Dolibarr\Code\Hrm\Classes\Position::validate()

Complexity

Conditions	22
Paths	2801

Size

Total Lines	122
Code Lines	71

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function validate($user, $notrigger = 0)
    {
        global $conf, $langs;

        require_once constant('DOL_DOCUMENT_ROOT') . '/core/lib/files.lib.php';

        $error = 0;

        // Protection
        if ($this->status == self::STATUS_VALIDATED) {
            dol_syslog(get_class($this) . "::validate action abandoned: already validated", LOG_WARNING);
            return 0;
        }

        /*if (! ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->hrm->position->write))
         || (!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && !empty($user->rights->hrm->position->position_advance->validate))))
         {
         $this->error='NotEnoughPermissions';
         dol_syslog(get_class($this)."::valid ".$this->error, LOG_ERR);
         return -1;
         }*/

        $now = dol_now();

        $this->db->begin();

        // Define new ref
        if (!$error && (preg_match('/^[\(]?PROV/i', $this->ref) || empty($this->ref))) { // empty should not happened, but when it occurs, the test save life
            $num = $this->getNextNumRef();
        } else {
            $num = $this->ref;
        }
        $this->newref = $num;

        if (!empty($num)) {
            // Validate
            $sql = "UPDATE " . MAIN_DB_PREFIX . $this->table_element;
            $sql .= " SET ref = '" . $this->db->escape($num) . "',";
            $sql .= " status = " . self::STATUS_VALIDATED;
            if (!empty($this->fields['date_validation'])) {
                $sql .= ", date_validation = '" . $this->db->idate($now) . "'";
            }
            if (!empty($this->fields['fk_user_valid'])) {
                $sql .= ", fk_user_valid = " . ((int) $user->id);
            }
            $sql .= " WHERE rowid = " . ((int) $this->id);

            dol_syslog(get_class($this) . "::validate()", LOG_DEBUG);
            $resql = $this->db->query($sql);
            if (!$resql) {
                dol_print_error($this->db);
                $this->error = $this->db->lasterror();
                $error++;
            }

            if (!$error && !$notrigger) {
                // Call trigger
                $result = $this->call_trigger('HRM_POSITION_VALIDATE', $user);
                if ($result < 0) {
                    $error++;
                }
                // End call triggers
            }
        }

        if (!$error) {
            $this->oldref = $this->ref;

            // Rename directory if dir was a temporary ref
            if (preg_match('/^[\(]?PROV/i', $this->ref)) {
                // Now we rename also files into index
                $sql = 'UPDATE ' . MAIN_DB_PREFIX . "ecm_files set filename = CONCAT('" . $this->db->escape($this->newref) . "', SUBSTR(filename, " . (strlen($this->ref) + 1) . ")), filepath = 'position/" . $this->db->escape($this->newref) . "'";
                $sql .= " WHERE filename LIKE '" . $this->db->escape($this->ref) . "%' AND filepath = 'position/" . $this->db->escape($this->ref) . "' and entity = " . $conf->entity;
                $resql = $this->db->query($sql);
                if (!$resql) {
                    $error++;
                    $this->error = $this->db->lasterror();
                }
                $sql = 'UPDATE ' . MAIN_DB_PREFIX . "ecm_files set filepath = 'position/" . $this->db->escape($this->newref) . "'";
                $sql .= " WHERE filepath = 'position/" . $this->db->escape($this->ref) . "' and entity = " . $conf->entity;
                $resql = $this->db->query($sql);
                if (!$resql) {
                    $error++;
                    $this->error = $this->db->lasterror();
                }

                // We rename directory ($this->ref = old ref, $num = new ref) in order not to lose the attachments
                $oldref = dol_sanitizeFileName($this->ref);
                $newref = dol_sanitizeFileName($num);
                $dirsource = $conf->hrm->dir_output . '/position/' . $oldref;
                $dirdest = $conf->hrm->dir_output . '/position/' . $newref;
                if (!$error && file_exists($dirsource)) {
                    dol_syslog(get_class($this) . "::validate() rename dir " . $dirsource . " into " . $dirdest);

                    if (@rename($dirsource, $dirdest)) {
                        dol_syslog("Rename ok");
                        // Rename docs starting with $oldref with $newref
                        $listoffiles = dol_dir_list($conf->hrm->dir_output . '/position/' . $newref, 'files', 1, '^' . preg_quote($oldref, '/'));
                        foreach ($listoffiles as $fileentry) {
                            $dirsource = $fileentry['name'];
                            $dirdest = preg_replace('/^' . preg_quote($oldref, '/') . '/', $newref, $dirsource);
                            $dirsource = $fileentry['path'] . '/' . $dirsource;
                            $dirdest = $fileentry['path'] . '/' . $dirdest;
                            @rename($dirsource, $dirdest);

It seems like you do not handle an error condition for rename(). This can introduce security issues, and is generally not recommended.

                        }
                    }
                }
            }
        }

        // Set new ref and current status
        if (!$error) {
            $this->ref = $num;
            $this->status = self::STATUS_VALIDATED;
        }

        if (!$error) {
            $this->db->commit();
            return 1;
        } else {
            $this->db->rollback();
            return -1;
        }