Issues (1940)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

programs/planning.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/************************************************************************
3
 * OVIDENTIA http://www.ovidentia.org                                   *
4
 ************************************************************************
5
 * Copyright (c) 2003 by CANTICO ( http://www.cantico.fr )              *
6
 *                                                                      *
7
 * This file is part of Ovidentia.                                      *
8
 *                                                                      *
9
 * Ovidentia is free software; you can redistribute it and/or modify    *
10
 * it under the terms of the GNU General Public License as published by *
11
 * the Free Software Foundation; either version 2, or (at your option)  *
12
 * any later version.													*
13
 *																		*
14
 * This program is distributed in the hope that it will be useful, but  *
15
 * WITHOUT ANY WARRANTY; without even the implied warranty of			*
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.					*
17
 * See the  GNU General Public License for more details.				*
18
 *																		*
19
 * You should have received a copy of the GNU General Public License	*
20
 * along with this program; if not, write to the Free Software			*
21
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,*
22
 * USA.																	*
23
************************************************************************/
24
25
26
require_once $GLOBALS['babInstallPath'].'utilit/defines.php';
27
include_once dirname(__FILE__)."/functions.php";
28
include_once dirname(__FILE__)."/utilit/vacincl.php";
29
include_once dirname(__FILE__)."/utilit/planningincl.php";
30
include_once dirname(__FILE__)."/utilit/agent.class.php";
31
32
33
34
35
36
37
38
class absences_PlanningTreeView
39
{
40
    public $altbg = true;
41
    
42
43
    private $res;
44
45
    public function __construct()
46
    {
47
        global $babDB;
48
49
        $this->t_name = absences_translate('Search by name');
50
        $this->t_quantity = absences_translate('Quantity');
51
52
    }
53
54
    
55
    private function addEntitesToTree(Widget_SimpleTreeView $tree, $root)
56
    {
57
        global $babDB;
58
        $W = bab_Widgets();
59
        $addon = absences_addon();
60
        
61
        $id_chart = absences_getVacationOption('id_chart');
62
        $res = $babDB->db_query('SELECT e.id entity, e.name, t.id, t.id_parent 
63
            FROM 
64
                
65
                bab_oc_trees t 
66
                    LEFT JOIN bab_oc_entities e ON e.id_node=t.id 
67
            
68
            WHERE t.id_user='.$babDB->quote($id_chart).' ORDER BY name
69
        ');
70
        
71
        while ($arr = $babDB->db_fetch_assoc($res)) {
72
            
73
            $id_parent = $arr['id_parent'] ? 'entity'.$arr['id_parent'] : $root;
74
            $entity = $W->Link($arr['name'], $addon->getUrl().'planning&idx=entity_cal&ide='.$arr['entity'], 'entity'.$arr['id']);
75
            $entity->addClass('icon')->addClass(Func_Icons::OBJECTS_ORGANIZATION);
76
            
77
            $element = $tree->createElement($entity->getId());
78
            $element->setItem($entity);
79
            
80
            $tree->appendElement($element, $id_parent);
81
            
82
            $element->addAction(
83
                'edit_entity',
84
                absences_translate('Edit entity planning'),
85
                $GLOBALS['babSkinPath'] . 'images/Puces/edit.png',
86
                $addon->getUrl().'planning&idx=edit_entity&ide='.$arr['entity'],
87
                ''
88
            );
89
        }
90
    }
91
    
92
    
93
    private function addCustomToTree(Widget_SimpleTreeView $tree, $root)
94
    {
95
        global $babDB;
96
        $W = bab_Widgets();
97
        $addon = absences_addon();
98
        
99
        $res = $babDB->db_query('SELECT id, name FROM absences_custom_planning ORDER BY name');
100
        while($arr = $babDB->db_fetch_assoc($res)) {
101
            
102
            $custom = $W->Link($arr['name'], $addon->getUrl().'planning&idx=custom&id='.$arr['id'], 'custom'.$arr['id']);
103
            $custom->addClass('icon')->addClass(Func_Icons::OBJECTS_ORGANIZATION);
104
            
105
            $element = $tree->createElement($custom->getId());
106
            $element->setItem($custom);
107
            
108
            $tree->appendElement($element, $root);
109
            
110
            $element->addAction(
111
                    'set_users_custom',
112
                    absences_translate('Set custom planning displayed users'),
113
                    $GLOBALS['babSkinPath'] . 'images/Puces/user-group-new.png',
114
                    $addon->getUrl().'planning&idx=setusers&id='.$arr['id'],
115
                    ''
116
            );
117
            
118
            
119
            $element->addAction(
120
                    'edit_custom',
121
                    absences_translate('Edit custom planning'),
122
                    $GLOBALS['babSkinPath'] . 'images/Puces/edit.png',
123
                    $addon->getUrl().'planning&idx=edit&id='.$arr['id'],
124
                    ''
125
            );
126
            
127
128
            
129
        }
130
    }
131
132
133
    public function display()
134
    {
135
        bab_functionality::includefile('Icons');
136
        
137
        $addon = absences_addon();
138
        $W = bab_Widgets();
139
        $tree = $W->SimpleTreeView('plannings');
140
        $tree->setPersistent();
141
        $tree->addClass(Func_Icons::ICON_LEFT_16);
142
        
143
        
144
        $rootNode = $tree->createRootNode(absences_translate('Plannings'));
145
        
146
        
147
        // create nodes for each types
148
        
149
        $entities = $W->Icon(absences_translate('Entities'), Func_Icons::APPS_ORGCHARTS)->setId('entities');
150
        $tree->addItem($entities, 'Root');
151
        $this->addEntitesToTree($tree, $entities->getId());
152
        
153
        
154
        // custom plannings
155
        
156
        $item = $W->Icon(absences_translate('Custom plannings'), Func_Icons::APPS_USERS)->setId('custom');
157
        $element = $tree->createElement($item->getId());
158
        $element->setItem($item);
159
        
160
        $tree->appendElement($element, 'Root');
161
        $this->addCustomToTree($tree, $item->getId());
162
        
163
        $element->addAction(
164
            'add',
165
            absences_translate('Add custom planning'),
166
            $GLOBALS['babSkinPath'] . 'images/Puces/edit_add.png',
167
            $addon->getUrl().'planning&idx=edit',
168
            ''
169
        );
170
        
171
        
172
        // complete planning
173
        
174
        if (bab_isAccessValid('absences_public_planning_groups', 1)) {
175
            $complete = $W->Link(absences_translate('Complete planning'), $addon->getUrl().'planning&idx=public')
176
                ->setId('public')
177
                ->addClass('icon')
178
                ->addClass(Func_Icons::APPS_DIRECTORIES);
179
            
180
            $element = $tree->createElement($complete->getId());
181
            $element->setItem($complete);
182
            
183
            $tree->appendElement($element, 'Root');
184
        }
185
        
186
        
187
        
188
        /*
189
        $element->addAction(
190
            'configure_public_planning',
191
            absences_translate('configure complete planning'),
192
            $GLOBALS['babSkinPath'] . 'images/Puces/edit.png',
193
            $addon->getUrl().'planning&idx=configure_public_planning',
194
            ''
195
        );
196
        */
197
198
        bab_getBody()->babEcho($tree->display($W->HtmlCanvas()));
199
    }
200
}
201
202
203
204
function absences_PlanningSave()
205
{
206
    global $babDB;
207
    require_once $GLOBALS['babInstallPath'].'admin/acl.php';
208
    $id_planning = 0;
209
    $arr = bab_pp('planning');
210
    
211
    if (isset($arr['id'])) {
212
        $id_planning = $arr['id'];
213
    }
214
    
215
    if ($id_planning) {
216
        $babDB->db_query('UPDATE absences_custom_planning SET name='.$babDB->quote($arr['name']).' 
217
                WHERE id='.$babDB->quote($id_planning));
218
        
219
    } else {
220
        
221
        $babDB->db_query('INSERT INTO absences_custom_planning (name) VALUES ('.$babDB->quote($arr['name']).')');
222
        $id_planning = $babDB->db_insert_id();
223
    }
224
    
225
    aclSetRightsString('absences_custom_planning_groups', $id_planning, $arr['groups']);
226
    
227
    $url = bab_url::get_request('tg');
228
    $url->idx = 'list';
229
    
230
    $url->location();
231
}
232
233
234
235 View Code Duplication
function absences_getPlanningValues($id)
236
{     
237
    require_once $GLOBALS['babInstallPath'].'admin/acl.php';
238
    global $babDB;
239
    
240
    $res = $babDB->db_query('SELECT * FROM absences_custom_planning WHERE id='.$babDB->quote($id));
241
    $arr = $babDB->db_fetch_assoc($res);
242
    
243
    $arr['groups'] = aclGetRightsString('absences_custom_planning_groups', $id);
244
    
245
    return $arr;
246
}
247
248
249
250
251
function absences_PlanningEdit()
252
{
253
    
254
    if (isset($_POST['planning'])) {
255
        absences_PlanningSave();
256
    }
257
    
258
    
259
    $id_planning = (int) bab_rp('id');
260
    
261
    
262
    $W = bab_Widgets();
263
    
264
    $page = $W->BabPage();
265
    
266
    if (empty($id_planning)) {
267
        $page->setTitle(absences_translate('Create new planning'));
268
    } else {
269
        $page->setTitle(absences_translate('Edit planning'));
270
    }
271
    
272
    
273
    $form = $W->Form(null, $W->VBoxLayout()->setVerticalSpacing(2, 'em'));
274
    $form->setHiddenValue('tg', bab_rp('tg'));
275
    $form->setHiddenValue('idx', bab_rp('idx'));
276
    
277
    $form->setName('planning');
278
    $form->addClass(Func_Icons::ICON_LEFT_16);
279
    
280
    $form->addClass('BabLoginMenuBackground');
281
    $form->addClass('widget-bordered');
282
    
283
    $form->addItem($W->LabelledWidget(absences_translate('Name'), $W->LineEdit()->setSize(80), 'name'));
284
    $form->addItem($W->Acl()->setName('groups')->setTitle(absences_translate('Who can view this planning?')));
285
    
286
    $buttons = $W->FlowLayout()->setHorizontalSpacing(3, 'em');
287
    $buttons->addItem($W->SubmitButton()->setLabel(absences_translate('Save')));
288
    
289
    $form->addItem($buttons);
290
    
291
    if ($id_planning) {
292
        
293
        $form->setHiddenValue('planning[id]', $id_planning);
294
        $form->setValues(array('planning' => absences_getPlanningValues($id_planning)));
295
296
        
297
        $url = bab_url::get_request('tg', 'id');
298
        $url->idx = 'delete';
299
        $buttons->addItem($W->Link(absences_translate('Delete'), $url->toString())
300
                ->setConfirmationMessage(absences_translate('Do you really want to delete this planning?'))
301
                ->addClass('icon')
302
                ->addClass(Func_Icons::ACTIONS_EDIT_DELETE));
303
    }
304
    
305
    $form->display($W->HtmlCanvas());
306
    
307
    $page->addItem($form);
308
    $page->displayHtml();
309
}
310
311
312
313
function absences_savePlanningUsers($arr)
314
{
315
    global $babDB;
316
    $id_planning = (int) bab_rp('id');
317
    
318
    $babDB->db_query('DELETE FROM absences_custom_planning_users WHERE id_planning='.$babDB->quote($id_planning));
319
    
320
    foreach($arr as $id_user) {
321
        $babDB->db_query('INSERT INTO absences_custom_planning_users (id_planning, id_user) 
322
                VALUES ('.$babDB->quote($id_planning).', '.$babDB->quote($id_user).')');
323
    }
324
    
325
    $url = bab_url::get_request('tg', 'id');
326
    $url->idx = 'list';
327
    $url->location();
328
}
329
330
331
332
function absences_PlanningSetUsers()
333
{
334
    global $babDB;
335
    
336
    $babBody = bab_getBody();
337
    $id_planning = (int) bab_rp('id');
338
    
339
    $res = $babDB->db_query('SELECT name FROM absences_custom_planning  WHERE id='.$babDB->quote($id_planning));
340
    $arr = $babDB->db_fetch_assoc($res);
341
    
342
    if (!$arr) {
343
        throw new Exception('This planning does not exists');
344
    }
345
    
346
    $babBody->setTitle(absences_translate("Planning members").' : '.$arr['name']);
347
    
348
    include_once $GLOBALS['babInstallPath'].'utilit/selectusers.php';
349
    global $babBody, $babDB;
350
    $obj = new bab_selectusers();
351
    $obj->addVar('id', $id_planning);
352
    $res = $babDB->db_query("SELECT id_user FROM absences_custom_planning_users WHERE id_planning=".$babDB->quote($id_planning));
353
    while (list($id) = $babDB->db_fetch_array($res)) {
354
        $obj->addUser($id);
355
    }
356
    $obj->setRecordCallback('absences_savePlanningUsers');
357
    $babBody->babecho($obj->getHtml());
358
}
359
360
361
362
363
function absences_planningDelete()
364
{
365
    global $babDB;
366
    $id_planning = (int) bab_rp('id');
367
    
368
    $babDB->db_query('DELETE FROM absences_custom_planning WHERE id='.$babDB->quote($id_planning));
369
    
370
    $url = bab_url::get_request('tg');
371
    $url->idx = 'list';
372
    
373
    $url->location();
374
}
375
376 View Code Duplication
function absences_getPlanningName($id)
377
{
378
    global $babDB;
379
    $res = $babDB->db_query("SELECT name FROM absences_custom_planning WHERE id=".$babDB->quote($id));
380
    $arr = $babDB->db_fetch_assoc($res);
381
    return $arr['name'];
382
}
383
384
function absences_getPlanningUsers($id)
385
{
386
    global $babDB;
387
    $users = array();
388
    $res = $babDB->db_query("SELECT id_user FROM absences_custom_planning_users WHERE id_planning=".$babDB->quote($id));
389
    while (list($id) = $babDB->db_fetch_array($res)) {
390
        $users[$id] = $id;
391
    }
392
    
393
    return $users;
394
}
395
396
/**
397
 * Display a vacation calendar, do not test access right per user
398
 * 
399
 * @param	array		$users		array of id_user to display
400
 * @param	boolean		$period		allow period selection, first step of vacation request
401
 */
402
function absences_displayCalendar($users, $period = false) {
403
    
404
    $display_users = false;
405
    $defaultNbMonth = 12;
406
    if (count($users) > 1) {
407
        $display_users = true;
408
        $defaultNbMonth = 1;
409
    }
410
    
411
    $nbmonth = (int) bab_rp('nbmonth', $defaultNbMonth);
412
    absences_viewVacationCalendar($users, $period, true, $nbmonth, $display_users);
413
}
414
415
416
417
/**
418
 * Display a vacation calendar
419
 * test access rights
420
 * @param	array		$users		array of id_user to display
421
 * @param	boolean		$period		allow period selection, first step of vacation request
422
 */
423
function absences_userViewVacationCalendar($users, $period = false) {
424
425
	global $babBody, $babDB;
426
	$current_agent = absences_Agent::getCurrentUser();
427
428
	foreach($users as $uid) {
429
		$target_agent = absences_Agent::getFromIdUser($uid);
430
		if (!$current_agent->canViewCalendarOf($target_agent)) {
431
			$babBody->addError(absences_translate('Access denied'));
432
			$babBody->babPopup('');
433
			return;
434
		}
435
	}
436
437
	absences_displayCalendar($users, $period);
438
}
439
440
441
442
/**
443
 * Get users to display in a entity calendar
444
 * @param int $ide
445
 */
446
function absences_getEntityUsers($ide)
447
{
448
    global $babDB;
449
    $users = array();
450
    $res = bab_OCSelectEntityCollaborators($ide);
451
    while ($arr = $babDB->db_fetch_assoc($res)) {
452
        $users[$arr['id_user']] = $arr['id_user'];
453
    }
454
455
    return $users;
456
}
457
458
459
/**
460
 * Affiche le planning d'une entite d'organigramme
461
 * @param int $ide
462
 */
463
function entity_cal($ide)
464
{
465
466
	global $babDB, $babBody;
467
	
468
	$agent = absences_Agent::getCurrentUser();
469
	
470
    $entity_planning = (bool) absences_getVacationOption('entity_planning');
471
    
472
    if (!$entity_planning && !$agent->isEntityManager() && !$agent->isManager()) {
473
        $babBody->msgerror = absences_translate("Access denied to entity planning, access has been disabled by administrator");
474
		return;
475
    }
476
    
477
    $entity = bab_OCGetEntity($ide);
478
    bab_getBody()->setTitle($entity['name']);
479
    
480
    $display_types = (bool) absences_getVacationOption('entity_planning_display_types');
481
    
482
    
483
	$calendars = $agent->getCalendarEntities();
484
	
485
	if (!$display_types) {
486
	    // les personnes autorisees peuvent quand meme voir les types
487
	    $display_types = (isset($calendars[$ide]) || $agent->isEntityManagerOf($ide));
488
	}
489
	
490
	$users = absences_getEntityUsers($ide);
491
	$all = (bool) bab_rp('all');
492
	
493
	if ($all) {
494
	    foreach (absences_getChildsEntities($ide) as $entity) {
495
	        $users += absences_getEntityUsers($entity['id']);
496
	    }
497
	}
498
	
499
500
	$defaultNbMonth = 12;
501
	if (count($users) > 1) {
502
	    $defaultNbMonth = 1;
503
	}
504
	
505
	$nbmonth = (int) bab_rp('nbmonth', $defaultNbMonth);
506
	
507
	absences_viewVacationCalendar($users, false, $display_types, $nbmonth, true);
508
509
}
510
511
512
513
514
515
516
function absences_saveEntityPlanning($userids, $params)
517
{
518
    $ide = $params['ide'];
519
    global $babDB;
520
    $babDB->db_query("DELETE FROM ".ABSENCES_PLANNING_TBL." WHERE id_entity = ".$babDB->quote($ide));
521
522 View Code Duplication
    foreach ($userids as $uid)
523
    {
524
        $babDB->db_query("INSERT INTO ".ABSENCES_PLANNING_TBL." (id_user, id_entity) VALUES ('".$babDB->db_escape_string($uid)."','".$babDB->db_escape_string($ide)."')");
525
    }
526
    
527
    $agent = absences_Agent::getCurrentUser();
528
    if ($agent->isManager()) {
529
        header('location:'.absences_addon()->getUrl()."planning&idx=list");
530
        exit;
531
    }
532
533
    header('location:'.absences_addon()->getUrl()."vacchart&idx=entities");
534
    exit;
535
}
536
537
538
539
function absences_edit_entity($ide)
540
{
541
    
542
    include_once $GLOBALS['babInstallPath'].'utilit/selectusers.php';
543
    global $babBody, $babDB;
544
    
545
    $e =  bab_OCGetEntity($ide);
546
    $babBody->setTitle(sprintf(absences_translate('Planning access "%s" (other than delegated managers above this entity)'),$e['name']));
547
548
    $obj = new bab_selectusers();
549
    $obj->addVar('ide', $ide);
550
    $res = $babDB->db_query("SELECT id_user FROM ".ABSENCES_PLANNING_TBL." WHERE id_entity=".$babDB->quote($ide));
551
    while (list($id) = $babDB->db_fetch_array($res)) {
552
        $obj->addUser($id);
553
    }
554
    $obj->setRecordCallback('absences_saveEntityPlanning');
555
    $babBody->babecho($obj->getHtml());
556
}
557
558
559
560
561
562
563
564
function absences_publicCalendar()
565
{
566
	global $babBody, $babDB;
567
	
568
	if (!bab_isAccessValid('absences_public_planning_groups', 1))
569
	{
570
		$babBody->addError(absences_translate('Access denied to public calendar'));
571
		return;
572
	}
573
	
574
	
575
	$nbmonth = (int) bab_rp('nbmonth', 1);
576
	$initusers = absences_getSearchLimit($nbmonth);
577
	
578
	$users = array();
579
	$res = absences_publicCalendarUsers(bab_rp('keyword', null), bab_rp('departments', null), bab_rp('searchtype'), bab_rp('dateb'), bab_rp('datee'), bab_rp('date'));
580
	
581
	$i = 0;
582 View Code Duplication
	while ($arr = $babDB->db_fetch_assoc($res))
583
	{
584
		$users[] = $arr['id'];
585
		if ($i > $initusers) {
586
			break;
587
		}
588
		
589
		$i++;
590
	}
591
	
592
	absences_viewVacationCalendar($users, false, true, $nbmonth, true, $babDB->db_num_rows($res));
593
}
594
595
596
597
598
599
600
function absence_canViewCalendarOf(absences_Agent $agent)
601
{
602
    if (bab_isAccessValid('absences_public_planning_groups', 1)) {
603
        return true;
604
    }
605
    
606
    require_once $GLOBALS['babInstallPath'].'utilit/userincl.php';
607
    
608
    if (!bab_isUserLogged()) {
609
        return false;
610
    }
611
    
612
    $currentAgent = absences_Agent::getCurrentUser();
613
    if ($currentAgent->canViewCalendarOf($agent)) {
614
        return true;
615
    }
616
617
    return false;
618
}
619
620
621
/**
622
 * Ouput JSON for a list of users in one month 
623
 * 
624
 * @param array     $users
625
 * @param int       $month
626
 * @param int       $year
627
 * @param string    $dateb      Search by entry dates, datepicker input
628
 * @param string    $datee      Search by entry dates, datepicker input
629
 * @throws Exception
630
 */
631
function absences_ouputUserMonthJson($users, $month, $year, $dateb, $datee)
632
{
633
	require_once $GLOBALS['babInstallPath'].'utilit/json.php';
634
	require_once dirname(__FILE__).'/utilit/agent.class.php';
635
	
636
	$users = (array) $users;
637
	$month = (int) $month;
638
	$year = (int) $year;
639
	
640
	// convert dates to ISO
641
	
642
	$datePicker = bab_Widgets()->DatePicker();
643
	
644
	$dateb = $datePicker->getISODate($dateb);
645
	$datee = $datePicker->getISODate($datee);
646
	
647
	
648
	$output = array();
649
	
650
	if (empty($users) || 0 === $month || 0 === $year)
651
	{
652
		throw new Exception('Wrong parameters');
653
	}
654
	
655
	
656
657
	foreach($users as $id_user)
658
	{
659
		$id_user = (int) $id_user;
660
		$target_agent = absences_Agent::getFromIdUser($id_user);
661
		
662
		if (!absence_canViewCalendarOf($target_agent)) {
663
			continue;
664
		}
665
		
666
		$arr = absences_getPeriodIndex($id_user, $month, $year, $dateb, $datee);
667
		foreach($arr as &$v)
668
		{
669
			$v['title'] = bab_convertStringFromDatabase($v['title'], 'UTF-8');
670
		}
671
		$output[] = $arr;
672
	}
673
674
675
	echo bab_json_encode($output);
676
	die();
677
}
678
679
680
681
682
683
/**
684
 * Output in json format
685
 * Get the list of user to display in planning, if keyword is empty, return all users
686
 * Get total number of result
687
 * 
688
 * @param string $keyword
689
 * @param array $departments
690
 * 
691
 */
692
function absences_searchUsers($keyword, $departments, $searchtype, $dateb, $datee, $date, $pos, $limit)
693
{
694
	
695
	require_once $GLOBALS['babInstallPath'].'utilit/json.php';
696
	global $babDB;
697
	
698
	if (!bab_isAccessValid('absences_public_planning_groups', 1))
699
	{
700
		die('Access denied to public calendar');
701
	}
702
	
703
	$pos = (int) $pos;
704
	$limit = (int) $limit;
705
	
706
707
	$res = absences_publicCalendarUsers($keyword, $departments, $searchtype, $dateb, $datee, $date);
708
	$count = $babDB->db_num_rows($res);
709
	
710
	if ($pos > $count)
711
	{
712
		die('pos must be lower than total count');
713
	}
714
	
715
	$babDB->db_data_seek($res, $pos);
716
	
717
	$return = array(
718
		'count' => $count,
719
		'users' => array()	
720
	);
721
	
722
	$i = 0;
723
	while($arr = $babDB->db_fetch_assoc($res))
724
	{
725
		$return['users'][] = array(
726
			'id' =>	$arr['id'],
727
			'name' => bab_convertStringFromDatabase($arr['lastname'].' '.$arr['firstname'], 'UTF-8')
728
		);
729
		$i++;
730
		
731
		if ($i > $limit)
732
		{
733
			break;
734
		}
735
	}
736
	
737
	echo bab_json_encode($return);
738
	die();
739
}
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
class absences_AccessiblePlanningsCls
758
{
759
    var $altbg = true;
760
    
761
    private $plannings = array();
762
763
    function __construct()
764
    {
765
        
766
        $this->t_name = absences_translate('Name');
767
        $this->t_calendar = absences_translate('Planning');
768
        
769
    }
770
    
771
    
772
    public function addEntities(array $entities)
773
    {
774
        $addon = absences_addon();
775
        $baseurl = new bab_url($addon->getUrl().'planning');
776
        $baseurl->idx = 'entity_cal';
777
        $baseurl->popup = 1;
778
        
779
        foreach($entities as $e) {
780
            
781
            $url = clone $baseurl;
782
            $url->ide = $e['id'];
783
            
784
            $this->plannings[] = array(
785
                'name' => $e['name'],
786
                'url' => $url
787
            );
788
        }
789
    }
790
    
791
    
792
    public function addCustomPlannings()
793
    {
794
        global $babDB;
795
        
796
        $addon = absences_addon();
797
        $baseurl = new bab_url($addon->getUrl().'planning');
798
        $baseurl->idx = 'custom';
799
        $baseurl->popup = 1;
800
        
801
        $accessibles = bab_getUserIdObjects('absences_custom_planning_groups');
802
        
803
        $res = $babDB->db_query('SELECT * FROM absences_custom_planning WHERE id IN('.$babDB->quote($accessibles).')');
804
        while ($arr = $babDB->db_fetch_assoc($res)) {
805
            
806
            $url = clone $baseurl;
807
            $url->id = $arr['id'];
808
            
809
            $this->plannings[] = array(
810
                'name' => $arr['name'],
811
                'url' => $url
812
            );
813
        }
814
    }
815
    
816
    
817
    public function addPublicPlanning()
818
    {
819
        if (!bab_isAccessValid('absences_public_planning_groups', 1)) {
820
            return;
821
        }
822
        
823
        $addon = absences_addon();
824
        $url = new bab_url($addon->getUrl().'planning');
825
        $url->idx = 'public';
826
        $url->popup = 1;
827
        
828
        
829
        $this->plannings[] = array(
830
            'name' => absences_translate('Complete planning'),
831
            'url' => $url
832
        );
833
    }
834
    
835
    
836
    public function sort()
837
    {
838
        bab_Sort::asort($this->plannings, 'name', bab_Sort::CASE_INSENSITIVE);
839
    }
840
841
842
843
    function getnext()
844
    {
845
        if (list(,$arr) = each($this->plannings)) {
846
            $this->altbg 		= !$this->altbg;
847
            $this->name 		= bab_toHtml($arr['name']);
848
            $this->url 			= bab_toHtml($arr['url']->toString());
849
            return true;
850
        }
851
        else
852
            return false;
853
    }
854
}
855
856
857
858
859
860
861
862
863
/**
864
 *
865
 */
866
function absences_accessible_plannings()
867
{
868
    $babBody = bab_getBody();
869
    
870
    $babBody->setTitle(absences_translate('Plannings list'));
871
    
872
    $agent = absences_Agent::getCurrentUser();
873
    
874
    if ($agent->isInPersonnel()) {
875
        $babBody->addItemMenu("lvreq", absences_translate("Requests"), absences_addon()->getUrl()."vacuser&idx=lvreq");
876
        if (absences_getVacationOption('display_personal_history'))
877
        {
878
            $babBody->addItemMenu("movement", absences_translate("History"), absences_addon()->getUrl()."vacuser&idx=movement");
879
        }
880
        	
881
        if (absences_getVacationOption('user_add_email'))
882
        {
883
            $babBody->addItemMenu("options", absences_translate("Options"), absences_addon()->getUrl()."vacuser&idx=options");
884
        }
885
    }
886
    
887
    if( $agent->isManager())
888
    {
889
        $babBody->addItemMenu("list", absences_translate("Management"), absences_addon()->getUrl()."vacadm");
890
    }
891
    
892
    if ($agent->isEntityManager())
893
    {
894
        $babBody->addItemMenu("entities", absences_translate("Delegate management"), absences_addon()->getUrl()."vacchart&idx=entities");
895
    }
896
    
897
    $babBody->addItemMenu("userlist", absences_translate("Plannings"), absences_addon()->getUrl()."planning&idx=userlist");
898
    
899
    
900
    $entities = $agent->getManagedEntities();
901
902
903
    global $babDB;
904
    $id_oc = absences_getVacationOption('id_chart');
905
906
    $res =$babDB->db_query("SELECT e.id, e.name, e.description
907
		FROM ".ABSENCES_PLANNING_TBL." p,
908
			bab_oc_entities e
909
		WHERE p.id_user='".$babDB->db_escape_string($GLOBALS['BAB_SESS_USERID'])."'
910
			AND p.id_entity=e.id
911
			AND e.id_oc=".$babDB->quote($id_oc));
912
    $entities = array();
913
    while ($arr = $babDB->db_fetch_assoc($res)) {
914
        $entities[] = $arr;
915
    }
916
     
917
918
    $temp = new absences_AccessiblePlanningsCls();
919
    $temp->addEntities($entities);
920
    $temp->addCustomPlannings();
921
    $temp->addPublicPlanning();
922
    $temp->sort();
923
    
924
    $babBody->babecho(bab_printTemplate($temp,  absences_addon()->getRelativePath()."planning.html", 'userlist'));
0 ignored issues
show
Deprecated Code introduced by
The method bab_addonInfos::getRelativePath() has been deprecated with message: Do not use relative path in addons Addons are subject to move out of the core folder in futures version for bab_printTemplate, replace with $addon->printTemplate() for babBody->addStyleSheet use $addon->getStylePath() instead of relative path the addStyleSheet method support full path starting with vendor/ since the 8.1.98 version

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
925
926
}
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
// main
943
944
945
$idx = bab_rp('idx', "cal");
946
947
948
949
950
switch($idx)
951
{
952
953
    case 'userlist':
954
        
955
        
956
        // liste des planning partages accessible a l'utilisateur
957
        // les entites accessibles (gestion delegue et co-gestion), les entites partages, les plannings personnalises accessibles
958
        // et le planning complet
959
        absences_accessible_plannings();
960
        break;
961
    
962
    
963
    case 'list':
964
        bab_requireCredential();
965
        $agent = absences_Agent::getCurrentUser();
966
        if(!$agent->isManager()) {
967
            $babBody->msgerror = absences_translate("Access denied to planning list");
968
            return;
969
        }
970
        
971
        $treeview = new absences_PlanningTreeView();
972
        $treeview->display();
973
        
974
        break;
975
        
976
   
977
        
978 View Code Duplication
    case 'edit': // create / edit custom planning
979
        bab_requireCredential();
980
        $agent = absences_Agent::getCurrentUser();
981
        if(!$agent->isManager()) {
982
            $babBody->addError(absences_translate("Access denied to planning"));
983
            return;
984
        }
985
        
986
        absences_PlanningEdit();
987
        
988
        break;
989
        
990
    
991 View Code Duplication
    case 'setusers':
992
        bab_requireCredential();
993
        $agent = absences_Agent::getCurrentUser();
994
        if(!$agent->isManager()) {
995
            $babBody->addError(absences_translate("Access denied to planning"));
996
            return;
997
        }
998
        
999
        absences_PlanningSetUsers();
1000
        break;
1001
        
1002
        
1003 View Code Duplication
    case 'delete':
1004
        bab_requireCredential();
1005
        $agent = absences_Agent::getCurrentUser();
1006
        if(!$agent->isManager()) {
1007
            $babBody->addError(absences_translate("Access denied to planning"));
1008
            return;
1009
        }
1010
        
1011
        absences_planningDelete();
1012
        break;
1013
        
1014
        
1015
    case 'custom':
1016
        $agent = absences_Agent::getCurrentUser();
1017
        if (!$agent->canViewCustomPlanning(bab_rp('id'))) {
1018
            $babBody->addError(absences_translate("Access denied to planning"));
1019
            return;
1020
        }
1021
        $babBody->setTitle(absences_getPlanningName(bab_rp('id')));
1022
        absences_displayCalendar(absences_getPlanningUsers(bab_rp('id')));
1023
        break;
1024
        
1025
	case "cal":
1026
		bab_requireCredential();
1027
		$agent = absences_Agent::getCurrentUser();
1028
		
1029 View Code Duplication
		if(!$agent->isInPersonnel() && !$agent->isEntityManager() && !$agent->isManager() && !$agent->isApprover())
1030
		{
1031
			$babBody->msgerror = absences_translate("Access denied to planning");
1032
			return;
1033
		}
1034
1035
		$users = explode(',',bab_rp('idu'));
1036
		absences_userViewVacationCalendar($users);
1037
		break;
1038
		
1039
	case 'entity_cal':
1040
		bab_requireCredential();
1041
		$agent = absences_Agent::getCurrentUser();
1042
		
1043
		$myplanning = false;
1044
		$myEntity = $agent->getMainEntity();
1045
		if (isset($myEntity))
1046
		{
1047
			$myplanning = ($myEntity['id'] == bab_rp('ide'));
1048
		}
1049
		
1050
		if(!$agent->canViewEntityPlanning(bab_rp('ide')))
1051
		{
1052
			$babBody->msgerror = absences_translate("Access denied to planning");
1053
			return;
1054
		}
1055
		
1056
		
1057
		entity_cal(bab_rp('ide'));
1058
		break;
1059
		
1060
1061
		
1062
	case 'edit_entity': // configure partage
1063
	    bab_requireCredential();
1064
	    $agent = absences_Agent::getCurrentUser();
1065
	    $babBody->addItemMenu("edit_entity", absences_translate("Planning access"), absences_addon()->getUrl()."planning&idx=entity_requests");
1066
	
1067
	    $ide = bab_rp('ide');
1068
	
1069
	    if($agent->canViewEntityPlanning($ide)) {
1070
	        absences_edit_entity($ide);
1071
	    }
1072
	    break;
1073
		
1074
		
1075
		
1076
	case 'public':
1077
		absences_publicCalendar();
1078
		break;
1079
		
1080
		
1081
	case 'load': // ajax
1082
		
1083
		$GLOBALS['babLanguage'] = bab_getLanguage();
1084
		
1085
		// for ovidentia < 8.4.91
1086
		$babBody = bab_getBody();
1087
		
1088
		absences_ouputUserMonthJson(bab_rp('users'), bab_rp('month'), bab_rp('year'), bab_rp('dateb'), bab_rp('datee'));
1089
		break;
1090
		
1091
		
1092
	case 'users': // ajax, public calendar only
1093
	    $departments = bab_rp('departments');
1094
	    if (empty($departments)) {
1095
	        $departments = null;
1096
	    }
1097
	    
1098
		absences_searchUsers(bab_rp('keyword'), $departments, bab_rp('searchtype'), bab_rp('dateb'), bab_rp('datee'), bab_rp('date'), bab_rp('pos'), bab_rp('limit'));
1099
		break;
1100
}
1101
1102
1103
1104
$babBody->setCurrentItemMenu($idx);
1105
bab_siteMap::setPosition('absences','User');