lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #22981 from ibuiv/develop

Browse Source 
Fix #19789 Visibility of private contacts
This commit is contained in:
Laurent Destailleur 2022-11-29 00:18:14 +01:00 committed by GitHub
commit 0f40159e39
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/contact/card.php
View File

@ -86,6 +86,7 @@ $hookmanager->initHooks(array('contactcard', 'globalcard'));
if ($id > 0) { if ($id > 0) {
$object->fetch($id); $object->fetch($id);
$object->info($id);
} }
if (!($object->id > 0) && $action == 'view') { if (!($object->id > 0) && $action == 'view') {
@ -101,6 +102,9 @@ $permissiontoadd = $user->rights->societe->contact->creer;
if ($user->socid) { if ($user->socid) {
$socid = $user->socid; $socid = $user->socid;
} }
if ($object->priv && $object->user_creation->id != $user->id) {
accessforbidden();
}
$result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', 0); // If we create a contact with no company (shared contacts), no check on write permission $result = restrictedArea($user, 'contact', $id, 'socpeople&societe', '', '', 'rowid', 0); // If we create a contact with no company (shared contacts), no check on write permission

1
htdocs/core/lib/company.lib.php
View File

@ -1123,6 +1123,7 @@ function show_contacts($conf, $langs, $db, $object, $backtopage = '', $showuserl
$sql .= " FROM ".MAIN_DB_PREFIX."socpeople as t"; $sql .= " FROM ".MAIN_DB_PREFIX."socpeople as t";
$sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople_extrafields as ef on (t.rowid = ef.fk_object)"; $sql .= " LEFT JOIN ".MAIN_DB_PREFIX."socpeople_extrafields as ef on (t.rowid = ef.fk_object)";
$sql .= " WHERE t.fk_soc = ".((int) $object->id); $sql .= " WHERE t.fk_soc = ".((int) $object->id);
$sql .= " AND ((t.fk_user_creat = ".((int) $user->id)." AND t.priv = 1) OR t.priv = 0)";
if ($search_rowid) { if ($search_rowid) {
$sql .= natural_search('t.rowid', $search_rowid); $sql .= natural_search('t.rowid', $search_rowid);
} }