PageRenderTime 76ms CodeModel.GetById 16ms RepoModel.GetById 1ms app.codeStats 0ms

/htdocs/main.inc.php

https://github.com/zeert/dolibarr
PHP | 1702 lines | 1319 code | 149 blank | 234 comment | 237 complexity | 1a800985c8105ea858d67488d8aec5cb MD5 | raw file
Possible License(s): LGPL-2.0

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. /* Copyright (C) 2002-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
    3. 

  3.  * Copyright (C) 2003      Xavier Dutoit        <doli@sydesy.com>
    4. 

  4.  * Copyright (C) 2004-2012 Laurent Destailleur  <eldy@users.sourceforge.net>
    5. 

  5.  * Copyright (C) 2004      Sebastien Di Cintio  <sdicintio@ressource-toi.org>
    6. 

  6.  * Copyright (C) 2004      Benoit Mortier       <benoit.mortier@opensides.be>
    7. 

  7.  * Copyright (C) 2005-2012 Regis Houssin        <regis@dolibarr.fr>
    8. 

  8.  * Copyright (C) 2011      Philippe Grand       <philippe.grand@atoo-net.com>
    9. 

  9.  * Copyright (C) 2008      Matteli
    10. 

  10.  * Copyright (C) 2011      Juanjo Menent		<jmenent@2byte.es>
    11. 

  11.  *
    12. 

  12.  * This program is free software; you can redistribute it and/or modify
    13. 

  13.  * it under the terms of the GNU General Public License as published by
    14. 

  14.  * the Free Software Foundation; either version 2 of the License, or
    15. 

  15.  * (at your option) any later version.
    16. 

  16.  *
    17. 

  17.  * This program is distributed in the hope that it will be useful,
    18. 

  18.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
    19. 

  19.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    20. 

  20.  * GNU General Public License for more details.
    21. 

  21.  *
    22. 

  22.  * You should have received a copy of the GNU General Public License
    23. 

  23.  * along with this program. If not, see <http://www.gnu.org/licenses/>.
    24. 

  24.  */
    25. 

  25. 

  26. /**
    27. 

  27.  *	\file       htdocs/main.inc.php
    28. 

  28.  *	\ingroup	core
    29. 

  29.  *	\brief      File that defines environment for Dolibarr pages only (variables not required by scripts)
    30. 

  30.  */
    31. 

  31. 

  32. //@ini_set('memory_limit', '64M');	// This may be useless if memory is hard limited by your PHP
    33. 

  33. 

  34. // For optionnal tuning. Enabled if environment variable DOL_TUNING is defined.
    35. 

  35. // A call first. Is the equivalent function dol_microtime_float not yet loaded.
    36. 

  36. $micro_start_time=0;
    37. 

  37. if (! empty($_SERVER['DOL_TUNING']))
    38. 

  38. {
    39. 

  39.     list($usec, $sec) = explode(" ", microtime());
    40. 

  40.     $micro_start_time=((float) $usec + (float) $sec);
    41. 

  41.     // Add Xdebug code coverage
    42. 

  42.     //define('XDEBUGCOVERAGE',1);
    43. 

  43.     if (defined('XDEBUGCOVERAGE')) {
    44. 

  44.         xdebug_start_code_coverage();
    45. 

  45.     }
    46. 

  46. }
    47. 

  47. 

  48. // Removed magic_quotes
    49. 

  49. if (function_exists('get_magic_quotes_gpc'))	// magic_quotes_* removed in PHP6
    50. 

  50. {
    51. 

  51.     if (get_magic_quotes_gpc())
    52. 

  52.     {
    53. 

  53.         // Forcing parameter setting magic_quotes_gpc and cleaning parameters
    54. 

  54.         // (Otherwise he would have for each position, condition
    55. 

  55.         // Reading stripslashes variable according to state get_magic_quotes_gpc).
    56. 

  56.         // Off mode recommended (just do $db->escape for insert / update).
    57. 

  57.         function stripslashes_deep($value)
    58. 

  58.         {
    59. 

  59.             return (is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value));
    60. 

  60.         }
    61. 

  61.         $_GET     = array_map('stripslashes_deep', $_GET);
    62. 

  62.         $_POST    = array_map('stripslashes_deep', $_POST);
    63. 

  63.         $_FILES   = array_map('stripslashes_deep', $_FILES);
    64. 

  64.         //$_COOKIE  = array_map('stripslashes_deep', $_COOKIE); // Useless because a cookie should never be outputed on screen nor used into sql
    65. 

  65.         @set_magic_quotes_runtime(0);
    66. 

  66.     }
    67. 

  67. }
    68. 

  68. 

  69. /**
    70. 

  70.  * Security: SQL Injection and XSS Injection (scripts) protection (Filters on GET, POST, PHP_SELF).
    71. 

  71.  *
    72. 

  72.  * @param		string		$val		Value
    73. 

  73.  * @param		string		$type		1=GET, 0=POST, 2=PHP_SELF
    74. 

  74.  * @return		boolean					true if there is an injection
    75. 

  75.  */
    76. 

  76. function test_sql_and_script_inject($val, $type)
    77. 

  77. {
    78. 

  78.     $sql_inj = 0;
    79. 

  79.     // For SQL Injection (only GET and POST are used to be included into bad escaped SQL requests)
    80. 

  80.     if ($type != 2)
    81. 

  81.     {
    82. 

  82.         $sql_inj += preg_match('/delete[\s]+from/i', $val);
    83. 

  83.         $sql_inj += preg_match('/create[\s]+table/i', $val);
    84. 

  84.         $sql_inj += preg_match('/update.+set.+=/i', $val);
    85. 

  85.         $sql_inj += preg_match('/insert[\s]+into/i', $val);
    86. 

  86.         $sql_inj += preg_match('/select.+from/i', $val);
    87. 

  87.         $sql_inj += preg_match('/union.+select/i', $val);
    88. 

  88.         $sql_inj += preg_match('/(\.\.%2f)+/i', $val);
    89. 

  89.     }
    90. 

  90.     // For XSS Injection done by adding javascript with script
    91. 

  91.     // This is all cases a browser consider text is javascript:
    92. 

  92.     // When it found '<script', 'javascript:', '<style', 'onload\s=' on body tag, '="&' on a tag size with old browsers
    93. 

  93.     // All examples on page: http://ha.ckers.org/xss.html#XSScalc
    94. 

  94.     $sql_inj += preg_match('/<script/i', $val);
    95. 

  95.     $sql_inj += preg_match('/<style/i', $val);
    96. 

  96.     $sql_inj += preg_match('/base[\s]+href/i', $val);
    97. 

  97.     if ($type == 1)
    98. 

  98.     {
    99. 

  99.         $sql_inj += preg_match('/javascript:/i', $val);
    100. 

  100.         $sql_inj += preg_match('/vbscript:/i', $val);
    101. 

  101.     }
    102. 

  102.     // For XSS Injection done by adding javascript closing html tags like with onmousemove, etc... (closing a src or href tag with not cleaned param)
    103. 

  103.     if ($type == 1) $sql_inj += preg_match('/"/i', $val);      // We refused " in GET parameters value
    104. 

  104.     if ($type == 2) $sql_inj += preg_match('/[\s;"]/', $val);    // PHP_SELF is an url and must match url syntax
    105. 

  105.     return $sql_inj;
    106. 

  106. }
    107. 

  107. 

  108. /**
    109. 

  109.  * Security: Return true if OK, false otherwise.
    110. 

  110.  *
    111. 

  111.  * @param		string		&$var		Variable name
    112. 

  112.  * @param		string		$type		1=GET, 0=POST, 2=PHP_SELF
    113. 

  113.  * @return		boolean					true if ther is an injection
    114. 

  114.  */
    115. 

  115. function analyse_sql_and_script(&$var, $type)
    116. 

  116. {
    117. 

  117.     if (is_array($var))
    118. 

  118.     {
    119. 

  119.         foreach ($var as $key => $value)
    120. 

  120.         {
    121. 

  121.             if (analyse_sql_and_script($value,$type))
    122. 

  122.             {
    123. 

  123.                 $var[$key] = $value;
    124. 

  124.             }
    125. 

  125.             else
    126. 

  126.             {
    127. 

  127.                 print 'Access refused by SQL/Script injection protection in main.inc.php';
    128. 

  128.                 exit;
    129. 

  129.             }
    130. 

  130.         }
    131. 

  131.         return true;
    132. 

  132.     }
    133. 

  133.     else
    134. 

  134.     {
    135. 

  135.         return (test_sql_and_script_inject($var,$type) <= 0);
    136. 

  136.     }
    137. 

  137. }
    138. 

  138. 

  139. // Sanity check on URL
    140. 

  140. if (! empty($_SERVER["PHP_SELF"]))
    141. 

  141. {
    142. 

  142.     $morevaltochecklikepost=array($_SERVER["PHP_SELF"]);
    143. 

  143.     analyse_sql_and_script($morevaltochecklikepost,2);
    144. 

  144. }
    145. 

  145. // Sanity check on GET parameters
    146. 

  146. if (! empty($_SERVER["QUERY_STRING"]))
    147. 

  147. {
    148. 

  148.     $morevaltochecklikeget=array($_SERVER["QUERY_STRING"]);
    149. 

  149.     analyse_sql_and_script($morevaltochecklikeget,1);
    150. 

  150. }
    151. 

  151. // Sanity check on POST
    152. 

  152. analyse_sql_and_script($_POST,0);
    153. 

  153. 

  154. // This is to make Dolibarr working with Plesk
    155. 

  155. if (! empty($_SERVER['DOCUMENT_ROOT'])) set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
    156. 

  156. 

  157. // Include the conf.php and functions.lib.php
    158. 

  158. require_once("filefunc.inc.php");
    159. 

  159. 

  160. // Init session. Name of session is specific to Dolibarr instance.
    161. 

  161. $prefix=dol_getprefix();
    162. 

  162. $sessionname='DOLSESSID_'.$prefix;
    163. 

  163. $sessiontimeout='DOLSESSTIMEOUT_'.$prefix;
    164. 

  164. if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]);
    165. 

  165. session_name($sessionname);
    166. 

  166. session_start();
    167. 

  167. if (ini_get('register_globals'))    // To solve bug in using $_SESSION
    168. 

  168. {
    169. 

  169.     foreach ($_SESSION as $key=>$value)
    170. 

  170.     {
    171. 

  171.         if (isset($GLOBALS[$key])) unset($GLOBALS[$key]);
    172. 

  172.     }
    173. 

  173. }
    174. 

  174. 

  175. // Init the 5 global objects
    176. 

  176. // This include will set: $conf, $db, $langs, $user, $mysoc objects
    177. 

  177. require_once("master.inc.php");
    178. 

  178. 

  179. // Activate end of page function
    180. 

  180. register_shutdown_function('dol_shutdown');
    181. 

  181. 

  182. // Detection browser
    183. 

  183. if (isset($_SERVER["HTTP_USER_AGENT"]))
    184. 

  184. {
    185. 

  185.     $tmp=getBrowserInfo();
    186. 

  186.     $conf->browser->phone=$tmp['phone'];
    187. 

  187.     $conf->browser->name=$tmp['browsername'];
    188. 

  188.     $conf->browser->os=$tmp['browseros'];
    189. 

  189.     $conf->browser->firefox=$tmp['browserfirefox'];
    190. 

  190.     $conf->browser->version=$tmp['browserversion'];
    191. 

  191. }
    192. 

  192. 

  193. 

  194. // Force HTTPS if required ($conf->file->main_force_https is 0/1 or https dolibarr root url)
    195. 

  195. if (! empty($conf->file->main_force_https))
    196. 

  196. {
    197. 

  197.     $newurl='';
    198. 

  198.     if ($conf->file->main_force_https == '1')
    199. 

  199.     {
    200. 

  200.         if (! empty($_SERVER["SCRIPT_URI"]))	// If SCRIPT_URI supported by server
    201. 

  201.         {
    202. 

  202.             if (preg_match('/^http:/i',$_SERVER["SCRIPT_URI"]) && ! preg_match('/^https:/i',$_SERVER["SCRIPT_URI"]))	// If link is http
    203. 

  203.             {
    204. 

  204.                 $newurl=preg_replace('/^http:/i','https:',$_SERVER["SCRIPT_URI"]);
    205. 

  205.             }
    206. 

  206.         }
    207. 

  207.         else	// Check HTTPS environment variable (Apache/mod_ssl only)
    208. 

  208.         {
    209. 

  209.             // $_SERVER["HTTPS"] is 'on' when link is https, otherwise $_SERVER["HTTPS"] is empty or 'off'
    210. 

  210.             if (empty($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != 'on')		// If link is http
    211. 

  211.             {
    212. 

  212.                 $newurl=preg_replace('/^http:/i','https:',DOL_MAIN_URL_ROOT).$_SERVER["REQUEST_URI"];
    213. 

  213.             }
    214. 

  214.         }
    215. 

  215.     }
    216. 

  216.     else
    217. 

  217.     {
    218. 

  218.         $newurl=$conf->file->main_force_https.$_SERVER["REQUEST_URI"];
    219. 

  219.     }
    220. 

  220.     // Start redirect
    221. 

  221.     if ($newurl)
    222. 

  222.     {
    223. 

  223.         dol_syslog("main.inc: dolibarr_main_force_https is on, we make a redirect to ".$newurl);
    224. 

  224.         header("Location: ".$newurl);
    225. 

  225.         exit;
    226. 

  226.     }
    227. 

  227.     else
    228. 

  228.     {
    229. 

  229.         dol_syslog("main.inc: dolibarr_main_force_https is on but we failed to forge new https url so no redirect is done", LOG_WARNING);
    230. 

  230.     }
    231. 

  231. }
    232. 

  232. 

  233. 

  234. // Chargement des includes complementaires de presentation
    235. 

  235. if (! defined('NOREQUIREMENU')) require_once(DOL_DOCUMENT_ROOT ."/core/class/menu.class.php");			// Need 10ko memory (11ko in 2.2)
    236. 

  236. if (! defined('NOREQUIREHTML')) require_once(DOL_DOCUMENT_ROOT ."/core/class/html.form.class.php");	    // Need 660ko memory (800ko in 2.2)
    237. 

  237. if (! defined('NOREQUIREAJAX') && $conf->use_javascript_ajax) require_once(DOL_DOCUMENT_ROOT.'/core/lib/ajax.lib.php');	// Need 22ko memory
    238. 

  238. 

  239. // If install or upgrade process not done or not completely finished, we call the install page.
    240. 

  240. if (! empty($conf->global->MAIN_NOT_INSTALLED) || ! empty($conf->global->MAIN_NOT_UPGRADED))
    241. 

  241. {
    242. 

  242.     dol_syslog("main.inc: A previous install or upgrade was not complete. Redirect to install page.", LOG_WARNING);
    243. 

  243.     Header("Location: ".DOL_URL_ROOT."/install/index.php");
    244. 

  244.     exit;
    245. 

  245. }
    246. 

  246. // If an upgrade process is required, we call the install page.
    247. 

  247. if ((! empty($conf->global->MAIN_VERSION_LAST_UPGRADE) && ($conf->global->MAIN_VERSION_LAST_UPGRADE != DOL_VERSION))
    248. 

  248. || (empty($conf->global->MAIN_VERSION_LAST_UPGRADE) && ! empty($conf->global->MAIN_VERSION_LAST_INSTALL) && ($conf->global->MAIN_VERSION_LAST_INSTALL != DOL_VERSION)))
    249. 

  249. {
    250. 

  250.     $versiontocompare=empty($conf->global->MAIN_VERSION_LAST_UPGRADE)?$conf->global->MAIN_VERSION_LAST_INSTALL:$conf->global->MAIN_VERSION_LAST_UPGRADE;
    251. 

  251.     require_once(DOL_DOCUMENT_ROOT ."/core/lib/admin.lib.php");
    252. 

  252.     $dolibarrversionlastupgrade=preg_split('/[.-]/',$versiontocompare);
    253. 

  253.     $dolibarrversionprogram=preg_split('/[.-]/',DOL_VERSION);
    254. 

  254.     $rescomp=versioncompare($dolibarrversionprogram,$dolibarrversionlastupgrade);
    255. 

  255.     if ($rescomp > 0)   // Programs have a version higher than database. We did not add "&& $rescomp < 3" because we want upgrade process for build upgrades
    256. 

  256.     {
    257. 

  257.         dol_syslog("main.inc: database version ".$versiontocompare." is lower than programs version ".DOL_VERSION.". Redirect to install page.", LOG_WARNING);
    258. 

  258.         Header("Location: ".DOL_URL_ROOT."/install/index.php");
    259. 

  259.         exit;
    260. 

  260.     }
    261. 

  261. }
    262. 

  262. 

  263. // Creation of a token against CSRF vulnerabilities
    264. 

  264. if (! defined('NOTOKENRENEWAL'))
    265. 

  265. {
    266. 

  266.     $token = dol_hash(uniqid(mt_rand(),TRUE)); // Genere un hash d'un nombre aleatoire
    267. 

  267.     // roulement des jetons car cree a chaque appel
    268. 

  268.     if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];
    269. 

  269.     $_SESSION['newtoken'] = $token;
    270. 

  270. }
    271. 

  271. if (! empty($conf->global->MAIN_SECURITY_CSRF))	// Check validity of token, only if option enabled (this option breaks some features sometimes)
    272. 

  272. {
    273. 

  273.     if (isset($_POST['token']) && isset($_SESSION['token']))
    274. 

  274.     {
    275. 

  275.         if (($_POST['token'] != $_SESSION['token']))
    276. 

  276.         {
    277. 

  277.             dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'],LOG_WARNING);
    278. 

  278.             //print 'Unset POST by CSRF protection in main.inc.php.';	// Do not output anything because this create problems when using the BACK button on browsers.
    279. 

  279.             unset($_POST);
    280. 

  280.         }
    281. 

  281.     }
    282. 

  282. }
    283. 

  283. 

  284. // Disable modules (this must be after session_start and after conf has been loaded)
    285. 

  285. if (GETPOST('disablemodules'))  $_SESSION["disablemodules"]=GETPOST('disablemodules');
    286. 

  286. if (! empty($_SESSION["disablemodules"]))
    287. 

  287. {
    288. 

  288.     $disabled_modules=explode(',',$_SESSION["disablemodules"]);
    289. 

  289.     foreach($disabled_modules as $module)
    290. 

  290.     {
    291. 

  291.         if ($module) $conf->$module->enabled=false;
    292. 

  292.     }
    293. 

  293. }
    294. 

  294. 

  295. 

  296. /*
    297. 

  297.  * Phase authentication / login
    298. 

  298. */
    299. 

  299. $login='';
    300. 

  300. if (! defined('NOLOGIN'))
    301. 

  301. {
    302. 

  302.     // $authmode lists the different means of identification to be tested in order of preference.
    303. 

  303.     // Example: 'http', 'dolibarr', 'ldap', 'http,forceuser'
    304. 

  304. 

  305.     // Authentication mode
    306. 

  306.     if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr';
    307. 

  307.     // Authentication mode: forceuser
    308. 

  308.     if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto';
    309. 

  309.     // Set authmode
    310. 

  310.     $authmode=explode(',',$dolibarr_main_authentication);
    311. 

  311. 

  312.     // No authentication mode
    313. 

  313.     if (! count($authmode))
    314. 

  314.     {
    315. 

  315.         $langs->load('main');
    316. 

  316.         dol_print_error('',$langs->trans("ErrorConfigParameterNotDefined",'dolibarr_main_authentication'));
    317. 

  317.         exit;
    318. 

  318.     }
    319. 

  319. 

  320.     // If requested by the login has already occurred, it is retrieved from the session
    321. 

  321.     // Call module if not realized that his request.
    322. 

  322.     // At the end of this phase, the variable $login is defined.
    323. 

  323.     $resultFetchUser='';
    324. 

  324.     $test=true;
    325. 

  325.     if (! isset($_SESSION["dol_login"]))
    326. 

  326.     {
    327. 

  327.         // It is not already authenticated and it requests the login / password
    328. 

  328.         include_once(DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php');
    329. 

  329. 

  330.         // If in demo mode, we check we go to home page through the public/demo/index.php page
    331. 

  331.         if (! empty($dolibarr_main_demo) && $_SERVER['PHP_SELF'] == DOL_URL_ROOT.'/index.php')  // We ask index page
    332. 

  332.         {
    333. 

  333.             if (! preg_match('/public/',$_SERVER['HTTP_REFERER']))
    334. 

  334.             {
    335. 

  335.                 dol_syslog("Call index page from another url than demo page");
    336. 

  336.                 header("Location: ".DOL_URL_ROOT.'/public/demo/index.php');
    337. 

  337.                 exit;
    338. 

  338.             }
    339. 

  339.         }
    340. 

  340. 

  341.         // Verification security graphic code
    342. 

  342.         if (GETPOST("username","alpha",2) && ! empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA))
    343. 

  343.         {
    344. 

  344.             $sessionkey = 'dol_antispam_value';
    345. 

  345.             $ok=(array_key_exists($sessionkey, $_SESSION) === TRUE && (strtolower($_SESSION[$sessionkey]) == strtolower($_POST['code'])));
    346. 

  346. 

  347.             // Verifie code
    348. 

  348.             if (! $ok)
    349. 

  349.             {
    350. 

  350.                 dol_syslog('Bad value for code, connexion refused');
    351. 

  351.                 $langs->load('main');
    352. 

  352.                 $langs->load('errors');
    353. 

  353. 

  354.                 $user->trigger_mesg='ErrorBadValueForCode - login='.GETPOST("username","alpha",2);
    355. 

  355.                 $_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadValueForCode");
    356. 

  356.                 $test=false;
    357. 

  357. 

  358.                 // Appel des triggers
    359. 

  359.                 include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
    360. 

  360.                 $interface=new Interfaces($db);
    361. 

  361.                 $result=$interface->run_triggers('USER_LOGIN_FAILED',$user,$user,$langs,$conf,GETPOST('entity','int'));
    362. 

  362.                 if ($result < 0) {
    363. 

  363.                     $error++;
    364. 

  364.                 }
    365. 

  365.                 // Fin appel triggers
    366. 

  366.             }
    367. 

  367.         }
    368. 

  368. 

  369.         $usertotest		= (! empty($_COOKIE['login_dolibarr']) ? $_COOKIE['login_dolibarr'] : GETPOST("username","alpha",2));
    370. 

  370.         $passwordtotest	= (! empty($_COOKIE['password_dolibarr']) ? $_COOKIE['password_dolibarr'] : GETPOST('password'));
    371. 

  371.         $entitytotest	= (GETPOST('entity','int') ? GETPOST('entity','int') : 1);
    372. 

  372. 

  373.         // Validation of login/pass/entity
    374. 

  374.         // If ok, the variable login will be returned
    375. 

  375.         // If error, we will put error message in session under the name dol_loginmesg
    376. 

  376.         $goontestloop=false;
    377. 

  377.         if (isset($_SERVER["REMOTE_USER"]) && in_array('http',$authmode)) $goontestloop=true;
    378. 

  378.         if (GETPOST("username","alpha",2) || ! empty($_COOKIE['login_dolibarr']) || GETPOST('openid_mode','alpha',1)) $goontestloop=true;
    379. 

  379. 

  380.         if ($test && $goontestloop)
    381. 

  381.         {
    382. 

  382.             $login = checkLoginPassEntity($usertotest,$passwordtotest,$entitytotest,$authmode);
    383. 

  383.             if ($login)
    384. 

  384.             {
    385. 

  385.                 $dol_authmode=$conf->authmode;	// This properties is defined only when logged to say what mode was successfully used
    386. 

  386.                 $dol_tz=$_POST["tz"];
    387. 

  387.                 $dol_tz_string=$_POST["tz_string"];
    388. 

  388.                 $dol_dst=0;
    389. 

  389.                 if (isset($_POST["dst_first"]) && isset($_POST["dst_second"]))
    390. 

  390.                 {
    391. 

  391.                     include_once(DOL_DOCUMENT_ROOT."/core/lib/date.lib.php");
    392. 

  392.                     $datenow=dol_now();
    393. 

  393.                     $datefirst=dol_stringtotime($_POST["dst_first"]);
    394. 

  394.                     $datesecond=dol_stringtotime($_POST["dst_second"]);
    395. 

  395.                     if ($datenow >= $datefirst && $datenow < $datesecond) $dol_dst=1;
    396. 

  396.                 }
    397. 

  397.                 //print $datefirst.'-'.$datesecond.'-'.$datenow; exit;
    398. 

  398.                 $dol_dst_observed=$_POST["dst_observed"];
    399. 

  399.                 $dol_dst_first=$_POST["dst_first"];
    400. 

  400.                 $dol_dst_second=$_POST["dst_second"];
    401. 

  401.                 $dol_screenwidth=$_POST["screenwidth"];
    402. 

  402.                 $dol_screenheight=$_POST["screenheight"];
    403. 

  403.             }
    404. 

  404. 

  405.             if (! $login)
    406. 

  406.             {
    407. 

  407.                 dol_syslog('Bad password, connexion refused',LOG_DEBUG);
    408. 

  408.                 $langs->load('main');
    409. 

  409.                 $langs->load('errors');
    410. 

  410. 

  411.                 // Bad password. No authmode has found a good password.
    412. 

  412.                 $user->trigger_mesg=$langs->trans("ErrorBadLoginPassword").' - login='.GETPOST("username","alpha",2);
    413. 

  413.                 $_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
    414. 

  414. 

  415.                 // Appel des triggers
    416. 

  416.                 include_once(DOL_DOCUMENT_ROOT."/core/class/interfaces.class.php");
    417. 

  417.                 $interface=new Interfaces($db);
    418. 

  418.                 $result=$interface->run_triggers('USER_LOGIN_FAILED',$user,$user,$langs,$conf,GETPOST("username","alpha",2));
    419. 

  419.                 if ($result < 0) {
    420. 

  420.                     $error++;
    421. 

  421.                 }
    422. 

  422.                 // Fin appel triggers
    423. 

  423.             }
    424. 

  424.         }
    425. 

  425. 

  426.         // End test login / passwords
    427. 

  427.         if (! $login)
    428. 

  428.         {
    429. 

  429.             // We show login page
    430. 

  430.             if (! is_object($langs)) // This can occurs when calling page with NOREQUIRETRAN defined
    431. 

  431.             {
    432. 

  432.                 include_once(DOL_DOCUMENT_ROOT."/core/class/translate.class.php");
    433. 

  433.                 $langs=new Translate("",$conf);
    434. 

  434.             }
    435. 

  435.             dol_loginfunction($langs,$conf,$mysoc);
    436. 

  436.             exit;
    437. 

  437.         }
    438. 

  438. 

  439.         $resultFetchUser=$user->fetch('',$login);
    440. 

  440.         if ($resultFetchUser <= 0)
    441. 

  441.         {
    442. 

  442.             dol_syslog('User not found, connexion refused');
    443. 

  443.             session_destroy();
    444. 

  444.             session_name($sessionname);
    445. 

  445.             session_start();    // Fixing the bug of register_globals here is useless since session is empty
    446. 

  446. 

  447.             if ($resultFetchUser == 0)
    448. 

  448.             {
    449. 

  449.                 $langs->load('main');
    450. 

  450.                 $langs->load('errors');
    451. 

  451. 

  452.                 $user->trigger_mesg='ErrorCantLoadUserFromDolibarrDatabase - login='.$login;
    453. 

  453.                 $_SESSION["dol_loginmesg"]=$langs->trans("ErrorCantLoadUserFromDolibarrDatabase",$login);
    454. 

  454.             }
    455. 

  455.             if ($resultFetchUser < 0)
    456. 

  456.             {
    457. 

  457.                 $user->trigger_mesg=$user->error;
    458. 

  458.                 $_SESSION["dol_loginmesg"]=$user->error;
    459. 

  459.             }
    460. 

  460. 

  461.             // Call triggers
    462. 

  462.             include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
    463. 

  463.             $interface=new Interfaces($db);
    464. 

  464.             $result=$interface->run_triggers('USER_LOGIN_FAILED',$user,$user,$langs,$conf,$_POST["entity"]);
    465. 

  465.             if ($result < 0) {
    466. 

  466.                 $error++;
    467. 

  467.             }
    468. 

  468.             // End call triggers
    469. 

  469. 

  470.             header('Location: '.DOL_URL_ROOT.'/index.php');
    471. 

  471.             exit;
    472. 

  472.         }
    473. 

  473.     }
    474. 

  474.     else
    475. 

  475.     {
    476. 

  476.         // We are already into an authenticated session
    477. 

  477.         $login=$_SESSION["dol_login"];
    478. 

  478.         dol_syslog("This is an already logged session. _SESSION['dol_login']=".$login);
    479. 

  479. 

  480.         $resultFetchUser=$user->fetch('',$login);
    481. 

  481.         if ($resultFetchUser <= 0)
    482. 

  482.         {
    483. 

  483.             // Account has been removed after login
    484. 

  484.             dol_syslog("Can't load user even if session logged. _SESSION['dol_login']=".$login, LOG_WARNING);
    485. 

  485.             session_destroy();
    486. 

  486.             session_name($sessionname);
    487. 

  487.             session_start();    // Fixing the bug of register_globals here is useless since session is empty
    488. 

  488. 

  489.             if ($resultFetchUser == 0)
    490. 

  490.             {
    491. 

  491.                 $langs->load('main');
    492. 

  492.                 $langs->load('errors');
    493. 

  493. 

  494.                 $user->trigger_mesg='ErrorCantLoadUserFromDolibarrDatabase - login='.$login;
    495. 

  495.                 $_SESSION["dol_loginmesg"]=$langs->trans("ErrorCantLoadUserFromDolibarrDatabase",$login);
    496. 

  496.             }
    497. 

  497.             if ($resultFetchUser < 0)
    498. 

  498.             {
    499. 

  499.                 $user->trigger_mesg=$user->error;
    500. 

  500.                 $_SESSION["dol_loginmesg"]=$user->error;
    501. 

  501.             }
    502. 

  502. 

  503.             // Call triggers
    504. 

  504.             include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
    505. 

  505.             $interface=new Interfaces($db);
    506. 

  506.             $result=$interface->run_triggers('USER_LOGIN_FAILED',$user,$user,$langs,$conf,(isset($_POST["entity"])?$_POST["entity"]:0));
    507. 

  507.             if ($result < 0) {
    508. 

  508.                 $error++;
    509. 

  509.             }
    510. 

  510.             // End call triggers
    511. 

  511. 

  512.             header('Location: '.DOL_URL_ROOT.'/index.php');
    513. 

  513.             exit;
    514. 

  514.         }
    515. 

  515.         else
    516. 

  516.         {
    517. 

  517.             if (! empty($conf->global->MAIN_ACTIVATE_UPDATESESSIONTRIGGER))	// We do not execute such trigger at each page load by default
    518. 

  518.             {
    519. 

  519.                 // Call triggers
    520. 

  520.                 include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
    521. 

  521.                 $interface=new Interfaces($db);
    522. 

  522.                 $result=$interface->run_triggers('USER_UPDATE_SESSION',$user,$user,$langs,$conf,$conf->entity);
    523. 

  523.                 if ($result < 0) {
    524. 

  524.                     $error++;
    525. 

  525.                 }
    526. 

  526.                 // End call triggers
    527. 

  527.             }
    528. 

  528.         }
    529. 

  529.     }
    530. 

  530. 

  531.     // Is it a new session that has started ?
    532. 

  532.     // If we are here, this means authentication was successfull.
    533. 

  533.     if (! isset($_SESSION["dol_login"]))
    534. 

  534.     {
    535. 

  535.         $error=0;
    536. 

  536. 

  537.         // New session for this login
    538. 

  538.         $_SESSION["dol_login"]=$user->login;
    539. 

  539.         $_SESSION["dol_authmode"]=isset($dol_authmode)?$dol_authmode:'';
    540. 

  540.         $_SESSION["dol_tz"]=isset($dol_tz)?$dol_tz:'';
    541. 

  541.         $_SESSION["dol_tz_string"]=isset($dol_tz_string)?$dol_tz_string:'';
    542. 

  542.         $_SESSION["dol_dst"]=isset($dol_dst)?$dol_dst:'';
    543. 

  543.         $_SESSION["dol_dst_observed"]=isset($dol_dst_observed)?$dol_dst_observed:'';
    544. 

  544.         $_SESSION["dol_dst_first"]=isset($dol_dst_first)?$dol_dst_first:'';
    545. 

  545.         $_SESSION["dol_dst_second"]=isset($dol_dst_second)?$dol_dst_second:'';
    546. 

  546.         $_SESSION["dol_screenwidth"]=isset($dol_screenwidth)?$dol_screenwidth:'';
    547. 

  547.         $_SESSION["dol_screenheight"]=isset($dol_screenheight)?$dol_screenheight:'';
    548. 

  548.         $_SESSION["dol_company"]=$conf->global->MAIN_INFO_SOCIETE_NOM;
    549. 

  549.         $_SESSION["dol_entity"]=$conf->entity;
    550. 

  550.         dol_syslog("This is a new started user session. _SESSION['dol_login']=".$_SESSION["dol_login"].' Session id='.session_id());
    551. 

  551. 

  552.         $db->begin();
    553. 

  553. 

  554.         $user->update_last_login_date();
    555. 

  555. 

  556.         // Call triggers
    557. 

  557.         include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
    558. 

  558.         $interface=new Interfaces($db);
    559. 

  559.         $result=$interface->run_triggers('USER_LOGIN',$user,$user,$langs,$conf,GETPOST('entity','int'));
    560. 

  560.         if ($result < 0) {
    561. 

  561.             $error++;
    562. 

  562.         }
    563. 

  563.         // End call triggers
    564. 

  564. 

  565.         if ($error)
    566. 

  566.         {
    567. 

  567.             $db->rollback();
    568. 

  568.             session_destroy();
    569. 

  569.             dol_print_error($db,'Error in some triggers on action USER_LOGIN',LOG_ERR);
    570. 

  570.             exit;
    571. 

  571.         }
    572. 

  572.         else
    573. 

  573.         {
    574. 

  574.             $db->commit();
    575. 

  575.         }
    576. 

  576. 

  577.         // Create entity cookie, just used for login page
    578. 

  578.         if (! empty($conf->multicompany->enabled) && ! empty($conf->global->MULTICOMPANY_COOKIE_ENABLED) && isset($_POST["entity"]))
    579. 

  579.         {
    580. 

  580.             include_once(DOL_DOCUMENT_ROOT."/core/class/cookie.class.php");
    581. 

  581. 

  582.             $entity = $_SESSION["dol_login"].'|'.$_POST["entity"];
    583. 

  583. 

  584.             $prefix=dol_getprefix();
    585. 

  585.             $entityCookieName = 'DOLENTITYID_'.$prefix;
    586. 

  586.             // TTL : is defined in the config page multicompany
    587. 

  587.             $ttl = (! empty($conf->global->MULTICOMPANY_COOKIE_TTL) ? dol_now()+$conf->global->MULTICOMPANY_COOKIE_TTL : dol_now()+60*60*8 );
    588. 

  588.             // Cryptkey : will be created randomly in the config page multicompany
    589. 

  589.             $cryptkey = (! empty($conf->file->cookie_cryptkey) ? $conf->file->cookie_cryptkey : '' );
    590. 

  590. 

  591.             $entityCookie = new DolCookie($cryptkey);
    592. 

  592.             $entityCookie->_setCookie($entityCookieName, $entity, $ttl);
    593. 

  593.         }
    594. 

  594. 

  595.         // Hooks on successfull login
    596. 

  596.         $action='';
    597. 

  597.         include_once(DOL_DOCUMENT_ROOT.'/core/class/hookmanager.class.php');
    598. 

  598.         $hookmanager=new HookManager($db);
    599. 

  599.         $hookmanager->initHooks(array('login'));
    600. 

  600.         $parameters=array('dol_authmode'=>$dol_authmode);
    601. 

  601.         $reshook=$hookmanager->executeHooks('afterLogin',$parameters,$user,$action);    // Note that $action and $object may have been modified by some hooks
    602. 

  602.         if ($reshook < 0) $error++;
    603. 

  603.     }
    604. 

  604. 

  605. 

  606.     // If user admin, we force the rights-based modules
    607. 

  607.     if ($user->admin)
    608. 

  608.     {
    609. 

  609.         $user->rights->user->user->lire=1;
    610. 

  610.         $user->rights->user->user->creer=1;
    611. 

  611.         $user->rights->user->user->password=1;
    612. 

  612.         $user->rights->user->user->supprimer=1;
    613. 

  613.         $user->rights->user->self->creer=1;
    614. 

  614.         $user->rights->user->self->password=1;
    615. 

  615.     }
    616. 

  616. 

  617.     /*
    618. 

  618.      * Overwrite configs global by personal configs
    619. 

  619.     */
    620. 

  620.     // Set liste_limit
    621. 

  621.     if (isset($user->conf->MAIN_SIZE_LISTE_LIMIT))	// Can be 0
    622. 

  622.     {
    623. 

  623.         $conf->liste_limit = $user->conf->MAIN_SIZE_LISTE_LIMIT;
    624. 

  624.     }
    625. 

  625.     if (isset($user->conf->PRODUIT_LIMIT_SIZE))		// Can be 0
    626. 

  626.     {
    627. 

  627.         $conf->product->limit_size = $user->conf->PRODUIT_LIMIT_SIZE;
    628. 

  628.     }
    629. 

  629.     // Replace conf->css by personalized value
    630. 

  630.     if (isset($user->conf->MAIN_THEME) && $user->conf->MAIN_THEME)
    631. 

  631.     {
    632. 

  632.         $conf->theme=$user->conf->MAIN_THEME;
    633. 

  633.         $conf->css  = "/theme/".$conf->theme."/style.css.php";
    634. 

  634.     }
    635. 

  635. 

  636.     // If theme support option like flip-hide left menu and we use a smartphone, we force it
    637. 

  637.     if (! empty($conf->global->MAIN_SMARTPHONE_OPTIM) && $conf->browser->phone && $conf->theme == 'eldy') $conf->global->MAIN_MENU_USE_JQUERY_LAYOUT='forced';
    638. 

  638. 

  639.     // Set javascript option
    640. 

  640.     if (! GETPOST('nojs'))   // If javascript was not disabled on URL
    641. 

  641.     {
    642. 

  642.         if (! empty($user->conf->MAIN_DISABLE_JAVASCRIPT))
    643. 

  643.         {
    644. 

  644.             $conf->use_javascript_ajax=! $user->conf->MAIN_DISABLE_JAVASCRIPT;
    645. 

  645.         }
    646. 

  646.     }
    647. 

  647.     else $conf->use_javascript_ajax=0;
    648. 

  648. }
    649. 

  649. 

  650. if (! defined('NOREQUIRETRAN'))
    651. 

  651. {
    652. 

  652.     if (! GETPOST('lang'))	// If language was not forced on URL
    653. 

  653.     {
    654. 

  654.         // If user has chosen its own language
    655. 

  655.         if (! empty($user->conf->MAIN_LANG_DEFAULT))
    656. 

  656.         {
    657. 

  657.             // If different than current language
    658. 

  658.             //print ">>>".$langs->getDefaultLang()."-".$user->conf->MAIN_LANG_DEFAULT;
    659. 

  659.             if ($langs->getDefaultLang() != $user->conf->MAIN_LANG_DEFAULT)
    660. 

  660.             {
    661. 

  661.                 $langs->setDefaultLang($user->conf->MAIN_LANG_DEFAULT);
    662. 

  662.             }
    663. 

  663.         }
    664. 

  664.     }
    665. 

  665.     else	// If language was forced on URL
    666. 

  666.     {
    667. 

  667.         $langs->setDefaultLang(GETPOST('lang','alpha',1));
    668. 

  668.     }
    669. 

  669. }
    670. 

  670. 

  671. // Use php template engine
    672. 

  672. if (! empty($conf->global->MAIN_USE_TEMPLATE_ENGINE) && ! defined('NOTEMPLATEENGINE'))
    673. 

  673. {
    674. 

  674. 	require_once(DOL_DOCUMENT_ROOT.'/includes/savant/Savant3.php');
    675. 

  675. 

  676. 	$tpl = new Savant3();
    677. 

  677. }
    678. 

  678. 

  679. // Case forcing style from url
    680. 

  680. if (GETPOST('theme'))
    681. 

  681. {
    682. 

  682.     $conf->theme=GETPOST('theme','alpha',1);
    683. 

  683.     $conf->css  = "/theme/".$conf->theme."/style.css.php";
    684. 

  684. }
    685. 

  685. 

  686. 

  687. if (! defined('NOLOGIN'))
    688. 

  688. {
    689. 

  689.     // If the login is not recovered, it is identified with an account that does not exist.
    690. 

  690.     // Hacking attempt?
    691. 

  691.     if (! $user->login) accessforbidden();
    692. 

  692. 

  693.     // Check if user is active
    694. 

  694.     if ($user->statut < 1)
    695. 

  695.     {
    696. 

  696.         // If not active, we refuse the user
    697. 

  697.         $langs->load("other");
    698. 

  698.         dol_syslog("Authentification ko as login is disabled");
    699. 

  699.         accessforbidden($langs->trans("ErrorLoginDisabled"));
    700. 

  700.         exit;
    701. 

  701.     }
    702. 

  702. 

  703.     // Load permissions
    704. 

  704.     $user->getrights();
    705. 

  705. }
    706. 

  706. 

  707. 

  708. dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]);
    709. 

  709. //Another call for easy debugg
    710. 

  710. //dol_syslog("Access to ".$_SERVER["PHP_SELF"].' GET='.join(',',array_keys($_GET)).'->'.join(',',$_GET).' POST:'.join(',',array_keys($_POST)).'->'.join(',',$_POST));
    711. 

  711. 

  712. // Load main languages files
    713. 

  713. if (! defined('NOREQUIRETRAN'))
    714. 

  714. {
    715. 

  715.     $langs->load("main");
    716. 

  716.     $langs->load("dict");
    717. 

  717. }
    718. 

  718. 

  719. // Define some constants used for style of arrays
    720. 

  720. $bc=array(0=>'class="impair"',1=>'class="pair"');
    721. 

  721. $bcdd=array(0=>'class="impair drag drop"',1=>'class="pair drag drop"');
    722. 

  722. $bcnd=array(0=>'class="impair nodrag nodrop"',1=>'class="pair nodrag nodrop"');
    723. 

  723. 

  724. // Define messages variables
    725. 

  725. $mesg=''; $warning=''; $error=0;
    726. 

  726. // deprecated, see setEventMessage() and dol_htmloutput_events()
    727. 

  727. $mesgs=array(); $warnings=array(); $errors=array();
    728. 

  728. 

  729. // Constants used to defined number of lines in textarea
    730. 

  730. if (empty($conf->browser->firefox))
    731. 

  731. {
    732. 

  732.     define('ROWS_1',1);
    733. 

  733.     define('ROWS_2',2);
    734. 

  734.     define('ROWS_3',3);
    735. 

  735.     define('ROWS_4',4);
    736. 

  736.     define('ROWS_5',5);
    737. 

  737.     define('ROWS_6',6);
    738. 

  738.     define('ROWS_7',7);
    739. 

  739.     define('ROWS_8',8);
    740. 

  740.     define('ROWS_9',9);
    741. 

  741. }
    742. 

  742. else
    743. 

  743. {
    744. 

  744.     define('ROWS_1',0);
    745. 

  745.     define('ROWS_2',1);
    746. 

  746.     define('ROWS_3',2);
    747. 

  747.     define('ROWS_4',3);
    748. 

  748.     define('ROWS_5',4);
    749. 

  749.     define('ROWS_6',5);
    750. 

  750.     define('ROWS_7',6);
    751. 

  751.     define('ROWS_8',7);
    752. 

  752.     define('ROWS_9',8);
    753. 

  753. }
    754. 

  754. 

  755. $heightforframes=52;
    756. 

  756. 

  757. // Switch to another entity
    758. 

  758. if (! empty($conf->multicompany->enabled) && GETPOST('action') == 'switchentity')
    759. 

  759. {
    760. 

  760.     if ($mc->switchEntity(GETPOST('entity','int')) > 0)
    761. 

  761.     {
    762. 

  762.         Header("Location: ".DOL_URL_ROOT.'/');
    763. 

  763.         exit;
    764. 

  764.     }
    765. 

  765. }
    766. 

  766. 

  767. 

  768. // Functions
    769. 

  769. 

  770. if (! function_exists("llxHeader"))
    771. 

  771. {
    772. 

  772.     /**
    773. 

  773.      *	Show HTML header HTML + BODY + Top menu + left menu + DIV
    774. 

  774.      *
    775. 

  775.      * @param 	string 	$head				Optionnal head lines
    776. 

  776.      * @param 	string 	$title				HTML title
    777. 

  777.      * @param	string	$help_url			Url links to help page
    778. 

  778.      * 		                            	Syntax is: For a wiki page: EN:EnglishPage|FR:FrenchPage|ES:SpanishPage
    779. 

  779.      *                                  	For other external page: http://server/url
    780. 

  780.      * @param	string	$target				Target to use on links
    781. 

  781.      * @param 	int    	$disablejs			More content into html header
    782. 

  782.      * @param 	int    	$disablehead		More content into html header
    783. 

  783.      * @param 	array  	$arrayofjs			Array of complementary js files
    784. 

  784.      * @param 	array  	$arrayofcss			Array of complementary css files
    785. 

  785.      * @param	string	$morequerystring	Query string to add to the link "print" to get same parameters (use only if autodetect fails)
    786. 

  786.      * @return	void
    787. 

  787.      */
    788. 

  788. 	function llxHeader($head = '', $title='', $help_url='', $target='', $disablejs=0, $disablehead=0, $arrayofjs='', $arrayofcss='', $morequerystring='')
    789. 

  789. 	{
    790. 

  790. 		top_htmlhead($head, $title, $disablejs, $disablehead, $arrayofjs, $arrayofcss);	// Show html headers
    791. 

  791. 		top_menu($head, $title, $target, $disablejs, $disablehead, $arrayofjs, $arrayofcss, $morequerystring);
    792. 

  792. 		if (empty($conf->global->MAIN_HIDE_LEFT_MENU)) {
    793. 

  793. 			left_menu('', $help_url, '', '', 1, $title);
    794. 

  794. 		}
    795. 

  795. 		main_area($title);
    796. 

  796. 	}
    797. 

  797. }
    798. 

  798. 

  799. 

  800. /**
    801. 

  801.  *  Show HTTP header
    802. 

  802.  *
    803. 

  803.  *  @return	void
    804. 

  804.  */
    805. 

  805. function top_httphead()
    806. 

  806. {
    807. 

  807.     global $conf;
    808. 

  808. 

  809.     //header("Content-type: text/html; charset=UTF-8");
    810. 

  810.     header("Content-type: text/html; charset=".$conf->file->character_set_client);
    811. 

  811. 

  812.     // On the fly GZIP compression for all pages (if browser support it). Must set the bit 3 of constant to 1.
    813. 

  813.     if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x04)) {
    814. 

  814.         ob_start("ob_gzhandler");
    815. 

  815.     }
    816. 

  816. }
    817. 

  817. 

  818. /**
    819. 

  819.  * Ouput html header of a page.
    820. 

  820.  * This code is also duplicated into security2.lib.php::dol_loginfunction
    821. 

  821.  *
    822. 

  822.  * @param 	string 	$head			Optionnal head lines
    823. 

  823.  * @param 	string 	$title			HTML title
    824. 

  824.  * @param 	int    	$disablejs		More content into html header
    825. 

  825.  * @param 	int    	$disablehead	More content into html header
    826. 

  826.  * @param 	array  	$arrayofjs		Array of complementary js files
    827. 

  827.  * @param 	array  	$arrayofcss		Array of complementary css files
    828. 

  828.  * @return	void
    829. 

  829.  */
    830. 

  830. function top_htmlhead($head, $title='', $disablejs=0, $disablehead=0, $arrayofjs='', $arrayofcss='')
    831. 

  831. {
    832. 

  832.     global $user, $conf, $langs, $db;
    833. 

  833. 

  834.     top_httphead();
    835. 

  835. 

  836.     if (empty($conf->css)) $conf->css = '/theme/eldy/style.css.php';	// If not defined, eldy by default
    837. 

  837. 

  838.     print '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">';
    839. 

  839.     //print '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd">';
    840. 

  840.     //print '<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">';
    841. 

  841.     //print '<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">';
    842. 

  842.     //print '<!DOCTYPE HTML>';
    843. 

  843.     print "\n";
    844. 

  844.     if (! empty($conf->global->MAIN_USE_CACHE_MANIFEST)) print '<html manifest="cache.manifest">'."\n";
    845. 

  845.     else print '<html>'."\n";
    846. 

  846.     //print '<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr">'."\n";
    847. 

  847.     if (empty($disablehead))
    848. 

  848.     {
    849. 

  849.         print "<head>\n";
    850. 

  850. 

  851.         // Displays meta
    852. 

  852.         print '<meta name="robots" content="noindex,nofollow">'."\n";      // Evite indexation par robots
    853. 

  853.         print '<meta name="author" content="Dolibarr Development Team">'."\n";
    854. 

  854.         $favicon=DOL_URL_ROOT.'/theme/'.$conf->theme.'/img/favicon.ico';
    855. 

  855.         print '<link rel="shortcut icon" type="image/x-icon" href="'.$favicon.'"/>'."\n";
    856. 

  856.         // Displays title
    857. 

  857.         $appli='Dolibarr';
    858. 

  858.         if (!empty($conf->global->MAIN_APPLICATION_TITLE)) $appli=$conf->global->MAIN_APPLICATION_TITLE;
    859. 

  859. 

  860.         if ($title) print '<title>'.$appli.' - '.$title.'</title>';
    861. 

  861.         else print "<title>".$appli."</title>";
    862. 

  862.         print "\n";
    863. 

  863. 

  864.         if (! defined('DISABLE_JQUERY') && ! $disablejs && $conf->use_javascript_ajax)
    865. 

  865.         {
    866. 

  866.             print '<!-- Includes for JQuery (Ajax library) -->'."\n";
    867. 

  867.             $jquerytheme = 'smoothness';
    868. 

  868.             if (!empty($conf->global->MAIN_USE_JQUERY_THEME)) $jquerytheme = $conf->global->MAIN_USE_JQUERY_THEME;
    869. 

  869.             if (constant('JS_JQUERY_UI')) print '<link rel="stylesheet" type="text/css" href="'.JS_JQUERY_UI.'css/'.$jquerytheme.'/jquery-ui.min.css" />'."\n";  // JQuery
    870. 

  870.             else print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/css/'.$jquerytheme.'/jquery-ui-latest.custom.css" />'."\n";    // JQuery
    871. 

  871.             print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/tiptip/tipTip.css" />'."\n";                           // Tooltip
    872. 

  872.             print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/jnotify/jquery.jnotify-alt.min.css" />'."\n";          // JNotify
    873. 

  873.             //print '<link rel="stylesheet" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/lightbox/css/jquery.lightbox-0.5.css" media="screen" />'."\n";       // Lightbox
    874. 

  874.             if (! empty($conf->global->MAIN_USE_JQUERY_FILEUPLOAD))     // jQuery fileupload
    875. 

  875.             {
    876. 

  876.                 print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/css/jquery.fileupload-ui.css" />'."\n";
    877. 

  877.             }
    878. 

  878.             if (! empty($conf->global->MAIN_USE_JQUERY_DATATABLES))     // jQuery datatables
    879. 

  879.             {
    880. 

  880.                 //print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/css/jquery.dataTables.css" />'."\n";
    881. 

  881.                 print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/css/jquery.dataTables_jui.css" />'."\n";
    882. 

  882.                 print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/ColReorder/css/ColReorder.css" />'."\n";
    883. 

  883.                 print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/ColVis/css/ColVis.css" />'."\n";
    884. 

  884.                 //print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/ColVis/css/ColVisAlt.css" />'."\n";
    885. 

  885.                 print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/TableTools/css/TableTools.css" />'."\n";
    886. 

  886.             }
    887. 

  887.             if (! empty($conf->global->MAIN_USE_JQUERY_MULTISELECT))     // jQuery multiselect
    888. 

  888.             {
    889. 

  889.             	print '<link rel="stylesheet" type="text/css" href="'.DOL_URL_ROOT.'/includes/jquery/plugins/multiselect/css/ui.multiselect.css" />'."\n";
    890. 

  890.             }
    891. 

  891.         }
    892. 

  892. 

  893.         print '<!-- Includes for Dolibarr, modules or specific pages-->'."\n";
    894. 

  894.         // Output style sheets (optioncss='print' or '')
    895. 

  895.         $themepath=dol_buildpath((empty($conf->global->MAIN_FORCETHEMEDIR)?'':$conf->global->MAIN_FORCETHEMEDIR).$conf->css,1);
    896. 

  896.         $themeparam='?lang='.$langs->defaultlang.'&amp;theme='.$conf->theme.(GETPOST('optioncss')?'&amp;optioncss='.GETPOST('optioncss','alpha',1):'');
    897. 

  897.         if (! empty($_SESSION['dol_resetcache'])) $themeparam.='&amp;dol_resetcache='.$_SESSION['dol_resetcache'];
    898. 

  898.         //print 'themepath='.$themepath.' themeparam='.$themeparam;exit;
    899. 

  899.         print '<link rel="stylesheet" type="text/css" title="default" href="'.$themepath.$themeparam.'">'."\n";
    900. 

  900.         // CSS forced by modules (relative url starting with /)
    901. 

  901.         if (isset($conf->modules_parts['css']))
    902. 

  902.         {
    903. 

  903.         	$dircss=(array) $conf->modules_parts['css'];
    904. 

  904.         	foreach($dircss as $key => $cssfile)
    905. 

  905.         	{
    906. 

  906.         		// cssfile is a relative path
    907. 

  907.         		print '<link rel="stylesheet" type="text/css" title="default" href="'.dol_buildpath($cssfile,1);
    908. 

  908.         		// We add params only if page is not static, because some web server setup does not return content type text/css if url has parameters, so browser cache is not used.
    909. 

  909.         		if (!preg_match('/\.css$/i',$cssfile)) print $themeparam;
    910. 

  910.         		print '"><!-- Added by module '.$key. '-->'."\n";
    911. 

  911.         	}
    912. 

  912.         }
    913. 

  913.         // CSS forced by page in top_htmlhead call (relative url starting with /)
    914. 

  914.         if (is_array($arrayofcss))
    915. 

  915.         {
    916. 

  916.             foreach($arrayofcss as $cssfile)
    917. 

  917.             {
    918. 

  918.                 print '<link rel="stylesheet" type="text/css" title="default" href="'.dol_buildpath($cssfile,1);
    919. 

  919.                 // We add params only if page is not static, because some web server setup does not return content type text/css if url has parameters and browser cache is not used.
    920. 

  920.                 if (!preg_match('/\.css$/i',$cssfile)) print $themeparam;
    921. 

  921.                 print '"><!-- Added by page -->'."\n";
    922. 

  922.             }
    923. 

  923.         }
    924. 

  924. 

  925.         if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) print '<link rel="top" title="'.$langs->trans("Home").'" href="'.(DOL_URL_ROOT?DOL_URL_ROOT:'/').'">'."\n";
    926. 

  926.         if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) print '<link rel="copyright" title="GNU General Public License" href="http://www.gnu.org/copyleft/gpl.html#SEC1">'."\n";
    927. 

  927.         if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) print '<link rel="author" title="Dolibarr Development Team" href="http://www.dolibarr.org">'."\n";
    928. 

  928. 

  929.         // Output standard javascript links
    930. 

  930.         if (! $disablejs && $conf->use_javascript_ajax)
    931. 

  931.         {
    932. 

  932.             $ext='.js';
    933. 

  933.             if (isset($conf->global->MAIN_OPTIMIZE_SPEED) && ($conf->global->MAIN_OPTIMIZE_SPEED & 0x01)) {
    934. 

  934.                 $ext='.jgz';
    935. 

  935.             }	// mini='_mini', ext='.gz'
    936. 

  936. 

  937.             // JQuery. Must be before other includes
    938. 

  938.             print '<!-- Includes JS for JQuery -->'."\n";
    939. 

  939.             if (constant('JS_JQUERY')) print '<script type="text/javascript" src="'.JS_JQUERY.'jquery.min.js"></script>'."\n";
    940. 

  940.             else print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/js/jquery-latest.min'.$ext.'"></script>'."\n";
    941. 

  941.             if (constant('JS_JQUERY_UI')) print '<script type="text/javascript" src="'.JS_JQUERY_UI.'jquery-ui.min.js"></script>'."\n";
    942. 

  942.             else print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/js/jquery-ui-latest.custom.min'.$ext.'"></script>'."\n";
    943. 

  943.             print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/tablednd/jquery.tablednd_0_5'.$ext.'"></script>'."\n";
    944. 

  944.             print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/tiptip/jquery.tipTip.min'.$ext.'"></script>'."\n";
    945. 

  945.             //print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/lightbox/js/jquery.lightbox-0.5.min'.$ext.'"></script>'."\n";
    946. 

  946.             // jQuery Layout
    947. 

  947.             if (! empty($conf->global->MAIN_MENU_USE_JQUERY_LAYOUT) || defined('REQUIRE_JQUERY_LAYOUT'))
    948. 

  948.             {
    949. 

  949.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/layout/jquery.layout-latest'.$ext.'"></script>'."\n";
    950. 

  950.             }
    951. 

  951.             // jQuery jnotify
    952. 

  952.             if (empty($conf->global->MAIN_DISABLE_JQUERY_JNOTIFY))
    953. 

  953.             {
    954. 

  954.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/jnotify/jquery.jnotify.min.js"></script>'."\n";
    955. 

  955.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/core/js/jnotify.js"></script>'."\n";
    956. 

  956.             }
    957. 

  957.             // Flot
    958. 

  958.             if (empty($conf->global->MAIN_DISABLE_JQUERY_FLOT))
    959. 

  959.             {
    960. 

  960.                 if (constant('JS_JQUERY_FLOT'))
    961. 

  961.                 {
    962. 

  962.                     print '<!--[if lte IE 8]><script language="javascript" type="text/javascript" src="/javascript/excanvas/excanvas.min.js"></script><![endif]-->'."\n";
    963. 

  963.                     print '<script type="text/javascript" src="'.JS_JQUERY_FLOT.'jquery.flot.js"></script>'."\n";
    964. 

  964.                     print '<script type="text/javascript" src="'.JS_JQUERY_FLOT.'jquery.flot.pie.js"></script>'."\n";
    965. 

  965.                     print '<script type="text/javascript" src="'.JS_JQUERY_FLOT.'jquery.flot.stack.js"></script>'."\n";
    966. 

  966.                 }
    967. 

  967.                 else
    968. 

  968.                 {
    969. 

  969.                     print '<!--[if lte IE 8]><script language="javascript" type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/flot/excanvas.min.js"></script><![endif]-->'."\n";
    970. 

  970.                     print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/flot/jquery.flot.min.js"></script>'."\n";
    971. 

  971.                     print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/flot/jquery.flot.pie.min.js"></script>'."\n";
    972. 

  972.                     print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/flot/jquery.flot.stack.min.js"></script>'."\n";
    973. 

  973.                 }
    974. 

  974.             }
    975. 

  975.             // jQuery jeditable
    976. 

  976.             if (! empty($conf->global->MAIN_USE_JQUERY_JEDITABLE))
    977. 

  977.             {
    978. 

  978.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/jeditable/jquery.jeditable.min'.$ext.'"></script>'."\n";
    979. 

  979.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/jeditable/jquery.jeditable.ui-datepicker.js"></script>'."\n";
    980. 

  980.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/jeditable/jquery.jeditable.ui-autocomplete.js"></script>'."\n";
    981. 

  981.                 print '<script type="text/javascript">'."\n";
    982. 

  982.                 print 'var urlSaveInPlace = \''.DOL_URL_ROOT.'/core/ajax/saveinplace.php\';'."\n";
    983. 

  983.                 print 'var urlLoadInPlace = \''.DOL_URL_ROOT.'/core/ajax/loadinplace.php\';'."\n";
    984. 

  984.                 print 'var tooltipInPlace = \''.$langs->transnoentities('ClickToEdit').'\';'."\n";
    985. 

  985.                 print 'var placeholderInPlace = \''.$langs->trans('ClickToEdit').'\';'."\n";
    986. 

  986.                 print 'var cancelInPlace = \''.$langs->trans('Cancel').'\';'."\n";
    987. 

  987.                 print 'var submitInPlace = \''.$langs->trans('Ok').'\';'."\n";
    988. 

  988.                 print 'var indicatorInPlace = \'<img src="'.DOL_URL_ROOT."/theme/".$conf->theme."/img/working.gif".'">\';'."\n";
    989. 

  989.                 print '</script>'."\n";
    990. 

  990.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/core/js/editinplace.js"></script>'."\n";
    991. 

  991.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/jeditable/jquery.jeditable.ckeditor.js"></script>'."\n";
    992. 

  992.             }
    993. 

  993.             // jQuery File Upload
    994. 

  994.             if (! empty($conf->global->MAIN_USE_JQUERY_FILEUPLOAD))
    995. 

  995.             {
    996. 

  996.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/template/tmpl.min.js"></script>'."\n";
    997. 

  997.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/jquery.iframe-transport.js"></script>'."\n";
    998. 

  998.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/jquery.fileupload.js"></script>'."\n";
    999. 

  999.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/jquery.fileupload-fp.js"></script>'."\n";
    1000. 

  1000.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/jquery.fileupload-ui.js"></script>'."\n";
    1001. 

  1001.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/jquery.fileupload-jui.js"></script>'."\n";
    1002. 

  1002.                 print '<!-- The XDomainRequest Transport is included for cross-domain file deletion for IE8+ -->'."\n";
    1003. 

  1003.                 '<!--[if gte IE 8]><script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/fileupload/js/cors/jquery.xdr-transport.js"></script><![endif]-->'."\n";
    1004. 

  1004.             }
    1005. 

  1005.             // jQuery DataTables
    1006. 

  1006.             if (! empty($conf->global->MAIN_USE_JQUERY_DATATABLES))
    1007. 

  1007.             {
    1008. 

  1008.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/js/jquery.dataTables.min'.$ext.'"></script>'."\n";
    1009. 

  1009.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/ColReorder/js/ColReorder.min'.$ext.'"></script>'."\n";
    1010. 

  1010.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/ColVis/js/ColVis.min'.$ext.'"></script>'."\n";
    1011. 

  1011.                 print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/datatables/extras/TableTools/js/TableTools.min'.$ext.'"></script>'."\n";
    1012. 

  1012.             }
    1013. 

  1013.             // jQuery Multiselect
    1014. 

  1014.             if (! empty($conf->global->MAIN_USE_JQUERY_MULTISELECT))
    1015. 

  1015.             {
    1016. 

  1016.             	print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/includes/jquery/plugins/multiselect/js/ui.multiselect.js"></script>'."\n";
    1017. 

  1017.             }
    1018. 

  1018.             // CKEditor
    1019. 

  1019.             if (! empty($conf->fckeditor->enabled) && (empty($conf->global->FCKEDITOR_EDITORNAME) || $conf->global->FCKEDITOR_EDITORNAME == 'ckeditor'))
    1020. 

  1020.             {
    1021. 

  1021.                 print '<!-- Includes JS for CKEditor -->'."\n";
    1022. 

  1022.                 $pathckeditor=DOL_URL_ROOT.'/includes/ckeditor/';
    1023. 

  1023.                 if (constant('JS_CKEDITOR')) $pathckeditor=JS_CKEDITOR;    // To use external ckeditor js lib
    1024. 

  1024.                 print '<script type="text/javascript">';
    1025. 

  1025.                 print 'var CKEDITOR_BASEPATH = \''.$pathckeditor.'\';'."\n";
    1026. 

  1026.                 print 'var ckeditorConfig = \''.dol_buildpath('/theme/'.$conf->theme.'/ckeditor/config.js',1).'\';'."\n";
    1027. 

  1027.                 print 'var ckeditorFilebrowserBrowseUrl = \''.DOL_URL_ROOT.'/core/filemanagerdol/browser/default/browser.php?Connector='.DOL_URL_ROOT.'/core/filemanagerdol/connectors/php/connector.php\';'."\n";
    1028. 

  1028.                 print 'var ckeditorFilebrowserImageBrowseUrl = \''.DOL_URL_ROOT.'/core/filemanagerdol/browser/default/browser.php?Type=Image&Connector='.DOL_URL_ROOT.'/core/filemanagerdol/connectors/php/connector.php\';'."\n";
    1029. 

  1029.                 print '</script>'."\n";
    1030. 

  1030.                 print '<script type="text/javascript" src="'.$pathckeditor.'ckeditor_basic.js"></script>'."\n";
    1031. 

  1031.             }
    1032. 

  1032. 

  1033.             // Global js function
    1034. 

  1034.             print '<!-- Includes JS of Dolibarr -->'."\n";
    1035. 

  1035.             print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/core/js/lib_head.js"></script>'."\n";
    1036. 

  1036. 

  1037.             // Add datepicker default options
    1038. 

  1038.             print '<script type="text/javascript" src="'.DOL_URL_ROOT.'/core/js/datepicker.js.php?lang='.$langs->defaultlang.'"></script>'."\n";
    1039. 

  1039. 

  1040.             // JS forced by modules (relative url starting with /)
    1041. 

  1041.             $dirjs=(array) $conf->modules_parts['js'];
    1042. 

  1042.             foreach($dirjs as $key => $jsfile)
    1043. 

  1043.             {
    1044. 

  1044.             	// jsfile is a relative path
    1045. 

  1045.             	print '<script type="text/javascript" src="'.dol_buildpath($jsfile,1).'"></script><!-- Added by module '.$key. '-->'."\n";
    1046. 

  1046.             }
    1047. 

  1047.             // JS forced by page in top_htmlhead (relative url starting with /)
    1048. 

  1048.             if (is_array($arrayofjs))
    1049. 

  1049.             {
    1050. 

  1050.                 print '<!-- Includes JS specific to page -->'."\n";
    1051. 

  1051.                 foreach($arrayofjs as $jsfile)
    1052. 

  1052.                 {
    1053. 

  1053.                     if (preg_match('/^http/i',$jsfile))
    1054. 

  1054.                     {
    1055. 

  1055.                         print '<script type="text/javascript" src="'.$jsfile.'"></script>'."\n";
    1056. 

  1056.                     }
    1057. 

  1057.                     else
    1058. 

  1058.                     {
    1059. 

  1059.                         if (! preg_match('/^\//',$jsfile)) $jsfile='/'.$jsfile;	// For b…
    1060.

Large files files are truncated, but you can click here to view the full file