ea54342891
* FIX Drag and drop of a file reports a wrong error, or none at all
The error handler of dragAndDropFileUpload() had three defects that all end on
the user believing the file was attached when it was not.
- The first assignment of the message was dead code, there was no return after
the test on the http code 403, so a refusal was reported as a generic error.
- The key ErrorUploadPermissionDenied it used exists in no language file, so
the raw key was shown.
- JSON.parse() was called with no try/catch on an answer that is not always a
json, a fatal error of the endpoint or a request over post_max_size for
example. The exception left the user on a page with no message at all.
- An empty list of files was treated as a success, while it means the endpoint
stored nothing.
The value of PHP_SELF is also escaped before it is written into the 6 generated
javascript strings. It holds the path info of the request on a server that
accepts it, so it is a user input. dol_escape_js() is called with the mode that
escapes a double quote by a double quote, the strings being delimited by double
quotes, and the sequence '</' is escaped too because the function does not do it
and the path info could otherwise close the script tag and open one of its own.
Adds the key ErrorOnAtLeastOneFileUpload to en_US, used when some files of a
batch failed and some did not.
* FIX getMultidirOutput returns a directory the Documents tab does not read
Four defects of the same function, all ending on a file stored where the user
will never see it, or written outside the documents directory.
- The ref of the project of a task was only passed through dol_sanitizePathName(),
which keeps a slash, a colon and the accented chars, while projet/tasks/document.php
sanitizes it with dol_sanitizeFileName(). A project ref holding a slash even
created an extra level of directory. Measured on real databases: 304 projects
over 330 hold a slash on one of them, carrying 701 tasks over 824.
- The same case calls $object->fetchProject() with no guard, while the signature
of the function accepts an object that is not a CommonObject, and even a null
when a module is given. Such a caller gets a fatal error where it expects the
error string. No core caller is in that case today, an external module or a
hook can be.
- The entity of the object may have no declared directory, an object shared by
another entity for example. The undefined index returned a relative path, so
the caller read or wrote under the web root. The current entity is used
instead, and the fallback is logged because the directory is then not the one
of the entity of the object, which matters for a caller that deletes files.
- When the current entity has no declared directory either, the fallback
returned the sub directory alone, again a relative path. The same error than
for a module that declares no directory at all is now returned.
Adds the sub directory of a partnership and of a stock transfer, which their own
document tabs already read.
* FIX getElementProperties answers wrong properties for 9 elements
A customer payment, a supplier payment, a various payment, a stock transfer and
the 4 objects of the hrm module had no properties at all, or wrong ones, so any
caller that resolves a class, a table or a document directory from an element
failed on them.
- payment, payment_supplier and payment_various had no branch. The branch of a
customer payment tests $elementType and not $element, because the rule on the
elements named myobject_mysubobject rewrites $element to 'payment' for
'payment_salary' too, which is stored somewhere else.
- job, position, skill and evaluation answered a wrong table (hrm_job_user for
a position, and so on) and no sub directory, while their document tabs read
one named after the element.
- stocktransfer answered an empty classname, because it is not the ucfirst() of
the element, so a caller doing new $classname($db) ended on a fatal error.
- The sub directory was concatenated even when the module is disabled and the
directory is empty, which answered a path at the root of the file system.
- A contact and a conference are stored into a sub directory their tab reads.
isModEnabled('invoice') is tested for a customer payment: there is no module
named 'compta', so testing it was always false, while $conf->compta->payment is
set unconditionally by Conf::setValues() and could not be used as a proxy.
* FIX Access refused to everyone on 11 objects of the core
restrictedArea() and checkUserAccessToObject() refuse the access to objects that
no permission and no rule can match, whatever the user, an administrator
included.
- The hrm module declares no permission at its first level, only 'all', and the
stocktransfer module only 'stocktransfer'. A check on the module itself
therefore tests a permission that does not exist. The mapping is the same one
as into User::hasRight().
- The module of an event organization declares no permission at all, its whole
permission block being commented out on purpose, and its cards check the
parent project instead. The feature is mapped onto that project, with the two
guards the card has: an external user is refused, and so is a conference with
no parent project, whose id of 0 would otherwise grant an access with no check
on the record at all.
- The default rule of checkUserAccessToObject() builds its sql on the columns
entity and fk_soc of the table. llx_asset, llx_paiement, llx_paiementfourn and
llx_workstation_workstation have no fk_soc, and llx_hrm_job, llx_hrm_job_user
and llx_hrm_skill have neither. The sql failed, so the access was refused to
every user this rule applies to. These tables are now checked on their entity
only, which is what the $check rule already does for the same class of tables,
and the 3 tables of hrm can be checked on nothing at all. The rule is selected
on the table and not on the element, because $object is an id and not an
object for most of the callers, the cards of an asset and of a workstation
included, which are broken today for any user without the permission to see
all third parties.
- An external user is refused explicitly on those tables: none of these objects
is linked to a third party, so the default rule refused him through a link
that does not exist, and the rules that replace it do not look at the third
party of the user at all.
Measured on a vanilla instance with 5 profiles, an administrator, an internal
user with every right, one without the permission to see all third parties, one
that is not a sales representative of the third party of the object, and an
external user: the 11 objects go from refused to granted for the internal users
and stay refused for the external one, and the 26 other elements answer exactly
the same for the 5 profiles.
* FIX A file dropped on a card is lost, or reported as refused when it was stored
FileUpload stores the file into a directory that the "Attached files" tab of the
object never reads, so the user attaches a file that no screen will ever show,
and nothing is indexed in database to find it back. Measured on real databases:
216487 thirdparties over 216887 and 157852 products over 280319 are in that case
on the cards that already enable the drag and drop.
- The directory of the object is now forged with get_exdir(), the way the tabs
do: it always uses the id for a thirdparty, whose ref is a company name and is
not unique, and it falls back on the id when the ref is empty. The sub
directory of the module is read with getMultidirOutput(), which knows the
elements that store their documents into one. That function does not return
an empty string when it fails but a string starting with 'error-', so only an
absolute path is accepted: writing into that string would create the files
under the web root.
- fetchObjectByElement() returns an object even when fetch() returned 0. The
object was then not loaded, and the file was stored at the root of the
directory of the module, out of any object. The constructor now throws, and
the endpoint answers the error with the same json contract than a successful
call so that the caller can show it, instead of a fatal error and an http 500.
- An attachment of the same name was silently overwritten, dol_move_uploaded_file()
being called with $allowoverwrite = 1 while the name was checked before the
ref of the object was added as a prefix. The check is done again on the final
name, and on the .noexe suffixed name too, which that function appends to an
executable file.
- An executable file was renamed with that .noexe suffix and then reported as an
error, while it was correctly stored.
- The endpoint called restrictedArea() with an empty feature when the element is
unknown, and the loop of that function then takes no branch at all and grants
the access with no check. It refuses before, with the same http code and the
same message than a refusal, so that a user cannot tell an object that exists
but is not allowed from an object that does not exist. The refusal of an
external user on an object of another third party answered a message of its
own, which allowed the same enumeration.
Comes with the tests of the path resolution, of the fallback of get_exdir(), of
the rejection of the error string of getMultidirOutput(), and of the file name
deduplication.
* FIX Remove the drop area from 13 cards where dropping a file is harmful
Two distinct groups, both of them removing a drop area that only produces a
result the user does not want.
7 pages have no "Attached files" tab at all, so a file dropped on them can be
reached by no screen: a fiscal year and its info page, an accounting model, a
webhook trigger history, an intracomm report, a bookcal calendar and its booking
list. Measured: 4 of them accepted the upload and wrote an orphan file, the
accounting model wrote it at the root of the directory of the module, out of any
object, and the 2 bookcal ones answered an http 500.
6 cards print their tabs inside their edit form, so the drop area covered that
form: a product, an expense report, a VAT payment, a social contribution, a loan
and a salary. Dropping a file there reloads the page, which discards what the
user is typing. A product and an expense report have a second call for the read
only view, so the drop area is only removed from the call of the edit branch;
the 4 others share a single call between both views, so the parameter is now
conditional.
* NEW Drag and drop a file on the 23 remaining cards
Every card of the core that owns an "Attached files" tab can now receive a file
by drag and drop, which was the case of 32 of them only. The 23 added here are
an asset, an event, a various payment, a customer payment, a contact, a donation,
a conference or booth, a shipment, a supplier payment, a leave request, an
evaluation, a job, a position, a skill, a knowledge record, a manufacturing
order, a partnership, a lot, a stock transfer, a task, a reception, a resource
and a workstation.
The tab bar of a leave request and of a resource is printed inside their edit
form, so the drop area is not enabled there: dropping a file reloads the page,
which would discard what the user is typing. The card of a supplier payment
prints its tab bar even when the object was not loaded, so the drop area is only
enabled when it is.
* FIX getMultidirOutput refuses an entity with no directory instead of falling back [skip-claudemd]
The previous revision of this PR fell back on the directory of the current
entity when the entity of the object had none, with a LOG_WARNING. On a
multicompany install that made a caller read, write and above all delete
files in the directory of another entity. Refuse instead: the function
already answers 'error-diroutput-not-defined-for-this-object' when the
module declares no directory at all, so the caller has one behaviour to
handle, not two.
The entity is cast to int, which is what the array index needs and what
silences the four PhanTypeMismatchDimFetchNullable this function reported.
---------
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
1312 lines
53 KiB
PHP
1312 lines
53 KiB
PHP
<?php
|
|
|
|
/* Copyright (C) 2008-2021 Laurent Destailleur <eldy@users.sourceforge.net>
|
|
* Copyright (C) 2008-2021 Regis Houssin <regis.houssin@inodbox.com>
|
|
* Copyright (C) 2020 Ferran Marcet <fmarcet@2byte.es>
|
|
* Copyright (C) 2024-2025 MDW <mdeweerd@users.noreply.github.com>
|
|
* Copyright (C) 2025 Frédéric France <frederic.france@free.fr>
|
|
* Copyright (C) 2026 William Mead <william@m34d.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
* or see https://www.gnu.org/
|
|
*/
|
|
|
|
/**
|
|
* \file htdocs/core/lib/security.lib.php
|
|
* \ingroup core
|
|
* \brief Set of function used for dolibarr security (common function included into filefunc.inc.php)
|
|
* Warning, this file must not depends on other library files, except function.lib.php
|
|
* because it is used at low code level.
|
|
*/
|
|
|
|
include_once DOL_DOCUMENT_ROOT.'/blockedlog/lib/securitycore.lib.php';
|
|
|
|
|
|
/**
|
|
* Encode a string with base 64 algorithm + specific delta change.
|
|
*
|
|
* @param string $chain string to encode
|
|
* @param string $key rule to use for delta ('0', '1' or 'myownkey')
|
|
* @return string encoded string with format 'passcrypted'
|
|
* @see dol_decode(), dolEncrypt()
|
|
*/
|
|
function dol_encode($chain, $key = '1')
|
|
{
|
|
if (is_numeric($key) && $key == '1') { // rule 1 is offset of 17 for char
|
|
$output_tab = array();
|
|
$strlength = dol_strlen($chain);
|
|
for ($i = 0; $i < $strlength; $i++) {
|
|
$output_tab[$i] = chr(ord(substr($chain, $i, 1)) + 17);
|
|
}
|
|
$chain = implode("", $output_tab);
|
|
} elseif ($key) {
|
|
$result = '';
|
|
$strlength = dol_strlen($chain);
|
|
for ($i = 0; $i < $strlength; $i++) {
|
|
$keychar = substr($key, ($i % strlen($key)) - 1, 1);
|
|
$result .= chr(ord(substr($chain, $i, 1)) + (ord($keychar) - 65));
|
|
}
|
|
$chain = $result;
|
|
}
|
|
|
|
return base64_encode($chain);
|
|
}
|
|
|
|
/**
|
|
* Decode a base 64 encoded + specific delta change.
|
|
* This function is called by filefunc.inc.php at each page call.
|
|
*
|
|
* @param string $chain string to decode
|
|
* @param string $key rule to use for delta ('0', '1' or 'myownkey')
|
|
* @return string decoded string
|
|
* @see dol_encode(), dolDecrypt
|
|
*/
|
|
function dol_decode($chain, $key = '1')
|
|
{
|
|
$chain = base64_decode($chain);
|
|
|
|
if (is_numeric($key) && $key == '1') { // rule 1 is offset of 17 for char
|
|
$output_tab = array();
|
|
$strlength = dol_strlen($chain);
|
|
for ($i = 0; $i < $strlength; $i++) {
|
|
$output_tab[$i] = chr(ord(substr($chain, $i, 1)) - 17);
|
|
}
|
|
|
|
$chain = implode("", $output_tab);
|
|
} elseif ($key) {
|
|
$result = '';
|
|
$strlength = dol_strlen($chain);
|
|
for ($i = 0; $i < $strlength; $i++) {
|
|
$keychar = substr($key, ($i % strlen($key)) - 1, 1);
|
|
$result .= chr(ord(substr($chain, $i, 1)) - (ord($keychar) - 65));
|
|
}
|
|
$chain = $result;
|
|
}
|
|
|
|
return $chain;
|
|
}
|
|
|
|
/**
|
|
* Return a string of random bytes (hexa string) with length = $length for cryptographic purposes.
|
|
*
|
|
* @param int $length Length of random string
|
|
* @return string Random string
|
|
*/
|
|
function dolGetRandomBytes($length)
|
|
{
|
|
if (function_exists('random_bytes')) { // Available with PHP 7+ only.
|
|
return bin2hex(random_bytes((int) floor($length / 2))); // the bin2hex will double the number of bytes so we take length / 2
|
|
}
|
|
|
|
return bin2hex(openssl_random_pseudo_bytes((int) floor($length / 2))); // the bin2hex will double the number of bytes so we take length / 2. May be very slow on Windows.
|
|
}
|
|
|
|
/**
|
|
* Returns a specific ldap hash of a password.
|
|
*
|
|
* @param string $password Password to hash
|
|
* @param 'md5'|'md5frommd5'|'smd5'|'sha'|'ssha'|'sha256'|'ssha256'|'sha384'|'ssha384'|'sha512'|'ssha512'|'crypt'|'clear' $type Type of hash
|
|
* @return string Hash of password
|
|
*/
|
|
function dolGetLdapPasswordHash($password, $type = 'md5')
|
|
{
|
|
if (empty($type)) {
|
|
$type = 'md5';
|
|
}
|
|
|
|
$salt = substr(sha1((string) time()), 0, 8);
|
|
|
|
if ($type === 'md5') {
|
|
return '{MD5}' . base64_encode(hash("md5", $password, true)); //For OpenLdap with md5 (based on an unencrypted password in base)
|
|
} elseif ($type === 'md5frommd5') {
|
|
return '{MD5}' . base64_encode(hex2bin($password)); // Create OpenLDAP MD5 password from Dolibarr MD5 password
|
|
} elseif ($type === 'smd5') {
|
|
return "{SMD5}" . base64_encode(hash("md5", $password . $salt, true) . $salt);
|
|
} elseif ($type === 'sha') {
|
|
return '{SHA}' . base64_encode(hash("sha1", $password, true));
|
|
} elseif ($type === 'ssha') {
|
|
return "{SSHA}" . base64_encode(hash("sha1", $password . $salt, true) . $salt);
|
|
} elseif ($type === 'sha256') {
|
|
return "{SHA256}" . base64_encode(hash("sha256", $password, true));
|
|
} elseif ($type === 'ssha256') {
|
|
return "{SSHA256}" . base64_encode(hash("sha256", $password . $salt, true) . $salt);
|
|
} elseif ($type === 'sha384') {
|
|
return "{SHA384}" . base64_encode(hash("sha384", $password, true));
|
|
} elseif ($type === 'ssha384') {
|
|
return "{SSHA384}" . base64_encode(hash("sha384", $password . $salt, true) . $salt);
|
|
} elseif ($type === 'sha512') {
|
|
return "{SHA512}" . base64_encode(hash("sha512", $password, true));
|
|
} elseif ($type === 'ssha512') {
|
|
return "{SSHA512}" . base64_encode(hash("sha512", $password . $salt, true) . $salt);
|
|
} elseif ($type === 'crypt') {
|
|
return '{CRYPT}' . crypt($password, $salt);
|
|
} elseif ($type === 'clear') {
|
|
return '{CLEAR}' . $password; // Just for test, plain text password is not secured !
|
|
}
|
|
return "";
|
|
}
|
|
|
|
/**
|
|
* Check permissions of a user to show a page and an object. Check read permission.
|
|
* If GETPOST('action','aZ09') defined, we also check write and delete permission.
|
|
* This method check permission on module then call checkUserAccessToObject() for permission on object (according to entity and socid of user).
|
|
*
|
|
* @param User $user User to check
|
|
* @param string $features Features to check (it must be module name or $object->element. Can be a 'or' check with 'levela|levelb'.
|
|
* Examples: 'societe', 'contact', 'produit&service', 'produit|service', ...)
|
|
* This is used to check permission $user->rights->features->...
|
|
* @param int|string|Object $object Object (recommended) or Object ID or list of Object ID if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
|
|
* @param string $tableandshare 'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity for multicompany module. Param not used if objectid is null (optional).
|
|
* @param string $feature2 Feature to check, second level of permission (optional). Can be a 'or' check with 'sublevela|sublevelb'.
|
|
* This is used to check permission $user->rights->features->feature2...
|
|
* @param string $dbt_keyfield Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA.
|
|
* @param string $dbt_select Field rowid name, for select into tableandshare if not "rowid". Not used if objectid is null (optional)
|
|
* @param int<0,1> $isdraft 1=The object with id=$objectid is a draft
|
|
* @param int<0,1> $mode Mode (0=default, 1=return without dying)
|
|
* @return int If mode = 0 (default): die process if not allowed (else return 1). If mode = 1: Return 0 if access not allowed (else return 1).
|
|
* @see dol_check_secure_access_document(), checkUserAccessToObject()
|
|
*/
|
|
function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = 'fk_soc', $dbt_select = 'rowid', $isdraft = 0, $mode = 0)
|
|
{
|
|
global $hookmanager;
|
|
|
|
// Define $objectid
|
|
if (is_object($object)) {
|
|
$objectid = $object->id;
|
|
} else {
|
|
$objectid = $object; // $objectid can be X or 'X,Y,Z'
|
|
}
|
|
if ($objectid == "-1") {
|
|
$objectid = 0;
|
|
}
|
|
if ($objectid) {
|
|
$objectid = preg_replace('/[^0-9\.\,]/', '', (string) $objectid); // For the case value is coming from a non sanitized user input
|
|
}
|
|
|
|
//dol_syslog("functions.lib:restrictedArea $feature, $object, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
|
|
/*print "user_id=".$user->id.", features=".$features.", feature2=".$feature2.", object=".$object;
|
|
print ", dbtablename=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select;
|
|
print ", perm: user->hasRight(".$features.($feature2 ? ",".$feature2 : "").", lire) = ".($feature2 ? $user->hasRight($features, $feature2, 'lire') : $user->hasRight($features, 'lire'))."<br>";
|
|
*/
|
|
|
|
$parentfortableentity = '';
|
|
|
|
// Fix syntax of $features param to support non standard module names.
|
|
// @todo : use elseif ?
|
|
$originalfeatures = $features;
|
|
if ($features == 'agenda') {
|
|
$tableandshare = 'actioncomm&societe';
|
|
$feature2 = 'myactions|allactions';
|
|
$dbt_select = 'id';
|
|
} elseif ($features == 'bank') {
|
|
$features = 'banque';
|
|
} elseif ($features == 'facturerec') {
|
|
$features = 'facture';
|
|
} elseif ($features == 'supplier_invoicerec') {
|
|
$features = 'fournisseur';
|
|
$feature2 = 'facture';
|
|
} elseif ($features == 'mo') {
|
|
$features = 'mrp';
|
|
} elseif ($features == 'member') {
|
|
$features = 'adherent';
|
|
} elseif ($features == 'subscription') {
|
|
$features = 'adherent';
|
|
$feature2 = 'cotisation';
|
|
} elseif ($features == 'website' && is_object($object) && $object->element == 'websitepage') {
|
|
$parentfortableentity = 'fk_website@website';
|
|
} elseif ($features == 'project') {
|
|
$features = 'projet';
|
|
} elseif ($features == 'eventorganization' && is_object($object) && $object->element == 'conferenceorbooth') {
|
|
// The module of an event organization declares no permission of its own, on purpose, so a check on
|
|
// 'eventorganization' is refused to everyone, an administrator included. Check the parent project
|
|
// instead, which is what the card of the object does itself.
|
|
// The card refuses an external user before that check, and fk_project is nullable, so we must refuse
|
|
// both cases here too: with no parent project there is nothing left to check the access on, and
|
|
// granting it would be an access with no check at all.
|
|
if (!empty($user->socid) || empty($object->fk_project)) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden();
|
|
}
|
|
}
|
|
$features = 'projet';
|
|
$tableandshare = 'projet&project';
|
|
$objectid = (int) $object->fk_project;
|
|
$object = $objectid;
|
|
} elseif ($features == 'product') {
|
|
$features = 'produit';
|
|
} elseif ($features == 'productbatch') {
|
|
$features = 'produit';
|
|
} elseif ($features == 'tax') {
|
|
$feature2 = 'charges';
|
|
} elseif ($features == 'workstation') {
|
|
$feature2 = 'workstation';
|
|
} elseif ($features == 'hrm' && is_object($object) && in_array($object->element, array('job', 'position', 'skill'))) {
|
|
$feature2 = 'all'; // These 3 objects have no permission of their own, they share the level "all"
|
|
} elseif ($features == 'stocktransfer' && is_object($object) && $object->element == 'stocktransfer') {
|
|
$feature2 = 'stocktransfer'; // This module declares no permission at its first level, only this one
|
|
} elseif ($features == 'fournisseur') { // When vendor invoice and purchase order are into module 'fournisseur'
|
|
if (is_object($object) && $object->element == 'invoice_supplier') {
|
|
$feature2 = 'facture';
|
|
} elseif (is_object($object) && $object->element == 'order_supplier') {
|
|
$feature2 = 'commande';
|
|
}
|
|
} elseif ($features == 'payment_sc') {
|
|
$tableandshare = 'paiementcharge';
|
|
$parentfortableentity = 'fk_charge@chargesociales';
|
|
}
|
|
|
|
// if commonObjectLine : Using many2one related commonObject
|
|
// @see commonObjectLine::parentElement
|
|
if (in_array($features, ['commandedet', 'propaldet', 'facturedet', 'supplier_proposaldet', 'evaluationdet', 'skilldet', 'deliverydet', 'contratdet'])) {
|
|
$features = substr($features, 0, -3);
|
|
} elseif (in_array($features, ['stocktransferline', 'inventoryline', 'bomline', 'expensereport_det', 'facture_fourn_det'])) {
|
|
$features = substr($features, 0, -4);
|
|
} elseif ($features == 'commandefournisseurdispatch') {
|
|
$features = 'commandefournisseur';
|
|
} elseif ($features == 'invoice_supplier_det_rec') {
|
|
$features = 'invoice_supplier_rec';
|
|
}
|
|
if ($features == 'evaluation') {
|
|
$features = 'hrm';
|
|
$feature2 = 'evaluation';
|
|
}
|
|
|
|
// When the object is a task (element='project_task') and $feature2 is empty,
|
|
// $checkUserAccessToObject() falls into the $checkproject path and uses the task ID
|
|
// as project ID, which always fails. Setting $feature2='project_task' triggers the
|
|
// normalization at line 974 that redirects to the $checktask path, which correctly
|
|
// resolves $task->fk_project before calling getProjectsAuthorizedForUser().
|
|
if (is_object($object) && in_array($object->element, array('project_task', 'task'))
|
|
&& (empty($features) || in_array($features, array('projet', 'project')))
|
|
&& empty($feature2)) {
|
|
$features = 'projet';
|
|
$feature2 = 'project_task';
|
|
if (empty($tableandshare)) {
|
|
$tableandshare = 'projet_task';
|
|
}
|
|
}
|
|
|
|
// print $features.' - '.$tableandshare.' - '.$feature2.' - '.$dbt_select."\n";
|
|
|
|
// Get more permissions checks from hooks
|
|
$parameters = array(
|
|
'features' => $features,
|
|
'feature2' => $feature2,
|
|
'originalfeatures' => $originalfeatures,
|
|
'tableandshare' => $tableandshare,
|
|
'object' => $object,
|
|
'objectid' => $objectid,
|
|
'dbt_keyfield' => $dbt_keyfield,
|
|
'dbt_select' => $dbt_select,
|
|
'idtype' => $dbt_select,
|
|
'isdraft' => $isdraft,
|
|
'mode' => $mode,
|
|
);
|
|
if (!empty($hookmanager)) {
|
|
$reshook = $hookmanager->executeHooks('restrictedArea', $parameters);
|
|
|
|
if (isset($hookmanager->resArray['result'])) {
|
|
if ($hookmanager->resArray['result'] == 0) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden(); // Module returns 0, so access forbidden
|
|
}
|
|
}
|
|
}
|
|
if ($reshook > 0) { // No other test done.
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
// Features/modules to check (to support the & and | operator)
|
|
$featuresarray = array($features);
|
|
if (preg_match('/&/', $features)) {
|
|
$featuresarray = explode("&", $features);
|
|
} elseif (preg_match('/\|/', $features)) {
|
|
$featuresarray = explode("|", $features);
|
|
}
|
|
|
|
// More subfeatures to check
|
|
if (!empty($feature2)) {
|
|
$feature2 = explode("|", $feature2);
|
|
}
|
|
|
|
$listofmodules = explode(',', getDolGlobalString('MAIN_MODULES_FOR_EXTERNAL'));
|
|
|
|
// Check read permission from module
|
|
$readok = 1;
|
|
$nbko = 0;
|
|
foreach ($featuresarray as $feature) { // first we check nb of test ko
|
|
$featureforlistofmodule = $feature;
|
|
if ($featureforlistofmodule == 'produit') {
|
|
$featureforlistofmodule = 'product';
|
|
}
|
|
if ($featureforlistofmodule == 'supplier_proposal') {
|
|
$featureforlistofmodule = 'supplierproposal';
|
|
}
|
|
if (!empty($user->socid) && getDolGlobalString('MAIN_MODULES_FOR_EXTERNAL') && !in_array($featureforlistofmodule, $listofmodules)) { // If limits on modules for external users, module must be into list of modules for external users
|
|
$readok = 0;
|
|
$nbko++;
|
|
continue;
|
|
}
|
|
|
|
if ($feature == 'societe' && (empty($feature2) || !in_array('contact', $feature2))) {
|
|
if (!$user->hasRight('societe', 'lire') && !$user->hasRight('fournisseur', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif (($feature == 'societe' && (!empty($feature2) && in_array('contact', $feature2))) || $feature == 'contact') {
|
|
if (!$user->hasRight('societe', 'contact', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'produit|service') {
|
|
if (!$user->hasRight('produit', 'lire') && !$user->hasRight('service', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'prelevement') {
|
|
if (!$user->hasRight('prelevement', 'bons', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'cheque') {
|
|
if (!$user->hasRight('banque', 'cheque')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'projet') {
|
|
if (!$user->hasRight('projet', 'lire') && !$user->hasRight('projet', 'all', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'payment') {
|
|
if (!$user->hasRight('facture', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'payment_supplier') {
|
|
if (!$user->hasRight('fournisseur', 'facture', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'payment_sc') {
|
|
if (!$user->hasRight('tax', 'charges', 'lire')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'webhook') {
|
|
if (empty($user->admin)) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif (!empty($feature2)) { // This is for permissions on 2 levels (module->object->read)
|
|
$tmpreadok = 1;
|
|
foreach ($feature2 as $subfeature) {
|
|
if ($subfeature == 'user' && $user->id == $objectid) {
|
|
continue; // A user can always read its own card
|
|
}
|
|
if ($subfeature == 'fiscalyear' && $user->hasRight('accounting', 'fiscalyear', 'write')) {
|
|
// only one right for fiscalyear
|
|
$tmpreadok = 1;
|
|
continue;
|
|
}
|
|
if (!empty($subfeature) && !$user->hasRight($feature, $subfeature, 'lire') && !$user->hasRight($feature, $subfeature, 'read')) {
|
|
$tmpreadok = 0;
|
|
} elseif (empty($subfeature) && !$user->hasRight($feature, 'lire') && !$user->hasRight($feature, 'read')) {
|
|
$tmpreadok = 0;
|
|
} else {
|
|
$tmpreadok = 1;
|
|
break;
|
|
} // Break is to bypass second test if the first is ok
|
|
}
|
|
if (!$tmpreadok) { // We found a test on feature that is ko
|
|
$readok = 0; // All tests are ko (we manage here the and, the or will be managed later using $nbko).
|
|
$nbko++;
|
|
}
|
|
} elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level (module->read)
|
|
if (!$user->hasRight($feature, 'lire')
|
|
&& !$user->hasRight($feature, 'read')
|
|
&& !$user->hasRight($feature, 'run')) {
|
|
$readok = 0;
|
|
$nbko++;
|
|
}
|
|
}
|
|
}
|
|
|
|
// If a or and at least one ok
|
|
if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
|
|
$readok = 1;
|
|
}
|
|
|
|
if (!$readok) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden();
|
|
}
|
|
}
|
|
//print "Read access is ok";
|
|
|
|
// Check write permission from module (we need to know write permission to create but also to delete drafts record or to upload files)
|
|
$createok = 1;
|
|
$nbko = 0;
|
|
$wemustcheckpermissionforcreate = (GETPOST('sendit', 'alpha') || GETPOST('linkit', 'alpha') || in_array(GETPOST('action', 'aZ09'), array('create', 'update', 'set', 'upload', 'add_element_resource', 'confirm_deletebank', 'confirm_delete_linked_resource')) || GETPOST('roworder', 'alpha', 2));
|
|
$wemustcheckpermissionfordeletedraft = ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete');
|
|
|
|
if ($wemustcheckpermissionforcreate || $wemustcheckpermissionfordeletedraft) {
|
|
foreach ($featuresarray as $feature) {
|
|
if ($feature == 'contact') {
|
|
if (!$user->hasRight('societe', 'contact', 'creer')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'produit|service') {
|
|
if (!$user->hasRight('produit', 'creer') && !$user->hasRight('service', 'creer')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'prelevement') {
|
|
if (!$user->hasRight('prelevement', 'bons', 'creer')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'commande_fournisseur') {
|
|
if (!$user->hasRight('fournisseur', 'commande', 'creer') || !$user->hasRight('supplier_order', 'creer')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'banque') {
|
|
if (!$user->hasRight('banque', 'modifier')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'cheque') {
|
|
if (!$user->hasRight('banque', 'cheque')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'import') {
|
|
if (!$user->hasRight('import', 'run')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'ecm') {
|
|
if (!$user->hasRight('ecm', 'upload')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'modulebuilder') {
|
|
if (!$user->hasRight('modulebuilder', 'run')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'payment') {
|
|
if (!$user->hasRight('facture', 'paiement')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif ($feature == 'webhook') {
|
|
if (empty($user->admin)) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
} elseif (!empty($feature2)) { // This is for permissions on 2 levels (module->object->write)
|
|
foreach ($feature2 as $subfeature) {
|
|
if ($subfeature == 'user' && $user->id == $objectid && $user->hasRight('user', 'self', 'creer')) {
|
|
continue; // User can edit its own card
|
|
}
|
|
if ($subfeature == 'user' && $user->id == $objectid && $user->hasRight('user', 'self', 'password')) {
|
|
continue; // User can edit its own password
|
|
}
|
|
if ($subfeature == 'user' && $user->id != $objectid && $user->hasRight('user', 'user', 'password')) {
|
|
continue; // User can edit another user's password
|
|
}
|
|
|
|
if (!$user->hasRight($feature, $subfeature, 'creer')
|
|
&& !$user->hasRight($feature, $subfeature, 'write')
|
|
&& !$user->hasRight($feature, $subfeature, 'create')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
} else {
|
|
$createok = 1;
|
|
// Break to bypass second test if the first is ok
|
|
break;
|
|
}
|
|
}
|
|
} elseif (!empty($feature)) { // This is for permissions on 1 levels (module->write)
|
|
//print '<br>feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write; exit;
|
|
if (!$user->hasRight($feature, 'creer')
|
|
&& !$user->hasRight($feature, 'write')
|
|
&& !$user->hasRight($feature, 'create')) {
|
|
$createok = 0;
|
|
$nbko++;
|
|
}
|
|
}
|
|
}
|
|
|
|
// If a or and at least one ok
|
|
if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
|
|
$createok = 1;
|
|
}
|
|
|
|
if ($wemustcheckpermissionforcreate && !$createok) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden();
|
|
}
|
|
}
|
|
//print "Write access is ok";
|
|
}
|
|
|
|
// Check create user permission
|
|
$createuserok = 1;
|
|
if (GETPOST('action', 'aZ09') == 'confirm_create_user' && GETPOST("confirm", 'aZ09') == 'yes') {
|
|
if (!$user->hasRight('user', 'user', 'creer')) {
|
|
$createuserok = 0;
|
|
}
|
|
|
|
if (!$createuserok) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden();
|
|
}
|
|
}
|
|
//print "Create user access is ok";
|
|
}
|
|
|
|
// Check delete permission from module
|
|
$deleteok = 1;
|
|
$nbko = 0;
|
|
if ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete') {
|
|
foreach ($featuresarray as $feature) {
|
|
if ($feature == 'bookmark') {
|
|
if (!$user->hasRight('bookmark', 'supprimer')) {
|
|
if ($user->id != $object->fk_user || !$user->hasRight('bookmark', 'creer')) {
|
|
$deleteok = 0;
|
|
}
|
|
}
|
|
} elseif ($feature == 'contact') {
|
|
if (!$user->hasRight('societe', 'contact', 'supprimer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'produit|service') {
|
|
if (!$user->hasRight('produit', 'supprimer') && !$user->hasRight('service', 'supprimer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'commande_fournisseur') {
|
|
if (!$user->hasRight('fournisseur', 'commande', 'supprimer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'payment_supplier') { // Permission to delete a payment of an invoice is permission to edit an invoice.
|
|
if (!$user->hasRight('fournisseur', 'facture', 'creer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'payment') {
|
|
if (!$user->hasRight('facture', 'paiement')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'payment_sc') {
|
|
if (!$user->hasRight('tax', 'charges', 'creer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'banque') {
|
|
if (!$user->hasRight('banque', 'modifier')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'cheque') {
|
|
if (!$user->hasRight('banque', 'cheque')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'ecm') {
|
|
if (!$user->hasRight('ecm', 'upload')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'ftp') {
|
|
if (!$user->hasRight('ftp', 'write')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'salaries') {
|
|
if (!$user->hasRight('salaries', 'delete')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'adherent') {
|
|
if (!$user->hasRight('adherent', 'supprimer')) {
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'paymentbybanktransfer') {
|
|
if (!$user->hasRight('paymentbybanktransfer', 'create')) { // There is no delete permission
|
|
$deleteok = 0;
|
|
}
|
|
} elseif ($feature == 'prelevement') {
|
|
if (!$user->hasRight('prelevement', 'bons', 'creer')) { // There is no delete permission
|
|
$deleteok = 0;
|
|
}
|
|
} elseif (!empty($feature2)) { // This is for permissions on 2 levels
|
|
foreach ($feature2 as $subfeature) {
|
|
if (!$user->hasRight($feature, $subfeature, 'supprimer') && !$user->hasRight($feature, $subfeature, 'delete')) {
|
|
$deleteok = 0;
|
|
} else {
|
|
$deleteok = 1;
|
|
break;
|
|
} // For bypass the second test if the first is ok
|
|
}
|
|
} elseif (!empty($feature)) { // This is used for permissions on 1 level
|
|
//print '<br>feature='.$feature.' creer='.$user->rights->$feature->supprimer.' write='.$user->rights->$feature->delete;
|
|
if (!$user->hasRight($feature, 'supprimer')
|
|
&& !$user->hasRight($feature, 'delete')
|
|
&& !$user->hasRight($feature, 'run')) {
|
|
$deleteok = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
// If a or and at least one ok
|
|
if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
|
|
$deleteok = 1;
|
|
}
|
|
|
|
if (!$deleteok && !($isdraft && $createok)) {
|
|
if ($mode) {
|
|
return 0;
|
|
} else {
|
|
accessforbidden();
|
|
}
|
|
}
|
|
//print "Delete access is ok";
|
|
}
|
|
|
|
// If we have a particular object to check permissions on, we check if $user has permission
|
|
// for this given object (link to company, is contact for project, ...)
|
|
if (!empty($objectid) && $objectid > 0) {
|
|
$ok = checkUserAccessToObject($user, $featuresarray, $object, $tableandshare, $feature2, $dbt_keyfield, $dbt_select, $parentfortableentity);
|
|
$params = array('objectid' => $objectid, 'features' => implode(',', $featuresarray), 'features2' => $feature2);
|
|
//print 'checkUserAccessToObject ok='.$ok;
|
|
if ($mode) {
|
|
return $ok ? 1 : 0;
|
|
} else {
|
|
if ($ok) {
|
|
return 1;
|
|
} else {
|
|
accessforbidden('', 1, 1, 0, $params);
|
|
}
|
|
}
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
/**
|
|
* Check that access by a given user to an object is ok.
|
|
* This function is also called by restrictedArea() that check before if module is enabled and if permission of user for $action is ok.
|
|
*
|
|
* @param User $user User to check
|
|
* @param string[] $featuresarray Features/modules to check. Example: ('user','service','member','project','task',...)
|
|
* @param int|string|Object $object Object (recommended) or Object ID or list of Object id. For example if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
|
|
* @param string $tableandshare 'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity for multicompany modume. Param not used if objectid is null (optional).
|
|
* @param string[]|string $feature2 Feature to check, second level of permission (optional). Can be or check with 'level1|level2'.
|
|
* @param string $dbt_keyfield Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA.
|
|
* @param string $dbt_select Field name for select if not rowid. Not used if objectid is null (optional).
|
|
* @param string $parenttableforentity Parent table for entity. Example 'fk_website@website'
|
|
* @return bool True if user has access, False otherwise
|
|
* @see restrictedArea()
|
|
*/
|
|
function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = '', $dbt_select = 'rowid', $parenttableforentity = '')
|
|
{
|
|
global $db, $conf;
|
|
|
|
if (is_object($object)) {
|
|
$objectid = $object->id;
|
|
} else {
|
|
$objectid = $object; // $objectid can be X or 'X,Y,Z'
|
|
}
|
|
$objectid = preg_replace('/[^0-9\.\,]/', '', (string) $objectid); // For the case value is coming from a non sanitized user input
|
|
|
|
//dol_syslog("functions.lib:restrictedArea $feature, $object, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
|
|
//print "user_id=".$user->id.", features=".join(',', $featuresarray).", object=".$object;
|
|
//print ", tableandshare=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select."<br>";
|
|
|
|
// More parameters
|
|
$params = explode('&', $tableandshare);
|
|
$dbtablename = (!empty($params[0]) ? $params[0] : '');
|
|
$sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename);
|
|
|
|
foreach ($featuresarray as $feature) {
|
|
$sql = '';
|
|
|
|
//var_dump($feature);exit;
|
|
|
|
// For backward compatibility
|
|
if ($feature == 'societe' && !empty($feature2) && is_array($feature2) && in_array('contact', $feature2)) {
|
|
$feature = 'contact';
|
|
$feature2 = '';
|
|
}
|
|
if ($feature == 'member') {
|
|
$feature = 'adherent';
|
|
}
|
|
if ($feature == 'category') {
|
|
$feature = 'categorie';
|
|
}
|
|
if ($feature == 'project') {
|
|
$feature = 'projet';
|
|
}
|
|
if ($feature == 'projet' && !empty($feature2) && is_array($feature2) && !empty(array_intersect(array('project_task', 'projet_task'), $feature2))) {
|
|
$feature = 'project_task';
|
|
}
|
|
if ($feature == 'task' || $feature == 'projet_task') {
|
|
$feature = 'project_task';
|
|
$dbtablename = 'projet_task';
|
|
}
|
|
if ($feature == 'eventorganization') {
|
|
$feature = 'agenda';
|
|
$dbtablename = 'actioncomm';
|
|
}
|
|
if ($feature == 'payment_sc' && empty($parenttableforentity)) {
|
|
// If we check perm on payment page but $parenttableforentity not defined, we force value on parent table
|
|
$parenttableforentity = '';
|
|
$dbtablename = "chargesociales";
|
|
$feature = "chargesociales";
|
|
$objectid = (string) $object->fk_charge;
|
|
}
|
|
|
|
$checkonentitydone = 0;
|
|
|
|
// Array to define rules of checks to do
|
|
$check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'payment_sc', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salaries', 'website', 'recruitment', 'chargesociales', 'knowledgemanagement', 'stock'); // Test on entity only (Objects with no link to company)
|
|
$checksoc = array('societe'); // Test for object Societe
|
|
$checkparentsoc = array('agenda', 'contact', 'contrat'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...).
|
|
$checkproject = array('projet', 'project'); // Test for project object
|
|
$checktask = array('projet_task', 'project_task'); // Test for task object
|
|
$checkhierarchy = array('expensereport', 'holiday', 'hrm'); // check permission among the hierarchy of user
|
|
$checkuser = array('bookmark'); // check permission among the fk_user (must be myself or null)
|
|
$nocheck = array('barcode', 'webhook'); // No test
|
|
|
|
//$checkdefault = 'all other not already defined'; // Test on entity + link to third party on field $dbt_keyfield. Not allowed if link is empty (Ex: invoice, orders...).
|
|
|
|
// If dbtablename not defined, we use same name for table than module name
|
|
if (empty($dbtablename)) {
|
|
$dbtablename = $feature;
|
|
$sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename); // We change dbtablename, so we set sharedelement too.
|
|
}
|
|
|
|
// The default rule reads the columns entity and $dbt_keyfield of the table, but some tables own neither of
|
|
// them. The sql was then built on columns that do not exist, so it always failed and the access was refused
|
|
// to the users that this rule applies to.
|
|
// The rule is selected on the table and not on the element of the object, because $object is an id and not
|
|
// an object for most of the callers, the card of an asset and the card of a workstation included.
|
|
if (!empty($objectid) && in_array($dbtablename, array('asset', 'paiement', 'paiementfourn', 'workstation_workstation', 'hrm_job', 'hrm_job_user', 'hrm_skill'))) {
|
|
// None of these objects is linked to a third party, so an external user can own none of them. The
|
|
// default rule refused him through a link that does not exist, we must refuse him explicitly instead,
|
|
// otherwise the rules below, which do not look at the third party of the user at all, would grant it.
|
|
if (!empty($user->socid)) {
|
|
return false;
|
|
}
|
|
if (in_array($dbtablename, array('hrm_job', 'hrm_job_user', 'hrm_skill'))) {
|
|
// These 3 tables have no entity column either, so no rule that reads the table can be run on them.
|
|
// The permission is still checked by restrictedArea(), and the $checkhierarchy rule below still runs.
|
|
// Note that these 3 objects are therefore not partitioned between entities at all, in the database
|
|
// itself: their cards already answer to a user of another entity, and their lists already show the
|
|
// records of all of them. This rule does not widen that, it aligns with it.
|
|
$nocheck[] = $feature;
|
|
} else {
|
|
$check[] = $feature; // Test on the entity only, there is no third party to restrict on
|
|
}
|
|
}
|
|
|
|
// $objectid was already sanitized at begin of this method (can be an int or a list of int separated by comma).
|
|
// To avoid an access forbidden with a numeric ref
|
|
if ($dbt_select != 'rowid' && $dbt_select != 'id') {
|
|
$objectid = "'".$objectid."'";
|
|
}
|
|
|
|
// Check permission for objectid on entity only
|
|
if (in_array($feature, $check) && !empty($objectid)) { // For $objectid = 0, no check
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$db->sanitize($dbtablename)." as dbt";
|
|
if (($feature == 'user' || $feature == 'usergroup') && isModEnabled('multicompany')) { // Special for multicompany
|
|
if (getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE')) {
|
|
if ($conf->entity == 1 && $user->admin && !$user->entity) {
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IS NOT NULL";
|
|
} else {
|
|
$sql .= ",".MAIN_DB_PREFIX."usergroup_user as ug";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND ((ug.fk_user = dbt.rowid";
|
|
$sql .= " AND ug.entity IN (".getEntity('usergroup')."))";
|
|
$sql .= " OR dbt.entity = 0)"; // Show always superadmin
|
|
}
|
|
} else {
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
} else {
|
|
$reg = array();
|
|
if ($parenttableforentity && preg_match('/(.*)@(.*)/', $parenttableforentity, $reg)) {
|
|
$sql .= ", ".MAIN_DB_PREFIX.$db->sanitize($reg[2])." as dbtp";
|
|
$sql .= " WHERE dbt.".$db->sanitize($reg[1])." = dbtp.rowid AND dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbtp.entity IN (".getEntity($sharedelement, 1).")";
|
|
} else {
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
}
|
|
$checkonentitydone = 1;
|
|
}
|
|
if (in_array($feature, $checksoc) && !empty($objectid)) { // We check feature = checksoc. For $objectid = 0, no check
|
|
// If external user: Check permission for external users
|
|
if ($user->socid > 0) {
|
|
if ((string) $user->socid != $objectid) {
|
|
return false;
|
|
}
|
|
} elseif (isModEnabled('societe') && !$user->hasRight('societe', 'lire') && !$user->hasRight('societe', 'client', 'voir')) {
|
|
dol_syslog("security.lib.php::checkUserAccessToObject Deny access due: (isModEnabled('societe') && !user->hasRight('societe', 'lire') && !user->hasRight('societe', 'client', 'voir'))", LOG_DEBUG);
|
|
return false;
|
|
} elseif (isModEnabled("societe") && ($user->hasRight('societe', 'lire') && !$user->hasRight('societe', 'client', 'voir'))) {
|
|
// If internal user: Check permission for internal users that are restricted on their objects
|
|
$sql = "SELECT COUNT(sc.fk_soc) as nb";
|
|
$sql .= " FROM (".MAIN_DB_PREFIX."societe_commerciaux as sc";
|
|
$sql .= ", ".MAIN_DB_PREFIX."societe as s)";
|
|
$sql .= " WHERE sc.fk_soc IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND (sc.fk_user = ".((int) $user->id);
|
|
if (getDolGlobalInt('MAIN_SEE_SUBORDINATES')) {
|
|
$userschilds = $user->getAllChildIds();
|
|
if (!empty($userschilds)) $sql .= " OR sc.fk_user IN (".$db->sanitize(implode(',', $userschilds)).")";
|
|
}
|
|
$sql .= ")";
|
|
$sql .= " AND sc.fk_soc = s.rowid";
|
|
$sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
|
|
} elseif (isModEnabled('multicompany')) {
|
|
// If multicompany and internal users with all permissions, check user is in correct entity
|
|
$sql = "SELECT COUNT(s.rowid) as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
|
|
$sql .= " WHERE s.rowid IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
|
|
$checkonentitydone = 1;
|
|
}
|
|
if (in_array($feature, $checkparentsoc) && !empty($objectid)) { // Test on entity + link to thirdparty. Allowed if link is empty (Ex: contacts...).
|
|
// If external user: Check permission for external users
|
|
if ($user->socid > 0) {
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.fk_soc = ".((int) $user->socid);
|
|
} elseif (isModEnabled("societe") && ($user->hasRight('societe', 'lire') && !$user->hasRight('societe', 'client', 'voir'))) {
|
|
// If internal user: Check permission for internal users that are restricted on their objects
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
} elseif (isModEnabled('multicompany')) {
|
|
// If multicompany and internal users with all permissions, check user is in correct entity
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
|
|
$checkonentitydone = 1;
|
|
}
|
|
if (in_array($feature, $checkproject) && !empty($objectid)) {
|
|
if (isModEnabled('project') && !$user->hasRight('projet', 'all', 'lire')) {
|
|
$projectid = $objectid; // Note that if $objectid is a string list of id; the test later will return false
|
|
|
|
include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
|
|
$projectstatic = new Project($db);
|
|
$tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);
|
|
|
|
$tmparray = explode(',', $tmps);
|
|
if (!in_array($projectid, $tmparray)) {
|
|
return false;
|
|
}
|
|
} else {
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
$checkonentitydone = 1;
|
|
}
|
|
if (in_array($feature, $checktask) && !empty($objectid)) {
|
|
if (isModEnabled('project') && !$user->hasRight('projet', 'all', 'lire')) {
|
|
if (preg_match('/,/', $objectid)) { // if this is a list of id
|
|
return false;
|
|
}
|
|
$task = new Task($db);
|
|
$task->fetch((int) $objectid);
|
|
$projectid = $task->fk_project;
|
|
|
|
include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
|
|
$projectstatic = new Project($db);
|
|
$tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);
|
|
|
|
$tmparray = explode(',', $tmps);
|
|
if (!in_array($projectid, $tmparray)) {
|
|
return false;
|
|
}
|
|
} else {
|
|
$sharedelement = 'project'; // for multicompany compatibility
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
|
|
$checkonentitydone = 1;
|
|
}
|
|
//var_dump($sql);
|
|
|
|
if (!$checkonentitydone && !in_array($feature, $nocheck) && !empty($objectid)) { // By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield
|
|
// If external user: Check permission for external users
|
|
if ($user->socid > 0) {
|
|
if (empty($dbt_keyfield)) {
|
|
dol_print_error(null, 'Param dbt_keyfield is required but not defined');
|
|
}
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_keyfield).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " WHERE dbt.rowid IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.".$db->sanitize($dbt_keyfield)." = ".((int) $user->socid);
|
|
} elseif (isModEnabled("societe") && !$user->hasRight('societe', 'client', 'voir')) {
|
|
// If internal user without permission to see all thirdparties: Check permission for internal users that are restricted on their objects
|
|
if (empty($dbt_keyfield)) {
|
|
dol_print_error(null, 'Param dbt_keyfield is required but not defined');
|
|
}
|
|
if ($feature != 'ticket') {
|
|
$sql = "SELECT COUNT(sc.fk_soc) as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$db->sanitize($dbtablename)." as dbt";
|
|
$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
$sql .= " AND sc.fk_soc = dbt.".$db->sanitize($dbt_keyfield);
|
|
$sql .= " AND (sc.fk_user = ".((int) $user->id);
|
|
if (getDolGlobalInt('MAIN_SEE_SUBORDINATES')) {
|
|
$userschilds = $user->getAllChildIds();
|
|
if (!empty($userschilds)) $sql .= " OR sc.fk_user IN (".$db->sanitize(implode(',', $userschilds)).")";
|
|
}
|
|
$sql .= ')';
|
|
} else {
|
|
// On ticket, the thirdparty is not mandatory, so we need a special test to accept record with no thirdparties.
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
|
|
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = dbt.".$db->sanitize($dbt_keyfield)." AND sc.fk_user = ".((int) $user->id);
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
$sql .= " AND (sc.fk_user = ".((int) $user->id)." OR dbt.".$dbt_keyfield." IS NULL OR dbt.".$dbt_keyfield." = 0)";
|
|
}
|
|
} elseif (isModEnabled('multicompany') && (!empty($object->ismultientitymanaged) || !isset($object->ismultientitymanaged))) {
|
|
// If multicompany, and user is an internal user with all permissions, check that object is in correct entity
|
|
$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
|
|
$sql .= " FROM ".MAIN_DB_PREFIX.$db->sanitize($dbtablename)." as dbt";
|
|
$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
|
|
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
|
|
}
|
|
}
|
|
|
|
// For events, check on users assigned to event
|
|
if ($feature === 'agenda' && !empty($objectid)) {
|
|
// Also check owner or attendee for users without allactions->read
|
|
if (!$user->hasRight('agenda', 'allactions', 'read')) {
|
|
if (preg_match('/,/', $objectid)) { // if this is a list of id
|
|
return false;
|
|
}
|
|
|
|
require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
|
|
$action = new ActionComm($db);
|
|
$action->fetch((int) $objectid);
|
|
if ($action->authorid != $user->id && $action->userownerid != $user->id && !(array_key_exists($user->id, $action->userassigned))) {
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
|
|
// For some object, we also have to check it is in the user hierarchy
|
|
// Param $object must be the full object and not a simple id to have this test possible.
|
|
if (in_array($feature, $checkhierarchy) && is_object($object) && !empty($objectid)) {
|
|
$childids = $user->getAllChildIds(1);
|
|
$useridtocheck = 0;
|
|
if ($feature == 'holiday') {
|
|
$useridtocheck = $object->fk_user;
|
|
if (!$user->hasRight('holiday', 'readall') && !in_array($useridtocheck, $childids) && !in_array($object->fk_validator, $childids)) {
|
|
return false;
|
|
}
|
|
}
|
|
if ($feature == 'expensereport') {
|
|
$useridtocheck = $object->fk_user_author;
|
|
if (!$user->hasRight('expensereport', 'readall')) {
|
|
if (!in_array($useridtocheck, $childids)) {
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
if ($feature == 'hrm' && in_array('evaluation', $feature2)) {
|
|
$useridtocheck = $object->fk_user;
|
|
|
|
if ($user->hasRight('hrm', 'evaluation', 'readall')) {
|
|
// the user can view evaluations for anyone
|
|
return true;
|
|
}
|
|
if (!$user->hasRight('hrm', 'evaluation', 'read')) {
|
|
// the user can't view any evaluations
|
|
return false;
|
|
}
|
|
// the user can only see their own evaluations or their subordinates'
|
|
return in_array($useridtocheck, $childids);
|
|
}
|
|
}
|
|
|
|
// For some object, we also have to check it is public or owned by user
|
|
// Param $object must be the full object and not a simple id to have this test possible.
|
|
if (in_array($feature, $checkuser) && is_object($object) && !empty($objectid)) {
|
|
$useridtocheck = $object->fk_user;
|
|
if (!empty($useridtocheck) && $useridtocheck > 0 && $useridtocheck != $user->id && empty($user->admin)) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if ($sql) {
|
|
$resql = $db->query($sql);
|
|
if ($resql) {
|
|
$obj = $db->fetch_object($resql);
|
|
if (!$obj || $obj->nb < count(explode(',', $objectid))) { // error if we found 0 or less record than the nb of ids provided
|
|
return false;
|
|
}
|
|
} else {
|
|
dol_syslog("Bad forged sql in security.lib.php::checkUserAccessToObject", LOG_WARNING);
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
|
|
dol_syslog("security.lib.php::checkUserAccessToObject::return True", LOG_DEBUG);
|
|
return true;
|
|
}
|
|
|
|
|
|
/**
|
|
* Show a message to say access is forbidden and stop program.
|
|
* This includes only HTTP header.
|
|
* Calling this function terminate execution of PHP.
|
|
*
|
|
* @param string $message Force error message
|
|
* @param int $http_response_code HTTP response code (403 for forbidden access, 400 bad parameters or request)
|
|
* @param int<0,1> $stringalreadysanitized 1 if string is already sanitized with HTML entities
|
|
* @return never
|
|
* @see accessforbidden()
|
|
*/
|
|
function httponly_accessforbidden($message = '1', $http_response_code = 403, $stringalreadysanitized = 0)
|
|
{
|
|
top_httphead();
|
|
http_response_code($http_response_code);
|
|
|
|
if ($stringalreadysanitized) {
|
|
print $message;
|
|
} else {
|
|
print htmlentities($message);
|
|
}
|
|
|
|
exit(1);
|
|
}
|
|
|
|
/**
|
|
* Show a message to say access is forbidden and stop program.
|
|
* This includes HTTP and HTML header and footer (except if $printheader and $printfooter is 0, use this case inside an already started page).
|
|
* Calling this function terminate execution of PHP.
|
|
*
|
|
* @param string $message Force error message
|
|
* @param int<0,1> $printheader Show header before
|
|
* @param int<0,1> $printfooter Show footer after
|
|
* @param int<0,1> $showonlymessage Show only message parameter. Otherwise add more information.
|
|
* @param ?array<string,mixed> $params More parameters provided to hook
|
|
* @return never
|
|
* @see httponly_accessforbidden()
|
|
*/
|
|
function accessforbidden($message = '', $printheader = 1, $printfooter = 1, $showonlymessage = 0, $params = null)
|
|
{
|
|
global $conf, $db, $user, $langs, $hookmanager;
|
|
global $action, $object;
|
|
|
|
if (!is_object($langs)) {
|
|
include_once DOL_DOCUMENT_ROOT.'/core/class/translate.class.php';
|
|
$langs = new Translate('', $conf);
|
|
$langs->setDefaultLang();
|
|
}
|
|
|
|
$langs->loadLangs(array("main", "errors"));
|
|
|
|
if ($printheader && !defined('NOHEADERNOFOOTER')) {
|
|
if (function_exists("llxHeader")) {
|
|
llxHeader('');
|
|
} elseif (function_exists("llxHeaderVierge")) {
|
|
llxHeaderVierge('');
|
|
}
|
|
print '<div style="padding: 20px">';
|
|
}
|
|
print '<div class="error">';
|
|
if (empty($message)) {
|
|
print $langs->trans("ErrorForbidden");
|
|
} else {
|
|
print $langs->trans($message);
|
|
}
|
|
print '</div>';
|
|
print '<br>';
|
|
if (empty($showonlymessage)) {
|
|
if (empty($hookmanager)) {
|
|
include_once DOL_DOCUMENT_ROOT.'/core/class/hookmanager.class.php';
|
|
$hookmanager = new HookManager($db);
|
|
// Initialize a technical object to manage hooks of page. Note that conf->hooks_modules contains an array of hook context
|
|
$hookmanager->initHooks(array('main'));
|
|
}
|
|
|
|
$parameters = array('message' => $message, 'params' => $params);
|
|
$reshook = $hookmanager->executeHooks('getAccessForbiddenMessage', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
|
|
print $hookmanager->resPrint;
|
|
if (empty($reshook)) {
|
|
$langs->loadLangs(array("errors"));
|
|
if ($user->login) {
|
|
print $langs->trans("CurrentLogin").': <span class="error">'.$user->login.'</span><br>';
|
|
print $langs->trans("ErrorForbidden2", $langs->transnoentitiesnoconv("Home"), $langs->transnoentitiesnoconv("Users"));
|
|
print $langs->trans("ErrorForbidden4");
|
|
} else {
|
|
print $langs->trans("ErrorForbidden3");
|
|
}
|
|
}
|
|
}
|
|
if ($printfooter && !defined('NOHEADERNOFOOTER') && function_exists("llxFooter")) {
|
|
print '</div>';
|
|
llxFooter();
|
|
}
|
|
|
|
// End PHP
|
|
exit(0);
|
|
}
|
|
|
|
|
|
/**
|
|
* Return the max allowed for file upload.
|
|
* Analyze among: upload_max_filesize, post_max_size, MAIN_UPLOAD_DOC
|
|
*
|
|
* @return array{max:string,maxmin:mixed,maxphptoshow:int|string,maxphptoshowparam:''|'post_max_size'|'upload_max_filesize'} Array with all max sizes for file upload
|
|
*/
|
|
function getMaxFileSizeArray()
|
|
{
|
|
$max = getDolGlobalString('MAIN_UPLOAD_DOC'); // In Kb
|
|
|
|
$maxphp = @ini_get('upload_max_filesize'); // In unknown
|
|
if (preg_match('/k$/i', $maxphp)) {
|
|
$maxphp = preg_replace('/k$/i', '', $maxphp);
|
|
$maxphp = (int) ((float) $maxphp * 1);
|
|
}
|
|
if (preg_match('/m$/i', $maxphp)) {
|
|
$maxphp = preg_replace('/m$/i', '', $maxphp);
|
|
$maxphp = (int) ((float) $maxphp * 1024);
|
|
}
|
|
if (preg_match('/g$/i', $maxphp)) {
|
|
$maxphp = preg_replace('/g$/i', '', $maxphp);
|
|
$maxphp = (int) ((float) $maxphp * 1024 * 1024);
|
|
}
|
|
if (preg_match('/t$/i', $maxphp)) {
|
|
$maxphp = preg_replace('/t$/i', '', $maxphp);
|
|
$maxphp = (int) ((float) $maxphp * 1024 * 1024 * 1024);
|
|
}
|
|
$maxphp2 = @ini_get('post_max_size'); // In unknown
|
|
if (preg_match('/k$/i', $maxphp2)) {
|
|
$maxphp2 = preg_replace('/k$/i', '', $maxphp2);
|
|
$maxphp2 = (int) ((float) $maxphp2) * 1;
|
|
}
|
|
if (preg_match('/m$/i', $maxphp2)) {
|
|
$maxphp2 = preg_replace('/m$/i', '', $maxphp2);
|
|
$maxphp2 = (int) ((float) $maxphp2 * 1024);
|
|
}
|
|
if (preg_match('/g$/i', $maxphp2)) {
|
|
$maxphp2 = preg_replace('/g$/i', '', $maxphp2);
|
|
$maxphp2 = (int) ((float) $maxphp2 * 1024 * 1024);
|
|
}
|
|
if (preg_match('/t$/i', $maxphp2)) {
|
|
$maxphp2 = preg_replace('/t$/i', '', $maxphp2);
|
|
$maxphp2 = (int) ((float) $maxphp2 * 1024 * 1024 * 1024);
|
|
}
|
|
// Now $max and $maxphp and $maxphp2 are in Kb
|
|
$maxmin = $max;
|
|
$maxphptoshow = $maxphptoshowparam = '';
|
|
if ($maxphp > 0) {
|
|
$maxmin = min($maxmin, $maxphp);
|
|
$maxphptoshow = $maxphp;
|
|
$maxphptoshowparam = 'upload_max_filesize';
|
|
}
|
|
if ($maxphp2 > 0) {
|
|
$maxmin = min($maxmin, $maxphp2);
|
|
if ($maxphp2 < $maxphp) {
|
|
$maxphptoshow = $maxphp2;
|
|
$maxphptoshowparam = 'post_max_size';
|
|
}
|
|
}
|
|
//var_dump($maxphp.'-'.$maxphp2);
|
|
//var_dump($maxmin);
|
|
|
|
return array('max' => $max, 'maxmin' => $maxmin, 'maxphptoshow' => $maxphptoshow, 'maxphptoshowparam' => $maxphptoshowparam);
|
|
}
|
|
|
|
/**
|
|
* Check if IP address is in CIDR range
|
|
*
|
|
* @param string $ip IP address to check (ex: 192.168.0.50, 2001:db8:3333:4444::5555:6666)
|
|
* @param string $cidr Network IP CIDR notation (ex: 192.168.0.0/24, 2001:db8:3333:4444::/64)
|
|
* @return int 1 if IP is in CIDR range, 0 if IP out of CIDR range, -1 if check error
|
|
*/
|
|
function checkIPInCidr($ip, $cidr)
|
|
{
|
|
list($network, $prefix) = explode('/', $cidr, 2);
|
|
|
|
// Convert IPs to binary format
|
|
$ip_bin = @inet_pton($ip);
|
|
$net_bin = @inet_pton($network);
|
|
if ($ip_bin === false || $net_bin === false) {
|
|
return -1;
|
|
}
|
|
|
|
// Require same address IPvX family
|
|
if (strlen($ip_bin) !== strlen($net_bin)) {
|
|
return -1;
|
|
}
|
|
|
|
// Comparison boundaries
|
|
$total_bits = strlen($ip_bin) * 8;
|
|
$prefix = max(0, min((int) $prefix, $total_bits));
|
|
$full_bytes = intdiv($prefix, 8);
|
|
$rem_bits = $prefix % 8;
|
|
|
|
// Compare full bytes and partial bytes
|
|
if ($full_bytes > 0) {
|
|
if (substr($ip_bin, 0, $full_bytes) !== substr($net_bin, 0, $full_bytes)) {
|
|
return 0;
|
|
}
|
|
}
|
|
if ($rem_bits > 0) {
|
|
$mask = (0xFF << (8 - $rem_bits)) & 0xFF;
|
|
$ip_byte = ord($ip_bin[$full_bytes]);
|
|
$net_byte = ord($net_bin[$full_bytes]);
|
|
if (($ip_byte & $mask) !== ($net_byte & $mask)) {
|
|
return 0;
|
|
}
|
|
}
|
|
return 1;
|
|
}
|