lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

TODO security broken with Multicompany

Browse Source
This commit is contained in:
Regis Houssin 2019-01-16 11:07:58 +01:00
parent f51b4288da
commit 24128ac28d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/user/card.php
View File

@ -85,7 +85,7 @@ if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
if (! $canreaduser) {
if (! $canreaduser) { // TODO security broken with Multicompany
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}