lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Permission check on bank account

Browse Source
This commit is contained in:
Laurent Destailleur 2011-03-16 10:55:23 +00:00
parent 447ce83619
commit a47e015f16
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/lib/functions.lib.php
View File

@ -1905,12 +1905,12 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
{ {
$sql=''; $sql='';
$check = array('user','usergroup','produit','service','produit|service'); // Test on entity only (Objects with no link to company) $check = array('banque','user','usergroup','produit','service','produit|service'); // Test on entity only (Objects with no link to company)
$checksoc = array('societe'); // Test for societe object $checksoc = array('societe'); // Test for societe object
$checkother = array('contact'); // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...). $checkother = array('contact'); // Test on entity and link to societe. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet'); // Test for project object $checkproject = array('projet'); // Test for project object
$nocheck = array('categorie','barcode','stock','fournisseur'); // No test $nocheck = array('categorie','barcode','stock','fournisseur'); // No test
$checkdefault = 'all other not already defined'; // Test on entity and link to societe. Not allowed if link is empty (Ex: invoice, orders...). $checkdefault = 'all other not already defined'; // Test on entity and link to third party. Not allowed if link is empty (Ex: invoice, orders...).
// If dbtable not defined, we use same name for table than module name // If dbtable not defined, we use same name for table than module name
if (empty($dbtablename)) $dbtablename = $feature; if (empty($dbtablename)) $dbtablename = $feature;
@ -1990,7 +1990,7 @@ function restrictedArea($user, $features='societe', $objectid=0, $dbtablename=''
if (! in_array($objectid,$tmparray)) accessforbidden(); if (! in_array($objectid,$tmparray)) accessforbidden();
} }
} }
else if (!in_array($feature,$nocheck)) else if (!in_array($feature,$nocheck)) // By default we check with link to third party
{ {
// If external user: Check permission for external users // If external user: Check permission for external users
if ($user->societe_id > 0) if ($user->societe_id > 0)