data/mahnung
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: verifCsrf() entfernt — Funktion existiert nicht in Dolibarr, CSRF wird via newToken() gehandhabt [deploy]
All checks were successful
Deploy mahnung / deploy (push) Successful in 12s
Details

Browse source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Eduard Wisch 2026-05-10 16:30:55 +02:00
parent f3b70788d2
commit c5ec39a258
1 changed files with 56 additions and 69 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

125
admin/setup.php
View file

@ -58,85 +58,72 @@ $action = GETPOST('action', 'aZ09');
// POST: Allgemeine Konstanten speichern // POST: Allgemeine Konstanten speichern
// --------------------------------------------------------------- // ---------------------------------------------------------------
if ($action === 'save_consts' && $user->hasRight('mahnung', 'setup')) { if ($action === 'save_consts' && $user->hasRight('mahnung', 'setup')) {
if (!verifCsrf($_POST['token'] ?? '', 'admin_mahnung')) { $basis = str_replace(',', '.', GETPOST('MAHNUNG_BASISZINS', 'alphanohtml'));
setEventMessages($langs->trans('ErrorBadValueForToken'), null, 'errors'); $b2c = str_replace(',', '.', GETPOST('MAHNUNG_AUFSCHLAG_B2C', 'alphanohtml'));
} else { $b2b = str_replace(',', '.', GETPOST('MAHNUNG_AUFSCHLAG_B2B', 'alphanohtml'));
$basis = str_replace(',', '.', GETPOST('MAHNUNG_BASISZINS', 'alphanohtml')); $pau = str_replace(',', '.', GETPOST('MAHNUNG_PAUSCHALE_B2B', 'alphanohtml'));
$b2c = str_replace(',', '.', GETPOST('MAHNUNG_AUFSCHLAG_B2C', 'alphanohtml')); $topic = GETPOST('MAHNUNG_NTFY_TOPIC', 'alphanohtml');
$b2b = str_replace(',', '.', GETPOST('MAHNUNG_AUFSCHLAG_B2B', 'alphanohtml'));
$pau = str_replace(',', '.', GETPOST('MAHNUNG_PAUSCHALE_B2B', 'alphanohtml'));
$topic = GETPOST('MAHNUNG_NTFY_TOPIC', 'alphanohtml');
dolibarr_set_const($db, 'MAHNUNG_BASISZINS', (string) (float) $basis, 'chaine', 0, '', 0); dolibarr_set_const($db, 'MAHNUNG_BASISZINS', (string) (float) $basis, 'chaine', 0, '', 0);
dolibarr_set_const($db, 'MAHNUNG_AUFSCHLAG_B2C', (string) (float) $b2c, 'chaine', 0, '', 0); dolibarr_set_const($db, 'MAHNUNG_AUFSCHLAG_B2C', (string) (float) $b2c, 'chaine', 0, '', 0);
dolibarr_set_const($db, 'MAHNUNG_AUFSCHLAG_B2B', (string) (float) $b2b, 'chaine', 0, '', 0); dolibarr_set_const($db, 'MAHNUNG_AUFSCHLAG_B2B', (string) (float) $b2b, 'chaine', 0, '', 0);
dolibarr_set_const($db, 'MAHNUNG_PAUSCHALE_B2B', (string) (float) $pau, 'chaine', 0, '', 0); dolibarr_set_const($db, 'MAHNUNG_PAUSCHALE_B2B', (string) (float) $pau, 'chaine', 0, '', 0);
dolibarr_set_const($db, 'MAHNUNG_NTFY_TOPIC', (string) $topic, 'chaine', 0, '', $conf->entity); dolibarr_set_const($db, 'MAHNUNG_NTFY_TOPIC', (string) $topic, 'chaine', 0, '', $conf->entity);
setEventMessages($langs->trans('MahnungSettingsSaved'), null, 'mesgs'); setEventMessages($langs->trans('MahnungSettingsSaved'), null, 'mesgs');
header('Location: '.$_SERVER['PHP_SELF']); header('Location: '.$_SERVER['PHP_SELF']);
exit; exit;
}
} }
// --------------------------------------------------------------- // ---------------------------------------------------------------
// POST: Stufen-Tabelle speichern (Bulk-Update aller 3 Stufen) // POST: Stufen-Tabelle speichern (Bulk-Update aller 3 Stufen)
// --------------------------------------------------------------- // ---------------------------------------------------------------
if ($action === 'save_stufen' && $user->hasRight('mahnung', 'setup')) { if ($action === 'save_stufen' && $user->hasRight('mahnung', 'setup')) {
if (!verifCsrf($_POST['token'] ?? '', 'admin_mahnung')) { $stufeObj = new MahnungStufe($db);
setEventMessages($langs->trans('ErrorBadValueForToken'), null, 'errors'); $alle = $stufeObj->fetchAllActive();
} else { // Auch inaktive laden (active=0) — fetchAllActive filtert; hier inkl. inaktive:
$stufeObj = new MahnungStufe($db); $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."mahnung_stufe WHERE entity = ".((int) $conf->entity)." ORDER BY stufe";
$alle = $stufeObj->fetchAllActive(); $resql = $db->query($sql);
// Auch inaktive laden (active=0) — fetchAllActive filtert; hier inkl. inaktive: $ids = array();
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."mahnung_stufe WHERE entity = ".((int) $conf->entity)." ORDER BY stufe"; if ($resql) {
$resql = $db->query($sql); while ($obj = $db->fetch_object($resql)) {
$ids = array(); $ids[] = (int) $obj->rowid;
if ($resql) {
while ($obj = $db->fetch_object($resql)) {
$ids[] = (int) $obj->rowid;
}
$db->free($resql);
} }
$ok = true; $db->free($resql);
foreach ($ids as $id) { }
$s = new MahnungStufe($db); $ok = true;
if ($s->fetch($id) <= 0 && method_exists($s, 'fetchByStufe')) { foreach ($ids as $id) {
// Fallback: per stufe laden $s = loadStufeById($db, $id, $conf->entity);
} if (!$s) {
// fetch() existiert in MahnungStufe nicht direkt; wir laden per direktem SQL continue;
$s = loadStufeById($db, $id, $conf->entity); }
if (!$s) { $prefix = 'stufe_'.$s->stufe.'_';
continue; $s->label = GETPOST($prefix.'label', 'alphanohtml');
} $s->frist_tage = (int) GETPOST($prefix.'frist_tage', 'int');
$prefix = 'stufe_'.$s->stufe.'_'; $s->neue_frist_tage = (int) GETPOST($prefix.'neue_frist_tage', 'int');
$s->label = GETPOST($prefix.'label', 'alphanohtml'); $s->mahngebuehr_b2c = (float) str_replace(',', '.', GETPOST($prefix.'mahngebuehr_b2c', 'alphanohtml'));
$s->frist_tage = (int) GETPOST($prefix.'frist_tage', 'int'); $s->mahngebuehr_b2b = (float) str_replace(',', '.', GETPOST($prefix.'mahngebuehr_b2b', 'alphanohtml'));
$s->neue_frist_tage = (int) GETPOST($prefix.'neue_frist_tage', 'int'); $s->pauschale_b2b_einmalig = GETPOSTISSET($prefix.'pauschale_b2b_einmalig') ? 1 : 0;
$s->mahngebuehr_b2c = (float) str_replace(',', '.', GETPOST($prefix.'mahngebuehr_b2c', 'alphanohtml')); $ovB2c = trim((string) GETPOST($prefix.'zinssatz_b2c', 'alphanohtml'));
$s->mahngebuehr_b2b = (float) str_replace(',', '.', GETPOST($prefix.'mahngebuehr_b2b', 'alphanohtml')); $ovB2b = trim((string) GETPOST($prefix.'zinssatz_b2b', 'alphanohtml'));
$s->pauschale_b2b_einmalig = GETPOSTISSET($prefix.'pauschale_b2b_einmalig') ? 1 : 0; $s->zinssatz_b2c_uebersteuern = $ovB2c === '' ? null : (float) str_replace(',', '.', $ovB2c);
$ovB2c = trim((string) GETPOST($prefix.'zinssatz_b2c', 'alphanohtml')); $s->zinssatz_b2b_uebersteuern = $ovB2b === '' ? null : (float) str_replace(',', '.', $ovB2b);
$ovB2b = trim((string) GETPOST($prefix.'zinssatz_b2b', 'alphanohtml')); $s->versandart_default = GETPOST($prefix.'versandart', 'alphanohtml') ?: 'pdf';
$s->zinssatz_b2c_uebersteuern = $ovB2c === '' ? null : (float) str_replace(',', '.', $ovB2c); $s->pdf_intro = GETPOST($prefix.'pdf_intro', 'restricthtml');
$s->zinssatz_b2b_uebersteuern = $ovB2b === '' ? null : (float) str_replace(',', '.', $ovB2b); $s->email_subject = GETPOST($prefix.'email_subject', 'alphanohtml');
$s->versandart_default = GETPOST($prefix.'versandart', 'alphanohtml') ?: 'pdf'; $s->email_body = GETPOST($prefix.'email_body', 'restricthtml');
$s->pdf_intro = GETPOST($prefix.'pdf_intro', 'restricthtml'); $s->active = GETPOSTISSET($prefix.'active') ? 1 : 0;
$s->email_subject = GETPOST($prefix.'email_subject', 'alphanohtml');
$s->email_body = GETPOST($prefix.'email_body', 'restricthtml');
$s->active = GETPOSTISSET($prefix.'active') ? 1 : 0;
if ($s->update($user) <= 0) { if ($s->update($user) <= 0) {
$ok = false; $ok = false;
setEventMessages($s->error, null, 'errors'); setEventMessages($s->error, null, 'errors');
}
}
if ($ok) {
setEventMessages($langs->trans('MahnungSettingsSaved'), null, 'mesgs');
header('Location: '.$_SERVER['PHP_SELF']);
exit;
} }
} }
if ($ok) {
setEventMessages($langs->trans('MahnungSettingsSaved'), null, 'mesgs');
header('Location: '.$_SERVER['PHP_SELF']);
exit;
}
} }
/** /**
@ -189,7 +176,7 @@ print '<span class="opacitymedium">'.$langs->trans('MahnungSetupDescription').'<
// --- Block: Konstanten ------------------------------------------------------- // --- Block: Konstanten -------------------------------------------------------
print '<form method="POST" action="'.$_SERVER['PHP_SELF'].'">'; print '<form method="POST" action="'.$_SERVER['PHP_SELF'].'">';
print '<input type="hidden" name="token" value="'.newToken('admin_mahnung').'">'; print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="save_consts">'; print '<input type="hidden" name="action" value="save_consts">';
print '<table class="noborder centpercent">'; print '<table class="noborder centpercent">';
@ -233,7 +220,7 @@ if ($resql) {
print '<br><br>'; print '<br><br>';
print '<form method="POST" action="'.$_SERVER['PHP_SELF'].'">'; print '<form method="POST" action="'.$_SERVER['PHP_SELF'].'">';
print '<input type="hidden" name="token" value="'.newToken('admin_mahnung').'">'; print '<input type="hidden" name="token" value="'.newToken().'">';
print '<input type="hidden" name="action" value="save_stufen">'; print '<input type="hidden" name="action" value="save_stufen">';
print '<table class="noborder centpercent">'; print '<table class="noborder centpercent">';