETPOST('search_amount_ht', 'alpha'); $search_amount_vat = GETPOST('search_amount_vat', 'alpha'); $search_amount_ttc = GETPOST('search_amount_ttc', 'alpha'); From c22dce308b63b2fdb68ce618b7a7c40ddca9f5c9 Mon Sep 17 00:00:00 2001 From: Jon Bendtsen Date: Fri, 22 Mar 2024 22:41:00 +0100 Subject: [PATCH 03/16] allow user to self edit their bank account details + allowing a user administrator edit bank account details --- htdocs/user/bank.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/user/bank.php b/htdocs/user/bank.php index ff445c5cf85..ec3c2d2e426 100644 --- a/htdocs/user/bank.php +++ b/htdocs/user/bank.php @@ -87,7 +87,7 @@ if (empty($account->userid)) { // Define value to know what current user can do on users $canadduser = (!empty($user->admin) || $user->hasRight('user', 'user', 'creer') || $user->rights->hrm->write_personal_information->write); $canreaduser = (!empty($user->admin) || $user->rights->user->user->lire || $user->rights->hrm->read_personal_information->read); -$permissiontoaddbankaccount = ($user->hasRight('salaries', 'write') || $user->hasRight('hrm', 'employee', 'write') || $user->hasRight('user', 'creer')); +$permissiontoaddbankaccount = ($user->hasRight('salaries', 'write') || $user->hasRight('hrm', 'employee', 'write') || $user->hasRight('user', 'user', 'creer') || $user->hasRight('user', 'self', 'creer')); $permissiontoreadhr = $user->hasRight('hrm', 'read_personal_information', 'read') || $user->hasRight('hrm', 'write_personal_information', 'write'); $permissiontowritehr = $user->hasRight('hrm', 'write_personal_information', 'write'); From 4489187edd6368d87b38b16d8a46249e44d95b2f Mon Sep 17 00:00:00 2001 From: Jon Bendtsen Date: Fri, 22 Mar 2024 23:13:12 +0100 Subject: [PATCH 04/16] create and edit actions uses permissiontoaddbankaccount variable --- htdocs/user/bank.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/user/bank.php b/htdocs/user/bank.php index ec3c2d2e426..a42790ea222 100644 --- a/htdocs/user/bank.php +++ b/htdocs/user/bank.php @@ -282,7 +282,7 @@ llxHeader('', $title, $help_url); $head = user_prepare_head($object); -if ($id && $bankid && $action == 'edit' && ($user->hasRight('user', 'user', 'creer') || $user->hasRight('hrm', 'write_personal_information', 'write'))) { +if ($id && $bankid && $action == 'edit' && !$cancel && $permissiontoaddbankaccount)) { if ($conf->use_javascript_ajax) { print "\n