diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
index 2424523ec0a..4daf78ad52e 100644
--- a/htdocs/core/class/html.form.class.php
+++ b/htdocs/core/class/html.form.class.php
@@ -1441,7 +1441,7 @@ class Form
/**
* Return select list of users
*
- * @param string $selected User id or user object of user preselected. If -1, we use id of current user.
+ * @param string $selected User id or user object of user preselected. If 0 or < -2, we use id of current user. If -1, keep unselected (if empty is allowed)
* @param string $htmlname Field name in form
* @param int $show_empty 0=list with no empty value, 1=add also an empty value into list
* @param array $exclude Array list of users id to exclude
diff --git a/htdocs/holiday/card.php b/htdocs/holiday/card.php
index 799b0907a92..e788abca30f 100644
--- a/htdocs/holiday/card.php
+++ b/htdocs/holiday/card.php
@@ -50,6 +50,18 @@ $now=dol_now();
$langs->load("holiday");
+$childids = $user->getAllChildIds(1);
+
+$cancreate = 0;
+if (! empty($user->rights->holiday->write_all)) $cancreate=1;
+if (! empty($user->rights->holiday->write) && in_array($fuserid, $childids)) $cancreate=1;
+
+$candelete = 0;
+if (! empty($user->rights->holiday->delete)) $candelete=1;
+
+$morefilter = 'AND employee = 1';
+if (! empty($conf->global->HOLIDAY_FOR_NON_SALARIES_TOO)) $morefilter = '';
+
/*
* Actions
@@ -61,8 +73,7 @@ if ($action == 'create')
$object = new Holiday($db);
// If no right to create a request
- $fuserid = GETPOST('fuserid','int');
- if (($fuserid == $user->id && empty($user->rights->holiday->write)) || ($fuserid != $user->id && empty($user->rights->holiday->write_all)))
+ if (! $cancreate)
{
$error++;
setEventMessages($langs->trans('CantCreateCP'), null, 'errors');
@@ -201,13 +212,11 @@ if ($action == 'update')
$object = new Holiday($db);
$object->fetch($id);
- $canedit=(($user->id == $object->fk_user && $user->rights->holiday->write) || ($user->id != $object->fk_user && $user->rights->holiday->write_all));
-
// If under validation
if ($object->statut == 1)
{
// If this is the requestor or has read/write rights
- if ($canedit)
+ if ($cancreate)
{
$valideur = $_POST['valideur'];
$description = trim($_POST['description']);
@@ -280,13 +289,11 @@ if ($action == 'confirm_delete' && GETPOST('confirm') == 'yes' && $user->rights-
$object = new Holiday($db);
$object->fetch($id);
- $canedit=(($user->id == $object->fk_user && $user->rights->holiday->write) || ($user->id != $object->fk_user && $user->rights->holiday->write_all));
-
// If this is a rough draft, approved, canceled or refused
if ($object->statut == 1 || $object->statut == 4 || $object->statut == 5)
{
// Si l'utilisateur à le droit de lire cette demande, il peut la supprimer
- if ($canedit)
+ if ($candelete)
{
$result=$object->delete($user);
}
@@ -314,10 +321,8 @@ if ($action == 'confirm_send')
$object = new Holiday($db);
$object->fetch($id);
- $canedit=(($user->id == $object->fk_user && $user->rights->holiday->write) || ($user->id != $object->fk_user && $user->rights->holiday->write_all));
-
// Si brouillon et créateur
- if($object->statut == 1 && $canedit)
+ if($object->statut == 1 && $cancreate)
{
$object->statut = 2;
@@ -615,7 +620,7 @@ if ($action == 'confirm_cancel' && GETPOST('confirm') == 'yes')
$object->fetch($id);
// Si statut en attente de validation et valideur = valideur ou utilisateur, ou droits de faire pour les autres
- if (($object->statut == 2 || $object->statut == 3) && ($user->id == $object->fk_validator || $user->id == $object->fk_user || ! empty($user->rights->holiday->write_all)))
+ if (($object->statut == 2 || $object->statut == 3) && ($user->id == $object->fk_validator || in_array($object->fk_user, $childids) || ! empty($user->rights->holiday->write_all)))
{
$db->begin();
@@ -849,10 +854,10 @@ if (empty($id) || $action == 'add' || $action == 'request' || $action == 'create
print '