Security: More features to check

htdocs/categories/categorie.php

@@ -39,14 +39,14 @@ if ($_REQUEST["socid"])
 {
 	if ($_REQUEST["typeid"] == 1) { $type = 'fournisseur'; $socid = isset($_REQUEST["socid"])?$_REQUEST["socid"]:''; }
 	if ($_REQUEST["typeid"] == 2) { $type = 'societe'; $socid = isset($_REQUEST["socid"])?$_REQUEST["socid"]:''; }
-	$objecttype = 'societe';
+	$objecttype = 'societe&&categorie';
 	$objectid = isset($_REQUEST["socid"])?$_REQUEST["socid"]:'';
 	$fieldid = 'rowid';
 }
 else if ($_REQUEST["id"] || $_REQUEST["ref"])
 {
 	$type = 'produit';
-	$objecttype = 'produit|service';
+	$objecttype = 'produit|service&&categorie';
 	$objectid = isset($_REQUEST["id"])?$_REQUEST["id"]:(isset($_REQUEST["ref"])?$_REQUEST["ref"]:'');
 	$dbtablename = 'product';
 	$fieldid = isset($_REQUEST["ref"])?'ref':'rowid';

htdocs/lib/functions.lib.php

@@ -1499,27 +1499,32 @@ function info_admin($texte,$infoonimgalt=0)
 /**
  *	\brief      Check permissions of a user to show a page and an object.
  *	\param      user      	  	User to check
- *	\param      feature			    Feature to check (in most cases, it's module name)
+ *	\param      features	    Features to check (in most cases, it's module name)
  *	\param      objectid      	Object ID if we want to check permission on on object (optionnal)
  *	\param      dbtablename    	Table name where object is stored. Not used if objectid is null (optionnal)
  *	\param      feature2		    Feature to check (second level of permission)
  *  \param      dbt_keyfield    Field name for socid foreign key if not fk_soc. (optionnal)
  *  \param      dbt_select      Field name for select if not rowid. (optionnal)
  */
-function restrictedArea($user, $feature='societe', $objectid=0, $dbtablename='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid')
+function restrictedArea($user, $features='societe', $objectid=0, $dbtablename='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid')
 {
 	global $db, $conf;
 
 	//dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename,$feature2,$dbt_socfield,$dbt_select");
 	if ($dbt_select != 'rowid') $objectid = "'".$objectid."'";
 
-	//print "user_id=".$user->id.", feature=".$feature.", feature2=".$feature2.", object_id=".$objectid;
+	//print "user_id=".$user->id.", features=".$features.", feature2=".$feature2.", object_id=".$objectid;
 	//print ", dbtablename=".$dbtablename.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select;
 	//print ", user_societe_contact_lire=".$user->rights->societe->contact->lire."<br>";
 	
+	// More features to check
+	$features = explode("&&",$features);
+	
 	// Check read permission from module
 	// TODO Replace "feature" param by permission for reading
 	$readok=1;
+	foreach ($features as $feature)
+	{
 		if ($feature == 'societe')
 		{
 			if (! $user->rights->societe->lire && ! $user->rights->fournisseur->lire) $readok=0;
@@ -1558,6 +1563,8 @@ function restrictedArea($user, $feature='societe', $objectid=0, $dbtablename='',
 			if (empty($user->rights->$feature->lire)
 			&& empty($user->rights->$feature->read)) $readok=0;
 		}
+	}
+
 	if (! $readok)
 	{
 		//print "Read access is down";
@@ -1569,6 +1576,8 @@ function restrictedArea($user, $feature='societe', $objectid=0, $dbtablename='',
 	$createok=1;
 	if ( (isset($_GET["action"])  && $_GET["action"]  == 'create')
 	|| (isset($_POST["action"]) && $_POST["action"] == 'create') )
+	{
+		foreach ($features as $feature)
 		{
 			if ($feature == 'societe')
 			{
@@ -1608,12 +1617,16 @@ function restrictedArea($user, $feature='societe', $objectid=0, $dbtablename='',
 				if (empty($user->rights->$feature->creer)
 				&& empty($user->rights->$feature->write)) $createok=0;
 			}
+		}
+		
 		if (! $createok) accessforbidden();
 		//print "Write access is ok";
 	}
 
 	// If we have a particular object to check permissions on
 	if ($objectid > 0)
+	{
+		foreach ($features as $feature)
 		{
 			$sql='';
 			
@@ -1702,6 +1715,7 @@ function restrictedArea($user, $feature='societe', $objectid=0, $dbtablename='',
 				}
 			}
 		}
+	}
 
 	return 1;
 }

htdocs/lib/product.lib.php

@@ -50,7 +50,7 @@ function product_prepare_head($product, $user)
 	$h++;
 
 	// Show category tab
-	if ($conf->categorie->enabled)
+	if ($conf->categorie->enabled && $user->rights->categorie->lire)
 	{
 		$head[$h][0] = DOL_URL_ROOT."/categories/categorie.php?id=".$product->id;
 		$head[$h][1] = $langs->trans('Categories');
@@ -59,7 +59,7 @@ function product_prepare_head($product, $user)
 	}
 
 	// Show barcode tab
-	if ($conf->global->MAIN_MODULE_BARCODE)
+	if ($conf->global->MAIN_MODULE_BARCODE && $user->rights->barcode->lire)
 	{
 		$head[$h][0] = DOL_URL_ROOT."/product/barcode.php?id=".$product->id;
 		$head[$h][1] = $langs->trans("BarCode");
@@ -85,7 +85,7 @@ function product_prepare_head($product, $user)
 		$h++;
 	}
 
-	if ($conf->fournisseur->enabled)
+	if ($conf->fournisseur->enabled && $user->rights->fournisseur->lire)
 	{
 		$head[$h][0] = DOL_URL_ROOT."/product/fournisseurs.php?id=".$product->id;
 		$head[$h][1] = $langs->trans("Suppliers");
@@ -110,7 +110,7 @@ function product_prepare_head($product, $user)
 
 	if($product->isproduct())	// Si produit stockable
 	{
-		if ($conf->stock->enabled)
+		if ($conf->stock->enabled && $user->rights->stock->lire)
 		{
 			$head[$h][0] = DOL_URL_ROOT."/product/stock/product.php?id=".$product->id;
 			$head[$h][1] = $langs->trans("Stock");

htdocs/product/barcode.php

@@ -40,7 +40,7 @@ if (isset($_GET["id"]) || isset($_GET["ref"]))
 }
 $fieldid = isset($_GET["ref"])?'ref':'rowid';
 if ($user->societe_id) $socid=$user->societe_id;
-$result=restrictedArea($user,'produit|service',$id,'product','','',$fieldid);
+$result=restrictedArea($user,'produit|service&&barcode',$id,'product','','',$fieldid);
 
 /*
  * Actions

htdocs/product/fournisseurs.php

@@ -50,7 +50,7 @@ if (isset($_GET["id"]) || isset($_GET["ref"]))
 }
 $fieldid = isset($_GET["ref"])?'ref':'rowid';
 if ($user->societe_id) $socid=$user->societe_id;
-$result=restrictedArea($user,'produit|service',$id,'product','','',$fieldid);
+$result=restrictedArea($user,'produit|service&&fournisseur',$id,'product','','',$fieldid);
 
 $mesg = '';
 

htdocs/product/stock/product.php

@@ -43,7 +43,7 @@ if (isset($_GET["id"]) || isset($_GET["ref"]))
 }
 $fieldid = isset($_GET["ref"])?'ref':'rowid';
 if ($user->societe_id) $socid=$user->societe_id;
-$result=restrictedArea($user,'produit',$id,'product','','',$fieldid);
+$result=restrictedArea($user,'produit&&stock',$id,'product','','',$fieldid);
 
 $mesg = '';