From b1f4f09b1c799f1b8dbec3ddd274fdd8540fa856 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 6 May 2024 18:25:06 +0200 Subject: [PATCH] Code comment --- htdocs/core/db/DoliDB.class.php | 5 +++-- htdocs/user/class/user.class.php | 36 ++++++++++++++++---------------- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/htdocs/core/db/DoliDB.class.php b/htdocs/core/db/DoliDB.class.php index 1c83b5a2785..83efe7f9ba5 100644 --- a/htdocs/core/db/DoliDB.class.php +++ b/htdocs/core/db/DoliDB.class.php @@ -179,11 +179,12 @@ abstract class DoliDB implements Database * @param int $allowsimplequote 1=Allow simple quotes in string. When string is used as a list of SQL string ('aa', 'bb', ...) * @param int $allowsequals 1=Allow equals sign * @param int $allowsspace 1=Allow space char + * @param int $allowschars 1=Allow a-z chars * @return string String escaped */ - public function sanitize($stringtosanitize, $allowsimplequote = 0, $allowsequals = 0, $allowsspace = 0) + public function sanitize($stringtosanitize, $allowsimplequote = 0, $allowsequals = 0, $allowsspace = 0, $allowschars = 1) { - return preg_replace('/[^a-z0-9_\-\.,'.($allowsequals ? '=' : '').($allowsimplequote ? "\'" : '').($allowsspace ? ' ' : '').']/i', '', $stringtosanitize); + return preg_replace('/[^0-9_\-\.,'.($allowschars ? 'a-z' : '').($allowsequals ? '=' : '').($allowsimplequote ? "\'" : '').($allowsspace ? ' ' : '').']/i', '', $stringtosanitize); } /** diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index ad60f72ced9..eff45f3f609 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -1059,12 +1059,12 @@ class User extends CommonObject /** * Remove a right to the user * - * @param int $rid Id du droit a retirer - * @param string $allmodule Retirer tous les droits du module allmodule - * @param string $allperms Retirer tous les droits du module allmodule, perms allperms - * @param int $entity Entity to use - * @param int $notrigger 1=Does not execute triggers, 0=Execute triggers - * @return int > 0 if OK, < 0 if OK + * @param int $rid Id of permission to remove (or 0 when using the other filters) + * @param string $allmodule Retirer tous les droits du module allmodule + * @param string $allperms Retirer tous les droits du module allmodule, perms allperms + * @param int|string $entity Entity to use. Example: '1', or '0,1', or '2,3' + * @param int $notrigger 1=Does not execute triggers, 0=Execute triggers + * @return int > 0 if OK, < 0 if OK * @see clearrights(), addrights(), getrights(), hasRight() */ public function delrights($rid, $allmodule = '', $allperms = '', $entity = 0, $notrigger = 0) @@ -1085,7 +1085,7 @@ class User extends CommonObject $sql = "SELECT module, perms, subperms"; $sql .= " FROM ".$this->db->prefix()."rights_def"; $sql .= " WHERE id = '".$this->db->escape($rid)."'"; - $sql .= " AND entity = ".((int) $entity); + $sql .= " AND entity IN (".$this->db->sanitize($entity, 0, 0, 0, 0).")"; $result = $this->db->query($sql); if ($result) { @@ -1126,17 +1126,17 @@ class User extends CommonObject } } - // Suppression des droits selon critere defini dans wherefordel + // Delete permission according to a criteria set into $wherefordel if (!empty($wherefordel)) { //print "$module-$perms-$subperms"; $sql = "SELECT id"; $sql .= " FROM ".$this->db->prefix()."rights_def"; - $sql .= " WHERE entity = ".((int) $entity); + $sql .= " WHERE entity IN (".$this->db->sanitize($entity, 0, 0, 0, 0).")"; if (!empty($wherefordel) && $wherefordel != 'allmodules') { $sql .= " AND (".$wherefordel.")"; // Note: parenthesis are important because wherefordel can contains OR. Also note that $wherefordel is already sanitized } - // avoid admin can remove his own important rights + // avoid admin to remove his own important rights if ($this->admin == 1) { $sql .= " AND id NOT IN (251, 252, 253, 254, 255, 256)"; // other users rights $sql .= " AND id NOT IN (341, 342, 343, 344)"; // own rights @@ -1148,7 +1148,7 @@ class User extends CommonObject $sqldelete .= " WHERE fk_user = ".((int) $this->id)." AND fk_id IN ("; $sqldelete .= $sql; $sqldelete .= ")"; - $sqldelete .= " AND entity = ".((int) $entity); + $sqldelete .= " AND entity IN (".$this->db->sanitize($entity, 0, 0, 0, 0).")"; $resql = $this->db->query($sqldelete); if (!$resql) { @@ -1294,12 +1294,12 @@ class User extends CommonObject } // Now permissions of groups - $sql = "SELECT DISTINCT r.module, r.perms, r.subperms"; + $sql = "SELECT DISTINCT r.module, r.perms, r.subperms, r.entity"; $sql .= " FROM ".$this->db->prefix()."usergroup_rights as gr,"; $sql .= " ".$this->db->prefix()."usergroup_user as gu,"; $sql .= " ".$this->db->prefix()."rights_def as r"; $sql .= " WHERE r.id = gr.fk_id"; - // A very strange business rules. Must be same than into user->getrights() user/perms.php and user/group/perms.php + // @FIXME Very strange business rules. Must be alays the same than into user->getrights() user/perms.php and user/group/perms.php if (getDolGlobalString('MULTICOMPANY_BACKWARD_COMPATIBILITY')) { if (isModEnabled('multicompany') && getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE')) { $sql .= " AND gu.entity IN (0,".$conf->entity.")"; @@ -1308,9 +1308,9 @@ class User extends CommonObject } } else { $sql .= " AND gr.entity = ".((int) $conf->entity); // Only groups created in current entity - // The entity on the table usergroup_user should be useless and should never be used because it is already into gr and r. - // but when using MULTICOMPANY_TRANSVERSE_MODE, we may insert record that make rubbish result due to duplicate record of - // other entities, so we are forced to add a filter here + // The entity on the table gu=usergroup_user should be useless and should never be used because it is already into gr and r. + // but when using MULTICOMPANY_TRANSVERSE_MODE, we may have inserted record that make rubbish result here due to the duplicate record of + // other entities, so we are forced to add a filter on gu here $sql .= " AND gu.entity IN (0,".$conf->entity.")"; $sql .= " AND r.entity = ".((int) $conf->entity); // Only permission of modules enabled in current entity } @@ -1343,12 +1343,12 @@ class User extends CommonObject if (!isset($this->rights->$module->$perms) || !is_object($this->rights->$module->$perms)) { $this->rights->$module->$perms = new stdClass(); } - if (empty($this->rights->$module->$perms->$subperms)) { + if (empty($this->rights->$module->$perms->$subperms)) { // already counted $this->nb_rights++; } $this->rights->$module->$perms->$subperms = 1; } else { - if (empty($this->rights->$module->$perms)) { + if (empty($this->rights->$module->$perms)) { // already counted $this->nb_rights++; } // if we have already define a subperm like this $this->rights->$module->level1->level2 with llx_user_rights, we don't want override level1 because the level2 can be not define on user group