updateextrafield.php

Go to the documentation of this file.

<?php
/* Copyright (C) 2022       Laurent Destailleur     <eldy@users.sourceforge.net>
 * Copyright (C) 2024-2025  Frédéric France         <frederic.france@free.fr>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
if (!defined('NOTOKENRENEWAL')) {
  define('NOTOKENRENEWAL', 1); // Disables token renewal
}
if (!defined('NOREQUIREMENU')) {
  define('NOREQUIREMENU', '1');
}
if (!defined('NOREQUIREHTML')) {
  define('NOREQUIREHTML', '1');
}
if (!defined('NOREQUIREAJAX')) {
  define('NOREQUIREAJAX', '1');
}
if (!defined('NOREQUIRESOC')) {
  define('NOREQUIRESOC', '1');
}
 
// Load Dolibarr environment
include '../../main.inc.php';
$objectType = GETPOST('objectType', 'aZ09');  // modulepart
$objectId = GETPOST('objectId', 'aZ09');
$field = GETPOST('field', 'aZ09');
$value = GETPOST('value', 'alpha');
 
$module = getElementProperties($objectType)['module'];
$element_ref = '';
if (is_numeric($objectId)) {
  $objectId = (int) $objectId;
} else {
  $element_ref = $objectId;
  $objectId = 0;
}
$object = fetchObjectByElement($objectId, $objectType, $element_ref);
if (empty($object->element)) {
  httponly_accessforbidden('Failed to get object with fetchObjectByElement(id=' . $objectId . ', objecttype=' . $objectType . ')');
}
 
$module = $object->module;
$element = $object->element;
 
// Security check
$usesublevelpermission = ($module != $element ? $element : '');
if ($usesublevelpermission && !$user->hasRight($module, $element, 'write') && !$user->hasRight($module, 'write')) { // There is no permission on object defined, we will check permission on module directly
  $usesublevelpermission = '';
}
// print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n";
 
// Security check with mode 'write', so restrictedArea() tests the write permission and not only the read
// permission, because this page makes a write operation on the object (update of an extrafield value).
$result = restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission, 'fk_soc', 'rowid', 0, 1, 'write');  // Call with nodie return
if (!$result) {
  httponly_accessforbidden('Not allowed by restrictArea');
}
 
// Add blacklist of some forbidden field name.
/* Removed, this is useful only for main fields not for extrafields
$blacklistedfields = array('pass', 'pass_crypted', 'pass_temp', 'api_key', 'openid', 'admin', 'status', 'statut');
$canreadsalary = ((isModEnabled('salaries') && $user->hasRight('salaries', 'read')) || !isModEnabled('salaries'));
if (!$canreadsalary) {
  $blacklistedfields[] = 'salary';
  $blacklistedfields[] = 'salaryextra';
  $blacklistedfields[] = 'thm';
  $blacklistedfields[] = 'tjm';
}
if (in_array($field, $blacklistedfields)) {
  access_forbidden("Can't edit a field blacklisted with name ".$field);
}
*/
 
 
/*
 * View
 */
 
dol_syslog("Call ajax core/ajax/updateextrafield.php");
 
top_httphead();
 
// Update the object field with the new value
if ($object->id > 0 && $field && isset($value)) {
  // Fetch optionals attributes and labels
  $extrafields->fetch_name_optionals_label($object->table_element);
 
  // Test specific permission of extrafield $field for object $object. It is stored into $extrafields->attributes[$object->table_element]['label']['perms'][$key]
  if (empty($field)
   || empty($extrafields->attributes[$object->table_element]['label'][$field])
   || !dol_eval((string) $extrafields->attributes[$object->table_element]['enabled'][$field])) {
    http_response_code(403);
    accessforbidden('Can\'t edit the invalid or disabled extrafield '.$field);
  }
 
  $fieldPermsExpr = $extrafields->attributes[$object->table_element]['perms'][$field] ?? '';
 
  if (!empty($fieldPermsExpr)) {
    $allowed = (int) dol_eval((string) $fieldPermsExpr);
    if (empty($allowed)) {
      http_response_code(403);
      accessforbidden('The extrafield '.$field.' has dedicated permission and you are not allowed to edit it.');
    }
  }
 
  $object->array_options['options_'.$field] = $value;
 
  if ($object instanceof Societe) {
    $result = $object->update($object->id, $user);
  } else {
    $result = $object->update($user);
  }
 
  if ($result < 0) {
    print json_encode(['status' => 'error', 'message' => 'Error updating '. $field]);
  } else {
    print json_encode(['status' => 'success', 'message' => $field . ' updated successfully']);
  }
}
 
$db->close();