dolibarr  18.0.0
security.lib.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2008-2021 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2008-2021 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2020 Ferran Marcet <fmarcet@2byte.es>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program. If not, see <https://www.gnu.org/licenses/>.
18  * or see https://www.gnu.org/
19  */
20 
38 function dol_encode($chain, $key = '1')
39 {
40  if (is_numeric($key) && $key == '1') { // rule 1 is offset of 17 for char
41  $output_tab = array();
42  $strlength = dol_strlen($chain);
43  for ($i = 0; $i < $strlength; $i++) {
44  $output_tab[$i] = chr(ord(substr($chain, $i, 1)) + 17);
45  }
46  $chain = implode("", $output_tab);
47  } elseif ($key) {
48  $result = '';
49  $strlength = dol_strlen($chain);
50  for ($i = 0; $i < $strlength; $i++) {
51  $keychar = substr($key, ($i % strlen($key)) - 1, 1);
52  $result .= chr(ord(substr($chain, $i, 1)) + (ord($keychar) - 65));
53  }
54  $chain = $result;
55  }
56 
57  return base64_encode($chain);
58 }
59 
69 function dol_decode($chain, $key = '1')
70 {
71  $chain = base64_decode($chain);
72 
73  if (is_numeric($key) && $key == '1') { // rule 1 is offset of 17 for char
74  $output_tab = array();
75  $strlength = dol_strlen($chain);
76  for ($i = 0; $i < $strlength; $i++) {
77  $output_tab[$i] = chr(ord(substr($chain, $i, 1)) - 17);
78  }
79 
80  $chain = implode("", $output_tab);
81  } elseif ($key) {
82  $result = '';
83  $strlength = dol_strlen($chain);
84  for ($i = 0; $i < $strlength; $i++) {
85  $keychar = substr($key, ($i % strlen($key)) - 1, 1);
86  $result .= chr(ord(substr($chain, $i, 1)) - (ord($keychar) - 65));
87  }
88  $chain = $result;
89  }
90 
91  return $chain;
92 }
93 
100 function dolGetRandomBytes($length)
101 {
102  if (function_exists('random_bytes')) { // Available with PHP 7 only.
103  return bin2hex(random_bytes((int) floor($length / 2))); // the bin2hex will double the number of bytes so we take length / 2
104  }
105 
106  return bin2hex(openssl_random_pseudo_bytes((int) floor($length / 2))); // the bin2hex will double the number of bytes so we take length / 2. May be very slow on Windows.
107 }
108 
122 function dolEncrypt($chain, $key = '', $ciphering = 'AES-256-CTR', $forceseed = '')
123 {
124  global $conf;
125  global $dolibarr_disable_dolcrypt_for_debug;
126 
127  if ($chain === '' || is_null($chain)) {
128  return '';
129  }
130 
131  $reg = array();
132  if (preg_match('/^dolcrypt:([^:]+):(.+)$/', $chain, $reg)) {
133  // The $chain is already a crypted string
134  return $chain;
135  }
136 
137  if (empty($key)) {
138  $key = $conf->file->instance_unique_id;
139  }
140  if (empty($ciphering)) {
141  $ciphering = 'AES-256-CTR';
142  }
143 
144  $newchain = $chain;
145 
146  if (function_exists('openssl_encrypt') && empty($dolibarr_disable_dolcrypt_for_debug)) {
147  $ivlen = 16;
148  if (function_exists('openssl_cipher_iv_length')) {
149  $ivlen = openssl_cipher_iv_length($ciphering);
150  }
151  if ($ivlen === false || $ivlen < 1 || $ivlen > 32) {
152  $ivlen = 16;
153  }
154  if (empty($forceseed)) {
155  $ivseed = dolGetRandomBytes($ivlen);
156  } else {
157  $ivseed = dol_substr(md5($forceseed), 0, $ivlen, 'ascii', 1);
158  }
159 
160  $newchain = openssl_encrypt($chain, $ciphering, $key, 0, $ivseed);
161  return 'dolcrypt:'.$ciphering.':'.$ivseed.':'.$newchain;
162  } else {
163  return $chain;
164  }
165 }
166 
177 function dolDecrypt($chain, $key = '')
178 {
179  global $conf;
180 
181  if ($chain === '' || is_null($chain)) {
182  return '';
183  }
184 
185  if (empty($key)) {
186  $key = $conf->file->instance_unique_id;
187  }
188 
189  $reg = array();
190  if (preg_match('/^dolcrypt:([^:]+):(.+)$/', $chain, $reg)) {
191  $ciphering = $reg[1];
192  if (function_exists('openssl_decrypt')) {
193  if (empty($key)) {
194  return 'Error dolDecrypt decrypt key is empty';
195  }
196  $tmpexplode = explode(':', $reg[2]);
197  if (!empty($tmpexplode[1]) && is_string($tmpexplode[0])) {
198  $newchain = openssl_decrypt($tmpexplode[1], $ciphering, $key, 0, $tmpexplode[0]);
199  } else {
200  $newchain = openssl_decrypt($tmpexplode[0], $ciphering, $key, 0, null);
201  }
202  } else {
203  $newchain = 'Error dolDecrypt function openssl_decrypt() not available';
204  }
205  return $newchain;
206  } else {
207  return $chain;
208  }
209 }
210 
221 function dol_hash($chain, $type = '0')
222 {
223  global $conf;
224 
225  // No need to add salt for password_hash
226  if (($type == '0' || $type == 'auto') && !empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'password_hash' && function_exists('password_hash')) {
227  return password_hash($chain, PASSWORD_DEFAULT);
228  }
229 
230  // Salt value
231  if (!empty($conf->global->MAIN_SECURITY_SALT) && $type != '4' && $type !== 'openldap') {
232  $chain = $conf->global->MAIN_SECURITY_SALT.$chain;
233  }
234 
235  if ($type == '1' || $type == 'sha1') {
236  return sha1($chain);
237  } elseif ($type == '2' || $type == 'sha1md5') {
238  return sha1(md5($chain));
239  } elseif ($type == '3' || $type == 'md5') {
240  return md5($chain);
241  } elseif ($type == '4' || $type == 'openldap') {
242  return dolGetLdapPasswordHash($chain, getDolGlobalString('LDAP_PASSWORD_HASH_TYPE', 'md5'));
243  } elseif ($type == '5' || $type == 'sha256') {
244  return hash('sha256', $chain);
245  } elseif ($type == '6' || $type == 'password_hash') {
246  return password_hash($chain, PASSWORD_DEFAULT);
247  } elseif (!empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'sha1') {
248  return sha1($chain);
249  } elseif (!empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'sha1md5') {
250  return sha1(md5($chain));
251  }
252 
253  // No particular encoding defined, use default
254  return md5($chain);
255 }
256 
269 function dol_verifyHash($chain, $hash, $type = '0')
270 {
271  global $conf;
272 
273  if ($type == '0' && !empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'password_hash' && function_exists('password_verify')) {
274  if (! empty($hash[0]) && $hash[0] == '$') {
275  return password_verify($chain, $hash);
276  } elseif (dol_strlen($hash) == 32) {
277  return dol_verifyHash($chain, $hash, '3'); // md5
278  } elseif (dol_strlen($hash) == 40) {
279  return dol_verifyHash($chain, $hash, '2'); // sha1md5
280  }
281 
282  return false;
283  }
284 
285  return dol_hash($chain, $type) == $hash;
286 }
287 
295 function dolGetLdapPasswordHash($password, $type = 'md5')
296 {
297  if (empty($type)) {
298  $type = 'md5';
299  }
300 
301  $salt = substr(sha1(time()), 0, 8);
302 
303  if ($type === 'md5') {
304  return '{MD5}' . base64_encode(hash("md5", $password, true)); //For OpenLdap with md5 (based on an unencrypted password in base)
305  } elseif ($type === 'md5frommd5') {
306  return '{MD5}' . base64_encode(hex2bin($password)); // Create OpenLDAP MD5 password from Dolibarr MD5 password
307  } elseif ($type === 'smd5') {
308  return "{SMD5}" . base64_encode(hash("md5", $password . $salt, true) . $salt);
309  } elseif ($type === 'sha') {
310  return '{SHA}' . base64_encode(hash("sha1", $password, true));
311  } elseif ($type === 'ssha') {
312  return "{SSHA}" . base64_encode(hash("sha1", $password . $salt, true) . $salt);
313  } elseif ($type === 'sha256') {
314  return "{SHA256}" . base64_encode(hash("sha256", $password, true));
315  } elseif ($type === 'ssha256') {
316  return "{SSHA256}" . base64_encode(hash("sha256", $password . $salt, true) . $salt);
317  } elseif ($type === 'sha384') {
318  return "{SHA384}" . base64_encode(hash("sha384", $password, true));
319  } elseif ($type === 'ssha384') {
320  return "{SSHA384}" . base64_encode(hash("sha384", $password . $salt, true) . $salt);
321  } elseif ($type === 'sha512') {
322  return "{SHA512}" . base64_encode(hash("sha512", $password, true));
323  } elseif ($type === 'ssha512') {
324  return "{SSHA512}" . base64_encode(hash("sha512", $password . $salt, true) . $salt);
325  } elseif ($type === 'crypt') {
326  return '{CRYPT}' . crypt($password, $salt);
327  } elseif ($type === 'clear') {
328  return '{CLEAR}' . $password; // Just for test, plain text password is not secured !
329  }
330  return "";
331 }
332 
353 function restrictedArea(User $user, $features, $object = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = 'fk_soc', $dbt_select = 'rowid', $isdraft = 0, $mode = 0)
354 {
355  global $db, $conf;
356  global $hookmanager;
357 
358  // Define $objectid
359  if (is_object($object)) {
360  $objectid = $object->id;
361  } else {
362  $objectid = $object; // $objectid can be X or 'X,Y,Z'
363  }
364  if ($objectid == "-1") {
365  $objectid = 0;
366  }
367  if ($objectid) {
368  $objectid = preg_replace('/[^0-9\.\,]/', '', $objectid); // For the case value is coming from a non sanitized user input
369  }
370 
371  //dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
372  /*print "user_id=".$user->id.", features=".$features.", feature2=".$feature2.", objectid=".$objectid;
373  print ", dbtablename=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select;
374  print ", perm: user->right->".$features.($feature2 ? "->".$feature2 : "")."=".($user->hasRight($features, $feature2, 'lire'))."<br>";
375  */
376 
377  $parentfortableentity = '';
378 
379  // Fix syntax of $features param
380  $originalfeatures = $features;
381  if ($features == 'agenda') {
382  $tableandshare = 'actioncomm&societe';
383  $feature2 = 'myactions|allactions';
384  $dbt_select = 'id';
385  }
386  if ($features == 'bank') {
387  $features = 'banque';
388  }
389  if ($features == 'facturerec') {
390  $features = 'facture';
391  }
392  if ($features == 'mo') {
393  $features = 'mrp';
394  }
395  if ($features == 'member') {
396  $features = 'adherent';
397  }
398  if ($features == 'subscription') {
399  $features = 'adherent';
400  $feature2 = 'cotisation';
401  }
402  if ($features == 'website' && is_object($object) && $object->element == 'websitepage') {
403  $parentfortableentity = 'fk_website@website';
404  }
405  if ($features == 'project') {
406  $features = 'projet';
407  }
408  if ($features == 'product') {
409  $features = 'produit';
410  }
411  if ($features == 'productbatch') {
412  $features = 'produit';
413  }
414  if ($features == 'tax') {
415  $feature2 = 'charges';
416  }
417  if ($features == 'workstation') {
418  $feature2 = 'workstation';
419  }
420  if ($features == 'fournisseur') { // When vendor invoice and purchase order are into module 'fournisseur'
421  $features = 'fournisseur';
422  if (is_object($object) && $object->element == 'invoice_supplier') {
423  $feature2 = 'facture';
424  } elseif (is_object($object) && $object->element == 'order_supplier') {
425  $feature2 = 'commande';
426  }
427  }
428 
429  //print $features.' - '.$tableandshare.' - '.$feature2.' - '.$dbt_select."\n";
430 
431  // Get more permissions checks from hooks
432  $parameters = array('features'=>$features, 'originalfeatures'=>$originalfeatures, 'objectid'=>$objectid, 'dbt_select'=>$dbt_select, 'idtype'=>$dbt_select, 'isdraft'=>$isdraft);
433  $reshook = $hookmanager->executeHooks('restrictedArea', $parameters);
434 
435  if (isset($hookmanager->resArray['result'])) {
436  if ($hookmanager->resArray['result'] == 0) {
437  if ($mode) {
438  return 0;
439  } else {
440  accessforbidden(); // Module returns 0, so access forbidden
441  }
442  }
443  }
444  if ($reshook > 0) { // No other test done.
445  return 1;
446  }
447 
448  // Features/modules to check
449  $featuresarray = array($features);
450  if (preg_match('/&/', $features)) {
451  $featuresarray = explode("&", $features);
452  } elseif (preg_match('/\|/', $features)) {
453  $featuresarray = explode("|", $features);
454  }
455 
456  // More subfeatures to check
457  if (!empty($feature2)) {
458  $feature2 = explode("|", $feature2);
459  }
460 
461  $listofmodules = explode(',', $conf->global->MAIN_MODULES_FOR_EXTERNAL);
462 
463  // Check read permission from module
464  $readok = 1;
465  $nbko = 0;
466  foreach ($featuresarray as $feature) { // first we check nb of test ko
467  $featureforlistofmodule = $feature;
468  if ($featureforlistofmodule == 'produit') {
469  $featureforlistofmodule = 'product';
470  }
471  if ($featureforlistofmodule == 'supplier_proposal') {
472  $featureforlistofmodule = 'supplierproposal';
473  }
474  if (!empty($user->socid) && !empty($conf->global->MAIN_MODULES_FOR_EXTERNAL) && !in_array($featureforlistofmodule, $listofmodules)) { // If limits on modules for external users, module must be into list of modules for external users
475  $readok = 0;
476  $nbko++;
477  continue;
478  }
479 
480  if ($feature == 'societe' && (empty($feature2) || !in_array('contact', $feature2))) {
481  if (!$user->hasRight('societe', 'lire') && !$user->hasRight('fournisseur', 'lire')) {
482  $readok = 0;
483  $nbko++;
484  }
485  } elseif (($feature == 'societe' && (!empty($feature2) && in_array('contact', $feature2))) || $feature == 'contact') {
486  if (empty($user->rights->societe->contact->lire)) {
487  $readok = 0;
488  $nbko++;
489  }
490  } elseif ($feature == 'produit|service') {
491  if (empty($user->rights->produit->lire) && empty($user->rights->service->lire)) {
492  $readok = 0;
493  $nbko++;
494  }
495  } elseif ($feature == 'prelevement') {
496  if (empty($user->rights->prelevement->bons->lire)) {
497  $readok = 0;
498  $nbko++;
499  }
500  } elseif ($feature == 'cheque') {
501  if (empty($user->rights->banque->cheque)) {
502  $readok = 0;
503  $nbko++;
504  }
505  } elseif ($feature == 'projet') {
506  if (empty($user->rights->projet->lire) && empty($user->rights->projet->all->lire)) {
507  $readok = 0;
508  $nbko++;
509  }
510  } elseif ($feature == 'payment') {
511  if (!$user->hasRight('facture', 'lire')) {
512  $readok = 0;
513  $nbko++;
514  }
515  } elseif ($feature == 'payment_supplier') {
516  if (empty($user->rights->fournisseur->facture->lire)) {
517  $readok = 0;
518  $nbko++;
519  }
520  } elseif ($feature == 'payment_sc') {
521  if (empty($user->rights->tax->charges->lire)) {
522  $readok = 0;
523  $nbko++;
524  }
525  } elseif (!empty($feature2)) { // This is for permissions on 2 levels (module->object->read)
526  $tmpreadok = 1;
527  foreach ($feature2 as $subfeature) {
528  if ($subfeature == 'user' && $user->id == $objectid) {
529  continue; // A user can always read its own card
530  }
531  if ($subfeature == 'fiscalyear' && $user->hasRight('accounting', 'fiscalyear', 'write')) {
532  // only one right for fiscalyear
533  $tmpreadok = 1;
534  continue;
535  }
536  if (!empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) {
537  $tmpreadok = 0;
538  } elseif (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) {
539  $tmpreadok = 0;
540  } else {
541  $tmpreadok = 1;
542  break;
543  } // Break is to bypass second test if the first is ok
544  }
545  if (!$tmpreadok) { // We found a test on feature that is ko
546  $readok = 0; // All tests are ko (we manage here the and, the or will be managed later using $nbko).
547  $nbko++;
548  }
549  } elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) { // This is permissions on 1 level (module->read)
550  if (empty($user->rights->$feature->lire)
551  && empty($user->rights->$feature->read)
552  && empty($user->rights->$feature->run)) {
553  $readok = 0;
554  $nbko++;
555  }
556  }
557  }
558 
559  // If a or and at least one ok
560  if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
561  $readok = 1;
562  }
563 
564  if (!$readok) {
565  if ($mode) {
566  return 0;
567  } else {
568  accessforbidden();
569  }
570  }
571  //print "Read access is ok";
572 
573  // Check write permission from module (we need to know write permission to create but also to delete drafts record or to upload files)
574  $createok = 1;
575  $nbko = 0;
576  $wemustcheckpermissionforcreate = (GETPOST('sendit', 'alpha') || GETPOST('linkit', 'alpha') || in_array(GETPOST('action', 'aZ09'), array('create', 'update', 'set', 'upload', 'add_element_resource', 'confirm_deletebank', 'confirm_delete_linked_resource')) || GETPOST('roworder', 'alpha', 2));
577  $wemustcheckpermissionfordeletedraft = ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete');
578 
579  if ($wemustcheckpermissionforcreate || $wemustcheckpermissionfordeletedraft) {
580  foreach ($featuresarray as $feature) {
581  if ($feature == 'contact') {
582  if (empty($user->rights->societe->contact->creer)) {
583  $createok = 0;
584  $nbko++;
585  }
586  } elseif ($feature == 'produit|service') {
587  if (empty($user->rights->produit->creer) && empty($user->rights->service->creer)) {
588  $createok = 0;
589  $nbko++;
590  }
591  } elseif ($feature == 'prelevement') {
592  if (!$user->rights->prelevement->bons->creer) {
593  $createok = 0;
594  $nbko++;
595  }
596  } elseif ($feature == 'commande_fournisseur') {
597  if (empty($user->rights->fournisseur->commande->creer) || empty($user->rights->supplier_order->creer)) {
598  $createok = 0;
599  $nbko++;
600  }
601  } elseif ($feature == 'banque') {
602  if (!$user->hasRight('banque', 'modifier')) {
603  $createok = 0;
604  $nbko++;
605  }
606  } elseif ($feature == 'cheque') {
607  if (empty($user->rights->banque->cheque)) {
608  $createok = 0;
609  $nbko++;
610  }
611  } elseif ($feature == 'import') {
612  if (empty($user->rights->import->run)) {
613  $createok = 0;
614  $nbko++;
615  }
616  } elseif ($feature == 'ecm') {
617  if (!$user->rights->ecm->upload) {
618  $createok = 0;
619  $nbko++;
620  }
621  } elseif (!empty($feature2)) { // This is for permissions on 2 levels (module->object->write)
622  foreach ($feature2 as $subfeature) {
623  if ($subfeature == 'user' && $user->id == $objectid && $user->hasRight('user', 'self', 'creer')) {
624  continue; // User can edit its own card
625  }
626  if ($subfeature == 'user' && $user->id == $objectid && $user->hasRight('user', 'self', 'password')) {
627  continue; // User can edit its own password
628  }
629  if ($subfeature == 'user' && $user->id != $objectid && $user->hasRight('user', 'user', 'password')) {
630  continue; // User can edit another user's password
631  }
632 
633  if (empty($user->rights->$feature->$subfeature->creer)
634  && empty($user->rights->$feature->$subfeature->write)
635  && empty($user->rights->$feature->$subfeature->create)) {
636  $createok = 0;
637  $nbko++;
638  } else {
639  $createok = 1;
640  // Break to bypass second test if the first is ok
641  break;
642  }
643  }
644  } elseif (!empty($feature)) { // This is for permissions on 1 levels (module->write)
645  //print '<br>feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write; exit;
646  if (empty($user->rights->$feature->creer)
647  && empty($user->rights->$feature->write)
648  && empty($user->rights->$feature->create)) {
649  $createok = 0;
650  $nbko++;
651  }
652  }
653  }
654 
655  // If a or and at least one ok
656  if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
657  $createok = 1;
658  }
659 
660  if ($wemustcheckpermissionforcreate && !$createok) {
661  if ($mode) {
662  return 0;
663  } else {
664  accessforbidden();
665  }
666  }
667  //print "Write access is ok";
668  }
669 
670  // Check create user permission
671  $createuserok = 1;
672  if (GETPOST('action', 'aZ09') == 'confirm_create_user' && GETPOST("confirm", 'aZ09') == 'yes') {
673  if (!$user->hasRight('user', 'user', 'creer')) {
674  $createuserok = 0;
675  }
676 
677  if (!$createuserok) {
678  if ($mode) {
679  return 0;
680  } else {
681  accessforbidden();
682  }
683  }
684  //print "Create user access is ok";
685  }
686 
687  // Check delete permission from module
688  $deleteok = 1;
689  $nbko = 0;
690  if ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete') {
691  foreach ($featuresarray as $feature) {
692  if ($feature == 'bookmark') {
693  if (!$user->rights->bookmark->supprimer) {
694  if ($user->id != $object->fk_user || empty($user->rights->bookmark->creer)) {
695  $deleteok = 0;
696  }
697  }
698  } elseif ($feature == 'contact') {
699  if (!$user->rights->societe->contact->supprimer) {
700  $deleteok = 0;
701  }
702  } elseif ($feature == 'produit|service') {
703  if (!$user->hasRight('produit', 'supprimer') && !$user->hasRight('service', 'supprimer')) {
704  $deleteok = 0;
705  }
706  } elseif ($feature == 'commande_fournisseur') {
707  if (!$user->rights->fournisseur->commande->supprimer) {
708  $deleteok = 0;
709  }
710  } elseif ($feature == 'payment_supplier') { // Permission to delete a payment of an invoice is permission to edit an invoice.
711  if (!$user->rights->fournisseur->facture->creer) {
712  $deleteok = 0;
713  }
714  } elseif ($feature == 'payment') {
715  if (!$user->rights->facture->paiement) {
716  $deleteok = 0;
717  }
718  } elseif ($feature == 'payment_sc') {
719  if (!$user->rights->tax->charges->creer) {
720  $deleteok = 0;
721  }
722  } elseif ($feature == 'banque') {
723  if (!$user->hasRight('banque', 'modifier')) {
724  $deleteok = 0;
725  }
726  } elseif ($feature == 'cheque') {
727  if (empty($user->rights->banque->cheque)) {
728  $deleteok = 0;
729  }
730  } elseif ($feature == 'ecm') {
731  if (!$user->rights->ecm->upload) {
732  $deleteok = 0;
733  }
734  } elseif ($feature == 'ftp') {
735  if (!$user->rights->ftp->write) {
736  $deleteok = 0;
737  }
738  } elseif ($feature == 'salaries') {
739  if (!$user->rights->salaries->delete) {
740  $deleteok = 0;
741  }
742  } elseif ($feature == 'adherent') {
743  if (empty($user->rights->adherent->supprimer)) {
744  $deleteok = 0;
745  }
746  } elseif ($feature == 'paymentbybanktransfer') {
747  if (empty($user->rights->paymentbybanktransfer->create)) { // There is no delete permission
748  $deleteok = 0;
749  }
750  } elseif ($feature == 'prelevement') {
751  if (empty($user->rights->prelevement->bons->creer)) { // There is no delete permission
752  $deleteok = 0;
753  }
754  } elseif (!empty($feature2)) { // This is for permissions on 2 levels
755  foreach ($feature2 as $subfeature) {
756  if (empty($user->rights->$feature->$subfeature->supprimer) && empty($user->rights->$feature->$subfeature->delete)) {
757  $deleteok = 0;
758  } else {
759  $deleteok = 1;
760  break;
761  } // For bypass the second test if the first is ok
762  }
763  } elseif (!empty($feature)) { // This is used for permissions on 1 level
764  //print '<br>feature='.$feature.' creer='.$user->rights->$feature->supprimer.' write='.$user->rights->$feature->delete;
765  if (empty($user->rights->$feature->supprimer)
766  && empty($user->rights->$feature->delete)
767  && empty($user->rights->$feature->run)) {
768  $deleteok = 0;
769  }
770  }
771  }
772 
773  // If a or and at least one ok
774  if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
775  $deleteok = 1;
776  }
777 
778  if (!$deleteok && !($isdraft && $createok)) {
779  if ($mode) {
780  return 0;
781  } else {
782  accessforbidden();
783  }
784  }
785  //print "Delete access is ok";
786  }
787 
788  // If we have a particular object to check permissions on, we check if $user has permission
789  // for this given object (link to company, is contact for project, ...)
790  if (!empty($objectid) && $objectid > 0) {
791  $ok = checkUserAccessToObject($user, $featuresarray, $object, $tableandshare, $feature2, $dbt_keyfield, $dbt_select, $parentfortableentity);
792  $params = array('objectid' => $objectid, 'features' => join(',', $featuresarray), 'features2' => $feature2);
793  //print 'checkUserAccessToObject ok='.$ok;
794  if ($mode) {
795  return $ok ? 1 : 0;
796  } else {
797  if ($ok) {
798  return 1;
799  } else {
800  accessforbidden('', 1, 1, 0, $params);
801  }
802  }
803  }
804 
805  return 1;
806 }
807 
823 function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = '', $dbt_select = 'rowid', $parenttableforentity = '')
824 {
825  global $db, $conf;
826 
827  if (is_object($object)) {
828  $objectid = $object->id;
829  } else {
830  $objectid = $object; // $objectid can be X or 'X,Y,Z'
831  }
832  $objectid = preg_replace('/[^0-9\.\,]/', '', $objectid); // For the case value is coming from a non sanitized user input
833 
834  //dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
835  //print "user_id=".$user->id.", features=".join(',', $featuresarray).", objectid=".$objectid;
836  //print ", tableandshare=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select."<br>";
837 
838  // More parameters
839  $params = explode('&', $tableandshare);
840  $dbtablename = (!empty($params[0]) ? $params[0] : '');
841  $sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename);
842 
843  foreach ($featuresarray as $feature) {
844  $sql = '';
845 
846  //var_dump($feature);exit;
847 
848  // For backward compatibility
849  if ($feature == 'societe' && !empty($feature2) && is_array($feature2) && in_array('contact', $feature2)) {
850  $feature = 'contact';
851  $feature2 = '';
852  }
853  if ($feature == 'member') {
854  $feature = 'adherent';
855  }
856  if ($feature == 'project') {
857  $feature = 'projet';
858  }
859  if ($feature == 'task') {
860  $feature = 'projet_task';
861  }
862  if ($feature == 'eventorganization') {
863  $feature = 'agenda';
864  $dbtablename = 'actioncomm';
865  }
866  if ($feature == 'payment_sc') {
867  $feature = "chargesociales";
868  $objectid = $object->fk_charge;
869  }
870 
871  $checkonentitydone = 0;
872 
873  // Array to define rules of checks to do
874  $check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salaries', 'website', 'recruitment', 'chargesociales'); // Test on entity only (Objects with no link to company)
875  $checksoc = array('societe'); // Test for object Societe
876  $checkparentsoc = array('agenda', 'contact', 'contrat'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...).
877  $checkproject = array('projet', 'project'); // Test for project object
878  $checktask = array('projet_task'); // Test for task object
879  $checkhierarchy = array('expensereport', 'holiday'); // check permission among the hierarchy of user
880  $checkuser = array('bookmark'); // check permission among the fk_user (must be myself or null)
881  $nocheck = array('barcode', 'stock'); // No test
882 
883  //$checkdefault = 'all other not already defined'; // Test on entity + link to third party on field $dbt_keyfield. Not allowed if link is empty (Ex: invoice, orders...).
884 
885  // If dbtablename not defined, we use same name for table than module name
886  if (empty($dbtablename)) {
887  $dbtablename = $feature;
888  $sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename); // We change dbtablename, so we set sharedelement too.
889  }
890 
891  // To avoid an access forbidden with a numeric ref
892  if ($dbt_select != 'rowid' && $dbt_select != 'id') {
893  $objectid = "'".$objectid."'"; // Note: $objectid was already cast into int at begin of this method.
894  }
895 
896  // Check permission for objectid on entity only
897  if (in_array($feature, $check) && $objectid > 0) { // For $objectid = 0, no check
898  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
899  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
900  if (($feature == 'user' || $feature == 'usergroup') && isModEnabled('multicompany')) { // Special for multicompany
901  if (!empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) {
902  if ($conf->entity == 1 && $user->admin && !$user->entity) {
903  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
904  $sql .= " AND dbt.entity IS NOT NULL";
905  } else {
906  $sql .= ",".MAIN_DB_PREFIX."usergroup_user as ug";
907  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
908  $sql .= " AND ((ug.fk_user = dbt.rowid";
909  $sql .= " AND ug.entity IN (".getEntity('usergroup')."))";
910  $sql .= " OR dbt.entity = 0)"; // Show always superadmin
911  }
912  } else {
913  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
914  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
915  }
916  } else {
917  $reg = array();
918  if ($parenttableforentity && preg_match('/(.*)@(.*)/', $parenttableforentity, $reg)) {
919  $sql .= ", ".MAIN_DB_PREFIX.$reg[2]." as dbtp";
920  $sql .= " WHERE dbt.".$reg[1]." = dbtp.rowid AND dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
921  $sql .= " AND dbtp.entity IN (".getEntity($sharedelement, 1).")";
922  } else {
923  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
924  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
925  }
926  }
927  $checkonentitydone = 1;
928  }
929  if (in_array($feature, $checksoc) && $objectid > 0) { // We check feature = checksoc. For $objectid = 0, no check
930  // If external user: Check permission for external users
931  if ($user->socid > 0) {
932  if ($user->socid != $objectid) {
933  return false;
934  }
935  } elseif (isModEnabled("societe") && ($user->hasRight('societe', 'lire') && empty($user->rights->societe->client->voir))) {
936  // If internal user: Check permission for internal users that are restricted on their objects
937  $sql = "SELECT COUNT(sc.fk_soc) as nb";
938  $sql .= " FROM (".MAIN_DB_PREFIX."societe_commerciaux as sc";
939  $sql .= ", ".MAIN_DB_PREFIX."societe as s)";
940  $sql .= " WHERE sc.fk_soc IN (".$db->sanitize($objectid, 1).")";
941  $sql .= " AND sc.fk_user = ".((int) $user->id);
942  $sql .= " AND sc.fk_soc = s.rowid";
943  $sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
944  } elseif (isModEnabled('multicompany')) {
945  // If multicompany and internal users with all permissions, check user is in correct entity
946  $sql = "SELECT COUNT(s.rowid) as nb";
947  $sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
948  $sql .= " WHERE s.rowid IN (".$db->sanitize($objectid, 1).")";
949  $sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
950  }
951 
952  $checkonentitydone = 1;
953  }
954  if (in_array($feature, $checkparentsoc) && $objectid > 0) { // Test on entity + link to thirdparty. Allowed if link is empty (Ex: contacts...).
955  // If external user: Check permission for external users
956  if ($user->socid > 0) {
957  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
958  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
959  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
960  $sql .= " AND dbt.fk_soc = ".((int) $user->socid);
961  } elseif (isModEnabled("societe") && ($user->hasRight('societe', 'lire') && empty($user->rights->societe->client->voir))) {
962  // If internal user: Check permission for internal users that are restricted on their objects
963  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
964  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
965  $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
966  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
967  $sql .= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user
968  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
969  } elseif (isModEnabled('multicompany')) {
970  // If multicompany and internal users with all permissions, check user is in correct entity
971  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
972  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
973  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
974  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
975  }
976 
977  $checkonentitydone = 1;
978  }
979  if (in_array($feature, $checkproject) && $objectid > 0) {
980  if (isModEnabled('project') && empty($user->rights->projet->all->lire)) {
981  $projectid = $objectid;
982 
983  include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
984  $projectstatic = new Project($db);
985  $tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);
986 
987  $tmparray = explode(',', $tmps);
988  if (!in_array($projectid, $tmparray)) {
989  return false;
990  }
991  } else {
992  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
993  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
994  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
995  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
996  }
997  $checkonentitydone = 1;
998  }
999  if (in_array($feature, $checktask) && $objectid > 0) {
1000  if (isModEnabled('project') && empty($user->rights->projet->all->lire)) {
1001  $task = new Task($db);
1002  $task->fetch($objectid);
1003  $projectid = $task->fk_project;
1004 
1005  include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
1006  $projectstatic = new Project($db);
1007  $tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);
1008 
1009  $tmparray = explode(',', $tmps);
1010  if (!in_array($projectid, $tmparray)) {
1011  return false;
1012  }
1013  } else {
1014  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
1015  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
1016  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
1017  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
1018  }
1019 
1020  $checkonentitydone = 1;
1021  }
1022  //var_dump($sql);
1023 
1024  if (!$checkonentitydone && !in_array($feature, $nocheck) && $objectid > 0) { // By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield
1025  // If external user: Check permission for external users
1026  if ($user->socid > 0) {
1027  if (empty($dbt_keyfield)) {
1028  dol_print_error('', 'Param dbt_keyfield is required but not defined');
1029  }
1030  $sql = "SELECT COUNT(dbt.".$dbt_keyfield.") as nb";
1031  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
1032  $sql .= " WHERE dbt.rowid IN (".$db->sanitize($objectid, 1).")";
1033  $sql .= " AND dbt.".$dbt_keyfield." = ".((int) $user->socid);
1034  } elseif (isModEnabled("societe") && empty($user->rights->societe->client->voir)) {
1035  // If internal user without permission to see all thirdparties: Check permission for internal users that are restricted on their objects
1036  if ($feature != 'ticket') {
1037  if (empty($dbt_keyfield)) {
1038  dol_print_error('', 'Param dbt_keyfield is required but not defined');
1039  }
1040  $sql = "SELECT COUNT(sc.fk_soc) as nb";
1041  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
1042  $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
1043  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
1044  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
1045  $sql .= " AND sc.fk_soc = dbt.".$dbt_keyfield;
1046  $sql .= " AND sc.fk_user = ".((int) $user->id);
1047  } else {
1048  // On ticket, the thirdparty is not mandatory, so we need a special test to accept record with no thirdparties.
1049  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
1050  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
1051  $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = dbt.".$dbt_keyfield." AND sc.fk_user = ".((int) $user->id);
1052  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
1053  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
1054  $sql .= " AND (sc.fk_user = ".((int) $user->id)." OR sc.fk_user IS NULL)";
1055  }
1056  } elseif (isModEnabled('multicompany')) {
1057  // If multicompany, and user is an internal user with all permissions, check that object is in correct entity
1058  $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
1059  $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
1060  $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
1061  $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
1062  }
1063  }
1064 
1065  // For events, check on users assigned to event
1066  if ($feature === 'agenda' && $objectid > 0) {
1067  // Also check owner or attendee for users without allactions->read
1068  if ($objectid > 0 && empty($user->rights->agenda->allactions->read)) {
1069  require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
1070  $action = new ActionComm($db);
1071  $action->fetch($objectid);
1072  if ($action->authorid != $user->id && $action->userownerid != $user->id && !(array_key_exists($user->id, $action->userassigned))) {
1073  return false;
1074  }
1075  }
1076  }
1077 
1078  // For some object, we also have to check it is in the user hierarchy
1079  // Param $object must be the full object and not a simple id to have this test possible.
1080  if (in_array($feature, $checkhierarchy) && is_object($object) && $objectid > 0) {
1081  $childids = $user->getAllChildIds(1);
1082  $useridtocheck = 0;
1083  if ($feature == 'holiday') {
1084  $useridtocheck = $object->fk_user;
1085  if (!in_array($object->fk_user, $childids) && !in_array($object->fk_validator, $childids)) {
1086  return false;
1087  }
1088  }
1089  if ($feature == 'expensereport') {
1090  $useridtocheck = $object->fk_user_author;
1091  if (!$user->rights->expensereport->readall) {
1092  if (!in_array($useridtocheck, $childids)) {
1093  return false;
1094  }
1095  }
1096  }
1097  }
1098 
1099  // For some object, we also have to check it is public or owned by user
1100  // Param $object must be the full object and not a simple id to have this test possible.
1101  if (in_array($feature, $checkuser) && is_object($object) && $objectid > 0) {
1102  $useridtocheck = $object->fk_user;
1103  if (!empty($useridtocheck) && $useridtocheck > 0 && $useridtocheck != $user->id && empty($user->admin)) {
1104  return false;
1105  }
1106  }
1107 
1108  if ($sql) {
1109  $resql = $db->query($sql);
1110  if ($resql) {
1111  $obj = $db->fetch_object($resql);
1112  if (!$obj || $obj->nb < count(explode(',', $objectid))) { // error if we found 0 or less record than nb of id provided
1113  return false;
1114  }
1115  } else {
1116  dol_syslog("Bad forged sql in checkUserAccessToObject", LOG_WARNING);
1117  return false;
1118  }
1119  }
1120  }
1121 
1122  return true;
1123 }
1124 
1125 
1137 function httponly_accessforbidden($message = 1, $http_response_code = 403, $stringalreadysanitized = 0)
1138 {
1139  top_httphead();
1140  http_response_code($http_response_code);
1141 
1142  if ($stringalreadysanitized) {
1143  print $message;
1144  } else {
1145  print htmlentities($message);
1146  }
1147 
1148  exit(1);
1149 }
1150 
1164 function accessforbidden($message = '', $printheader = 1, $printfooter = 1, $showonlymessage = 0, $params = null)
1165 {
1166  global $conf, $db, $user, $langs, $hookmanager;
1167  global $action, $object;
1168 
1169  if (!is_object($langs)) {
1170  include_once DOL_DOCUMENT_ROOT.'/core/class/translate.class.php';
1171  $langs = new Translate('', $conf);
1172  $langs->setDefaultLang();
1173  }
1174 
1175  $langs->load("errors");
1176 
1177  if ($printheader) {
1178  if (function_exists("llxHeader")) {
1179  llxHeader('');
1180  } elseif (function_exists("llxHeaderVierge")) {
1181  llxHeaderVierge('');
1182  }
1183  }
1184  print '<div class="error">';
1185  if (empty($message)) {
1186  print $langs->trans("ErrorForbidden");
1187  } else {
1188  print $langs->trans($message);
1189  }
1190  print '</div>';
1191  print '<br>';
1192  if (empty($showonlymessage)) {
1193  if (empty($hookmanager)) {
1194  include_once DOL_DOCUMENT_ROOT.'/core/class/hookmanager.class.php';
1195  $hookmanager = new HookManager($db);
1196  // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
1197  $hookmanager->initHooks(array('main'));
1198  }
1199 
1200  $parameters = array('message'=>$message, 'params'=>$params);
1201  $reshook = $hookmanager->executeHooks('getAccessForbiddenMessage', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
1202  print $hookmanager->resPrint;
1203  if (empty($reshook)) {
1204  $langs->loadLangs(array("errors"));
1205  if ($user->login) {
1206  print $langs->trans("CurrentLogin").': <span class="error">'.$user->login.'</span><br>';
1207  print $langs->trans("ErrorForbidden2", $langs->transnoentitiesnoconv("Home"), $langs->transnoentitiesnoconv("Users"));
1208  print $langs->trans("ErrorForbidden4");
1209  } else {
1210  print $langs->trans("ErrorForbidden3");
1211  }
1212  }
1213  }
1214  if ($printfooter && function_exists("llxFooter")) {
1215  llxFooter();
1216  }
1217 
1218  exit(0);
1219 }
1220 
1221 
1229 {
1230  global $conf;
1231 
1232  $max = $conf->global->MAIN_UPLOAD_DOC; // In Kb
1233  $maxphp = @ini_get('upload_max_filesize'); // In unknown
1234  if (preg_match('/k$/i', $maxphp)) {
1235  $maxphp = preg_replace('/k$/i', '', $maxphp);
1236  $maxphp = $maxphp * 1;
1237  }
1238  if (preg_match('/m$/i', $maxphp)) {
1239  $maxphp = preg_replace('/m$/i', '', $maxphp);
1240  $maxphp = $maxphp * 1024;
1241  }
1242  if (preg_match('/g$/i', $maxphp)) {
1243  $maxphp = preg_replace('/g$/i', '', $maxphp);
1244  $maxphp = $maxphp * 1024 * 1024;
1245  }
1246  if (preg_match('/t$/i', $maxphp)) {
1247  $maxphp = preg_replace('/t$/i', '', $maxphp);
1248  $maxphp = $maxphp * 1024 * 1024 * 1024;
1249  }
1250  $maxphp2 = @ini_get('post_max_size'); // In unknown
1251  if (preg_match('/k$/i', $maxphp2)) {
1252  $maxphp2 = preg_replace('/k$/i', '', $maxphp2);
1253  $maxphp2 = $maxphp2 * 1;
1254  }
1255  if (preg_match('/m$/i', $maxphp2)) {
1256  $maxphp2 = preg_replace('/m$/i', '', $maxphp2);
1257  $maxphp2 = $maxphp2 * 1024;
1258  }
1259  if (preg_match('/g$/i', $maxphp2)) {
1260  $maxphp2 = preg_replace('/g$/i', '', $maxphp2);
1261  $maxphp2 = $maxphp2 * 1024 * 1024;
1262  }
1263  if (preg_match('/t$/i', $maxphp2)) {
1264  $maxphp2 = preg_replace('/t$/i', '', $maxphp2);
1265  $maxphp2 = $maxphp2 * 1024 * 1024 * 1024;
1266  }
1267  // Now $max and $maxphp and $maxphp2 are in Kb
1268  $maxmin = $max;
1269  $maxphptoshow = $maxphptoshowparam = '';
1270  if ($maxphp > 0) {
1271  $maxmin = min($maxmin, $maxphp);
1272  $maxphptoshow = $maxphp;
1273  $maxphptoshowparam = 'upload_max_filesize';
1274  }
1275  if ($maxphp2 > 0) {
1276  $maxmin = min($maxmin, $maxphp2);
1277  if ($maxphp2 < $maxphp) {
1278  $maxphptoshow = $maxphp2;
1279  $maxphptoshowparam = 'post_max_size';
1280  }
1281  }
1282  //var_dump($maxphp.'-'.$maxphp2);
1283  //var_dump($maxmin);
1284 
1285  return array('max'=>$max, 'maxmin'=>$maxmin, 'maxphptoshow'=>$maxphptoshow, 'maxphptoshowparam'=>$maxphptoshowparam);
1286 }
if(!defined('NOTOKENRENEWAL')) if(!defined('NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined('NOREQUIREAJAX')) if(!defined('NOLOGIN')) if(!defined('NOCSRFCHECK')) if(!defined('NOIPCHECK')) llxHeaderVierge()
Header function.
if(!defined('NOREQUIRESOC')) if(!defined('NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined('NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined('NOREQUIREAJAX')) llxHeader()
Empty header.
Definition: wrapper.php:56
llxFooter()
Empty footer.
Definition: wrapper.php:70
Class to manage agenda events (actions)
Class to manage hooks.
Class to manage projects.
Class to manage tasks.
Definition: task.class.php:40
Class to manage translations.
Class to manage Dolibarr users.
Definition: user.class.php:48
if(isModEnabled('facture') && $user->hasRight('facture', 'lire')) if((isModEnabled('fournisseur') &&empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) && $user->hasRight("fournisseur", "facture", "lire"))||(isModEnabled('supplier_invoice') && $user->hasRight("supplier_invoice", "lire"))) if(isModEnabled('don') && $user->hasRight('don', 'lire')) if(isModEnabled('tax') &&!empty($user->rights->tax->charges->lire)) if(isModEnabled('facture') &&isModEnabled('commande') && $user->hasRight("commande", "lire") &&empty($conf->global->WORKFLOW_DISABLE_CREATE_INVOICE_FROM_ORDER)) $sql
Social contributions to pay.
Definition: index.php:746
dol_print_error($db='', $error='', $errors=null)
Displays error message system with all the information to facilitate the diagnosis and the escalation...
dol_strlen($string, $stringencoding='UTF-8')
Make a strlen call.
dol_substr($string, $start, $length=null, $stringencoding='', $trunconbytes=0)
Make a substring.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
isModEnabled($module)
Is Dolibarr module enabled.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
if(!defined('NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
Definition: main.inc.php:1494
dolEncrypt($chain, $key='', $ciphering='AES-256-CTR', $forceseed='')
Encode a string with a symetric encryption.
dolGetRandomBytes($length)
Return a string of random bytes (hexa string) with length = $length fro cryptographic purposes.
dol_encode($chain, $key='1')
Encode a string with base 64 algorithm + specific delta change.
checkUserAccessToObject($user, array $featuresarray, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='', $dbt_select='rowid', $parenttableforentity='')
Check that access by a given user to an object is ok.
dol_verifyHash($chain, $hash, $type='0')
Compute a hash and compare it to the given one For backward compatibility reasons,...
getMaxFileSizeArray()
Return the max allowed for file upload.
restrictedArea(User $user, $features, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $isdraft=0, $mode=0)
Check permissions of a user to show a page and an object.
dol_decode($chain, $key='1')
Decode a base 64 encoded + specific delta change.
dolGetLdapPasswordHash($password, $type='md5')
Returns a specific ldap hash of a password.
httponly_accessforbidden($message=1, $http_response_code=403, $stringalreadysanitized=0)
Show a message to say access is forbidden and stop program.
dolDecrypt($chain, $key='')
Decode a string with a symetric encryption.
dol_hash($chain, $type='0')
Returns a hash (non reversible encryption) of a string.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.