From 51b6be4a64ad3d5a7123e9f610e7f71b22934604 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Mon, 26 May 2014 17:33:19 +0200 Subject: [PATCH] Fix: If user has no perm to see other user, see himself. --- htdocs/core/class/html.formother.class.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/htdocs/core/class/html.formother.class.php b/htdocs/core/class/html.formother.class.php index eced2a75729..5150f2d4e41 100644 --- a/htdocs/core/class/html.formother.class.php +++ b/htdocs/core/class/html.formother.class.php @@ -363,7 +363,8 @@ class FormOther $sql_usr = "SELECT u.rowid, u.lastname, u.firstname, u.statut, u.login"; $sql_usr.= " FROM ".MAIN_DB_PREFIX."user as u"; $sql_usr.= " WHERE u.entity IN (0,".$conf->entity.")"; - if (empty($user->rights->user->user->lire)) $sql_usr.=" AND u.rowid = ".$user->id; + if (empty($user->rights->user->user->lire)) $sql_usr.=" AND u.rowid = ".$user->id; + if (! empty($user->societe_id)) $sql_usr.=" AND u.fk_societe = ".$user->societe_id; // Add existing sales representatives of thirdparty of external user if (empty($user->rights->user->user->lire) && $user->societe_id) {