Dolibarr\Code\Delivery\Classes\Delivery::valid()

Complexity

Conditions	25
Paths	1301

Size

Total Lines	144
Code Lines	92

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function valid($user, $notrigger = 0)
    {
        global $conf;

        require_once constant('DOL_DOCUMENT_ROOT') . '/core/lib/files.lib.php';

        dol_syslog(get_only_class($this) . "::valid begin");

        $this->db->begin();

        $error = 0;

        if (
            (!getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && $user->hasRight('expedition', 'delivery', 'creer'))
            || (getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && $user->hasRight('expedition', 'delivery_advance', 'validate'))
        ) {
            if (getDolGlobalString('DELIVERY_ADDON_NUMBER')) {
                // Setting the command numbering module name
                $modName = getDolGlobalString('DELIVERY_ADDON_NUMBER');

                if (is_readable(DOL_DOCUMENT_ROOT . '/core/modules/delivery/' . $modName . '.php')) {
                    require_once constant('DOL_DOCUMENT_ROOT') . '/core/modules/delivery/' . $modName . '.php';

                    $now = dol_now();

                    // Retrieving the new reference
                    $objMod = new $modName($this->db);
                    $soc = new Societe($this->db);
                    $soc->fetch($this->socid);

                    if (preg_match('/^[\(]?PROV/i', $this->ref) || empty($this->ref)) { // empty should not happened, but when it occurs, the test save life
                        $numref = $objMod->delivery_get_num($soc, $this);
                    } else {
                        $numref = $this->ref;
                    }
                    $this->newref = dol_sanitizeFileName($numref);

                    // Test if is not already in valid status. If so, we stop to avoid decrementing the stock twice.
                    $sql = "SELECT ref";
                    $sql .= " FROM " . MAIN_DB_PREFIX . "delivery";
                    $sql .= " WHERE ref = '" . $this->db->escape($numref) . "'";
                    $sql .= " AND fk_statut <> 0";
                    $sql .= " AND entity = " . ((int) $conf->entity);

                    $resql = $this->db->query($sql);
                    if ($resql) {
                        $num = $this->db->num_rows($resql);
                        if ($num > 0) {
                            return 0;
                        }
                    }

                    $sql = "UPDATE " . MAIN_DB_PREFIX . "delivery SET";
                    $sql .= " ref='" . $this->db->escape($numref) . "'";
                    $sql .= ", fk_statut = 1";
                    $sql .= ", date_valid = '" . $this->db->idate($now) . "'";
                    $sql .= ", fk_user_valid = " . $user->id;
                    $sql .= " WHERE rowid = " . ((int) $this->id);
                    $sql .= " AND fk_statut = 0";

                    $resql = $this->db->query($sql);
                    if (!$resql) {
                        dol_print_error($this->db);
                        $this->error = $this->db->lasterror();
                        $error++;
                    }

                    if (!$error && !$notrigger) {
                        // Call trigger
                        $result = $this->call_trigger('DELIVERY_VALIDATE', $user);
                        if ($result < 0) {
                            $error++;
                        }
                        // End call triggers
                    }

                    if (!$error) {
                        $this->oldref = $this->ref;

                        // Rename directory if dir was a temporary ref
                        if (preg_match('/^[\(]?PROV/i', $this->ref)) {
                            // Now we rename also files into index
                            $sql = 'UPDATE ' . MAIN_DB_PREFIX . "ecm_files set filename = CONCAT('" . $this->db->escape($this->newref) . "', SUBSTR(filename, " . (strlen($this->ref) + 1) . ")), filepath = 'expedition/receipt/" . $this->db->escape($this->newref) . "'";
                            $sql .= " WHERE filename LIKE '" . $this->db->escape($this->ref) . "%' AND filepath = 'expedition/receipt/" . $this->db->escape($this->ref) . "' and entity = " . ((int) $conf->entity);
                            $resql = $this->db->query($sql);
                            if (!$resql) {
                                $error++;
                                $this->error = $this->db->lasterror();
                            }
                            $sql = 'UPDATE ' . MAIN_DB_PREFIX . "ecm_files set filepath = 'expedition/receipt/" . $this->db->escape($this->newref) . "'";
                            $sql .= " WHERE filepath = 'expedition/receipt/" . $this->db->escape($this->ref) . "' and entity = " . $conf->entity;
                            $resql = $this->db->query($sql);
                            if (!$resql) {
                                $error++;
                                $this->error = $this->db->lasterror();
                            }

                            // We rename directory ($this->ref = old ref, $num = new ref) in order not to lose the attachments
                            $oldref = dol_sanitizeFileName($this->ref);
                            $newref = dol_sanitizeFileName($numref);
                            $dirsource = $conf->expedition->dir_output . '/receipt/' . $oldref;
                            $dirdest = $conf->expedition->dir_output . '/receipt/' . $newref;
                            if (!$error && file_exists($dirsource)) {
                                dol_syslog(get_only_class($this) . "::valid rename dir " . $dirsource . " into " . $dirdest);

                                if (@rename($dirsource, $dirdest)) {
                                    dol_syslog("Rename ok");
                                    // Rename docs starting with $oldref with $newref
                                    $listoffiles = dol_dir_list($conf->expedition->dir_output . '/receipt/' . $newref, 'files', 1, '^' . preg_quote($oldref, '/'));
                                    foreach ($listoffiles as $fileentry) {
                                        $dirsource = $fileentry['name'];
                                        $dirdest = preg_replace('/^' . preg_quote($oldref, '/') . '/', $newref, $dirsource);
                                        $dirsource = $fileentry['path'] . '/' . $dirsource;
                                        $dirdest = $fileentry['path'] . '/' . $dirdest;
                                        @rename($dirsource, $dirdest);

It seems like you do not handle an error condition for rename(). This can introduce security issues, and is generally not recommended.

                                    }
                                }
                            }
                        }

                        // Set new ref and current status
                        if (!$error) {
                            $this->ref = $numref;
                            $this->statut = 1;

The property Dolibarr\Core\Base\CommonObject::$statut has been deprecated: Use $status instead.

                        }

                        dol_syslog(get_only_class($this) . "::valid ok");
                    }

                    if (!$error) {
                        $this->db->commit();
                        return 1;
                    } else {
                        $this->db->rollback();
                        return -1;
                    }
                }
            }

            return -1;
        } else {
            $this->error = "NotAllowed";
            dol_syslog(get_only_class($this) . "::valid " . $this->error, LOG_ERR);
            return -1;
        }