* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm Replaces manual '?key='.urlencode($val).'&key2='.urlencode($val2) string-building with dolBuildUrl($path, $params) across the ECM directory-tree/file-manager code, for consistency with the rest of the codebase (see htdocs/core/lib/ecm.lib.php, which already uses this pattern for the same page) and to benefit from dolBuildUrl()'s buildurl hook. - core/ajax/ajaxdirtree.php: the dir_card.php edit link built from the sql tree loop. - ecm/dir_card.php: the edit/add-section action buttons and the two delete confirmation URLs. Also switches the three buttons that used to manually concatenate '&token='.newToken() to dolBuildUrl()'s own $addtoken parameter. - ecm/class/ecmfiles.class.php: EcmFiles::getNomUrl()'s document.php and file_card.php URLs. - ecm/tpl/enablefiletreeajax.tpl.php: the ajaxdirtree.php script URL and the ajaxdirpreview.php URL. The token here intentionally stays currentToken() (not dolBuildUrl()'s own newToken()-based $addtoken), per the existing comment: ajaxdirtree.php has NOTOKENRENEWAL defined, so the token must match the one already valid on the calling page. $paramwithoutsection is a pre-built raw query-string fragment from an external caller and is appended as-is after the dolBuildUrl() result rather than folded into it. Verified all five refactored URL-building expressions produce byte- identical output to the original code for representative inputs (including values with '/', '&' and spaces), except for query parameter order (which has no effect) and one real, minor pre- existing bug this incidentally fixes: the delete-section confirm URL in dir_card.php was building '&module='.$module without urlencode(), now correctly encoded by dolBuildUrl()/http_build_query(). Could not do a live browser check (no Chrome available for Playwright in this environment) - verified via php -l, phpcs, and a standalone script comparing old vs new output for each call site instead. * Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in filemanager.tpl.php Same refactor as the previous commit, applied to the 7 remaining manually-concatenated URLs in core/tpl/filemanager.tpl.php (used by the ECM/medias file manager): the delete-file/delete-section/ convert-to-webp confirm URLs, the create-directory and refresh-list toolbar buttons (now using dolBuildUrl()'s $addtoken instead of a manual '&token='.newToken()), the two generate-webp buttons, and the "Root" link. $websitekeyandpageid is kept as a helper to build the raw sub-query string embedded once (single-encoded) as the create-directory button's 'backtopage' value - it is not itself passed to dolBuildUrl. Verified all 7 refactored URL-building expressions produce the same query parameters as the original code for representative inputs (compared as parsed, order-independent query strings, since http_build_query() does not preserve insertion order the same way as the original manual concatenation), including one case (convertimgwebp confirm with sortfield/sortorder) where the original code had a harmless but sloppy leading '?&' that dolBuildUrl() no longer produces. * fix * Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in index_auto.php Same refactor as the previous commits, applied to the 4 manually- concatenated URLs in ecm/index_auto.php: the delete-file and delete-section confirm URLs, the refresh-list toolbar link, and the per-directory link in the auto-directories list. Verified all 4 refactored URL-building expressions produce the same query parameters as the original code for representative inputs (including an empty-module/empty-section case for the refresh link, and values with '/' and spaces for the others). * Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (file_card, dir_add_card, index_medias) Same refactor as the previous commits, applied to the remaining manually-concatenated URLs in: - ecm/file_card.php: the cancel and rename-file redirects, the internal download link (document.php), the delete-file confirm URL and the edit button. - ecm/dir_add_card.php: the delete-section confirm URL and the delete button (now using dolBuildUrl()'s $addtoken instead of a manual '&token='.newToken()). - ecm/index_medias.php: the $backtopage URL used by core/actions_linkedfiles.inc.php after a confirm_deletefile. Left ecm/search.php's '$param = "§ion=".urlencode($section)' alone: it is a raw query-string fragment (starting with '&', no leading path) passed into FormFile::list_of_documents(), not a base+params URL build, so it does not fit the dolBuildUrl($path, $params) shape - same reasoning as $paramwithoutsection in the already-refactored enablefiletreeajax.tpl.php. Verified all 8 refactored URL-building expressions produce the same query parameters as the original code for representative inputs (order-independent comparison, since http_build_query() does not preserve the original insertion order).
311 lines
9.2 KiB
PHP
311 lines
9.2 KiB
PHP
<?php
|
|
/* Copyright (C) 2008-2017 Laurent Destailleur <eldy@users.sourceforge.net>
|
|
* Copyright (C) 2008-2012 Regis Houssin <regis.houssin@inodbox.com>
|
|
* Copyright (C) 2015-2024 Alexandre Spangaro <alexandre@inovea-conseil.com>
|
|
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
|
|
* Copyright (C) 2025-2026 MDW <mdeweerd@users.noreply.github.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
/**
|
|
* \file htdocs/ecm/dir_add_card.php
|
|
* \ingroup ecm
|
|
* \brief Main page for ECM section area
|
|
*/
|
|
|
|
if (! defined('DISABLE_JS_GRAHP')) {
|
|
define('DISABLE_JS_GRAPH', 1);
|
|
}
|
|
|
|
// Load Dolibarr environment
|
|
require '../main.inc.php';
|
|
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
|
|
require_once DOL_DOCUMENT_ROOT.'/ecm/class/htmlecm.form.class.php';
|
|
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
|
|
|
|
/**
|
|
* @var Conf $conf
|
|
* @var DoliDB $db
|
|
* @var HookManager $hookmanager
|
|
* @var Translate $langs
|
|
* @var User $user
|
|
*/
|
|
|
|
// Load translation files required by the page
|
|
$langs->loadLangs(array("ecm", "companies", "other", "users", "orders", "propal", "bills", "contracts", "categories"));
|
|
|
|
// Get parameters
|
|
$socid = GETPOSTINT('socid');
|
|
$action = GETPOST('action', 'alpha');
|
|
$cancel = GETPOST('cancel');
|
|
$backtopage = GETPOST('backtopage', 'alpha');
|
|
$confirm = GETPOST('confirm', 'alpha');
|
|
|
|
$module = GETPOST('module', 'aZ09arobase');
|
|
$website = GETPOST('website', 'alpha');
|
|
$pageid = GETPOSTINT('pageid');
|
|
if (empty($module)) {
|
|
$module = 'ecm';
|
|
}
|
|
|
|
// Security check
|
|
if ($user->socid > 0) {
|
|
$action = '';
|
|
$socid = $user->socid;
|
|
}
|
|
|
|
$section = $urlsection = GETPOST('section', 'alpha');
|
|
if (empty($urlsection)) {
|
|
$urlsection = 'misc';
|
|
}
|
|
|
|
if ($module == 'ecm') {
|
|
$upload_dir = $conf->ecm->dir_output.'/'.$urlsection;
|
|
} else { // For example $module == 'medias'
|
|
$upload_dir = $conf->medias->multidir_output[$conf->entity];
|
|
}
|
|
|
|
$limit = GETPOSTINT('limit') ? GETPOSTINT('limit') : $conf->liste_limit;
|
|
$sortfield = GETPOST('sortfield', 'aZ09comma');
|
|
$sortorder = GETPOST('sortorder', 'aZ09comma');
|
|
$page = GETPOSTISSET('pageplusone') ? (GETPOSTINT('pageplusone') - 1) : GETPOSTINT("page");
|
|
if (empty($page) || $page == -1) {
|
|
$page = 0;
|
|
} // If $page is not defined, or '' or -1
|
|
$offset = $limit * $page;
|
|
$pageprev = $page - 1;
|
|
$pagenext = $page + 1;
|
|
if (!$sortorder) {
|
|
$sortorder = "ASC";
|
|
}
|
|
if (!$sortfield) {
|
|
$sortfield = "label";
|
|
}
|
|
|
|
$ecmdir = new EcmDirectory($db);
|
|
if (!empty($section)) {
|
|
$result = $ecmdir->fetch((int) $section);
|
|
if (!($result > 0)) {
|
|
dol_print_error($db, $ecmdir->error);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
// Permissions
|
|
$permissiontoadd = 0;
|
|
$permissiontodelete = 0;
|
|
$permissiontoupload = 0;
|
|
if ($module == 'ecm') {
|
|
$permissiontoadd = $user->hasRight('ecm', 'setup');
|
|
$permissiontodelete = $user->hasRight('ecm', 'setup');
|
|
$permissiontoupload = $user->hasRight('ecm', 'upload');
|
|
}
|
|
if ($module == 'medias') {
|
|
$permissiontoadd = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
|
|
$permissiontodelete = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
|
|
$permissiontoupload = ($user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
|
|
}
|
|
|
|
if (!$permissiontoadd) {
|
|
accessforbidden();
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
* Actions
|
|
*/
|
|
|
|
// Action - add product or service
|
|
if ($action == 'add' && $permissiontoadd) {
|
|
if ($cancel) {
|
|
if (!empty($backtopage)) {
|
|
header("Location: ".$backtopage);
|
|
exit;
|
|
} else {
|
|
header("Location: ".DOL_URL_ROOT.'/ecm/index.php?action=file_manager&module='.$module);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
$ref = (string) GETPOST("ref", 'alpha');
|
|
$label = dol_sanitizeFileName(GETPOST("label", 'alpha'));
|
|
$desc = (string) GETPOST("desc", 'alpha');
|
|
$catParent = GETPOST("catParent", 'alpha'); // Can be an int (with ECM) or a string (with generic filemanager)
|
|
if ($catParent == '-1') {
|
|
$catParent = 0;
|
|
}
|
|
|
|
$error = 0;
|
|
|
|
if (empty($label)) {
|
|
setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Label")), null, 'errors');
|
|
$action = 'create';
|
|
$error++;
|
|
}
|
|
|
|
if (!$error) {
|
|
if ($module == 'ecm') {
|
|
$ecmdir->ref = $ref;
|
|
$ecmdir->label = $label;
|
|
$ecmdir->description = $desc;
|
|
$ecmdir->fk_parent = (int) $catParent;
|
|
|
|
$id = $ecmdir->create($user);
|
|
if ($id <= 0) {
|
|
$error++;
|
|
$langs->load("errors");
|
|
setEventMessages($ecmdir->error, $ecmdir->errors, 'errors');
|
|
$action = 'create';
|
|
}
|
|
} else { // For example $module == 'medias'
|
|
$dirfornewdir = '';
|
|
if ($module == 'medias') {
|
|
$dirfornewdir = $conf->medias->multidir_output[$conf->entity];
|
|
}
|
|
if (empty($dirfornewdir)) {
|
|
$error++;
|
|
dol_print_error(null, 'Bad value for module. Not supported.');
|
|
}
|
|
|
|
if (!$error) {
|
|
$fullpathofdir = $dirfornewdir.'/'.($catParent ? $catParent.'/' : '').$label;
|
|
$result = dol_mkdir($fullpathofdir, DOL_DATA_ROOT);
|
|
if ($result < 0) {
|
|
$langs->load("errors");
|
|
setEventMessages($langs->trans('ErrorFailToCreateDir', $label), null, 'errors');
|
|
$error++;
|
|
} else {
|
|
setEventMessages($langs->trans("ECMSectionWasCreated", $label), null, 'mesgs');
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$error) {
|
|
if (!empty($backtopage)) {
|
|
header("Location: ".$backtopage);
|
|
exit;
|
|
} else {
|
|
header("Location: ".DOL_URL_ROOT.'/ecm/index.php?action=file_manager');
|
|
exit;
|
|
}
|
|
}
|
|
} elseif ($action == 'confirm_deletesection' && $confirm == 'yes' && $permissiontodelete) {
|
|
// Deleting file
|
|
$result = $ecmdir->delete($user);
|
|
setEventMessages($langs->trans("ECMSectionWasRemoved", $ecmdir->label), null, 'mesgs');
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
* View
|
|
*/
|
|
|
|
llxHeader('', $langs->trans("ECMNewSection"), '', '', 0, 0, '', '', '', 'mod-ecm page-dir_add_card');
|
|
|
|
$form = new Form($db);
|
|
$formecm = new FormEcm($db);
|
|
|
|
if ($action == 'create') {
|
|
//***********************
|
|
// Create
|
|
//***********************
|
|
print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
|
|
print '<input type="hidden" name="token" value="'.newToken().'">';
|
|
print '<input type="hidden" name="action" value="add">';
|
|
print '<input type="hidden" name="module" value="'.dol_escape_htmltag($module).'">';
|
|
print '<input type="hidden" name="backtopage" value="'.dol_escape_htmltag($backtopage).'">';
|
|
if ($website) {
|
|
print '<input type="hidden" name="website" value="'.dol_escape_htmltag($website).'">';
|
|
}
|
|
if ($pageid) {
|
|
print '<input type="hidden" name="pageid" value="'.dol_escape_htmltag((string) $pageid).'">';
|
|
}
|
|
|
|
$title = $langs->trans("ECMNewSection");
|
|
print load_fiche_titre($title);
|
|
|
|
print dol_get_fiche_head();
|
|
|
|
print '<table class="border centpercent">';
|
|
|
|
// Label
|
|
print '<tr><td class="titlefieldcreate fieldrequired">'.$langs->trans("Label").'</td><td>';
|
|
print '<input name="label" class="minwidth100" maxlength="32" value="'.GETPOST("label", 'alpha').'" autofocus></td></tr>'."\n";
|
|
|
|
print '<tr><td>'.$langs->trans("AddIn").'</td><td>';
|
|
print $formecm->selectAllSections((GETPOST("catParent", 'alpha') ? GETPOST("catParent", 'alpha') : $ecmdir->fk_parent), 'catParent', $module);
|
|
print '</td></tr>'."\n";
|
|
|
|
// Description
|
|
if ($module == 'ecm') {
|
|
print '<tr><td class="tdtop">'.$langs->trans("Description").'</td><td>';
|
|
print '<textarea name="desc" rows="4" class="quatrevingtpercent">';
|
|
print $ecmdir->description;
|
|
print '</textarea>';
|
|
print '</td></tr>'."\n";
|
|
}
|
|
|
|
print '</table>';
|
|
|
|
print dol_get_fiche_end();
|
|
|
|
print '<div class="center">';
|
|
print '<input type="submit" class="button" name="create" value="'.$langs->trans("Create").'">';
|
|
print ' ';
|
|
print '<input type="submit" class="button button-cancel" name="cancel" value="'.$langs->trans("Cancel").'">';
|
|
print '</div>';
|
|
print '</form>';
|
|
}
|
|
|
|
|
|
if (empty($action) || $action == 'delete_section') {
|
|
//***********************
|
|
// List
|
|
//***********************
|
|
print load_fiche_titre($langs->trans("ECMSectionOfDocuments"));
|
|
print '<br>';
|
|
|
|
/*
|
|
$ecmdir->ref=$ecmdir->label;
|
|
print $langs->trans("ECMSection").': ';
|
|
print img_picto('','object_dir').' ';
|
|
print '<a href="'.DOL_URL_ROOT.'/ecm/dir_add_card.php">'.$langs->trans("ECMRoot").'</a>';
|
|
//print ' -> <b>'.$ecmdir->getNomUrl(1).'</b><br>';
|
|
print "<br><br>";
|
|
*/
|
|
|
|
// Generate form to confirm deletion of a category line
|
|
if ($action == 'delete_section') {
|
|
print $form->formconfirm(dolBuildUrl($_SERVER["PHP_SELF"], array('section' => $section)), $langs->trans('DeleteSection'), $langs->trans('ConfirmDeleteSection', $ecmdir->label), 'confirm_deletesection');
|
|
}
|
|
|
|
|
|
// Actions buttons
|
|
print '<div class="tabsAction">';
|
|
|
|
// Delete
|
|
print dolGetButtonAction($langs->trans('Delete'), '', 'delete', dolBuildUrl($_SERVER["PHP_SELF"], array('section' => $section, 'action' => 'delete_section'), true), '', $user->hasRight('ecm', 'setup'));
|
|
|
|
print '</div>';
|
|
}
|
|
|
|
|
|
// End of page
|
|
llxFooter();
|
|
$db->close();
|