lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX A user may read holiday and expense report without permissions

Browse Source
This commit is contained in:
Laurent Destailleur 2019-06-18 16:01:24 +02:00
parent 6afda6a47a
commit 6e9874b95a
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
htdocs/expensereport/list.php
View File

@ -46,10 +46,25 @@ $confirm=GETPOST('confirm','alpha');
$toselect = GETPOST('toselect', 'array'); $toselect = GETPOST('toselect', 'array');
$contextpage=GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'expensereportlist'; $contextpage=GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'expensereportlist';
$childids = $user->getAllChildIds(1);
// Security check // Security check
$socid = GETPOST('socid','int'); $socid = GETPOST('socid','int');
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'expensereport','',''); $result = restrictedArea($user, 'expensereport','','');
$id = GETPOST('id', 'int');
// If we are on the view of a specific user
if ($id > 0)
{
$canread=0;
if ($id == $user->id) $canread=1;
if (! empty($user->rights->holiday->read_all)) $canread=1;
if (! empty($user->rights->holiday->read) && in_array($id, $childids)) $canread=1;
if (! $canread)
{
accessforbidden();
}
}
$diroutputmassaction=$conf->expensereport->dir_output . '/temp/massgeneration/'.$user->id; $diroutputmassaction=$conf->expensereport->dir_output . '/temp/massgeneration/'.$user->id;
@ -66,7 +81,6 @@ $pagenext = $page + 1;
if (!$sortorder) $sortorder="DESC"; if (!$sortorder) $sortorder="DESC";
if (!$sortfield) $sortfield="d.date_debut"; if (!$sortfield) $sortfield="d.date_debut";
$id = GETPOST('id', 'int');
$sall = trim((GETPOST('search_all', 'alphanohtml')!='')?GETPOST('search_all', 'alphanohtml'):GETPOST('sall', 'alphanohtml')); $sall = trim((GETPOST('search_all', 'alphanohtml')!='')?GETPOST('search_all', 'alphanohtml'):GETPOST('sall', 'alphanohtml'));
$search_ref = GETPOST('search_ref', 'alpha'); $search_ref = GETPOST('search_ref', 'alpha');

12
htdocs/holiday/list.php
View File

@ -60,6 +60,18 @@ if ($user->societe_id > 0) // Protection if external user
} }
$result = restrictedArea($user, 'holiday', $id, ''); $result = restrictedArea($user, 'holiday', $id, '');
$id = GETPOST('id','int'); $id = GETPOST('id','int');
// If we are on the view of a specific user
if ($id > 0)
{
$canread=0;
if ($id == $user->id) $canread=1;
if (! empty($user->rights->holiday->read_all)) $canread=1;
if (! empty($user->rights->holiday->read) && in_array($id, $childids)) $canread=1;
if (! $canread)
{
accessforbidden();
}
}
// Load variable for pagination // Load variable for pagination
$limit = GETPOST('limit','int')?GETPOST('limit','int'):$conf->liste_limit; $limit = GETPOST('limit','int')?GETPOST('limit','int'):$conf->liste_limit;