lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

No transmormation of data objectid before calling trigger

Browse Source
This commit is contained in:
Laurent Destailleur 2018-05-10 12:34:23 +02:00
parent 2fb5de6136
commit 63b9384ef6
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/core/lib/security.lib.php
View File

@ -186,15 +186,15 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
//print ", dbtablename=".$dbtablename.", dbt_socfield=".$dbt_keyfield.", dbt_select=".$dbt_select;
//print ", perm: ".$features."->".$feature2."=".($user->rights->$features->$feature2->lire)."<br>";
if ($dbt_select != 'rowid' && $dbt_select != 'id') $objectid = "'".$objectid."'";
// Get more permissions checks from hooks
$parameters=array('features'=>$features, 'objectid'=>$objectid, 'idtype'=>$dbt_select);
$reshook=$hookmanager->executeHooks('restrictedArea',$parameters);
if (! empty($hookmanager->resArray['result'])) return true;
if ($reshook > 0) return false;
// Features/modules to check
if ($dbt_select != 'rowid' && $dbt_select != 'id') $objectid = "'".$objectid."'";
// Features/modules to check
$featuresarray = array($features);
if (preg_match('/&/', $features)) $featuresarray = explode("&", $features);
else if (preg_match('/\|/', $features)) $featuresarray = explode("|", $features);