diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 8622e293906..cfa89120053 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -450,11 +450,15 @@ if (empty($reshook)) { // Do we update also ->entity ? if (!empty($conf->multicompany->enabled)) { // If multicompany is not enabled, we never update the entity of a user. if (!empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) { - $object->entity = 1; // all users are in master entity + if (GETPOST('superadmin', 'int') === 1) { + $object->entity = 0; + } else { + $object->entity = 1; // all users are in master entity + } } else { // A user should not be able to move a user into another entity. Only superadmin should be able to do this. if ($user->entity == 0 && $user->admin) { - if (GETPOST("superadmin")) { + if (GETPOST('superadmin', 'int')) { // We try to set the user as superadmin. $object->entity = 0; } else { diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 9540f082a4c..09bb34ddef3 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -1773,7 +1773,9 @@ class User extends CommonObject $sql .= ", salaryextra= ".($this->salaryextra != '' ? "'".$this->db->escape($this->salaryextra)."'" : "null"); } $sql .= ", weeklyhours= ".($this->weeklyhours != '' ? "'".$this->db->escape($this->weeklyhours)."'" : "null"); - $sql .= ", entity = ".((int) $this->entity); + if (!empty($user->admin) && empty($user->entity) && $user->id != $this->id) { + $sql .= ", entity = ".((int) $this->entity); // entity flag can be set/unset only by an another superadmin user + } $sql .= ", default_range = ".($this->default_range > 0 ? $this->default_range : 'null'); $sql .= ", default_c_exp_tax_cat = ".($this->default_c_exp_tax_cat > 0 ? $this->default_c_exp_tax_cat : 'null'); $sql .= ", fk_warehouse = ".($this->fk_warehouse > 0 ? $this->fk_warehouse : "null");