dolibarr/htdocs/ecm/dir_add_card.php
Frédéric FRANCE 585afa14de
Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (#39557)
* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm

Replaces manual '?key='.urlencode($val).'&key2='.urlencode($val2)
string-building with dolBuildUrl($path, $params) across the ECM
directory-tree/file-manager code, for consistency with the rest of
the codebase (see htdocs/core/lib/ecm.lib.php, which already uses
this pattern for the same page) and to benefit from dolBuildUrl()'s
buildurl hook.

- core/ajax/ajaxdirtree.php: the dir_card.php edit link built from
  the sql tree loop.
- ecm/dir_card.php: the edit/add-section action buttons and the two
  delete confirmation URLs. Also switches the three buttons that used
  to manually concatenate '&token='.newToken() to dolBuildUrl()'s own
  $addtoken parameter.
- ecm/class/ecmfiles.class.php: EcmFiles::getNomUrl()'s document.php
  and file_card.php URLs.
- ecm/tpl/enablefiletreeajax.tpl.php: the ajaxdirtree.php script URL
  and the ajaxdirpreview.php URL. The token here intentionally stays
  currentToken() (not dolBuildUrl()'s own newToken()-based
  $addtoken), per the existing comment: ajaxdirtree.php has
  NOTOKENRENEWAL defined, so the token must match the one already
  valid on the calling page. $paramwithoutsection is a pre-built raw
  query-string fragment from an external caller and is appended as-is
  after the dolBuildUrl() result rather than folded into it.

Verified all five refactored URL-building expressions produce byte-
identical output to the original code for representative inputs
(including values with '/', '&' and spaces), except for query
parameter order (which has no effect) and one real, minor pre-
existing bug this incidentally fixes: the delete-section confirm URL
in dir_card.php was building '&module='.$module without urlencode(),
now correctly encoded by dolBuildUrl()/http_build_query().

Could not do a live browser check (no Chrome available for Playwright
in this environment) - verified via php -l, phpcs, and a standalone
script comparing old vs new output for each call site instead.

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in filemanager.tpl.php

Same refactor as the previous commit, applied to the 7 remaining
manually-concatenated URLs in core/tpl/filemanager.tpl.php (used by
the ECM/medias file manager): the delete-file/delete-section/
convert-to-webp confirm URLs, the create-directory and refresh-list
toolbar buttons (now using dolBuildUrl()'s $addtoken instead of a
manual '&token='.newToken()), the two generate-webp buttons, and the
"Root" link.

$websitekeyandpageid is kept as a helper to build the raw sub-query
string embedded once (single-encoded) as the create-directory
button's 'backtopage' value - it is not itself passed to dolBuildUrl.

Verified all 7 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(compared as parsed, order-independent query strings, since
http_build_query() does not preserve insertion order the same way as
the original manual concatenation), including one case
(convertimgwebp confirm with sortfield/sortorder) where the original
code had a harmless but sloppy leading '?&' that dolBuildUrl() no
longer produces.

* fix

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in index_auto.php

Same refactor as the previous commits, applied to the 4 manually-
concatenated URLs in ecm/index_auto.php: the delete-file and
delete-section confirm URLs, the refresh-list toolbar link, and the
per-directory link in the auto-directories list.

Verified all 4 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(including an empty-module/empty-section case for the refresh link,
and values with '/' and spaces for the others).

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (file_card, dir_add_card, index_medias)

Same refactor as the previous commits, applied to the remaining
manually-concatenated URLs in:
- ecm/file_card.php: the cancel and rename-file redirects, the
  internal download link (document.php), the delete-file confirm URL
  and the edit button.
- ecm/dir_add_card.php: the delete-section confirm URL and the delete
  button (now using dolBuildUrl()'s $addtoken instead of a manual
  '&token='.newToken()).
- ecm/index_medias.php: the $backtopage URL used by
  core/actions_linkedfiles.inc.php after a confirm_deletefile.

Left ecm/search.php's '$param = "&section=".urlencode($section)'
alone: it is a raw query-string fragment (starting with '&', no
leading path) passed into FormFile::list_of_documents(), not a
base+params URL build, so it does not fit the dolBuildUrl($path,
$params) shape - same reasoning as $paramwithoutsection in the
already-refactored enablefiletreeajax.tpl.php.

Verified all 8 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(order-independent comparison, since http_build_query() does not
preserve the original insertion order).
2026-08-17 04:41:05 +02:00

311 lines
9.2 KiB
PHP

<?php
/* Copyright (C) 2008-2017 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2008-2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2015-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
/**
* \file htdocs/ecm/dir_add_card.php
* \ingroup ecm
* \brief Main page for ECM section area
*/
if (! defined('DISABLE_JS_GRAHP')) {
define('DISABLE_JS_GRAPH', 1);
}
// Load Dolibarr environment
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/htmlecm.form.class.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
/**
* @var Conf $conf
* @var DoliDB $db
* @var HookManager $hookmanager
* @var Translate $langs
* @var User $user
*/
// Load translation files required by the page
$langs->loadLangs(array("ecm", "companies", "other", "users", "orders", "propal", "bills", "contracts", "categories"));
// Get parameters
$socid = GETPOSTINT('socid');
$action = GETPOST('action', 'alpha');
$cancel = GETPOST('cancel');
$backtopage = GETPOST('backtopage', 'alpha');
$confirm = GETPOST('confirm', 'alpha');
$module = GETPOST('module', 'aZ09arobase');
$website = GETPOST('website', 'alpha');
$pageid = GETPOSTINT('pageid');
if (empty($module)) {
$module = 'ecm';
}
// Security check
if ($user->socid > 0) {
$action = '';
$socid = $user->socid;
}
$section = $urlsection = GETPOST('section', 'alpha');
if (empty($urlsection)) {
$urlsection = 'misc';
}
if ($module == 'ecm') {
$upload_dir = $conf->ecm->dir_output.'/'.$urlsection;
} else { // For example $module == 'medias'
$upload_dir = $conf->medias->multidir_output[$conf->entity];
}
$limit = GETPOSTINT('limit') ? GETPOSTINT('limit') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOSTINT('pageplusone') - 1) : GETPOSTINT("page");
if (empty($page) || $page == -1) {
$page = 0;
} // If $page is not defined, or '' or -1
$offset = $limit * $page;
$pageprev = $page - 1;
$pagenext = $page + 1;
if (!$sortorder) {
$sortorder = "ASC";
}
if (!$sortfield) {
$sortfield = "label";
}
$ecmdir = new EcmDirectory($db);
if (!empty($section)) {
$result = $ecmdir->fetch((int) $section);
if (!($result > 0)) {
dol_print_error($db, $ecmdir->error);
exit;
}
}
// Permissions
$permissiontoadd = 0;
$permissiontodelete = 0;
$permissiontoupload = 0;
if ($module == 'ecm') {
$permissiontoadd = $user->hasRight('ecm', 'setup');
$permissiontodelete = $user->hasRight('ecm', 'setup');
$permissiontoupload = $user->hasRight('ecm', 'upload');
}
if ($module == 'medias') {
$permissiontoadd = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
$permissiontodelete = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
$permissiontoupload = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
}
if (!$permissiontoadd) {
accessforbidden();
}
/*
* Actions
*/
// Action - add product or service
if ($action == 'add' && $permissiontoadd) {
if ($cancel) {
if (!empty($backtopage)) {
header("Location: ".$backtopage);
exit;
} else {
header("Location: ".DOL_URL_ROOT.'/ecm/index.php?action=file_manager&module='.$module);
exit;
}
}
$ref = (string) GETPOST("ref", 'alpha');
$label = dol_sanitizeFileName(GETPOST("label", 'alpha'));
$desc = (string) GETPOST("desc", 'alpha');
$catParent = GETPOST("catParent", 'alpha'); // Can be an int (with ECM) or a string (with generic filemanager)
if ($catParent == '-1') {
$catParent = 0;
}
$error = 0;
if (empty($label)) {
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Label")), null, 'errors');
$action = 'create';
$error++;
}
if (!$error) {
if ($module == 'ecm') {
$ecmdir->ref = $ref;
$ecmdir->label = $label;
$ecmdir->description = $desc;
$ecmdir->fk_parent = (int) $catParent;
$id = $ecmdir->create($user);
if ($id <= 0) {
$error++;
$langs->load("errors");
setEventMessages($ecmdir->error, $ecmdir->errors, 'errors');
$action = 'create';
}
} else { // For example $module == 'medias'
$dirfornewdir = '';
if ($module == 'medias') {
$dirfornewdir = $conf->medias->multidir_output[$conf->entity];
}
if (empty($dirfornewdir)) {
$error++;
dol_print_error(null, 'Bad value for module. Not supported.');
}
if (!$error) {
$fullpathofdir = $dirfornewdir.'/'.($catParent ? $catParent.'/' : '').$label;
$result = dol_mkdir($fullpathofdir, DOL_DATA_ROOT);
if ($result < 0) {
$langs->load("errors");
setEventMessages($langs->trans('ErrorFailToCreateDir', $label), null, 'errors');
$error++;
} else {
setEventMessages($langs->trans("ECMSectionWasCreated", $label), null, 'mesgs');
}
}
}
}
if (!$error) {
if (!empty($backtopage)) {
header("Location: ".$backtopage);
exit;
} else {
header("Location: ".DOL_URL_ROOT.'/ecm/index.php?action=file_manager');
exit;
}
}
} elseif ($action == 'confirm_deletesection' && $confirm == 'yes' && $permissiontodelete) {
// Deleting file
$result = $ecmdir->delete($user);
setEventMessages($langs->trans("ECMSectionWasRemoved", $ecmdir->label), null, 'mesgs');
}
/*
* View
*/
llxHeader('', $langs->trans("ECMNewSection"), '', '', 0, 0, '', '', '', 'mod-ecm page-dir_add_card');
$form = new Form($db);
$formecm = new FormEcm($db);
if ($action == 'create') {
//***********************
// Create
//***********************
print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="add">';
print '<input type="hidden" name="module" value="'.dol_escape_htmltag($module).'">';
print '<input type="hidden" name="backtopage" value="'.dol_escape_htmltag($backtopage).'">';
if ($website) {
print '<input type="hidden" name="website" value="'.dol_escape_htmltag($website).'">';
}
if ($pageid) {
print '<input type="hidden" name="pageid" value="'.dol_escape_htmltag((string) $pageid).'">';
}
$title = $langs->trans("ECMNewSection");
print load_fiche_titre($title);
print dol_get_fiche_head();
print '<table class="border centpercent">';
// Label
print '<tr><td class="titlefieldcreate fieldrequired">'.$langs->trans("Label").'</td><td>';
print '<input name="label" class="minwidth100" maxlength="32" value="'.GETPOST("label", 'alpha').'" autofocus></td></tr>'."\n";
print '<tr><td>'.$langs->trans("AddIn").'</td><td>';
print $formecm->selectAllSections((GETPOST("catParent", 'alpha') ? GETPOST("catParent", 'alpha') : $ecmdir->fk_parent), 'catParent', $module);
print '</td></tr>'."\n";
// Description
if ($module == 'ecm') {
print '<tr><td class="tdtop">'.$langs->trans("Description").'</td><td>';
print '<textarea name="desc" rows="4" class="quatrevingtpercent">';
print $ecmdir->description;
print '</textarea>';
print '</td></tr>'."\n";
}
print '</table>';
print dol_get_fiche_end();
print '<div class="center">';
print '<input type="submit" class="button" name="create" value="'.$langs->trans("Create").'">';
print ' &nbsp; &nbsp; ';
print '<input type="submit" class="button button-cancel" name="cancel" value="'.$langs->trans("Cancel").'">';
print '</div>';
print '</form>';
}
if (empty($action) || $action == 'delete_section') {
//***********************
// List
//***********************
print load_fiche_titre($langs->trans("ECMSectionOfDocuments"));
print '<br>';
/*
$ecmdir->ref=$ecmdir->label;
print $langs->trans("ECMSection").': ';
print img_picto('','object_dir').' ';
print '<a href="'.DOL_URL_ROOT.'/ecm/dir_add_card.php">'.$langs->trans("ECMRoot").'</a>';
//print ' -> <b>'.$ecmdir->getNomUrl(1).'</b><br>';
print "<br><br>";
*/
// Generate form to confirm deletion of a category line
if ($action == 'delete_section') {
print $form->formconfirm(dolBuildUrl($_SERVER["PHP_SELF"], array('section' => $section)), $langs->trans('DeleteSection'), $langs->trans('ConfirmDeleteSection', $ecmdir->label), 'confirm_deletesection');
}
// Actions buttons
print '<div class="tabsAction">';
// Delete
print dolGetButtonAction($langs->trans('Delete'), '', 'delete', dolBuildUrl($_SERVER["PHP_SELF"], array('section' => $section, 'action' => 'delete_section'), true), '', $user->hasRight('ecm', 'setup'));
print '</div>';
}
// End of page
llxFooter();
$db->close();