diff --git a/htdocs/product/card.php b/htdocs/product/card.php
index 4c30691318f..9e045b42998 100644
--- a/htdocs/product/card.php
+++ b/htdocs/product/card.php
@@ -90,7 +90,7 @@ if (! empty($canvas))
 
 // Security check
 $fieldvalue = (! empty($id) ? $id : (! empty($ref) ? $ref : ''));
-$fieldtype = (! empty($ref) ? 'ref' : 'rowid');
+$fieldtype = (! empty($id) ? 'rowid' : 'ref');
 $result=restrictedArea($user,'produit|service',$fieldvalue,'product&product','','',$fieldtype,$objcanvas);
 
 // Initialize technical object to manage hooks of thirdparties. Note that conf->hooks_modules contains array array