lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: you can't check "fournisseur" with checkUserAccessToObject without

Browse Source 
object ID
This commit is contained in:
Regis Houssin 2018-02-12 09:28:41 +01:00
parent 448fcae02f
commit 24cc687724
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/security.lib.php
View File

@ -378,7 +378,7 @@ function checkUserAccessToObject($user, $featuresarray, $objectid=0, $tableandsh
if ($feature == 'task') $feature='projet_task';
$check = array('adherent','banque','user','usergroup','produit','service','produit|service','categorie'); // Test on entity only (Objects with no link to company)
$checksoc = array('societe','fournisseur'); // Test for societe object
$checksoc = array('societe'); // Test for societe object
$checkother = array('contact','agenda'); // Test on entity and link to third party. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet','project'); // Test for project object
$checktask = array('projet_task');

4
htdocs/product/fournisseurs.php
View File

@ -51,6 +51,8 @@ $cost_price=GETPOST('cost_price', 'alpha');
$backtopage=GETPOST('backtopage','alpha');
$error=0;
if (!$user->rights->fournisseur->lire) accessforbidden();
// If socid provided by ajax company selector
if (! empty($_REQUEST['search_fourn_id']))
{
@ -63,7 +65,7 @@ if (! empty($_REQUEST['search_fourn_id']))
$fieldvalue = (! empty($id) ? $id : (! empty($ref) ? $ref : ''));
$fieldtype = (! empty($ref) ? 'ref' : 'rowid');
if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit|service&fournisseur',$fieldvalue,'product&product','','',$fieldtype);
$result=restrictedArea($user,'produit|service',$fieldvalue,'product&product','','',$fieldtype);
$limit = GETPOST('limit','int')?GETPOST('limit','int'):$conf->liste_limit;
$sortfield = GETPOST("sortfield",'alpha');