lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX a user can always read its own card

Browse Source
This commit is contained in:
Regis Houssin 2019-01-16 19:13:21 +01:00
parent 24128ac28d
commit 45a7e03562
2 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/lib/security.lib.php
View File

@ -181,7 +181,7 @@ function dol_verifyHash($chain, $hash, $type='0')
*/ */
function restrictedArea($user, $features, $objectid=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $objcanvas=null, $isdraft=0) function restrictedArea($user, $features, $objectid=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $objcanvas=null, $isdraft=0)
{ {
global $db, $conf; global $db, $conf, $user;
global $hookmanager; global $hookmanager;
//dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename,$feature2,$dbt_socfield,$dbt_select"); //dol_syslog("functions.lib:restrictedArea $feature, $objectid, $dbtablename,$feature2,$dbt_socfield,$dbt_select");
@ -253,6 +253,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
$tmpreadok=1; $tmpreadok=1;
foreach($feature2 as $subfeature) foreach($feature2 as $subfeature)
{ {
if ($subfeature == 'user' && $user->id == $objectid) continue; // A user can always read its own card
if (! empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) { $tmpreadok=0; } if (! empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) { $tmpreadok=0; }
else if (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) { $tmpreadok=0; } else if (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) { $tmpreadok=0; }
else { $tmpreadok=1; break; } // Break is to bypass second test if the first is ok else { $tmpreadok=1; break; } // Break is to bypass second test if the first is ok
@ -262,6 +263,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
$readok=0; // All tests are ko (we manage here the and, the or will be managed later using $nbko). $readok=0; // All tests are ko (we manage here the and, the or will be managed later using $nbko).
$nbko++; $nbko++;
} }
var_dump($readok);
} }
else if (! empty($feature) && ($feature!='user' && $feature!='usergroup')) // This is for old permissions else if (! empty($feature) && ($feature!='user' && $feature!='usergroup')) // This is for old permissions
{ {

5
htdocs/user/card.php
View File

@ -83,11 +83,8 @@ if ($id)
$socid=0; $socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id; if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user'; $feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
if (! $canreaduser) { // TODO security broken with Multicompany $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}
if ($user->id <> $id && ! $canreaduser) accessforbidden(); if ($user->id <> $id && ! $canreaduser) accessforbidden();