lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

amlioration de la scurit

Browse Source
This commit is contained in:
Regis Houssin 2006-03-10 09:22:46 +00:00
parent 8d8d32364e
commit 7b11d865b6
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/comm/prospect/fiche.php
View File

@ -43,6 +43,8 @@ $user->getrights('projet');
$socid = isset($_GET["id"])?$_GET["id"]:$_GET["socid"]; // Fonctionne si on passe id ou socid $socid = isset($_GET["id"])?$_GET["id"]:$_GET["socid"]; // Fonctionne si on passe id ou socid
if ($socid == '') accessforbidden();
if ($_GET["action"] == 'cstc') if ($_GET["action"] == 'cstc')
{ {
$sql = "UPDATE ".MAIN_DB_PREFIX."societe SET fk_stcomm = ".$_GET["stcomm"]; $sql = "UPDATE ".MAIN_DB_PREFIX."societe SET fk_stcomm = ".$_GET["stcomm"];
@ -58,6 +60,18 @@ if ($user->societe_id > 0)
$socid = $user->societe_id; $socid = $user->societe_id;
} }
// Protection restriction commercial
if (!$user->rights->commercial->client->voir && $socid && !$user->societe_id > 0)
{
$sql = "SELECT fk_soc";
$sql .= " FROM ".MAIN_DB_PREFIX."societe_commerciaux";
$sql .= " WHERE fk_soc = ".$socid." AND fk_user = ".$user->id;
if ( $db->query($sql) )
{
if ( $db->num_rows() == 0) accessforbidden();
}
}
llxHeader(); llxHeader();