security.lib.php

Go to the documentation of this file.

<?php
/* Copyright (C) 2008-2021 Laurent Destailleur  <eldy@users.sourceforge.net>
 * Copyright (C) 2008-2021 Regis Houssin        <regis.houssin@inodbox.com>
 * Copyright (C) 2020    Ferran Marcet        <fmarcet@2byte.es>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <https://www.gnu.org/licenses/>.
 * or see https://www.gnu.org/
 */

function dol_encode($chain, $key = '1')
{
  if (is_numeric($key) && $key == '1') {  // rule 1 is offset of 17 for char
    $output_tab = array();
    $strlength = dol_strlen($chain);
    for ($i = 0; $i < $strlength; $i++) {
      $output_tab[$i] = chr(ord(substr($chain, $i, 1)) + 17);
    }
    $chain = implode("", $output_tab);
  } elseif ($key) {
    $result = '';
    $strlength = dol_strlen($chain);
    for ($i = 0; $i < $strlength; $i++) {
      $keychar = substr($key, ($i % strlen($key)) - 1, 1);
      $result .= chr(ord(substr($chain, $i, 1)) + (ord($keychar) - 65));
    }
    $chain = $result;
  }

  return base64_encode($chain);
}

function dol_decode($chain, $key = '1')
{
  $chain = base64_decode($chain);

  if (is_numeric($key) && $key == '1') {  // rule 1 is offset of 17 for char
    $output_tab = array();
    $strlength = dol_strlen($chain);
    for ($i = 0; $i < $strlength; $i++) {
      $output_tab[$i] = chr(ord(substr($chain, $i, 1)) - 17);
    }

    $chain = implode("", $output_tab);
  } elseif ($key) {
    $result = '';
    $strlength = dol_strlen($chain);
    for ($i = 0; $i < $strlength; $i++) {
      $keychar = substr($key, ($i % strlen($key)) - 1, 1);
      $result .= chr(ord(substr($chain, $i, 1)) - (ord($keychar) - 65));
    }
    $chain = $result;
  }

  return $chain;
}

function dol_hash($chain, $type = '0')
{
  global $conf;

  // No need to add salt for password_hash
  if (($type == '0' || $type == 'auto') && !empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'password_hash' && function_exists('password_hash')) {
    return password_hash($chain, PASSWORD_DEFAULT);
  }

  // Salt value
  if (!empty($conf->global->MAIN_SECURITY_SALT) && $type != '4' && $type !== 'openldap') {
    $chain = $conf->global->MAIN_SECURITY_SALT.$chain;
  }

  if ($type == '1' || $type == 'sha1') {
    return sha1($chain);
  } elseif ($type == '2' || $type == 'sha1md5') {
    return sha1(md5($chain));
  } elseif ($type == '3' || $type == 'md5') {
    return md5($chain);
  } elseif ($type == '4' || $type == 'openldap') {
    return dolGetLdapPasswordHash($chain, getDolGlobalString('LDAP_PASSWORD_HASH_TYPE', 'md5'));
  } elseif ($type == '5' || $type == 'sha256') {
    return hash('sha256', $chain);
  } elseif ($type == '6' || $type == 'password_hash') {
    return password_hash($chain, PASSWORD_DEFAULT);
  } elseif (!empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'sha1') {
    return sha1($chain);
  } elseif (!empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'sha1md5') {
    return sha1(md5($chain));
  }

  // No particular encoding defined, use default
  return md5($chain);
}

function dol_verifyHash($chain, $hash, $type = '0')
{
  global $conf;

  if ($type == '0' && !empty($conf->global->MAIN_SECURITY_HASH_ALGO) && $conf->global->MAIN_SECURITY_HASH_ALGO == 'password_hash' && function_exists('password_verify')) {
    if ($hash[0] == '$') {
      return password_verify($chain, $hash);
    } elseif (strlen($hash) == 32) {
      return dol_verifyHash($chain, $hash, '3'); // md5
    } elseif (strlen($hash) == 40) {
      return dol_verifyHash($chain, $hash, '2'); // sha1md5
    }

    return false;
  }

  return dol_hash($chain, $type) == $hash;
}

function dolGetLdapPasswordHash($password, $type = 'md5')
{
  if (empty($type)) {
    $type = 'md5';
  }

  $salt = substr(sha1(time()), 0, 8);

  if ($type === 'md5') {
    return '{MD5}' . base64_encode(hash("md5", $password, true)); //For OpenLdap with md5 (based on an unencrypted password in base)
  } elseif ($type === 'md5frommd5') {
    return '{MD5}' . base64_encode(hex2bin($password)); // Create OpenLDAP MD5 password from Dolibarr MD5 password
  } elseif ($type === 'smd5') {
    return "{SMD5}" . base64_encode(hash("md5", $password . $salt, true) . $salt);
  } elseif ($type === 'sha') {
    return '{SHA}' . base64_encode(hash("sha1", $password, true));
  } elseif ($type === 'ssha') {
    return "{SSHA}" . base64_encode(hash("sha1", $password . $salt, true) . $salt);
  } elseif ($type === 'sha256') {
    return "{SHA256}" . base64_encode(hash("sha256", $password, true));
  } elseif ($type === 'ssha256') {
    return "{SSHA256}" . base64_encode(hash("sha256", $password . $salt, true) . $salt);
  } elseif ($type === 'sha384') {
    return "{SHA384}" . base64_encode(hash("sha384", $password, true));
  } elseif ($type === 'ssha384') {
    return "{SSHA384}" . base64_encode(hash("sha384", $password . $salt, true) . $salt);
  } elseif ($type === 'sha512') {
    return "{SHA512}" . base64_encode(hash("sha512", $password, true));
  } elseif ($type === 'ssha512') {
    return "{SSHA512}" . base64_encode(hash("sha512", $password . $salt, true) . $salt);
  } elseif ($type === 'crypt') {
    return '{CRYPT}' . crypt($password, $salt);
  } elseif ($type === 'clear') {
    return '{CLEAR}' . $password;  // Just for test, plain text password is not secured !
  }
}

function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = 'fk_soc', $dbt_select = 'rowid', $isdraft = 0, $mode = 0)
{
  global $db, $conf;
  global $hookmanager;

  $objectid = ((int) $objectid);  // For the case value is coming from a non sanitized user input

  //dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
  //print "user_id=".$user->id.", features=".$features.", feature2=".$feature2.", objectid=".$objectid;
  //print ", dbtablename=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select;
  //print ", perm: ".$features."->".$feature2."=".($user->rights->$features->$feature2->lire)."<br>";

  $parentfortableentity = '';

  // Fix syntax of $features param
  $originalfeatures = $features;
  if ($features == 'facturerec') {
    $features = 'facture';
  }
  if ($features == 'mo') {
    $features = 'mrp';
  }
  if ($features == 'member') {
    $features = 'adherent';
  }
  if ($features == 'subscription') {
    $features = 'adherent';
    $feature2 = 'cotisation';
  };
  if ($features == 'websitepage') {
    $features = 'website';
    $tableandshare = 'website_page';
    $parentfortableentity = 'fk_website@website';
  }
  if ($features == 'project') {
    $features = 'projet';
  }
  if ($features == 'product') {
    $features = 'produit';
  }

  // Get more permissions checks from hooks
  $parameters = array('features'=>$features, 'originalfeatures'=>$originalfeatures, 'objectid'=>$objectid, 'dbt_select'=>$dbt_select, 'idtype'=>$dbt_select, 'isdraft'=>$isdraft);
  $reshook = $hookmanager->executeHooks('restrictedArea', $parameters);

  if (isset($hookmanager->resArray['result'])) {
    if ($hookmanager->resArray['result'] == 0) {
      if ($mode) {
        return 0;
      } else {
        accessforbidden(); // Module returns 0, so access forbidden
      }
    }
  }
  if ($reshook > 0) {   // No other test done.
    return 1;
  }

  // Features/modules to check
  $featuresarray = array($features);
  if (preg_match('/&/', $features)) {
    $featuresarray = explode("&", $features);
  } elseif (preg_match('/\|/', $features)) {
    $featuresarray = explode("|", $features);
  }

  // More subfeatures to check
  if (!empty($feature2)) {
    $feature2 = explode("|", $feature2);
  }

  $listofmodules = explode(',', $conf->global->MAIN_MODULES_FOR_EXTERNAL);

  // Check read permission from module
  $readok = 1;
  $nbko = 0;
  foreach ($featuresarray as $feature) {  // first we check nb of test ko
    $featureforlistofmodule = $feature;
    if ($featureforlistofmodule == 'produit') {
      $featureforlistofmodule = 'product';
    }
    if (!empty($user->socid) && !empty($conf->global->MAIN_MODULES_FOR_EXTERNAL) && !in_array($featureforlistofmodule, $listofmodules)) { // If limits on modules for external users, module must be into list of modules for external users
      $readok = 0;
      $nbko++;
      continue;
    }

    if ($feature == 'societe') {
      if (empty($user->rights->societe->lire) && empty($user->rights->fournisseur->lire)) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'contact') {
      if (empty($user->rights->societe->contact->lire)) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'produit|service') {
      if (!$user->rights->produit->lire && !$user->rights->service->lire) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'prelevement') {
      if (!$user->rights->prelevement->bons->lire) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'cheque') {
      if (empty($user->rights->banque->cheque)) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'projet') {
      if (!$user->rights->projet->lire && empty($user->rights->projet->all->lire)) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'payment') {
      if (!$user->rights->facture->lire) {
        $readok = 0;
        $nbko++;
      }
    } elseif ($feature == 'payment_supplier') {
      if (empty($user->rights->fournisseur->facture->lire)) {
        $readok = 0;
        $nbko++;
      }
    } elseif (!empty($feature2)) {                          // This is for permissions on 2 levels
      $tmpreadok = 1;
      foreach ($feature2 as $subfeature) {
        if ($subfeature == 'user' && $user->id == $objectid) {
          continue; // A user can always read its own card
        }
        if (!empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) {
          $tmpreadok = 0;
        } elseif (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) {
          $tmpreadok = 0;
        } else {
          $tmpreadok = 1;
          break;
        } // Break is to bypass second test if the first is ok
      }
      if (!$tmpreadok) {  // We found a test on feature that is ko
        $readok = 0; // All tests are ko (we manage here the and, the or will be managed later using $nbko).
        $nbko++;
      }
    } elseif (!empty($feature) && ($feature != 'user' && $feature != 'usergroup')) {    // This is permissions on 1 level
      if (empty($user->rights->$feature->lire)
        && empty($user->rights->$feature->read)
        && empty($user->rights->$feature->run)) {
        $readok = 0;
        $nbko++;
      }
    }
  }

  // If a or and at least one ok
  if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
    $readok = 1;
  }

  if (!$readok) {
    if ($mode) {
      return 0;
    } else {
      accessforbidden();
    }
  }
  //print "Read access is ok";

  // Check write permission from module (we need to know write permission to create but also to delete drafts record or to upload files)
  $createok = 1;
  $nbko = 0;
  $wemustcheckpermissionforcreate = (GETPOST('sendit', 'alpha') || GETPOST('linkit', 'alpha') || in_array(GETPOST('action', 'aZ09'), array('create', 'update', 'add_element_resource', 'confirm_delete_linked_resource')) || GETPOST('roworder', 'alpha', 2));
  $wemustcheckpermissionfordeletedraft = ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete');

  if ($wemustcheckpermissionforcreate || $wemustcheckpermissionfordeletedraft) {
    foreach ($featuresarray as $feature) {
      if ($feature == 'contact') {
        if (empty($user->rights->societe->contact->creer)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'produit|service') {
        if (empty($user->rights->produit->creer) && empty($user->rights->service->creer)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'prelevement') {
        if (!$user->rights->prelevement->bons->creer) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'commande_fournisseur') {
        if (empty($user->rights->fournisseur->commande->creer) || empty($user->rights->supplier_order->creer)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'banque') {
        if (empty($user->rights->banque->modifier)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'cheque') {
        if (empty($user->rights->banque->cheque)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'import') {
        if (empty($user->rights->import->run)) {
          $createok = 0;
          $nbko++;
        }
      } elseif ($feature == 'ecm') {
        if (!$user->rights->ecm->upload) {
          $createok = 0;
          $nbko++;
        }
      } elseif (!empty($feature2)) {                            // This is for permissions on one level
        foreach ($feature2 as $subfeature) {
          if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->creer) {
            continue; // User can edit its own card
          }
          if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->password) {
            continue; // User can edit its own password
          }
          if ($subfeature == 'user' && $user->id != $objectid && $user->rights->user->user->password) {
            continue; // User can edit another user's password
          }

          if (empty($user->rights->$feature->$subfeature->creer)
          && empty($user->rights->$feature->$subfeature->write)
          && empty($user->rights->$feature->$subfeature->create)) {
            $createok = 0;
            $nbko++;
          } else {
            $createok = 1;
            // Break to bypass second test if the first is ok
            break;
          }
        }
      } elseif (!empty($feature)) {                       // This is for permissions on 2 levels ('creer' or 'write')
        //print '<br>feature='.$feature.' creer='.$user->rights->$feature->creer.' write='.$user->rights->$feature->write; exit;
        if (empty($user->rights->$feature->creer)
        && empty($user->rights->$feature->write)
        && empty($user->rights->$feature->create)) {
          $createok = 0;
          $nbko++;
        }
      }
    }

    // If a or and at least one ok
    if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
      $createok = 1;
    }

    if ($wemustcheckpermissionforcreate && !$createok) {
      if ($mode) {
        return 0;
      } else {
        accessforbidden();
      }
    }
    //print "Write access is ok";
  }

  // Check create user permission
  $createuserok = 1;
  if (GETPOST('action', 'aZ09') == 'confirm_create_user' && GETPOST("confirm", 'aZ09') == 'yes') {
    if (!$user->rights->user->user->creer) {
      $createuserok = 0;
    }

    if (!$createuserok) {
      if ($mode) {
        return 0;
      } else {
        accessforbidden();
      }
    }
    //print "Create user access is ok";
  }

  // Check delete permission from module
  $deleteok = 1;
  $nbko = 0;
  if ((GETPOST("action", "aZ09") == 'confirm_delete' && GETPOST("confirm", "aZ09") == 'yes') || GETPOST("action", "aZ09") == 'delete') {
    foreach ($featuresarray as $feature) {
      if ($feature == 'contact') {
        if (!$user->rights->societe->contact->supprimer) {
          $deleteok = 0;
        }
      } elseif ($feature == 'produit|service') {
        if (!$user->rights->produit->supprimer && !$user->rights->service->supprimer) {
          $deleteok = 0;
        }
      } elseif ($feature == 'commande_fournisseur') {
        if (!$user->rights->fournisseur->commande->supprimer) {
          $deleteok = 0;
        }
      } elseif ($feature == 'payment_supplier') { // Permission to delete a payment of an invoice is permission to edit an invoice.
        if (!$user->rights->fournisseur->facture->creer) {
          $deleteok = 0;
        }
      } elseif ($feature == 'payment') {
        if (!$user->rights->facture->paiement) {
            $deleteok = 0;
        }
      } elseif ($feature == 'banque') {
        if (empty($user->rights->banque->modifier)) {
          $deleteok = 0;
        }
      } elseif ($feature == 'cheque') {
        if (empty($user->rights->banque->cheque)) {
          $deleteok = 0;
        }
      } elseif ($feature == 'ecm') {
        if (!$user->rights->ecm->upload) {
          $deleteok = 0;
        }
      } elseif ($feature == 'ftp') {
        if (!$user->rights->ftp->write) {
          $deleteok = 0;
        }
      } elseif ($feature == 'salaries') {
        if (!$user->rights->salaries->delete) {
          $deleteok = 0;
        }
      } elseif ($feature == 'adherent') {
        if (empty($user->rights->adherent->supprimer)) {
          $deleteok = 0;
        }
      } elseif ($feature == 'paymentbybanktransfer') {
        if (empty($user->rights->paymentbybanktransfer->create)) {  // There is no delete permission
          $deleteok = 0;
        }
      } elseif ($feature == 'prelevement') {
        if (empty($user->rights->prelevement->bons->creer)) {   // There is no delete permission
          $deleteok = 0;
        }
      } elseif (!empty($feature2)) {              // This is for permissions on 2 levels
        foreach ($feature2 as $subfeature) {
          if (empty($user->rights->$feature->$subfeature->supprimer) && empty($user->rights->$feature->$subfeature->delete)) {
            $deleteok = 0;
          } else {
            $deleteok = 1;
            break;
          } // For bypass the second test if the first is ok
        }
      } elseif (!empty($feature)) {             // This is used for permissions on 1 level
        //print '<br>feature='.$feature.' creer='.$user->rights->$feature->supprimer.' write='.$user->rights->$feature->delete;
        if (empty($user->rights->$feature->supprimer)
          && empty($user->rights->$feature->delete)
          && empty($user->rights->$feature->run)) {
          $deleteok = 0;
        }
      }
    }

    // If a or and at least one ok
    if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) {
      $deleteok = 1;
    }

    if (!$deleteok && !($isdraft && $createok)) {
      if ($mode) {
        return 0;
      } else {
        accessforbidden();
      }
    }
    //print "Delete access is ok";
  }

  // If we have a particular object to check permissions on, we check if $user has permission
  // for this given object (link to company, is contact for project, ...)
  if (!empty($objectid) && $objectid > 0) {
    $ok = checkUserAccessToObject($user, $featuresarray, $objectid, $tableandshare, $feature2, $dbt_keyfield, $dbt_select, $parentfortableentity);
    $params = array('objectid' => $objectid, 'features' => join(',', $featuresarray), 'features2' => $feature2);
    //print 'checkUserAccessToObject ok='.$ok;
    if ($mode) {
      return $ok ? 1 : 0;
    } else {
      return $ok ? 1 : accessforbidden('', 1, 1, 0, $params);
    }
  }

  return 1;
}

function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tableandshare = '', $feature2 = '', $dbt_keyfield = '', $dbt_select = 'rowid', $parenttableforentity = '')
{
  global $db, $conf;

  if (is_object($object)) {
    $objectid = $object->id;
  } else {
    $objectid = $object;    // $objectid can be X or 'X,Y,Z'
  }

  //dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename, $feature2, $dbt_socfield, $dbt_select, $isdraft");
  //print "user_id=".$user->id.", features=".join(',', $featuresarray).", feature2=".$feature2.", objectid=".$objectid;
  //print ", tableandshare=".$tableandshare.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select."<br>";

  // More parameters
  $params = explode('&', $tableandshare);
  $dbtablename = (!empty($params[0]) ? $params[0] : '');
  $sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename);

  foreach ($featuresarray as $feature) {
    $sql = '';

    //var_dump($feature);exit;

    // For backward compatibility
    if ($feature == 'member') {
      $feature = 'adherent';
    }
    if ($feature == 'project') {
      $feature = 'projet';
    }
    if ($feature == 'task') {
      $feature = 'projet_task';
    }

    $checkonentitydone = 0;

    // Array to define rules of checks to do
    $check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salaries', 'website', 'recruitment'); // Test on entity only (Objects with no link to company)
    $checksoc = array('societe'); // Test for societe object
    $checkother = array('contact', 'agenda'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...).
    $checkproject = array('projet', 'project'); // Test for project object
    $checktask = array('projet_task'); // Test for task object
    $checkhierarchy = array('expensereport', 'holiday');
    $nocheck = array('barcode', 'stock'); // No test
    //$checkdefault = 'all other not already defined'; // Test on entity + link to third party on field $dbt_keyfield. Not allowed if link is empty (Ex: invoice, orders...).

    // If dbtablename not defined, we use same name for table than module name
    if (empty($dbtablename)) {
      $dbtablename = $feature;
      $sharedelement = (!empty($params[1]) ? $params[1] : $dbtablename); // We change dbtablename, so we set sharedelement too.
    }

    // Check permission for object on entity only
    if (in_array($feature, $check)) {
      $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
      $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
      if (($feature == 'user' || $feature == 'usergroup') && !empty($conf->multicompany->enabled)) {  // Special for multicompany
        if (!empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) {
          if ($conf->entity == 1 && $user->admin && !$user->entity) {
            $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
            $sql .= " AND dbt.entity IS NOT NULL";
          } else {
            $sql .= ",".MAIN_DB_PREFIX."usergroup_user as ug";
            $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
            $sql .= " AND ((ug.fk_user = dbt.rowid";
            $sql .= " AND ug.entity IN (".getEntity('usergroup')."))";
            $sql .= " OR dbt.entity = 0)"; // Show always superadmin
          }
        } else {
          $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
          $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
        }
      } else {
        $reg = array();
        if ($parenttableforentity && preg_match('/(.*)@(.*)/', $parenttableforentity, $reg)) {
          $sql .= ", ".MAIN_DB_PREFIX.$reg[2]." as dbtp";
          $sql .= " WHERE dbt.".$reg[1]." = dbtp.rowid AND dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
          $sql .= " AND dbtp.entity IN (".getEntity($sharedelement, 1).")";
        } else {
          $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
          $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
        }
      }
      $checkonentitydone = 1;
    }
    if (in_array($feature, $checksoc)) {  // We check feature = checksoc
      // If external user: Check permission for external users
      if ($user->socid > 0) {
        if ($user->socid != $objectid) {
          return false;
        }
      } elseif (!empty($conf->societe->enabled) && ($user->rights->societe->lire && empty($user->rights->societe->client->voir))) {
        // If internal user: Check permission for internal users that are restricted on their objects
        $sql = "SELECT COUNT(sc.fk_soc) as nb";
        $sql .= " FROM (".MAIN_DB_PREFIX."societe_commerciaux as sc";
        $sql .= ", ".MAIN_DB_PREFIX."societe as s)";
        $sql .= " WHERE sc.fk_soc IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND sc.fk_user = ".((int) $user->id);
        $sql .= " AND sc.fk_soc = s.rowid";
        $sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
      } elseif (!empty($conf->multicompany->enabled)) {
        // If multicompany and internal users with all permissions, check user is in correct entity
        $sql = "SELECT COUNT(s.rowid) as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX."societe as s";
        $sql .= " WHERE s.rowid IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND s.entity IN (".getEntity($sharedelement, 1).")";
      }

      $checkonentitydone = 1;
    }
    if (in_array($feature, $checkother)) {  // Test on entity + link to thirdparty. Allowed if link is empty (Ex: contacts...).
      // If external user: Check permission for external users
      if ($user->socid > 0) {
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.fk_soc = ".((int) $user->socid);
      } elseif (!empty($conf->societe->enabled) && ($user->rights->societe->lire && empty($user->rights->societe->client->voir))) {
        // If internal user: Check permission for internal users that are restricted on their objects
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON dbt.fk_soc = sc.fk_soc AND sc.fk_user = ".((int) $user->id);
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND (dbt.fk_soc IS NULL OR sc.fk_soc IS NOT NULL)"; // Contact not linked to a company or to a company of user
        $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
      } elseif (!empty($conf->multicompany->enabled)) {
        // If multicompany and internal users with all permissions, check user is in correct entity
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
      }

      $checkonentitydone = 1;
    }
    if (in_array($feature, $checkproject)) {
      if (!empty($conf->project->enabled) && empty($user->rights->projet->all->lire)) {
        $projectid = $objectid;

        include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
        $projectstatic = new Project($db);
        $tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);

        $tmparray = explode(',', $tmps);
        if (!in_array($projectid, $tmparray)) {
          return false;
        }
      } else {
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
      }

      $checkonentitydone = 1;
    }
    if (in_array($feature, $checktask)) {
      if (!empty($conf->project->enabled) && empty($user->rights->projet->all->lire)) {
        $task = new Task($db);
        $task->fetch($objectid);
        $projectid = $task->fk_project;

        include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
        $projectstatic = new Project($db);
        $tmps = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, 0);

        $tmparray = explode(',', $tmps);
        if (!in_array($projectid, $tmparray)) {
          return false;
        }
      } else {
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
      }

      $checkonentitydone = 1;
    }
    if (!$checkonentitydone && !in_array($feature, $nocheck)) {   // By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield
      // If external user: Check permission for external users
      if ($user->socid > 0) {
        if (empty($dbt_keyfield)) {
          dol_print_error('', 'Param dbt_keyfield is required but not defined');
        }
        $sql = "SELECT COUNT(dbt.".$dbt_keyfield.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.rowid IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.".$dbt_keyfield." = ".((int) $user->socid);
      } elseif (!empty($conf->societe->enabled) && empty($user->rights->societe->client->voir)) {
        // If internal user: Check permission for internal users that are restricted on their objects
        if ($feature != 'ticket') {
          if (empty($dbt_keyfield)) {
            dol_print_error('', 'Param dbt_keyfield is required but not defined');
          }
          $sql = "SELECT COUNT(sc.fk_soc) as nb";
          $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
          $sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
          $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
          $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
          $sql .= " AND sc.fk_soc = dbt.".$dbt_keyfield;
          $sql .= " AND sc.fk_user = ".((int) $user->id);
        } else {
          // On ticket, the thirdparty is not mandatory, so we need a special test to accept record with no thirdparties.
          $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
          $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
          $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = dbt.".$dbt_keyfield." AND sc.fk_user = ".((int) $user->id);
          $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
          $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
          $sql .= " AND (sc.fk_user = ".((int) $user->id)." OR sc.fk_user IS NULL)";
        }
      } elseif (!empty($conf->multicompany->enabled)) {
        // If multicompany and internal users with all permissions, check user is in correct entity
        $sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
        $sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
        $sql .= " WHERE dbt.".$dbt_select." IN (".$db->sanitize($objectid, 1).")";
        $sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
      }
    }
    //print $sql;

    // For events, check on users assigned to event
    if ($feature === 'agenda') {
      // Also check owner or attendee for users without allactions->read
      if ($objectid > 0 && empty($user->rights->agenda->allactions->read)) {
        require_once DOL_DOCUMENT_ROOT.'/comm/action/class/actioncomm.class.php';
        $action = new ActionComm($db);
        $action->fetch($objectid);
        if ($action->authorid != $user->id && $action->userownerid != $user->id && !(array_key_exists($user->id, $action->userassigned))) {
          return false;
        }
      }
    }

    // For some object, we also have to check it is in the user hierarchy
    // Param $object must be the full object and not a simple id to have this test possible.
    if (in_array($feature, $checkhierarchy) && is_object($object)) {
      $childids = $user->getAllChildIds(1);
      $useridtocheck = 0;
      if ($feature == 'holiday') {
        $useridtocheck = $object->fk_user;
        if (!in_array($useridtocheck, $childids)) {
          return false;
        }
        $useridtocheck = $object->fk_validator;
        if (!in_array($useridtocheck, $childids)) {
          return false;
        }
      }
      if ($feature == 'expensereport') {
        $useridtocheck = $object->fk_user_author;
        if (!$user->rights->expensereport->readall) {
          if (!in_array($useridtocheck, $childids)) {
            return false;
          }
        }
      }
    }

    if ($sql) {
      $resql = $db->query($sql);
      if ($resql) {
        $obj = $db->fetch_object($resql);
        if (!$obj || $obj->nb < count(explode(',', $objectid))) { // error if we found 0 or less record than nb of id provided
          return false;
        }
      } else {
        dol_syslog("Bad forged sql in checkUserAccessToObject", LOG_WARNING);
        return false;
      }
    }
  }

  return true;
}

function accessforbidden($message = '', $printheader = 1, $printfooter = 1, $showonlymessage = 0, $params = null)
{
  global $conf, $db, $user, $langs, $hookmanager;
  if (!is_object($langs)) {
    include_once DOL_DOCUMENT_ROOT.'/core/class/translate.class.php';
    $langs = new Translate('', $conf);
    $langs->setDefaultLang();
  }

  $langs->load("errors");

  if ($printheader) {
    if (function_exists("llxHeader")) {
      llxHeader('');
    } elseif (function_exists("llxHeaderVierge")) {
      llxHeaderVierge('');
    }
  }
  print '<div class="error">';
  if (!$message) {
    print $langs->trans("ErrorForbidden");
  } else {
    print $message;
  }
  print '</div>';
  print '<br>';
  if (empty($showonlymessage)) {
    global $action, $object;
    if (empty($hookmanager)) {
      $hookmanager = new HookManager($db);
      // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
      $hookmanager->initHooks(array('main'));
    }
    $parameters = array('message'=>$message, 'params'=>$params);
    $reshook = $hookmanager->executeHooks('getAccessForbiddenMessage', $parameters, $object, $action); // Note that $action and $object may have been modified by some hooks
    print $hookmanager->resPrint;
    if (empty($reshook)) {
      $langs->loadLangs(array("errors"));
      if ($user->login) {
        print $langs->trans("CurrentLogin").': <span class="error">'.$user->login.'</span><br>';
        print $langs->trans("ErrorForbidden2", $langs->transnoentitiesnoconv("Home"), $langs->transnoentitiesnoconv("Users"));
        print $langs->trans("ErrorForbidden4");
      } else {
        print $langs->trans("ErrorForbidden3");
      }
    }
  }
  if ($printfooter && function_exists("llxFooter")) {
    llxFooter();
  }
  exit(0);
}


function getMaxFileSizeArray()
{
  global $conf;

  $max = $conf->global->MAIN_UPLOAD_DOC; // In Kb
  $maxphp = @ini_get('upload_max_filesize'); // In unknown
  if (preg_match('/k$/i', $maxphp)) {
    $maxphp = preg_replace('/k$/i', '', $maxphp);
    $maxphp = $maxphp * 1;
  }
  if (preg_match('/m$/i', $maxphp)) {
    $maxphp = preg_replace('/m$/i', '', $maxphp);
    $maxphp = $maxphp * 1024;
  }
  if (preg_match('/g$/i', $maxphp)) {
    $maxphp = preg_replace('/g$/i', '', $maxphp);
    $maxphp = $maxphp * 1024 * 1024;
  }
  if (preg_match('/t$/i', $maxphp)) {
    $maxphp = preg_replace('/t$/i', '', $maxphp);
    $maxphp = $maxphp * 1024 * 1024 * 1024;
  }
  $maxphp2 = @ini_get('post_max_size'); // In unknown
  if (preg_match('/k$/i', $maxphp2)) {
    $maxphp2 = preg_replace('/k$/i', '', $maxphp2);
    $maxphp2 = $maxphp2 * 1;
  }
  if (preg_match('/m$/i', $maxphp2)) {
    $maxphp2 = preg_replace('/m$/i', '', $maxphp2);
    $maxphp2 = $maxphp2 * 1024;
  }
  if (preg_match('/g$/i', $maxphp2)) {
    $maxphp2 = preg_replace('/g$/i', '', $maxphp2);
    $maxphp2 = $maxphp2 * 1024 * 1024;
  }
  if (preg_match('/t$/i', $maxphp2)) {
    $maxphp2 = preg_replace('/t$/i', '', $maxphp2);
    $maxphp2 = $maxphp2 * 1024 * 1024 * 1024;
  }
  // Now $max and $maxphp and $maxphp2 are in Kb
  $maxmin = $max;
  $maxphptoshow = $maxphptoshowparam = '';
  if ($maxphp > 0) {
    $maxmin = min($maxmin, $maxphp);
    $maxphptoshow = $maxphp;
    $maxphptoshowparam = 'upload_max_filesize';
  }
  if ($maxphp2 > 0) {
    $maxmin = min($maxmin, $maxphp2);
    if ($maxphp2 < $maxphp) {
      $maxphptoshow = $maxphp2;
      $maxphptoshowparam = 'post_max_size';
    }
  }
  //var_dump($maxphp.'-'.$maxphp2);
  //var_dump($maxmin);

  return array('max'=>$max, 'maxmin'=>$maxmin, 'maxphptoshow'=>$maxphptoshow, 'maxphptoshowparam'=>$maxphptoshowparam);
}