dolibarr 18.0.6
api.class.php
1<?php
2/* Copyright (C) 2015 Jean-François Ferry <jfefe@aternatik.fr>
3 * Copyright (C) 2016 Laurent Destailleur <eldy@users.sourceforge.net>
4 * Copyright (C) 2020 Frédéric France <frederic.france@netlogic.fr>
5 * Copyright (C) 2025 William Mead <william@m34d.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
19 */
20
21use Luracast\Restler\Restler;
22use Luracast\Restler\RestException;
23use Luracast\Restler\Defaults;
24use Luracast\Restler\Format\UploadFormat;
25
26require_once DOL_DOCUMENT_ROOT.'/user/class/user.class.php';
27
32{
33
37 protected $db;
38
42 public $r;
43
51 public function __construct($db, $cachedir = '', $refreshCache = false)
52 {
53 global $conf, $dolibarr_main_url_root;
54
55 if (empty($cachedir)) {
56 $cachedir = $conf->api->dir_temp;
57 }
58 Defaults::$cacheDirectory = $cachedir;
59
60 $this->db = $db;
61 $production_mode = (empty($conf->global->API_PRODUCTION_MODE) ? false : true);
62 $this->r = new Restler($production_mode, $refreshCache);
63
64 $urlwithouturlroot = preg_replace('/'.preg_quote(DOL_URL_ROOT, '/').'$/i', '', trim($dolibarr_main_url_root));
65 $urlwithroot = $urlwithouturlroot.DOL_URL_ROOT; // This is to use external domain name found into config file
66
67 $urlwithouturlrootautodetect = preg_replace('/'.preg_quote(DOL_URL_ROOT, '/').'$/i', '', trim(DOL_MAIN_URL_ROOT));
68 $urlwithrootautodetect = $urlwithouturlroot.DOL_URL_ROOT; // This is to use local domain autodetected by dolibarr from url
69
70 $this->r->setBaseUrls($urlwithouturlroot, $urlwithouturlrootautodetect);
71 $this->r->setAPIVersion(1);
72 //$this->r->setSupportedFormats('json');
73 //$this->r->setSupportedFormats('jsonFormat');
74 }
75
76 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
87 protected function _checkValForAPI($field, $value, $object)
88 {
89 // phpcs:enable
90 // TODO Use type detected in $object->fields
91 if (in_array($field, array('note', 'note_private', 'note_public', 'desc', 'description'))) {
92 return sanitizeVal($value, 'restricthtml');
93 } else {
94 return sanitizeVal($value, 'alphanohtml');
95 }
96 }
97
98 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
105 protected function _cleanObjectDatas($object)
106 {
107 // phpcs:enable
108 // Remove $db object property for object
109 unset($object->db);
110 unset($object->isextrafieldmanaged);
111 unset($object->ismultientitymanaged);
112 unset($object->restrictiononfksoc);
113 unset($object->table_rowid);
114 unset($object->pass);
115 unset($object->pass_indatabase);
116
117 // Remove linkedObjects. We should already have and keep only linkedObjectsIds that avoid huge responses
118 unset($object->linkedObjects);
119 //unset($object->lines[$i]->linked_objects); // This is the array to create linked object during create
120
121 unset($object->fields);
122 unset($object->oldline);
123
124 unset($object->error);
125 unset($object->errors);
126 unset($object->errorhidden);
127
128 unset($object->ref_previous);
129 unset($object->ref_next);
130 unset($object->imgWidth);
131 unset($object->imgHeight);
132 unset($object->barcode_type_code);
133 unset($object->barcode_type_label);
134
135 unset($object->mode_reglement); // We use mode_reglement_id now
136 unset($object->cond_reglement); // We use cond_reglement_id now
137 unset($object->note); // We use note_public or note_private now
138 unset($object->contact); // We use contact_id now
139 unset($object->thirdparty); // We use thirdparty_id or fk_soc or socid now
140
141 unset($object->projet); // Should be fk_project
142 unset($object->project); // Should be fk_project
143 unset($object->fk_projet); // Should be fk_project
144 unset($object->author); // Should be fk_user_author
145 unset($object->timespent_old_duration);
146 unset($object->timespent_id);
147 unset($object->timespent_duration);
148 unset($object->timespent_date);
149 unset($object->timespent_datehour);
150 unset($object->timespent_withhour);
151 unset($object->timespent_fk_user);
152 unset($object->timespent_note);
153 unset($object->fk_delivery_address);
154 unset($object->modelpdf);
155 unset($object->sendtoid);
156 unset($object->name_bis);
157 unset($object->newref);
158 unset($object->alreadypaid);
159 unset($object->openid);
160
161 unset($object->statuts);
162 unset($object->statuts_short);
163 unset($object->statuts_logo);
164 unset($object->statuts_long);
165
166 //unset($object->labelStatus);
167 //unset($object->labelStatusShort);
168
169 unset($object->stats_propale);
170 unset($object->stats_commande);
171 unset($object->stats_contrat);
172 unset($object->stats_facture);
173 unset($object->stats_commande_fournisseur);
174 unset($object->stats_reception);
175 unset($object->stats_mrptoconsume);
176 unset($object->stats_mrptoproduce);
177
178 unset($object->fieldsforcombobox);
179 unset($object->regeximgext);
180
181 unset($object->skip_update_total);
182 unset($object->context);
183 unset($object->next_prev_filter);
184
185 unset($object->region);
186 unset($object->region_code);
187 unset($object->country);
188 unset($object->state);
189 unset($object->state_code);
190 unset($object->departement);
191 unset($object->departement_code);
192
193 unset($object->libelle_statut);
194 unset($object->libelle_paiement);
195
196 unset($object->prefix_comm);
197
198 if (!isset($object->table_element) || ! in_array($object->table_element, array('expensereport_det', 'ticket'))) {
199 unset($object->comments);
200 }
201
202 unset($object->element);
203 unset($object->element_for_permission);
204 unset($object->fk_element);
205 unset($object->table_element);
206 unset($object->table_element_line);
207 unset($object->class_element_line);
208 unset($object->picto);
209
210 // Remove the $oldcopy property because it is not supported by the JSON
211 // encoder. The following error is generated when trying to serialize
212 // it: "Error encoding/decoding JSON: Type is not supported"
213 // Note: Event if this property was correctly handled by the JSON
214 // encoder, it should be ignored because keeping it would let the API
215 // have a very strange behavior: calling PUT and then GET on the same
216 // resource would give different results:
217 // PUT /objects/{id} -> returns object with oldcopy = previous version of the object
218 // GET /objects/{id} -> returns object with oldcopy empty
219 unset($object->oldcopy);
220
221 // If object has lines, remove $db property
222 if (isset($object->lines) && is_array($object->lines) && count($object->lines) > 0) {
223 $nboflines = count($object->lines);
224 for ($i = 0; $i < $nboflines; $i++) {
225 $this->_cleanObjectDatas($object->lines[$i]);
226
227 unset($object->lines[$i]->contact);
228 unset($object->lines[$i]->contact_id);
229 unset($object->lines[$i]->country);
230 unset($object->lines[$i]->country_id);
231 unset($object->lines[$i]->country_code);
232 unset($object->lines[$i]->mode_reglement_id);
233 unset($object->lines[$i]->mode_reglement_code);
234 unset($object->lines[$i]->mode_reglement);
235 unset($object->lines[$i]->cond_reglement_id);
236 unset($object->lines[$i]->cond_reglement_code);
237 unset($object->lines[$i]->cond_reglement);
238 unset($object->lines[$i]->fk_delivery_address);
239 unset($object->lines[$i]->fk_projet);
240 unset($object->lines[$i]->fk_project);
241 unset($object->lines[$i]->thirdparty);
242 unset($object->lines[$i]->user);
243 unset($object->lines[$i]->model_pdf);
244 unset($object->lines[$i]->modelpdf);
245 unset($object->lines[$i]->note_public);
246 unset($object->lines[$i]->note_private);
247 unset($object->lines[$i]->fk_incoterms);
248 unset($object->lines[$i]->label_incoterms);
249 unset($object->lines[$i]->location_incoterms);
250 unset($object->lines[$i]->name);
251 unset($object->lines[$i]->lastname);
252 unset($object->lines[$i]->firstname);
253 unset($object->lines[$i]->civility_id);
254 unset($object->lines[$i]->fk_multicurrency);
255 unset($object->lines[$i]->multicurrency_code);
256 unset($object->lines[$i]->shipping_method_id);
257 }
258 }
259
260 if (!empty($object->thirdparty) && is_object($object->thirdparty)) {
261 $this->_cleanObjectDatas($object->thirdparty);
262 }
263
264 if (!empty($object->product) && is_object($object->product)) {
265 $this->_cleanObjectDatas($object->product);
266 }
267
268 return $object;
269 }
270
271 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
283 protected static function _checkAccessToResource($resource, $resource_id = 0, $dbtablename = '', $feature2 = '', $dbt_keyfield = 'fk_soc', $dbt_select = 'rowid')
284 {
285 // phpcs:enable
286 // Features/modules to check
287 $featuresarray = array($resource);
288 if (preg_match('/&/', $resource)) {
289 $featuresarray = explode("&", $resource);
290 } elseif (preg_match('/\|/', $resource)) {
291 $featuresarray = explode("|", $resource);
292 }
293
294 // More subfeatures to check
295 if (!empty($feature2)) {
296 $feature2 = explode("|", $feature2);
297 }
298
299 return checkUserAccessToObject(DolibarrApiAccess::$user, $featuresarray, $resource_id, $dbtablename, $feature2, $dbt_keyfield, $dbt_select);
300 }
301
302 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
311 protected function _checkFilters($sqlfilters, &$error = '')
312 {
313 // phpcs:enable
314
315 return dolCheckFilters($sqlfilters, $error);
316 }
317
318 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
319 // phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
329 protected static function _forge_criteria_callback($matches)
330 {
331 return dolForgeCriteriaCallback($matches);
332 }
333}
Class for API REST v1.
Definition api.class.php:32
__construct($db, $cachedir='', $refreshCache=false)
Constructor.
Definition api.class.php:51
static _checkAccessToResource($resource, $resource_id=0, $dbtablename='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid')
Check access by user to a given resource.
_checkFilters($sqlfilters, &$error='')
Return if a $sqlfilters parameter is valid Function no more used.
_checkValForAPI($field, $value, $object)
Check and convert a string depending on its type/name.
Definition api.class.php:87
_cleanObjectDatas($object)
Clean sensible object datas.
static _forge_criteria_callback($matches)
Function to forge a SQL criteria from a Generic filter string.
dolCheckFilters($sqlfilters, &$error='')
Return if a $sqlfilters parameter has a valid balance of parenthesis.
dolForgeCriteriaCallback($matches)
Function to forge a SQL criteria from a Dolibarr filter syntax string.
sanitizeVal($out='', $check='alphanohtml', $filter=null, $options=null)
Return a sanitized or empty value after checking value against a rule.
checkUserAccessToObject($user, array $featuresarray, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='', $dbt_select='rowid', $parenttableforentity='')
Check that access by a given user to an object is ok.