From 999ad7629fa6b20c04d822ec508bb42386229712 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 10 Sep 2021 13:29:19 +0200 Subject: [PATCH] Update api_users.class.php --- htdocs/user/class/api_users.class.php | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/htdocs/user/class/api_users.class.php b/htdocs/user/class/api_users.class.php index 791e9a61cb7..24c03bb9037 100644 --- a/htdocs/user/class/api_users.class.php +++ b/htdocs/user/class/api_users.class.php @@ -185,11 +185,16 @@ class Users extends DolibarrApi * * @url GET login/{login} * - * @throws RestException 401 Insufficient rights - * @throws RestException 404 User or group not found + * @throws RestException 400 Bad request + * @throws RestException 401 Insufficient rights + * @throws RestException 404 User or group not found */ public function getByLogin($login, $includepermissions = 0) { + if (empty($login)) { + throw new RestException(400, 'Bad parameters'); + } + if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->login != $login) { throw new RestException(401, 'Not allowed'); } @@ -219,11 +224,16 @@ class Users extends DolibarrApi * * @url GET email/{email} * + * @throws RestException 400 Bad request * @throws RestException 401 Insufficient rights * @throws RestException 404 User or group not found */ public function getByEmail($email, $includepermissions = 0) { + if (empty($email)) { + throw new RestException(400, 'Bad parameters'); + } + if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->email != $email) { throw new RestException(401, 'Not allowed'); }