lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Permission check on event tabs

Browse Source
This commit is contained in:
Laurent Destailleur 2013-09-24 11:11:59 +02:00
parent b6d5ebf81d
commit a674af5bcd
3 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/comm/action/contact.php
View File

@ -43,23 +43,24 @@ $confirm = GETPOST('confirm');
$lineid = GETPOST('lineid','int'); $lineid = GETPOST('lineid','int');
// Security check // Security check
$socid = GETPOST('socid','int');
if ($user->societe_id) $socid=$user->societe_id;
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
unset($_GET["action"]); unset($_GET["action"]);
$action=''; $action='';
$socid = $user->societe_id;
} }
$result = restrictedArea($user, 'agenda', $objectid, 'actioncomm&societe', 'myactions&allactions', 'fk_soc', 'id');
$object = new ActionComm($db); $object = new ActionComm($db);
/* /*
* Actions * Actions
*/ */
/* // Add new nouveau contact
* Ajout d'un nouveau contact
*/
if ($action == 'addcontact') if ($action == 'addcontact')
{ {
$result = $object->fetch($id); $result = $object->fetch($id);

6
htdocs/comm/action/document.php
View File

@ -44,14 +44,14 @@ $objectid = GETPOST('id','int');
$action=GETPOST('action','alpha'); $action=GETPOST('action','alpha');
// Security check // Security check
$socid = GETPOST('socid','int');
if ($user->societe_id) $socid=$user->societe_id;
if ($user->societe_id > 0) if ($user->societe_id > 0)
{ {
unset($_GET["action"]); unset($_GET["action"]);
$action=''; $action='';
$socid = $user->societe_id;
} }
$result = restrictedArea($user, 'agenda', $objectid, 'actioncomm&societe', 'myactions&allactions', 'fk_soc', 'id');
$result = restrictedArea($user, 'agenda', $objectid, 'actioncomm&societe', 'myactions&allactions', '', 'id');
$act = new ActionComm($db); $act = new ActionComm($db);

2
htdocs/comm/action/info.php
View File

@ -40,7 +40,7 @@ if ($user->societe_id > 0)
$socid = $user->societe_id; $socid = $user->societe_id;
} }
$result = restrictedArea($user, 'agenda', $id, 'actioncomm&societe', 'myactions&allactions', '', 'id'); $result = restrictedArea($user, 'agenda', $id, 'actioncomm&societe', 'myactions&allactions', 'fk_soc', 'id');
/* /*