lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Bugs into permissions for module category

Browse Source
This commit is contained in:
Laurent Destailleur 2014-01-07 14:55:03 +01:00
parent 555170e573
commit 89c772459f
4 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/categories/class/categorie.class.php
View File

@ -528,13 +528,13 @@ class Categorie
} }
/** /**
* Return list of contents of a category * Return list of id of elements having this category
* *
* @param string $field Field name for select in table. Full field name will be fk_field. * @param string $field Field name for select in table. Full field name will be fk_field.
* @param string $classname PHP Class of object to store entity * @param string $classname PHP Class of object to store entity
* @param string $category_table Table name for select in table. Full table name will be PREFIX_categorie_table. * @param string $category_table Table name for select in table. Full table name will be PREFIX_categorie_table.
* @param string $object_table Table name for select in table. Full table name will be PREFIX_table. * @param string $object_table Table name for select in table. Full table name will be PREFIX_table.
* @return void * @return mixed -1 if KO, array of instance of object if OK
*/ */
function get_type($field,$classname,$category_table='',$object_table='') function get_type($field,$classname,$category_table='',$object_table='')
{ {

2
htdocs/categories/viewcat.php
View File

@ -365,6 +365,8 @@ if($object->type == 2)
$var=true; $var=true;
foreach ($socs as $key => $soc) foreach ($socs as $key => $soc)
{ {
if ($user->societe_id > 0 && $soc->id != $user->societe_id) continue; // External user always see only themself
$i++; $i++;
$var=!$var; $var=!$var;
print "\t<tr ".$bc[$var].">\n"; print "\t<tr ".$bc[$var].">\n";

2
htdocs/core/class/conf.class.php
View File

@ -403,7 +403,7 @@ class Conf
$this->maxfilesize = (empty($this->global->MAIN_UPLOAD_DOC) ? 0 : $this->global->MAIN_UPLOAD_DOC * 1024); $this->maxfilesize = (empty($this->global->MAIN_UPLOAD_DOC) ? 0 : $this->global->MAIN_UPLOAD_DOC * 1024);
// Define list of limited modules // Define list of limited modules
if (! isset($this->global->MAIN_MODULES_FOR_EXTERNAL)) $this->global->MAIN_MODULES_FOR_EXTERNAL='user,facture,commande,fournisseur,contact,propal,projet,contrat,societe,ficheinter,expedition,agenda'; // '' means 'all'. Note that contact is added here as it should be a module later. if (! isset($this->global->MAIN_MODULES_FOR_EXTERNAL)) $this->global->MAIN_MODULES_FOR_EXTERNAL='user,facture,categorie,commande,fournisseur,contact,propal,projet,contrat,societe,ficheinter,expedition,agenda'; // '' means 'all'. Note that contact is added here as it should be a module later.
// Timeouts // Timeouts
if (empty($this->global->MAIN_USE_CONNECT_TIMEOUT)) $this->global->MAIN_USE_CONNECT_TIMEOUT=10; if (empty($this->global->MAIN_USE_CONNECT_TIMEOUT)) $this->global->MAIN_USE_CONNECT_TIMEOUT=10;

4
htdocs/core/lib/security.lib.php
View File

@ -341,7 +341,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
$sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")"; $sql.= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
} }
} }
else if (in_array($feature,$checksoc)) else if (in_array($feature,$checksoc)) // We check feature = checksoc
{ {
// If external user: Check permission for external users // If external user: Check permission for external users
if ($user->societe_id > 0) if ($user->societe_id > 0)
@ -450,7 +450,7 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
} }
} }
//print $sql."<br>"; //print "sql=".$sql."<br>";
if ($sql) if ($sql)
{ {
$resql=$db->query($sql); $resql=$db->query($sql);