dolibarr  18.0.0-alpha
saveinplace.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2011-2012 Regis Houssin <regis.houssin@inodbox.com>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 3 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program. If not, see <https://www.gnu.org/licenses/>.
16  */
17 
23 if (!defined('NOTOKENRENEWAL')) {
24  define('NOTOKENRENEWAL', '1'); // Disables token renewal
25 }
26 if (!defined('NOREQUIREMENU')) {
27  define('NOREQUIREMENU', '1');
28 }
29 if (!defined('NOREQUIREAJAX')) {
30  define('NOREQUIREAJAX', '1');
31 }
32 if (!defined('NOREQUIRESOC')) {
33  define('NOREQUIRESOC', '1');
34 }
35 
36 // Load Dolibarr environment
37 require '../../main.inc.php';
38 require_once DOL_DOCUMENT_ROOT.'/core/class/genericobject.class.php';
39 
40 $field = GETPOST('field', 'alpha', 2);
41 $element = GETPOST('element', 'alpha', 2);
42 $table_element = GETPOST('table_element', 'alpha', 2);
43 $fk_element = GETPOST('fk_element', 'alpha', 2);
44 $id = $fk_element;
45 
46 /* Example:
47 field:editval_ref_customer (8 first chars will removed to know name of property)
48 element:contrat
49 table_element:contrat
50 fk_element:4
51 type:string
52 value:aaa
53 loadmethod:
54 savemethod:
55 savemethodname:
56 */
57 
58 // Load object according to $id and $element
59 $object = fetchObjectByElement($id, $element);
60 
61 $module = $object->module;
62 $element = $object->element;
63 $usesublevelpermission = ($module != $element ? $element : '');
64 if ($usesublevelpermission && !isset($user->rights->$module->$element)) { // There is no permission on object defined, we will check permission on module directly
65  $usesublevelpermission = '';
66 }
67 
68 //print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n";
69 
70 // Security check
71 $result = restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission, 'fk_soc', 'rowid', 0, 1); // Call with mode return
72 if (!$result) {
73  httponly_accessforbidden('Not allowed by restrictArea');
74 }
75 
76 if (!getDolGlobalString('MAIN_USE_JQUERY_JEDITABLE')) {
77  httponly_accessforbidden('Can be used only when option MAIN_USE_JQUERY_JEDITABLE is set');
78 }
79 
80 
81 /*
82  * View
83  */
84 
85 top_httphead();
86 
87 //print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";
88 //print_r($_POST);
89 
90 // Load original field value
91 if (!empty($field) && !empty($element) && !empty($table_element) && !empty($fk_element)) {
92  $ext_element = GETPOST('ext_element', 'alpha', 2);
93  $field = substr($field, 8); // remove prefix val_
94  $type = GETPOST('type', 'alpha', 2);
95  $value = ($type == 'ckeditor' ? GETPOST('value', '', 2) : GETPOST('value', 'alpha', 2));
96  $loadmethod = GETPOST('loadmethod', 'alpha', 2);
97  $savemethod = GETPOST('savemethod', 'alpha', 2);
98  $savemethodname = (!empty($savemethod) ? $savemethod : 'setValueFrom');
99  $newelement = $element;
100 
101  $view = '';
102  $format = 'text';
103  $return = array();
104  $error = 0;
105 
106  if ($element != 'order_supplier' && $element != 'invoice_supplier' && preg_match('/^([^_]+)_([^_]+)/i', $element, $regs)) {
107  $element = $regs[1];
108  $subelement = $regs[2];
109  }
110 
111  if ($element == 'propal') {
112  $newelement = 'propale';
113  } elseif ($element == 'fichinter') {
114  $newelement = 'ficheinter';
115  } elseif ($element == 'product') {
116  $newelement = 'produit';
117  } elseif ($element == 'member') {
118  $newelement = 'adherent';
119  } elseif ($element == 'order_supplier') {
120  $newelement = 'fournisseur';
121  $subelement = 'commande';
122  } elseif ($element == 'invoice_supplier') {
123  $newelement = 'fournisseur';
124  $subelement = 'facture';
125  } else {
126  $newelement = $element;
127  }
128 
129  $_POST['action'] = 'update'; // Hack so restrictarea will test permissions on write too
130 
131  $feature = $newelement;
132  $feature2 = $subelement;
133  $object_id = $fk_element;
134  if ($feature == 'expedition' || $feature == 'shipping') {
135  $feature = 'commande';
136  $object_id = 0;
137  }
138  if ($feature == 'shipping') {
139  $feature = 'commande';
140  }
141  if ($feature == 'payment') {
142  $feature = 'facture';
143  }
144  if ($feature == 'payment_supplier') {
145  $feature = 'fournisseur';
146  $feature2 = 'facture';
147  }
148  //var_dump(GETPOST('action','aZ09'));
149  //var_dump($newelement.'-'.$subelement."-".$feature."-".$object_id);
150  $check_access = restrictedArea($user, $feature, $object_id, '', $feature2);
151  //var_dump($user->rights);
152  /*
153  if (!empty($user->rights->$newelement->creer) || !empty($user->rights->$newelement->create) || !empty($user->rights->$newelement->write)
154  || (isset($subelement) && (!empty($user->rights->$newelement->$subelement->creer) || !empty($user->rights->$newelement->$subelement->write)))
155  || ($element == 'payment' && $user->rights->facture->paiement)
156  || ($element == 'payment_supplier' && $user->rights->fournisseur->facture->creer))
157  */
158 
159  if ($check_access) {
160  // Clean parameters
161  $newvalue = trim($value);
162 
163  if ($type == 'numeric') {
164  $newvalue = price2num($newvalue);
165 
166  // Check parameters
167  if (!is_numeric($newvalue)) {
168  $error++;
169  $return['error'] = $langs->trans('ErrorBadValue');
170  }
171  } elseif ($type == 'datepicker') {
172  $timestamp = GETPOST('timestamp', 'int', 2);
173  $format = 'date';
174  $newvalue = ($timestamp / 1000);
175  } elseif ($type == 'select') {
176  $loadmethodname = 'load_cache_'.$loadmethod;
177  $loadcachename = 'cache_'.$loadmethod;
178  $loadviewname = 'view_'.$loadmethod;
179 
180  $form = new Form($db);
181  if (method_exists($form, $loadmethodname)) {
182  $ret = $form->$loadmethodname();
183  if ($ret > 0) {
184  $loadcache = $form->$loadcachename;
185  $value = $loadcache[$newvalue];
186 
187  if (!empty($form->$loadviewname)) {
188  $loadview = $form->$loadviewname;
189  $view = $loadview[$newvalue];
190  }
191  } else {
192  $error++;
193  $return['error'] = $form->error;
194  }
195  } else {
196  $module = $subelement = $ext_element;
197  if (preg_match('/^([^_]+)_([^_]+)/i', $ext_element, $regs)) {
198  $module = $regs[1];
199  $subelement = $regs[2];
200  }
201 
202  dol_include_once('/'.$module.'/class/actions_'.$subelement.'.class.php');
203  $classname = 'Actions'.ucfirst($subelement);
204  $object = new $classname($db);
205  $ret = $object->$loadmethodname();
206  if ($ret > 0) {
207  $loadcache = $object->$loadcachename;
208  $value = $loadcache[$newvalue];
209 
210  if (!empty($object->$loadviewname)) {
211  $loadview = $object->$loadviewname;
212  $view = $loadview[$newvalue];
213  }
214  } else {
215  $error++;
216  $return['error'] = $object->error;
217  }
218  }
219  }
220 
221  if (!$error) {
222  if ((isset($object) && !is_object($object)) || empty($savemethod)) {
223  $object = new GenericObject($db);
224  }
225 
226  // Specific for add_object_linked()
227  // TODO add a function for variable treatment
228  $object->ext_fk_element = $newvalue;
229  $object->ext_element = $ext_element;
230  $object->fk_element = $fk_element;
231  $object->element = $element;
232 
233  $ret = $object->$savemethodname($field, $newvalue, $table_element, $fk_element, $format);
234  if ($ret > 0) {
235  if ($type == 'numeric') {
236  $value = price($newvalue);
237  } elseif ($type == 'textarea') {
238  $value = dol_nl2br($newvalue);
239  }
240 
241  $return['value'] = $value;
242  $return['view'] = (!empty($view) ? $view : $value);
243  } else {
244  $return['error'] = $object->error;
245  }
246  }
247 
248  echo json_encode($return);
249  } else {
250  echo $langs->trans('NotEnoughPermissions');
251  }
252 }
httponly_accessforbidden
httponly_accessforbidden($message=1, $http_response_code=403, $stringalreadysanitized=0)
Show a message to say access is forbidden and stop program.
Definition: security.lib.php:1104
top_httphead
if(!defined('NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
Definition: main.inc.php:1477
GETPOST
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
Definition: functions.lib.php:551
dol_nl2br
dol_nl2br($stringtoencode, $nl2brmode=0, $forxml=false)
Replace CRLF in string with a HTML BR tag.
Definition: functions.lib.php:7245
dol_include_once
if(!function_exists('dol_getprefix')) dol_include_once($relpath, $classname='')
Make an include_once using default root and alternate root if it fails.
Definition: functions.lib.php:1072
$form
if($cancel &&! $id) if($action=='add' &&! $cancel) if($action=='delete') if($id) $form
Actions.
Definition: card.php:143
price2num
price2num($amount, $rounding='', $option=0)
Function that return a number with universal decimal format (decimal separator is '.
Definition: functions.lib.php:5876
restrictedArea
restrictedArea(User $user, $features, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $isdraft=0, $mode=0)
Check permissions of a user to show a page and an object.
Definition: security.lib.php:349
getDolGlobalString
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
Definition: functions.lib.php:101
Form
Class to manage generation of HTML components Only common components must be here.
Definition: html.form.class.php:52
GenericObject
Class of a generic business object.
Definition: genericobject.class.php:30
price
price($amount, $form=0, $outlangs='', $trunc=1, $rounding=-1, $forcerounding=-1, $currency_code='')
Function to format a value into an amount for visual output Function used into PDF and HTML pages.
Definition: functions.lib.php:5750
fetchObjectByElement
fetchObjectByElement($element_id, $element_type, $element_ref='')
Fetch an object from its id and element_type Inclusion of classes is automatic.
Definition: functions.lib.php:11385