lesanges/amortization
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correction problème sécurité CSRF

Browse source
This commit is contained in:
Jean-Christophe Engel 2026-09-24 13:28:48 +02:00
parent 8667a3643d
commit 20033aaa36
14 changed files with 417 additions and 364 deletions
Download patch file Download diff file Expand all files Collapse all files

91
exit_step3.html
View file

@ -20,6 +20,15 @@
{{:redirect to="exit_step4.html?immo_doc_id=%s&from=%s"|args:$_GET.immo_doc_id:$_GET.from}}
{{/form}}
{{*
Supprimer l'association entre une écriture d'immobilisation et
une écriture de cession
*}}
{{#form on="detach_cession"}}
{{:include file="_detach_cession.html" immo_doc_id=$_POST.immo_doc_id cession_line_id=$_POST.detach_cession}}
{{:redirect to="exit_step3.html?immo_doc_id=%s&from=exit&ok=1&msg=detach_cession"|args:$_GET.immo_doc_id}}
{{/form}}
{{:assign label_immo=$info_immo.label|or:$ligne_immo.trans_label}}
{{if $label_immo|strpos:$ligne_immo.line_label === false}}
{{:assign label_immo=$label_immo|cat:" — "|cat:$ligne_immo.line_label}}
@ -94,6 +103,7 @@
{{/select}}
{{:admin_header title="Immobilisation sortie du bilan" custom_css="./style.css" current="module_amortization"}}
{{if $_GET.from == "exit"}}
{{:assign current="other"}}
{{else}}
@ -109,6 +119,8 @@
<p class="block confirm">{{$msg}}</p>
{{/if}}
{{:form_errors}}
<div class="informations">
<dl class="describe">
<dt>Immobilisation</dt>
@ -147,46 +159,49 @@
<h3 class="ruler">Écriture de cession attachée à l'immobilisation</h3>
{{if $linked_cessions != null}}
<table class="list">
<thead>
<tr>
<td class="num">N°</td>
<td>Date</td>
<td>Libellé</td>
<td class="nombre">Montant</td>
<td>N° compte</td>
<td>Compte</td>
<td class="actions"></td>
</tr>
</thead>
<tbody>
{{#foreach from=$linked_cessions item="line"}}
{{* données de l'écriture *}}
{{:assign trans_url="%s/acc/transactions/details.php?id=%s"|args:$admin_url:$line.trans_id}}
{{:assign compte_url="%s/acc/accounts/journal.php?id=%s&year=%s"|args:$admin_url:$line.account_id:$line.year}}
<form method="post" action="">
<table class="list">
<thead>
<tr>
<td class="num"><a href="{{$trans_url}}">#{{$line.trans_id}}</a></td>
<td>{{$line.date|date_short}}</td>
<td>
{{if $line.line_label != null}}
{{$line.line_label}}
{{if $line.trans_label != $line.line_label}}
— {{$line.trans_label}}
{{/if}}
{{else}}
{{$line.trans_label}}
{{/if}}
</td>
<td class="money">{{"%f"|math:$line.amount|money_html:false|raw}}</td>
<td><a href="{{$compte_url}}">{{$line.account_code}}</a></td>
<td>{{$line.account_label}}</td>
<td class="actions">
{{:linkbutton label="Détacher" href="detach_cession.html?immo_doc_id=%s&cession_line_id=%s&from=exit"|args:$_GET.immo_doc_id:$line.line_id shape="minus"}}
</td>
<td class="num">N°</td>
<td>Date</td>
<td>Libellé</td>
<td class="nombre">Montant</td>
<td>N° compte</td>
<td>Compte</td>
<td class="actions"></td>
</tr>
{{/foreach}}
</tbody>
</table>
</thead>
<tbody>
{{#foreach from=$linked_cessions item="line"}}
{{* données de l'écriture *}}
{{:assign trans_url="%s/acc/transactions/details.php?id=%s"|args:$admin_url:$line.trans_id}}
{{:assign compte_url="%s/acc/accounts/journal.php?id=%s&year=%s"|args:$admin_url:$line.account_id:$line.year}}
<tr>
<td class="num"><a href="{{$trans_url}}">#{{$line.trans_id}}</a></td>
<td>{{$line.date|date_short}}</td>
<td>
{{if $line.line_label != null}}
{{$line.line_label}}
{{if $line.trans_label != $line.line_label}}
— {{$line.trans_label}}
{{/if}}
{{else}}
{{$line.trans_label}}
{{/if}}
</td>
<td class="money">{{"%f"|math:$line.amount|money_html:false|raw}}</td>
<td><a href="{{$compte_url}}">{{$line.account_code}}</a></td>
<td>{{$line.account_label}}</td>
<td class="actions">
{{:button type="submit" name="detach_cession" label="Détacher" shape="minus" value=$line.line_id}}
</td>
</tr>
{{/foreach}}
</tbody>
</table>
<input type="hidden" id="immo_doc_id" name="immo_doc_id" value="{{$_GET.immo_doc_id}}">
</form>
{{elseif $free_cessions}}
<p class="block alert">
Vous pouvez attacher une écriture de cession à l'immobilisation