Merge pull request #214 from delcroip/develop

4.6.2

build/docker-compose.yml

@@ -12,8 +12,7 @@ services:
       - ..\..\dolibarr_page_from_SQLtable\page_from_table:/var/www/build
     ports:
       - 18080:80
-    env_file:
-      .env
+    env_file: .env
     links:
       - database
   database:
@@ -22,15 +21,14 @@ services:
     volumes:
       - mysql_data_10:/var/lib/mysql
       - ./mount:/docker-entrypoint-initdb.d
-## How to reset database
-# 1 on the host download the right db (ver 9 bellow) because  the container doesn't have wget
-#wget https://github.com/Dolibarr/dolibarr/raw/develop/dev/initdemo/mysqldump_dolibarr_9.0.0.sql -o dump.sql
-# 2 uncomment the line - ./dump.sql:/var/www/html/dump.sql
-# 3 Attach shell to db containter and run those two commands
-#mysql -u root -p -e "SELECT concat('DROP TABLE IF EXISTS `', table_name, '`;') FROM information_schema.tables WHERE table_schema = 'dolibarr';"
-#mysql -u root -p dolibarr < /var/www/html/dump.sql
-    env_file:
-      .env
+    ## How to reset database
+    # 1 on the host download the right db (ver 9 bellow) because  the container doesn't have wget
+    #wget https://github.com/Dolibarr/dolibarr/raw/develop/dev/initdemo/mysqldump_dolibarr_9.0.0.sql -o dump.sql
+    # 2 uncomment the line - ./dump.sql:/var/www/html/dump.sql
+    # 3 Attach shell to db containter and run those two commands
+    #mysql -u root -p -e "SELECT concat('DROP TABLE IF EXISTS `', table_name, '`;') FROM information_schema.tables WHERE table_schema = 'dolibarr';"
+    #mysql -u root -p dolibarr < /var/www/html/dump.sql
+    env_file: .env
     environment:
       MYSQL_ROOT_PASSWORD: ${DOLI_DB_PASSWORD}
       MYSQL_DATABASE: ${DOLI_DB_NAME}
@@ -39,5 +37,4 @@ services:
 #    ports:
 #      - 3306:3306
 volumes:
-  mysql_data_10:
-  # password admin adminadmin
+  mysql_data_10: # password admin adminadmin

htdocs/timesheet/AttendanceEventAdmin.php

@@ -505,7 +505,7 @@ function init_myfunc()
                 $duration = ($obj->date_time_event_start <> "")
                     ?$db->jdate($obj->date_time_event)-$db->jdate($obj->date_time_event_start):'';
                 print "<td>".formatTime($duration, 0)."</td>";
-                print '<td><a href = "AttendanceEventAdmin.php?action=delete&id='.$obj->rowid.'">'
+                print '<td><a href = "AttendanceEventAdmin.php?action=delete&token='.$token.'&id='.$obj->rowid.'">'
                     .img_delete().'</a></td>';
                 print "</tr>";
             }

htdocs/timesheet/Timesheet.php

@@ -222,7 +222,7 @@
     print $task_timesheet->getHTMLGetOtherUserTs($SubordiateIds, $userid, $admin, $token);
 }
 //$ajax = false;
-$Form = $task_timesheet->getHTMLNavigation($optioncss);
+$Form = $task_timesheet->getHTMLNavigation($optioncss, $token);
 $Form .= $task_timesheet->getHTMLFormHeader();
 $Form .= $task_timesheet->getHTMLActions();
      if (getConf('TIMESHEET_WHITELIST') == 1) {

htdocs/timesheet/TimesheetFavouriteAdmin.php

@@ -57,11 +57,11 @@
 $id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
 $action = GETPOST('action', 'alpha');
-$backtopage = GETPOST('backtopage', 'aplha');
-$cancel = GETPOST('cancel', 'aplha');
-$confirm = GETPOST('confirm', 'aplha');
-$filter = GETPOST('filter', 'aplha');
-$param = GETPOST('param', 'aplha');
+$backtopage = GETPOST('backtopage', 'alpha');
+$cancel = GETPOST('cancel', 'alpha');
+$confirm = GETPOST('confirm', 'alpha');
+$filter = GETPOST('filter', 'alpha');
+$param = GETPOST('param', 'alpha');
 $token = GETPOST('token', 'alpha');
 $ajax = GETPOST('ajax', 'int');
 //// Get parameters
@@ -121,16 +121,14 @@
     if (GETPOST('User', 'int') == "") {
         //to keep the token on javvascript reload {
         $token = getToken();
-        $_SESSION['timesheet'][$token] = array();
-        $_SESSION['timesheet'][$token]['action'] = $action;
     } else {
         $editedUser = GETPOST('User', 'int');
         $editedProject = GETPOST('Project', 'int');
     }
 } elseif (($action == 'add') || ($action == 'update' && ($id>0 || !empty($ref)))) {
     //block resubmit
-    if ((empty($token) || (!isset($_SESSION['timesheet'][$token])))) {
-            setEventMessage('WrongTimeStamp_requestNotExpected', 'errors');
+    if ((empty($token))) {
+            setEventMessage('errors');
             $action = ($action == 'add')?'create':'edit';
     }
     //retrive the data
@@ -254,8 +252,6 @@
     echo json_encode(array('errors'=> $object->errors));
     ob_end_flush();
     exit();
-} else {
-    unset($_SESSION['timesheet'][$token]);
 }
 /***************************************************
 * VIEW
@@ -294,7 +290,7 @@ function init_myfunc()
         $edit = 1;
     case 'delete';
         if ($action == 'delete' && ($id>0 || $ref!="")) {
-            $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&id='.$id, 
+            $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&token='.$token.'&id='.$id, 
                 $langs->trans('DeleteTimesheetwhitelist'), $langs->trans('ConfirmDeleteTimesheetwhitelist'), 
                 'confirm_delete', '', 0, 1);
             if ($ret == 'html') print '<br />';
@@ -496,17 +492,17 @@ function init_myfunc()
             $userId = (is_object($user)?$user->id:$user);
             if (empty($reshook) && ($admin || $userId == $object->user)) {
                 print '<div class = "tabsAction">';
-                print '<a href = "'.$PHP_SELF.'?id='.$id.'&action=edit" class = "butAction">'
+                print '<a href = "'.$PHP_SELF.'?id='.$id.'&action=edit&token='.$token.'" class = "butAction">'
                     .$langs->trans('Update').'</a>';
-                print '<a class = "butActionDelete" href = "'.$PHP_SELF.'?id='.$id.'&action=delete">'
+                print '<a class = "butActionDelete" href = "'.$PHP_SELF.'?id='.$id.'&action=delete&token='.$token.'">'
                     .$langs->trans('Delete').'</a>';
                 print '</div>';
             }
         }
         break;
     case 'delete':
         if (($id>0 || $ref!='')) {
-            $ret = $form->form_confirm('?action=confirm_delete&id='.$id, 
+            $ret = $form->form_confirm('?action=confirm_delete&token='.$token.'&id='.$id, 
                 $langs->trans('DeleteTimesheetwhitelist'), 
                 $langs->trans('ConfirmDeleteTimesheetwhitelist'), 'confirm_delete', '', 0, 1);
             if ($ret == 'html') print '<br />';
@@ -713,7 +709,7 @@ function init_myfunc()
                     print "<td>".$obj->subtask."</td>";
                     print "<td>".dol_print_date($obj->date_start, 'day')."</td>";
                     print "<td>".dol_print_date($obj->date_end, 'day')."</td>";
-                    print '<td><a href = "?action=delete&id='.$obj->rowid.'">'.img_delete().'</a></td>';
+                    print '<td><a href = "?action=delete&token='.$token.'&id='.$obj->rowid.'">'.img_delete().'</a></td>';
                     print "</tr>";
                 }
                 $i++;
@@ -725,7 +721,7 @@ function init_myfunc()
         print '</table>'."\n";
         print '</from>'."\n";
         // new button
-        print '<a href="?action=create" class = "butAction" role = "button">'.$langs->trans('New');
+        print '<a href="?action=create&token='.$token.'" class = "butAction" role = "button">'.$langs->trans('New');
         print ' '.$langs->trans('Timesheetwhitelist')."</a>\n";
         break;
 }
@@ -739,15 +735,15 @@ function init_myfunc()
  */
 function reloadpage($backtopage = "", $id = "", $ref = "")
 {
-        if (!empty($backtopage)) {
-            header("Location: ".$backtopage);
-        } elseif (!empty($ref)) {
-            header("Location: ".$_SERVER["PHP_SELF"].'?action=view&ref='.$id);
-        } elseif ($id>0) {
-            header("Location: ".$_SERVER["PHP_SELF"].'?action=view&id='.$id);
-        } else{
-            header("Location: ".$_SERVER["PHP_SELF"].'?action=list');
-        }
+    if (!empty($backtopage)) {
+        header("Location: ".$backtopage);
+    } elseif (!empty($ref)) {
+        header("Location: ".$_SERVER["PHP_SELF"].'?action=view&ref='.$id);
+    } elseif ($id>0) {
+        header("Location: ".$_SERVER["PHP_SELF"].'?action=view&id='.$id);
+    } else{
+        header("Location: ".$_SERVER["PHP_SELF"].'?action=list');
+    }
 ob_end_flush();
 exit();
 }

htdocs/timesheet/TimesheetOtherApproval.php

@@ -47,8 +47,11 @@
 // end find the role
 // get other param
 $action = GETPOST('action', 'alpha');
+$offset = GETPOST('offset', 'int');
 if (!is_numeric($offset))$offset = 0;
-$print = (GETPOST('optioncss', 'alpha') == 'print')?true:false;
+$optioncss = GETPOST('optioncss', 'alpha');
+$print = ($optioncss == 'print')?true:false;
+
 $current = GETPOST('target', 'int');
 $token = GETPOST('token', 'alpha');
 if ($current == null)$current = '0';
@@ -201,19 +204,20 @@ function getHTMLNavigation($role, $optioncss, $selectList,$token, $current = 0)
     $form = new Form($db);
     $Nav = '<table class = "noborder" width = "50%">'."\n\t".'<tr>'."\n\t\t".'<th>'."\n\t\t\t";
     if ($current!=0) {
-        $Nav .= '<a href="?action=goTo&target='.($current-1);
+        $Nav .= '<a href="?action=goTo&token='.$token.'&target='.($current-1);
         $Nav .= '&role='.($role);
         if ($optioncss != '')$Nav .= '&amp;optioncss='.$optioncss;
         $Nav .= '">  &lt;&lt;'.$langs->trans("Previous").' </a>'."\n\t\t";
     }
     $Nav .= "</th>\n\t\t<th>\n\t\t\t";
     $Nav .= '<form name = "goTo" action="?action=goTo&role='.$role.'" method = "POST" >'."\n\t\t\t";
-    $Nav .= $langs->trans("GoTo").': '.$htmlSelect."\n\t\t\t";;
-    $Nav .= '<input type = "submit" value = "Go" /></form>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
+    $Nav .= $langs->trans("GoTo").': '.$htmlSelect."\n\t\t\t";
     $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
+    $Nav .= '<input type = "submit" value = "Go" /></form>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
+
 
     if ($current<count($selectList)) {
-        $Nav .= '<a href="?action=goTo&target='.($current+1);
+        $Nav .= '<a href="?action=goTo&token='.$token.'&target='.($current+1);
         $Nav .= '&role='.($role);
         if ($optioncss != '') $Nav .= '&amp;optioncss='.$optioncss;
         $Nav .= '">'.$langs->trans("Next").' &gt;&gt;</a>';
@@ -229,7 +233,7 @@ function getHTMLNavigation($role, $optioncss, $selectList,$token, $current = 0)
 function getTStobeApproved($current, $selectList)
 {
     global $db;
-    if ((!is_array($selectList) || !is_array($selectList[$current]['idList'])))return array();
+    if ((!is_array($selectList) ||  !array_key_exists($current,$selectList) ||!is_array($selectList[$current]['idList'])))return array();
     $listTTA = array();
     foreach ($selectList[$current]['idList'] as $idTTA) {
         $TTA = new TimesheetTask($db);
@@ -340,7 +344,7 @@ function getHTMLRows($objectArray)
 {
     global $langs, $conf;
     $headers = array('Approval', 'Note', 'Tasks', 'User');
-    if (!is_array($objectArray) || !is_object($objectArray[0])) return -1;
+    if (!is_array($objectArray) || !array_key_exists(0,$objectArray) || !is_object($objectArray[0])) return -1;
     echo '<tr class = "liste_titre">';
     echo '<th>'.$langs->trans('Approval').'</th>';
     echo '<th>'.$langs->trans('Note').'</th>';

htdocs/timesheet/TimesheetTeamApproval.php

@@ -245,7 +245,7 @@
     }
 } else{
 
-    $Form .= '<h1>'.$langs->trans('NothingToValidate').'</h1>';
+    $Form = '<h1>'.$langs->trans('NothingToValidate').'</h1>';
     $staticTs = new TimesheetUserTasks($db);
     $staticTs->token = $token;
     $Form .= $staticTs->getHTMLFooterAp($current);
@@ -366,18 +366,18 @@ function getHTMLNavigation($optioncss, $selectList, $token, $current = 0)
     $form = new Form($db);
     $Nav = '<table class = "noborder" width = "50%">'."\n\t".'<tr>'."\n\t\t".'<th>'."\n\t\t\t";
     if ($current!=0) {
-        $Nav .= '<a href="?action=goTo&target='.($current-1).'"';
+        $Nav .= '<a href="?action=goTo&token='.$token.'&target='.($current-1).'"';
         if ($optioncss != '')$Nav .= '&amp;optioncss='.$optioncss;
         $Nav .= '">  &lt;&lt;'.$langs->trans("Previous").' </a>'."\n\t\t";
     }
     $Nav .= "</th>\n\t\t<th>\n\t\t\t";
-    $Nav .= '<form name = "goTo" action="?action=goTo" method = "POST" >'."\n\t\t\t";
+    $Nav .= '<form name = "goTo" action="?action=goTo&token='.$token.'" method = "POST" >'."\n\t\t\t";
     $Nav .= '<input type = "hidden" id="csrf-token" name = "token" value = "'.$token.'"/>';
 
     $Nav .= $langs->trans("GoTo").': '.$htmlSelect."\n\t\t\t";;
     $Nav .= '<input type = "submit" value = "Go" /></form>'."\n\t\t</th>\n\t\t<th>\n\t\t\t";
     if ($current<count($selectList)) {
-        $Nav .= '<a href="?action=goTo&target='.($current+1);
+        $Nav .= '<a href="?action=goTo&token='.$token.'&target='.($current+1);
         if ($optioncss != '') $Nav .= '&amp;optioncss='.$optioncss;
         $Nav .= '">'.$langs->trans("Next").' &gt;&gt;</a>';
     }

htdocs/timesheet/TimesheetUserTasksAdmin.php

@@ -295,7 +295,7 @@ function init_myfunc()
         $edit = 1;
     case 'delete';
         if ($action == 'delete' && ($id>0 || $ref!="")) {
-         $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&id='
+         $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&token='.$token.'&id='
             .$id, $langs->trans('DeleteTimesheetuser'), 
             $langs->trans('ConfirmDelete'), 'confirm_delete', '', 0, 1);
         if ($ret == 'html') print '<br />';
@@ -434,12 +434,12 @@ function init_myfunc()
                 //if ($user->rights->Timesheetuser->edit)
                 //{
                     print '<a href = "'.$PHP_SELF.'?id='.$id
-                        .'&action=edit" class = "butAction">'.$langs->trans('Update').'</a>';
+                        .'&action=edit&token='.$token.'" class = "butAction">'.$langs->trans('Update').'</a>';
                 //}
                 //if ($user->rights->Timesheetuser->delete)
                 //{
                     print '<a class = "butActionDelete" href = "'.$PHP_SELF.'?id='
-                        .$id.'&action=delete">'.$langs->trans('Delete').'</a>';
+                        .$id.'&action=delete&token='.$token.'">'.$langs->trans('Delete').'</a>';
                 //}
                 //else
                 //{
@@ -494,7 +494,7 @@ function init_myfunc()
         break;
     case 'delete':
         if (($id>0 || $ref!='')) {
-         $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&id='.$id, $langs->trans('DeleteTimesheetuser'), $langs->trans('ConfirmDelete'), 'confirm_delete', '', 0, 1);
+         $ret = $form->form_confirm($PHP_SELF.'?action=confirm_delete&token='.$token.'&id='.$id, $langs->trans('DeleteTimesheetuser'), $langs->trans('ConfirmDelete'), 'confirm_delete', '', 0, 1);
          if ($ret == 'html') print '<br />';
          //to have the object to be deleted in the background
         }
@@ -630,7 +630,7 @@ function init_myfunc()
                             print "<td>".print_generic('user', 'rowid', $obj->fk_userid, 'lastname', 'firstname', ' ')."</td>";
                             print "<td>".dol_print_date($obj->date_start, 'day')."</td>";
                             print "<td>".$langs->trans(strtolower($statusA[$obj->status]))."</td>";
-                            print '<td><a href = "'.$PHP_SELF.'?action=delete&id='.$obj->rowid.'">'.img_delete().'</a></td>';
+                            print '<td><a href = "'.$PHP_SELF.'?action=delete&token='.$token.'&id='.$obj->rowid.'">'.img_delete().'</a></td>';
                             print "</tr>";
                     }
                     $i++;
@@ -656,6 +656,7 @@ function init_myfunc()
  */
 function reloadpage($backtopage, $id)
 {
+    global $token;
     if (!empty($backtopage)) {
         header("Location: ".$backtopage);
     //    header("Location: ".$_SERVER["PHP_SELF"].'?action=view&ref='.$ref);
@@ -677,7 +678,7 @@ function reloadpage($backtopage, $id)
  */
 function Timesheetuser_prepare_head($object)
 {
-    global $langs, $conf, $user;
+    global $langs, $conf, $user, $token;
     $h = 0;
     $head = array();
     $head[$h][0] = $_SERVER["PHP_SELF"].'?action=view&id='.$object->id;

htdocs/timesheet/class/AttendanceEvent.class.php

@@ -269,7 +269,7 @@ public function update($user, $notrigger = 0)
      */
     public function getNomUrl($withpicto = 0, $id = 0, $ref = '' )
     {
-        global $conf, $langs;
+        global $conf, $langs,$token;
         if (! empty($conf->dol_no_mouse_hover)) $notooltip = 1;// Force disable tooltips
         $result = '';
         if (empty($ref) && $id == 0) {
@@ -750,9 +750,9 @@ public function ajaxHeartbeat($user, $json)
 */
 public function getHTMLGetOtherUserTs($idsList, $selected, $admin)
 {
-    global $langs;
+    global $langs,$token;
     $form = new Form($this->db);
-    $HTML = '<form id = "timesheetForm" name = "OtherUser" action="?action=getOtherTs" method = "POST">';
+    $HTML = '<form id = "timesheetForm" name = "OtherUser" action="?action=getOtherTs&token='.$token.'" method = "POST">';
     if (!$admin) {
         $HTML .= $form->select_dolusers($selected, 'userid', 0, null, 0, $idsList);
     } else{
@@ -885,7 +885,7 @@ public function fetchTasks($userid = '', $date = '')
             $tasksList[$i]->id = $obj->taskid;
             $tasksList[$i]->userId = $this->userid;
             $tasksList[$i]->getTaskInfo();
-            $tasksList[$i]->listed = is_array($whiteList)?$whiteList[$obj->taskid]:null;
+            $tasksList[$i]->listed = (is_array($whiteList) && array_key_exists($obj->taskid, $whiteList) )?$whiteList[$obj->taskid]:null;
             $i++;
         }
         $this->db->free($resql);

htdocs/timesheet/class/TimesheetFavourite.class.php

@@ -319,7 +319,7 @@ public function update($notrigger = 0)
      */
     public function getNomUrl($htmlcontent, $id = 0, $ref = '', $withpicto = 0)
     {
-        global $langs;
+        global $langs, $token;
         $result = '';
         if (empty($ref) && $id == 0) {
             if (!empty($this->id)) {
@@ -335,7 +335,7 @@ public function getNomUrl($htmlcontent, $id = 0, $ref = '', $withpicto = 0)
                 .'/timesheet/timesheetFavouriteAdmin.php?id='.$id.'&action=view">';
         } elseif (!empty($ref)) {
             $lien = '<a href = "'.DOL_URL_ROOT
-                .'/timesheet/timesheetFavouriteAdmin.php?ref='.$ref.'&action=view">';
+                .'/timesheet/timesheetFavouriteAdmin.php?ref='.$ref.'&action=view"&token='.$token.'>';
         } else{
             $lien = "";
         }

htdocs/timesheet/class/TimesheetTask.class.php

@@ -569,7 +569,7 @@ public function getActuals($timeStart = 0, $timeEnd = 0, $userid = 0)
         $sql .= " FROM ".MAIN_DB_PREFIX."projet_task_time AS ptt";
         $sql .= " WHERE ";
         if ($this->id == -1 && is_array($this->exclusionlist)){
-            $sql .= " ptt.fk_task not in  '".implode("','",$this->exclusionlist)."' ";
+            $sql .= " ptt.fk_task not in  ('".implode("','",$this->exclusionlist)."') ";
             $sql .= " AND (ptt.fk_user = '".$userid."') ";
             $sql .= " AND (DATE(ptt.task_datehour) >= '".$this->db->idate($timeStart)."') ";
             $sql .= " AND (DATE(ptt.task_datehour)<'".$this->db->idate($timeEnd)."')";