dolibarr  18.0.0-alpha
objectonoff.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2015-2022 Laurent Destailleur <eldy@users.sourceforge.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 3 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program. If not, see <https://www.gnu.org/licenses/>.
16  */
17 
24 if (!defined('NOTOKENRENEWAL')) {
25  define('NOTOKENRENEWAL', '1'); // Disables token renewal
26 }
27 if (!defined('NOREQUIREMENU')) {
28  define('NOREQUIREMENU', '1');
29 }
30 if (!defined('NOREQUIREHTML')) {
31  define('NOREQUIREHTML', '1');
32 }
33 if (!defined('NOREQUIREAJAX')) {
34  define('NOREQUIREAJAX', '1');
35 }
36 if (!defined('NOREQUIRESOC')) {
37  define('NOREQUIRESOC', '1');
38 }
39 if (!defined('NOREQUIRETRAN')) {
40  define('NOREQUIRETRAN', '1');
41 }
42 
43 // Load Dolibarr environment
44 require '../../main.inc.php';
45 require_once DOL_DOCUMENT_ROOT.'/core/class/genericobject.class.php';
46 
47 $action = GETPOST('action', 'aZ09');
48 
49 $id = GETPOST('id', 'int');
50 $element = GETPOST('element', 'alpha'); // 'myobject' (myobject=mymodule) or 'myobject@mymodule' or 'myobject_mysubobject' (myobject=mymodule)
51 $field = GETPOST('field', 'alpha');
52 $value = GETPOST('value', 'int');
53 $format = 'int';
54 
55 // Load object according to $id and $element
56 $object = fetchObjectByElement($id, $element);
57 
58 $object->fields[$field] = array('type' => $format, 'enabled' => 1);
59 
60 $module = $object->module;
61 $element = $object->element;
62 $usesublevelpermission = ($module != $element ? $element : '');
63 if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // There is no permission on object defined, we will check permission on module directly
64  $usesublevelpermission = '';
65 }
66 
67 //print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n";
68 
69 // Security check
70 if (!empty($user->socid)) {
71  $socid = $user->socid;
72  if (!empty($object->socid) && $socid != $object->socid) {
73  httponly_accessforbidden("Access on object not allowed for this external user."); // This includes the exit.
74  }
75 }
76 
77 // We check permission.
78 // Check is done on $user->rights->element->create or $user->rights->element->subelement->create (because $action = 'set')
79 if (preg_match('/status$/', $field)) {
80  restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission);
81 } elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch'))) { // Special case for products
82  restrictedArea($user, 'produit|service', $object, 'product&product', '', '', 'rowid');
83 } else {
84  httponly_accessforbidden("Bad value for combination of parameters element/field."); // This includes the exit.
85 }
86 
87 
88 /*
89  * View
90  */
91 
92 top_httphead();
93 
94 print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";
95 
96 // Registering new values
97 if (($action == 'set') && !empty($id)) {
98  $triggerkey = strtoupper(($module != $element ? $module.'_' : '').$element).'_UPDATE';
99  // Special case
100  if ($triggerkey == 'SOCIETE_UPDATE') {
101  $triggerkey = 'COMPANY_MODIFY';
102  }
103  if ($triggerkey == 'PRODUCT_UPDATE') {
104  $triggerkey = 'PRODUCT_MODIFY';
105  }
106 
107  $result = $object->setValueFrom($field, $value, $object->table_element, $id, $format, '', $user, $triggerkey);
108 
109  if ($result < 0) {
110  print $object->error;
111  http_response_code(500);
112  exit;
113  }
114 }
httponly_accessforbidden
httponly_accessforbidden($message=1, $http_response_code=403, $stringalreadysanitized=0)
Show a message to say access is forbidden and stop program.
Definition: security.lib.php:1104
top_httphead
if(!defined('NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
Definition: main.inc.php:1477
dol_escape_htmltag
dol_escape_htmltag($stringtoescape, $keepb=0, $keepn=0, $noescapetags='', $escapeonlyhtmltags=0)
Returns text escaped for inclusion in HTML alt or title tags, or into values of HTML input fields.
Definition: functions.lib.php:1534
GETPOST
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
Definition: functions.lib.php:551
restrictedArea
restrictedArea(User $user, $features, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $isdraft=0, $mode=0)
Check permissions of a user to show a page and an object.
Definition: security.lib.php:349
fetchObjectByElement
fetchObjectByElement($element_id, $element_type, $element_ref='')
Fetch an object from its id and element_type Inclusion of classes is automatic.
Definition: functions.lib.php:11385