lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: access problem if thirdparty module is disable

Browse Source
This commit is contained in:
Regis Houssin 2012-07-02 20:04:28 +02:00
parent 9c2f1a7544
commit 0bb3aced2f
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/adherents/agenda.php
View File

@ -40,7 +40,7 @@ $mesg=isset($_GET["mesg"])?'<div class="ok">'.$_GET["mesg"].'</div>':'';
$id = GETPOST('id','int'); $id = GETPOST('id','int');
// Security check // Security check
if (! $user->rights->adherent->lire) accessforbidden(); $result=restrictedArea($user,'adherent',$id);
$object = new Adherent($db); $object = new Adherent($db);
$result=$object->fetch($id); $result=$object->fetch($id);

10
htdocs/core/lib/security.lib.php
View File

@ -286,7 +286,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
{ {
$sql=''; $sql='';
$check = array('banque','user','usergroup','produit','service','produit|service','categorie'); // Test on entity only (Objects with no link to company) $check = array('adherent','banque','user','usergroup','produit','service','produit|service','categorie'); // Test on entity only (Objects with no link to company)
$checksoc = array('societe'); // Test for societe object $checksoc = array('societe'); // Test for societe object
$checkother = array('contact'); // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...). $checkother = array('contact'); // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet'); // Test for project object $checkproject = array('projet'); // Test for project object
@ -319,7 +319,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
if ($user->societe_id <> $objectid) accessforbidden(); if ($user->societe_id <> $objectid) accessforbidden();
} }
// If internal user: Check permission for internal users that are restricted on their objects // If internal user: Check permission for internal users that are restricted on their objects
else if (! $user->rights->societe->client->voir) else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
{ {
$sql = "SELECT sc.fk_soc"; $sql = "SELECT sc.fk_soc";
$sql.= " FROM (".MAIN_DB_PREFIX."societe_commerciaux as sc"; $sql.= " FROM (".MAIN_DB_PREFIX."societe_commerciaux as sc";
@ -349,7 +349,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
$sql.= " AND dbt.fk_soc = ".$user->societe_id; $sql.= " AND dbt.fk_soc = ".$user->societe_id;
} }
// If internal user: Check permission for internal users that are restricted on their objects // If internal user: Check permission for internal users that are restricted on their objects
else if (! $user->rights->societe->client->voir) else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
{ {
$sql = "SELECT dbt.rowid"; $sql = "SELECT dbt.rowid";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
@ -369,7 +369,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
} }
else if (in_array($feature,$checkproject)) else if (in_array($feature,$checkproject))
{ {
if (! $user->rights->projet->all->lire) if (! empty($conf->projet->enabled) && ! $user->rights->projet->all->lire)
{ {
include_once(DOL_DOCUMENT_ROOT."/projet/class/project.class.php"); include_once(DOL_DOCUMENT_ROOT."/projet/class/project.class.php");
$projectstatic=new Project($db); $projectstatic=new Project($db);
@ -396,7 +396,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
$sql.= " AND dbt.".$dbt_keyfield." = ".$user->societe_id; $sql.= " AND dbt.".$dbt_keyfield." = ".$user->societe_id;
} }
// If internal user: Check permission for internal users that are restricted on their objects // If internal user: Check permission for internal users that are restricted on their objects
else if (! $user->rights->societe->client->voir) else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
{ {
$sql = "SELECT sc.fk_soc"; $sql = "SELECT sc.fk_soc";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";