This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /************************************************************************ |
||
| 3 | * OVIDENTIA http://www.ovidentia.org * |
||
| 4 | ************************************************************************ |
||
| 5 | * Copyright (c) 2003 by CANTICO ( http://www.cantico.fr ) * |
||
| 6 | * * |
||
| 7 | * This file is part of Ovidentia. * |
||
| 8 | * * |
||
| 9 | * Ovidentia is free software; you can redistribute it and/or modify * |
||
| 10 | * it under the terms of the GNU General Public License as published by * |
||
| 11 | * the Free Software Foundation; either version 2, or (at your option) * |
||
| 12 | * any later version. * |
||
| 13 | * * |
||
| 14 | * This program is distributed in the hope that it will be useful, but * |
||
| 15 | * WITHOUT ANY WARRANTY; without even the implied warranty of * |
||
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * |
||
| 17 | * See the GNU General Public License for more details. * |
||
| 18 | * * |
||
| 19 | * You should have received a copy of the GNU General Public License * |
||
| 20 | * along with this program; if not, write to the Free Software * |
||
| 21 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,* |
||
| 22 | * USA. * |
||
| 23 | ************************************************************************/ |
||
| 24 | |||
| 25 | require_once dirname(__FILE__).'/entry.class.php'; |
||
| 26 | require_once dirname(__FILE__).'/entry_elem.class.php'; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * Add a fixed vacation for a user |
||
| 30 | * appelle lors de la creation/modification d'un droit de conge pre attribue |
||
| 31 | * |
||
| 32 | * @param int $id_user |
||
| 33 | * @param absences_Right $right |
||
| 34 | * @param string $remarks |
||
| 35 | * |
||
| 36 | * @throws absences_EntryException |
||
| 37 | * |
||
| 38 | * @return bool |
||
| 39 | */ |
||
| 40 | function absences_addFixedVacation($id_user, absences_Right $right, $remarks = '') |
||
| 41 | { |
||
| 42 | |||
| 43 | |||
| 44 | $entry = new absences_Entry; |
||
| 45 | $entry->id_user = $id_user; |
||
| 46 | $entry->date_begin = $right->date_begin_fixed; |
||
| 47 | $entry->date_end = $right->date_end_fixed; |
||
| 48 | $entry->comment = $remarks; |
||
| 49 | $entry->status = 'Y'; |
||
| 50 | $entry->creation_type = absences_Entry::CREATION_FIXED; |
||
| 51 | |||
| 52 | $elem = new absences_EntryElem(); |
||
| 53 | $elem->setEntry($entry); |
||
| 54 | $elem->id_right = $right->id; |
||
| 55 | $elem->quantity = $right->quantity; |
||
| 56 | $elem->date_begin = $right->date_begin_fixed; |
||
| 57 | $elem->date_end = $right->date_end_fixed; |
||
| 58 | $entry->addElement($elem); |
||
| 59 | |||
| 60 | |||
| 61 | |||
| 62 | try { |
||
| 63 | $validity = $entry->checkValidity(false); |
||
| 64 | } catch(absences_EntryException $e) |
||
| 65 | { |
||
| 66 | if (!$e->blocking) |
||
| 67 | { |
||
| 68 | // ignorer les erreur non bloquantes |
||
| 69 | $validity = true; |
||
| 70 | } else { |
||
| 71 | |||
| 72 | throw $e; |
||
| 73 | } |
||
| 74 | |||
| 75 | } |
||
| 76 | |||
| 77 | |||
| 78 | if ($validity) |
||
| 79 | { |
||
| 80 | $entry->save(); |
||
| 81 | $entry->saveElements(); |
||
| 82 | $entry->createPlannedPeriods(); |
||
| 83 | $entry->savePlannedPeriods(); |
||
| 84 | |||
| 85 | $entry->addElementsMovements(sprintf(absences_translate('Add the fixed vacation right %s to the user %s'), $right->description, bab_getUserName($id_user))); |
||
| 86 | |||
| 87 | $entry->updateCalendar(); |
||
| 88 | absences_createPeriod($entry->id); |
||
| 89 | |||
| 90 | $entry->applyDynamicRight(); |
||
| 91 | |||
| 92 | return true; |
||
| 93 | } |
||
| 94 | |||
| 95 | // on doit etre sur qu'il n'y a pas de demande existante |
||
| 96 | // ile ne devrais pas y en avoir normalement |
||
| 97 | if (false === absences_updateFixedVacation($id_user, $right)) { |
||
| 98 | |||
| 99 | return false; // tout est normal |
||
| 100 | } |
||
| 101 | |||
| 102 | // une mise a jour a ete faite |
||
| 103 | return false; |
||
| 104 | } |
||
| 105 | |||
| 106 | |||
| 107 | |||
| 108 | /** |
||
| 109 | * Update dates and quantity of a fixed vacation for a user |
||
| 110 | * appelle lors de la creation/modification d'un droit de conge pre attribue |
||
| 111 | * |
||
| 112 | * @param int $id_user |
||
| 113 | * @param absences_Right $right |
||
| 114 | * |
||
| 115 | * @return bool |
||
| 116 | */ |
||
| 117 | function absences_updateFixedVacation($id_user, absences_Right $right) |
||
| 118 | { |
||
| 119 | global $babDB; |
||
| 120 | require_once $GLOBALS['babInstallPath'].'utilit/dateTime.php'; |
||
| 121 | |||
| 122 | $res = $babDB->db_query("select |
||
| 123 | vet.id entry, |
||
| 124 | veet.id entryelem |
||
| 125 | from ".ABSENCES_ENTRIES_ELEM_TBL." veet |
||
| 126 | left join ".ABSENCES_ENTRIES_TBL." vet |
||
| 127 | on veet.id_entry=vet.id |
||
| 128 | where veet.id_right=".$babDB->quote($right->id)." |
||
| 129 | and vet.id_user=".$babDB->quote($id_user)." |
||
| 130 | "); |
||
| 131 | |||
| 132 | |||
| 133 | if (0 === $babDB->db_num_rows($res)) { |
||
| 134 | return false; |
||
| 135 | } |
||
| 136 | |||
| 137 | $entry = null; |
||
| 138 | |||
| 139 | while( $arr = $babDB->db_fetch_assoc($res)) |
||
| 140 | { |
||
| 141 | if (isset($entry)) |
||
| 142 | { |
||
| 143 | // already updated, all other entries must not exists |
||
| 144 | absences_delete_request($arr['entry']); |
||
| 145 | continue; |
||
| 146 | } |
||
| 147 | |||
| 148 | if (absences_Right::FIXED !== (int) $right->kind) { |
||
| 149 | continue; |
||
| 150 | } |
||
| 151 | |||
| 152 | $entry = new absences_Entry; |
||
| 153 | $entry->id = (int) $arr['entry']; |
||
| 154 | $entry->date_begin = $right->date_begin_fixed; |
||
| 155 | $entry->date_end = $right->date_end_fixed; |
||
| 156 | $entry->id_user = $id_user; |
||
| 157 | $entry->status = 'Y'; |
||
| 158 | $entry->creation_type = absences_Entry::CREATION_FIXED; |
||
| 159 | |||
| 160 | $entry_elem = new absences_EntryElem; |
||
| 161 | $entry_elem->id = (int) $arr['entryelem']; |
||
| 162 | $entry_elem->id_right = $right->id; |
||
| 163 | $entry_elem->id_entry = $entry->id; |
||
| 164 | $entry_elem->quantity = $right->quantity; |
||
| 165 | $entry_elem->date_begin = $right->date_begin_fixed; |
||
| 166 | $entry_elem->date_end = $right->date_end_fixed; |
||
| 167 | $entry_elem->setEntry($entry); |
||
| 168 | |||
| 169 | $entry->addElement($entry_elem); |
||
| 170 | |||
| 171 | |||
| 172 | try { |
||
| 173 | $validity = $entry->checkValidity(); |
||
| 174 | } catch(absences_EntryException $e) |
||
| 175 | { |
||
| 176 | if (!$e->blocking) |
||
| 177 | { |
||
| 178 | // ignorer les erreur non bloquantes |
||
| 179 | $validity = true; |
||
| 180 | } else { |
||
| 181 | |||
| 182 | throw $e; |
||
| 183 | } |
||
| 184 | |||
| 185 | } |
||
| 186 | |||
| 187 | |||
| 188 | $begin = BAB_DateTime::fromIsoDateTime($entry->date_begin); |
||
| 189 | $end = BAB_DateTime::fromIsoDateTime($entry->date_end); |
||
| 190 | |||
| 191 | |||
| 192 | if ($validity) |
||
| 193 | { |
||
| 194 | $entry->save(); |
||
| 195 | $entry->saveElements(); |
||
| 196 | $entry->createPlannedPeriods(); |
||
| 197 | $entry->savePlannedPeriods(); |
||
| 198 | |||
| 199 | $entry->addElementsMovements(sprintf(absences_translate('Update fixed vacation %s for the user %s'), $right->description, bab_getUserName($id_user))); |
||
| 200 | |||
| 201 | $entry->applyDynamicRight(); |
||
| 202 | |||
| 203 | |||
| 204 | // try to update event copy in other backend (caldav) |
||
| 205 | absences_updatePeriod($arr['entry'], $begin, $end); |
||
| 206 | |||
| 207 | } else { |
||
| 208 | absences_removeFixedVacation($arr['entry']); |
||
| 209 | |||
| 210 | // remove period in calendar backend |
||
| 211 | if ($period = absences_getPeriod($arr['entry'], $id_user, $begin, $end)) { |
||
| 212 | $period->delete(); |
||
| 213 | } |
||
| 214 | } |
||
| 215 | |||
| 216 | |||
| 217 | |||
| 218 | } |
||
| 219 | |||
| 220 | return true; |
||
| 221 | } |
||
| 222 | |||
| 223 | |||
| 224 | /** |
||
| 225 | * Remove fixed vacation |
||
| 226 | * return false if entry cannot be removed (entry not found), or true on success |
||
| 227 | * |
||
| 228 | * @param int $id_entry |
||
| 229 | * |
||
| 230 | * @return bool |
||
| 231 | */ |
||
| 232 | function absences_removeFixedVacation($id_entry) |
||
| 233 | { |
||
| 234 | global $babDB; |
||
| 235 | require_once $GLOBALS['babInstallPath'].'utilit/dateTime.php'; |
||
| 236 | |||
| 237 | $res = $babDB->db_query("select id_user, date_begin, date_end FROM ".ABSENCES_ENTRIES_TBL." where id=".$babDB->quote($id_entry)); |
||
| 238 | $arr = $babDB->db_fetch_array($res); |
||
| 239 | |||
| 240 | |||
| 241 | if (!$arr) |
||
| 242 | { |
||
| 243 | // not found |
||
| 244 | return false; |
||
| 245 | } |
||
| 246 | |||
| 247 | $babDB->db_query("DELETE from ".ABSENCES_ENTRIES_TBL." where id='".$babDB->db_escape_string($id_entry)."'"); |
||
| 248 | $babDB->db_query("DELETE from ".ABSENCES_ENTRIES_ELEM_TBL." where id_entry='".$babDB->db_escape_string($id_entry)."'"); |
||
| 249 | $babDB->db_query("UPDATE absences_movement SET id_request='0' where request_class='absences_Entry' AND id_request='".$babDB->db_escape_string($id_entry)."'"); |
||
| 250 | |||
| 251 | absences_clearCalendars(); |
||
| 252 | |||
| 253 | // try to delete event copy in other backend (caldav) |
||
| 254 | |||
| 255 | $begin = BAB_DateTime::fromIsoDateTime($arr['date_begin']); |
||
| 256 | $end = BAB_DateTime::fromIsoDateTime($arr['date_end']); |
||
| 257 | $period = absences_getPeriod($id_entry, $arr['id_user'], $begin, $end); |
||
| 258 | if ($period) { |
||
| 259 | $period->delete(); |
||
| 260 | } |
||
| 261 | |||
| 262 | return true; |
||
| 263 | } |
||
| 264 | |||
| 265 | |||
| 266 | |||
| 267 | |||
| 268 | /** |
||
| 269 | * Update all fixed rights for one user |
||
| 270 | * @param int $id_user |
||
| 271 | * @param array $messages |
||
| 272 | */ |
||
| 273 | function absences_updateFixedRightsOnUser($id_user, &$messages) { |
||
| 274 | |||
| 275 | global $babDB, $babBody; |
||
| 276 | |||
| 277 | /* @var $babBody babBody */ |
||
| 278 | |||
| 279 | // trouver les droits fixes de l'utilisateur |
||
| 280 | |||
| 281 | $agent = absences_Agent::getFromIdUser($id_user); |
||
| 282 | $I = $agent->getAgentRightUserIterator(); |
||
| 283 | $I->setKind(absences_Right::FIXED); |
||
| 284 | |||
| 285 | foreach($I as $agentRight) |
||
| 286 | { |
||
| 287 | /*@var $agentRight absences_AgentRight */ |
||
| 288 | |||
| 289 | $right = $agentRight->getRight(); |
||
| 290 | |||
| 291 | try { |
||
| 292 | if (false === absences_updateFixedVacation($id_user, $right)) { |
||
|
0 ignored issues
–
show
|
|||
| 293 | absences_addFixedVacation($id_user, $right); |
||
|
0 ignored issues
–
show
It seems like
$right defined by $agentRight->getRight() on line 289 can be null; however, absences_addFixedVacation() does not accept null, maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
Loading history...
|
|||
| 294 | } |
||
| 295 | } |
||
| 296 | catch(absences_EntryException $e) |
||
| 297 | { |
||
| 298 | $messages[] = sprintf( |
||
| 299 | absences_translate('Failed to update period for right "%s", %s (%s)'), |
||
| 300 | $right->description, |
||
| 301 | $e->getMessage(), |
||
| 302 | absences_DateTimePeriod($e->entry->date_begin, $e->entry->date_end) |
||
| 303 | ); |
||
| 304 | } |
||
| 305 | } |
||
| 306 | |||
| 307 | } |
||
| 308 | |||
| 309 | |||
| 310 | /** |
||
| 311 | * Tester si la demande du droit a date fixe existe |
||
| 312 | * @return bool |
||
| 313 | */ |
||
| 314 | function absences_isFixedCreated($id_user, $id_right) |
||
| 315 | { |
||
| 316 | global $babDB; |
||
| 317 | $res = $babDB->db_query(" |
||
| 318 | SELECT * |
||
| 319 | FROM |
||
| 320 | absences_entries e, |
||
| 321 | absences_entries_elem ee |
||
| 322 | WHERE |
||
| 323 | e.id=ee.id_entry |
||
| 324 | AND e.id_user=".$babDB->quote($id_user)." |
||
| 325 | AND ee.id_right=".$babDB->quote($id_right) |
||
| 326 | ); |
||
| 327 | |||
| 328 | return (0 < $babDB->db_num_rows($res)); |
||
| 329 | } |
||
| 330 |
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: