diff --git a/ajax/ajax_accSearch.php b/ajax/ajax_accSearch.php index 160df01f..d14d7880 100644 --- a/ajax/ajax_accSearch.php +++ b/ajax/ajax_accSearch.php @@ -32,7 +32,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); if (!Init::isLoggedIn()) { Response::printJson(__('La sesión no se ha iniciado o ha caducado'), 10); diff --git a/ajax/ajax_accViewPass.php b/ajax/ajax_accViewPass.php deleted file mode 100644 index f903d63b..00000000 --- a/ajax/ajax_accViewPass.php +++ /dev/null @@ -1,109 +0,0 @@ -. - */ - -use SP\Account\Account; -use SP\Core\Session; -use SP\Account\AccountHistory; -use SP\Core\Acl; -use SP\Core\Crypt; -use SP\Core\Init; -use SP\DataModel\AccountExtData; -use SP\Http\Request; -use SP\Http\Response; -use SP\Log\Log; -use SP\Mgmt\Users\UserPass; -use SP\Util\Checks; - -define('APP_ROOT', '..'); - -require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; - -Request::checkReferer('POST'); - -if (!Init::isLoggedIn()) { - Response::printJson(__('La sesión no se ha iniciado o ha caducado'), 10); -} - -$accountId = Request::analyze('itemId', false); -$isHistory = Request::analyze('isHistory', false); -$isFull = Request::analyze('isFull', false); - -if (!$accountId) { - return; -} - -$AccountData = new AccountExtData(); - -if (!$isHistory) { - $AccountData->setAccountId($accountId); - $Account = new Account($AccountData); -} else { - $Account = new AccountHistory($AccountData); - $Account->setId($accountId); -} - -$Account->getAccountPassData(); - -if ($isHistory && !$Account->checkAccountMPass()) { - Response::printJson(__('La clave maestra no coincide')); -} - -$Acl = new Acl(Acl::ACTION_ACC_VIEW_PASS); -$Acl->setAccountData($Account->getAccountDataForACL()); - -if (!Acl::checkUserAccess(Acl::ACTION_ACC_VIEW_PASS) || !$Acl->checkAccountAccess()) { - Response::printJson(__('No tiene permisos para acceder a esta cuenta')); -} elseif (!UserPass::getItem(Session::getUserData())->checkUserUpdateMPass()) { - Response::printJson(__('Clave maestra actualizada') . '
' . __('Reinicie la sesión para cambiarla')); -} - -$accountClearPass = Crypt::getDecrypt($AccountData->getAccountPass(), $AccountData->getAccountIV()); - -if (!$isHistory) { - $Account->incrementDecryptCounter(); - - $Log = new Log(); - $LogMessage = $Log->getLogMessage(); - $LogMessage->setAction(__('Ver Clave', false)); - $LogMessage->addDetails(__('ID', false), $accountId); - $LogMessage->addDetails(__('Cuenta', false), $AccountData->getCustomerName() . ' / ' . $AccountData->getAccountName()); - $Log->writeLog(); -} - -$useImage = (int)Checks::accountPassToImageIsEnabled(); - -if (!$useImage) { - $pass = $isFull ? htmlentities(trim($accountClearPass)) : trim($accountClearPass); -} else { - $pass = \SP\Util\ImageUtil::convertText($accountClearPass); -} - -$data = [ - 'title' => __('Clave de Cuenta'), - 'acclogin' => $AccountData->getAccountLogin(), - 'accpass' => $pass, - 'useimage' => $useImage -]; - -Response::printJson($data, 0); \ No newline at end of file diff --git a/ajax/ajax_doLogin.php b/ajax/ajax_doLogin.php index 8994dae2..33269ddd 100644 --- a/ajax/ajax_doLogin.php +++ b/ajax/ajax_doLogin.php @@ -29,7 +29,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); if (!Request::analyze('login', false)) { return; diff --git a/ajax/ajax_eventlog.php b/ajax/ajax_eventlog.php index 04b6d136..8e5cf7d8 100644 --- a/ajax/ajax_eventlog.php +++ b/ajax/ajax_eventlog.php @@ -31,7 +31,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); if (!Init::isLoggedIn()) { \SP\Util\Util::logout(); diff --git a/ajax/ajax_getContent.php b/ajax/ajax_getContent.php index c932c7b6..293339de 100644 --- a/ajax/ajax_getContent.php +++ b/ajax/ajax_getContent.php @@ -42,7 +42,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); if (!Init::isLoggedIn()) { Util::logout(); diff --git a/ajax/ajax_itemSearch.php b/ajax/ajax_itemSearch.php index 69694b4f..f1078b16 100644 --- a/ajax/ajax_itemSearch.php +++ b/ajax/ajax_itemSearch.php @@ -29,7 +29,7 @@ use SP\Http\Request; require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); $ItemSearch = new ItemSearchController(); $ItemSearch->doAction(); \ No newline at end of file diff --git a/ajax/ajax_itemShow.php b/ajax/ajax_itemShow.php index 9ae97e23..798fdcc9 100644 --- a/ajax/ajax_itemShow.php +++ b/ajax/ajax_itemShow.php @@ -29,7 +29,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); $ItemShow = new ItemShowController(); $ItemShow->doAction(); \ No newline at end of file diff --git a/ajax/ajax_noticeSearch.php b/ajax/ajax_noticeSearch.php index 5ef39ebf..69637fda 100644 --- a/ajax/ajax_noticeSearch.php +++ b/ajax/ajax_noticeSearch.php @@ -29,7 +29,7 @@ use SP\Http\Request; require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); $NoticesSearch = new NoticesSearchController(); $NoticesSearch->doAction(); \ No newline at end of file diff --git a/ajax/ajax_noticeShow.php b/ajax/ajax_noticeShow.php index 3a3edff8..4f38be0b 100644 --- a/ajax/ajax_noticeShow.php +++ b/ajax/ajax_noticeShow.php @@ -29,7 +29,7 @@ use SP\Http\Request; require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); $NoticeShow = new NoticeShowController(); $NoticeShow->doAction(); \ No newline at end of file diff --git a/ajax/ajax_wiki.php b/ajax/ajax_wiki.php index 83eb2045..b1791577 100644 --- a/ajax/ajax_wiki.php +++ b/ajax/ajax_wiki.php @@ -29,7 +29,7 @@ define('APP_ROOT', '..'); require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php'; -Request::checkReferer('POST'); +Request::checkReferer('GET'); $Controller = new WikiController(); $Controller->doAction(); \ No newline at end of file diff --git a/inc/SP/Controller/ConfigController.class.php b/inc/SP/Controller/ConfigController.class.php index 28f9cb9c..37fe4500 100644 --- a/inc/SP/Controller/ConfigController.class.php +++ b/inc/SP/Controller/ConfigController.class.php @@ -319,6 +319,7 @@ class ConfigController extends ControllerBase implements ActionsInterface $this->view->assign('siteName', Util::getAppInfo('appname')); $this->view->assign('backupDir', Init::$SERVERROOT . '/backup'); $this->view->assign('backupPath', Init::$WEBROOT . '/backup'); + $this->view->assign('isAdminApp', $this->UserData->isUserIsAdminApp()); $backupHash = $this->Config->getBackupHash(); $exportHash = $this->Config->getExportHash(); diff --git a/inc/themes/material-blue/views/config/backup.inc b/inc/themes/material-blue/views/config/backup.inc index e43bb415..b9c7079e 100644 --- a/inc/themes/material-blue/views/config/backup.inc +++ b/inc/themes/material-blue/views/config/backup.inc @@ -21,7 +21,7 @@ - +