FIX unprivileged user can see task associated with a not allowed project

htdocs/projet/tasks/comment.php

@@ -47,13 +47,6 @@ $withproject = GETPOST('withproject', 'int');
 $project_ref = GETPOST('project_ref', 'alpha');
 $planned_workload = ((GETPOST('planned_workloadhour', 'int') != '' || GETPOST('planned_workloadmin', 'int') != '') ? (GETPOST('planned_workloadhour', 'int') > 0 ?GETPOST('planned_workloadhour', 'int') * 3600 : 0) + (GETPOST('planned_workloadmin', 'int') > 0 ?GETPOST('planned_workloadmin', 'int') * 60 : 0) : '');
 
-// Security check
-$socid = 0;
-//if ($user->socid > 0) $socid = $user->socid;    // For external user, no check is done on company because readability is managed by public status of project and assignement.
-if (!$user->rights->projet->lire) {
-	accessforbidden();
-}
-
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
 $hookmanager->initHooks(array('projecttaskcommentcard', 'globalcard'));
 
@@ -79,10 +72,21 @@ if (!empty($project_ref) && !empty($withproject)) {
 	}
 }
 
+
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+// Security check
+$socid = 0;
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
+
+
 /*
  * View
-*/
+ */
-
 
 llxHeader('', $langs->trans("CommentPage"));
 

htdocs/projet/tasks/contact.php

@@ -40,17 +40,18 @@ $confirm = GETPOST('confirm', 'alpha');
 $withproject = GETPOST('withproject', 'int');
 $project_ref = GETPOST('project_ref', 'alpha');
 
-// Security check
-$socid = 0;
-//if ($user->socid > 0) $socid = $user->socid;    // For external user, no check is done on company because readability is managed by public status of project and assignement.
-//$result = restrictedArea($user, 'projet', $id, 'projet_task');
-if (!$user->rights->projet->lire) {
-	accessforbidden();
-}
-
 $object = new Task($db);
 $projectstatic = new Project($db);
 
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+// Security check
+$socid = 0;
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
 
 /*
  * Actions

htdocs/projet/tasks/document.php

@@ -37,21 +37,13 @@ $langs->loadLangs(array('projects', 'other'));
 
 $action = GETPOST('action', 'aZ09');
 $confirm = GETPOST('confirm', 'alpha');
-$mine = $_REQUEST['mode'] == 'mine' ? 1 : 0;
+$mine = GETPOST('mode') == 'mine' ? 1 : 0;
 //if (! $user->rights->projet->all->lire) $mine=1;	// Special for projects
 $id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
 $withproject = GETPOST('withproject', 'int');
 $project_ref = GETPOST('project_ref', 'alpha');
 
-// Security check
-$socid = 0;
-//if ($user->socid > 0) $socid = $user->socid;    // For external user, no check is done on company because readability is managed by public status of project and assignement.
-//$result=restrictedArea($user,'projet',$id,'');
-if (!$user->rights->projet->lire) {
-	accessforbidden();
-}
-
 // Get parameters
 $limit = GETPOST('limit', 'int') ? GETPOST('limit', 'int') : $conf->liste_limit;
 $sortfield = GETPOST("sortfield", 'alpha');
@@ -73,6 +65,17 @@ if (!$sortfield) {
 $object = new Task($db);
 $projectstatic = new Project($db);
 
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+// Security check
+$socid = 0;
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
+
+
 /*
  * Actions
  */
@@ -92,7 +95,6 @@ if (!empty($project_ref) && !empty($withproject)) {
 }
 
 if ($id > 0 || !empty($ref)) {
-	if ($object->fetch($id, $ref) > 0) {
 	if (!empty($conf->global->PROJECT_ALLOW_COMMENT_ON_TASK) && method_exists($object, 'fetchComments') && empty($object->comments)) {
 		$object->fetchComments();
 	}
@@ -108,9 +110,6 @@ if ($id > 0 || !empty($ref)) {
 	$object->project = clone $projectstatic;
 
 	$upload_dir = $conf->projet->dir_output.'/'.dol_sanitizeFileName($projectstatic->ref).'/'.dol_sanitizeFileName($object->ref);
-	} else {
-		dol_print_error($db);
-	}
 }
 
 include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php';

htdocs/projet/tasks/note.php

@@ -31,7 +31,7 @@ $langs->load('projects');
 
 $action = GETPOST('action', 'aZ09');
 $confirm = GETPOST('confirm', 'alpha');
-$mine = $_REQUEST['mode'] == 'mine' ? 1 : 0;
+$mine = GETPOST('mode') == 'mine' ? 1 : 0;
 //if (! $user->rights->projet->all->lire) $mine=1;	// Special for projects
 $id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
@@ -82,6 +82,12 @@ if (!empty($project_ref) && !empty($withproject)) {
 	}
 }
 
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
 $permissionnote = ($user->rights->projet->creer || $user->rights->projet->all->creer);
 
 

htdocs/projet/tasks/task.php

@@ -46,13 +46,6 @@ $withproject = GETPOST('withproject', 'int');
 $project_ref = GETPOST('project_ref', 'alpha');
 $planned_workload = ((GETPOST('planned_workloadhour', 'int') != '' || GETPOST('planned_workloadmin', 'int') != '') ? (GETPOST('planned_workloadhour', 'int') > 0 ?GETPOST('planned_workloadhour', 'int') * 3600 : 0) + (GETPOST('planned_workloadmin', 'int') > 0 ?GETPOST('planned_workloadmin', 'int') * 60 : 0) : '');
 
-// Security check
-$socid = 0;
-//if ($user->socid > 0) $socid = $user->socid;    // For external user, no check is done on company because readability is managed by public status of project and assignement.
-if (!$user->rights->projet->lire) {
-	accessforbidden();
-}
-
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
 $hookmanager->initHooks(array('projecttaskcard', 'globalcard'));
 
@@ -69,6 +62,17 @@ if ($reshook < 0) {
 	setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');
 }
 
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+// Security check
+$socid = 0;
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
+
+
 /*
  * Actions
  */
@@ -85,7 +89,6 @@ if ($action == 'update' && !GETPOST("cancel") && $user->rights->projet->creer) {
 		setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentities("Label")), null, 'errors');
 	}
 	if (!$error) {
-		$object->fetch($id, $ref);
 		$object->oldcopy = clone $object;
 
 		$tmparray = explode('_', $_POST['task_parent']);
@@ -121,7 +124,6 @@ if ($action == 'update' && !GETPOST("cancel") && $user->rights->projet->creer) {
 }
 
 if ($action == 'confirm_delete' && $confirm == "yes" && $user->rights->projet->supprimer) {
-	if ($object->fetch($id, $ref) >= 0) {
 	$result = $projectstatic->fetch($object->fk_project);
 	$projectstatic->fetch_thirdparty();
 
@@ -132,7 +134,6 @@ if ($action == 'confirm_delete' && $confirm == "yes" && $user->rights->projet->s
 		setEventMessages($object->error, $object->errors, 'errors');
 		$action = '';
 	}
-	}
 }
 
 // Retrieve First Task ID of Project if withprojet is on to allow project prev next to work
@@ -149,8 +150,6 @@ if (!empty($project_ref) && !empty($withproject)) {
 
 // Build doc
 if ($action == 'builddoc' && $user->rights->projet->creer) {
-	$object->fetch($id, $ref);
-
 	// Save last template used to generate document
 	if (GETPOST('model')) {
 		$object->setDocModel($user, GETPOST('model', 'alpha'));
@@ -172,7 +171,6 @@ if ($action == 'builddoc' && $user->rights->projet->creer) {
 if ($action == 'remove_file' && $user->rights->projet->creer) {
 	require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
 
-	if ($object->fetch($id, $ref) >= 0) {
 	$langs->load("other");
 	$upload_dir = $conf->projet->dir_output;
 	$file = $upload_dir.'/'.dol_sanitizeFileName(GETPOST('file'));
@@ -183,7 +181,6 @@ if ($action == 'remove_file' && $user->rights->projet->creer) {
 	} else {
 		setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile')), null, 'errors');
 	}
-	}
 }
 
 
@@ -198,7 +195,6 @@ $formother = new FormOther($db);
 $formfile = new FormFile($db);
 
 if ($id > 0 || !empty($ref)) {
-	if ($object->fetch($id, $ref) > 0) {
 	$res = $object->fetch_optionals();
 	if (!empty($conf->global->PROJECT_ALLOW_COMMENT_ON_TASK) && method_exists($object, 'fetchComments') && empty($object->comments)) {
 		$object->fetchComments();
@@ -644,7 +640,6 @@ if ($id > 0 || !empty($ref)) {
 
 		print '</div></div></div>';
 	}
-	}
 }
 
 // End of page

htdocs/projet/tasks/time.php

@@ -107,6 +107,13 @@ $extrafields = new ExtraFields($db);
 $extrafields->fetch_name_optionals_label($projectstatic->table_element);
 $extrafields->fetch_name_optionals_label($object->table_element);
 
+if ($id > 0 || $ref) {
+	$object->fetch($id, $ref);
+}
+
+restrictedArea($user, 'projet', $object->fk_project, 'projet&project');
+
+
 
 /*
  * Actions