From 5d854dcce1702532c6b3b17dbc97f5db5a036bea Mon Sep 17 00:00:00 2001 From: javieralapps4up Date: Thu, 21 Oct 2021 18:17:43 +0200 Subject: [PATCH] FIX #19064 Access forbidden when the password of other users is changed Steps to reproduce the behavior User with lire and password (user) perms, but no creer. When this user saves or cancels the edition of the password of another user, he is sent to the prohibited page --- htdocs/core/lib/security.lib.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php index 4c36244a5bf..89211113d58 100644 --- a/htdocs/core/lib/security.lib.php +++ b/htdocs/core/lib/security.lib.php @@ -417,6 +417,9 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->password) { continue; // User can edit its own password } + if ($subfeature == 'user' && $user->id != $objectid && $user->rights->user->user->password) { + continue; // User can edit its own password + } if (empty($user->rights->$feature->$subfeature->creer) && empty($user->rights->$feature->$subfeature->write)