lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix regression of #16118 - entity not check

Browse Source 
Entity is not anymore check for user having permission $user->rights->societe->client->voir on the current entity. Then we can open object from any entity with current permissions and the entity field of objects are not anymore checked.
This commit is contained in:
LAURIER Alexis 2021-02-09 20:13:13 +01:00 committed by GitHub
parent abf2875eba
commit 0ae0eb5758
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/core/lib/security.lib.php
View File

@ -590,9 +590,9 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql .= " WHERE dbt.rowid IN (".$objectid.")";
$sql .= " AND dbt.".$dbt_keyfield." = ".$user->socid;
} elseif (!empty($conf->societe->enabled)) {
} elseif (!empty($conf->societe->enabled) && !$user->rights->societe->client->voir) {
// If internal user: Check permission for internal users that are restricted on their objects
if ($feature != 'ticket' && !$user->rights->societe->client->voir) {
if ($feature != 'ticket') {
if (empty($dbt_keyfield)) dol_print_error('', 'Param dbt_keyfield is required but not defined');
$sql = "SELECT COUNT(sc.fk_soc) as nb";
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
@ -601,9 +601,8 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
$sql .= " AND sc.fk_soc = dbt.".$dbt_keyfield;
$sql .= " AND sc.fk_user = ".$user->id;
}
} else {
// On ticket, the thirdparty is not mandatory, so we need a special test to accept record with no thirdparties.
if ($feature == 'ticket' && !$user->rights->societe->client->voir) {
$sql = "SELECT COUNT(dbt.".$dbt_select.") as nb";
$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON sc.fk_soc = dbt.".$dbt_keyfield." AND sc.fk_user = ".$user->id;