lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix add / delete contact access

Browse Source
This commit is contained in:
ptibogxiv 2019-06-16 14:18:26 +02:00 committed by GitHub
parent 6760368b64
commit 651f4158ac
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
htdocs/commande/class/api_orders.class.php
View File

@ -415,21 +415,16 @@ class Orders extends DolibarrApi
*/ */
public function postContact($id, $contactid, $type) public function postContact($id, $contactid, $type)
{ {
if(!DolibarrApiAccess::$user->rights->commande->creer) { if (! DolibarrApiAccess::$user->rights->commande->creer) {
throw new RestException(401); throw new RestException(401);
}
$result = $this->commande->fetch($id);
if(!$result) {
throw new RestException(404, 'Order not found');
} }
if (!in_array($type, array('BILLING', 'SHIPPING', 'CUSTOMER'), true)) { $result = $this->commande->fetch($id);
throw new RestException(500, 'Availables types: BILLING, SHIPPING OR CUSTOMER'); if (! $result) {
throw new RestException(404, 'Order not found');
} }
if(!DolibarrApi::_checkAccessToResource('order', $this->commande->id)) { if (! DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login); throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
} }
@ -457,17 +452,16 @@ class Orders extends DolibarrApi
*/ */
public function deleteContact($id, $rowid) public function deleteContact($id, $rowid)
{ {
if(!DolibarrApiAccess::$user->rights->commande->creer) { if (! DolibarrApiAccess::$user->rights->commande->creer) {
throw new RestException(401); throw new RestException(401);
}
$result = $this->commande->fetch($id);
if(!$result) {
throw new RestException(404, 'Order not found');
} }
if(!DolibarrApi::_checkAccessToResource('order', $this->commande->id)) { $result = $this->commande->fetch($id);
if (! $result) {
throw new RestException(404, 'Order not found');
}
if (! DolibarrApi::_checkAccessToResource('commande', $this->commande->id)) {
throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login); throw new RestException(401, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
} }