FIX deletion on draft is allowed if we are allwoed to create

htdocs/compta/facture/card.php

@@ -92,11 +92,6 @@ $hidedetails = (GETPOST('hidedetails', 'int') ? GETPOST('hidedetails', 'int') :
 $hidedesc = (GETPOST('hidedesc', 'int') ? GETPOST('hidedesc', 'int') : (! empty($conf->global->MAIN_GENERATE_DOCUMENTS_HIDE_DESC) ? 1 : 0));
 $hideref = (GETPOST('hideref', 'int') ? GETPOST('hideref', 'int') : (! empty($conf->global->MAIN_GENERATE_DOCUMENTS_HIDE_REF) ? 1 : 0));
 
-// Security check
-$fieldid = (! empty($ref) ? 'facnumber' : 'rowid');
-if ($user->societe_id) $socid = $user->societe_id;
-$result = restrictedArea($user, 'facture', $id, '', '', 'fk_soc', $fieldid);
-
 // Nombre de ligne pour choix de produit/service predefinis
 $NBLINES = 4;
 
@@ -117,6 +112,11 @@ $permissionnote = $user->rights->facture->creer; // Used by the include of actio
 $permissiondellink=$user->rights->facture->creer;	// Used by the include of actions_dellink.inc.php
 $permissiontoedit = $user->rights->facture->creer; // Used by the include of actions_lineupdonw.inc.php
 
+// Security check
+$fieldid = (! empty($ref) ? 'facnumber' : 'rowid');
+if ($user->societe_id) $socid = $user->societe_id;
+$result = restrictedArea($user, 'facture', $id, '', '', 'fk_soc', $fieldid, null, (($object->statut == Facture::STATUS_DRAFT) ? 1 : 0));
+
 
 /*
  * Actions

htdocs/core/lib/security.lib.php

@@ -175,10 +175,11 @@ function dol_verifyHash($chain, $hash, $type='0')
  *  @param  string	$dbt_keyfield   Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional)
  *  @param  string	$dbt_select     Field name for select if not rowid. Not used if objectid is null (optional)
  *  @param	Canvas	$objcanvas		Object canvas
+ *  @param	int		$isdraft		1=The object with id=$objectid is a draft
  * 	@return	int						Always 1, die process if not allowed
  *  @see dol_check_secure_access_document
  */
-function restrictedArea($user, $features, $objectid=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $objcanvas=null)
+function restrictedArea($user, $features, $objectid=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $objcanvas=null, $isdraft=0)
 {
 	global $db, $conf;
 	global $hookmanager;
@@ -276,9 +277,9 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 	if (! $readok) accessforbidden();
 	//print "Read access is ok";
 
-    // Check write permission from module
+	// Check write permission from module (we need to know write permission to create but also to delete drafts record)
 	$createok=1; $nbko=0;
-    if (GETPOST('action','aZ09')  == 'create')
+	if (GETPOST('action','aZ09')  == 'create' || ((GETPOST("action","aZ09")  == 'confirm_delete' && GETPOST("confirm","aZ09") == 'yes') || GETPOST("action","aZ09")  == 'delete'))
 	{
 		foreach ($featuresarray as $feature)
 		{
@@ -328,7 +329,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 		// If a or and at least one ok
 		if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) $createok=1;
 
-        if (! $createok) accessforbidden();
+		if (GETPOST('action','aZ09') == 'create' && ! $createok) accessforbidden();
 		//print "Write access is ok";
 	}
 
@@ -383,7 +384,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 			{
 				if (! $user->rights->salaries->delete) $deleteok=0;
 			}
-            else if (! empty($feature2))	// This should be used for future changes
+			else if (! empty($feature2))	// This should be used for permissions on 2 levels
 			{
 				foreach($feature2 as $subfeature)
 				{
@@ -391,7 +392,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 					else { $deleteok=1; break; } // For bypass the second test if the first is ok
 				}
 			}
-            else if (! empty($feature))		// This is for old permissions
+			else if (! empty($feature))		// This is used for permissions on 1 level
 			{
 				//print '<br>feature='.$feature.' creer='.$user->rights->$feature->supprimer.' write='.$user->rights->$feature->delete;
 				if (empty($user->rights->$feature->supprimer)
@@ -403,7 +404,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
 		// If a or and at least one ok
 		if (preg_match('/\|/', $features) && $nbko < count($featuresarray)) $deleteok=1;
 
-        if (! $deleteok) accessforbidden();
+		if (! $deleteok && ! ($isdraft && $createok)) accessforbidden();
 		//print "Delete access is ok";
 	}
 

htdocs/fourn/facture/card.php

@@ -72,11 +72,6 @@ $hidedetails = (GETPOST('hidedetails','int') ? GETPOST('hidedetails','int') : (!
 $hidedesc 	 = (GETPOST('hidedesc','int') ? GETPOST('hidedesc','int') : (! empty($conf->global->MAIN_GENERATE_DOCUMENTS_HIDE_DESC) ?  1 : 0));
 $hideref 	 = (GETPOST('hideref','int') ? GETPOST('hideref','int') : (! empty($conf->global->MAIN_GENERATE_DOCUMENTS_HIDE_REF) ? 1 : 0));
 
-// Security check
-$socid='';
-if (! empty($user->societe_id)) $socid=$user->societe_id;
-$result = restrictedArea($user, 'fournisseur', $id, 'facture_fourn', 'facture');
-
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
 $hookmanager->initHooks(array('invoicesuppliercard','globalcard'));
 
@@ -95,6 +90,11 @@ if ($id > 0 || ! empty($ref))
 	if ($ret < 0) dol_print_error($db,$object->error);
 }
 
+// Security check
+$socid='';
+if (! empty($user->societe_id)) $socid=$user->societe_id;
+$result = restrictedArea($user, 'fournisseur', $id, 'facture_fourn', 'facture', 'fk_soc', 'rowid', null, (($object->statut == FactureFournisseur::STATUS_DRAFT) ? 1 : 0));
+
 $permissionnote=$user->rights->fournisseur->facture->creer;	// Used by the include of actions_setnotes.inc.php
 $permissiondellink=$user->rights->fournisseur->facture->creer;	// Used by the include of actions_dellink.inc.php
 $permissionedit=$user->rights->fournisseur->facture->creer; // Used by the include of actions_lineupdown.inc.php