lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #20148 from marc-dll/12.0_FIX_medias_blocked_when_logged_with_multicompany

Browse Source 
FIX: viewimage.php blocks requests with multicompany from other enties
This commit is contained in:
Laurent Destailleur 2022-02-25 14:32:49 +01:00 committed by GitHub
commit a70d45b3ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/viewimage.php
View File

@ -185,7 +185,7 @@ $refname = basename(dirname($original_file)."/");
// Security check // Security check
if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1); if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1);
$check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $refname); $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname);
$accessallowed = $check_access['accessallowed']; $accessallowed = $check_access['accessallowed'];
$sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals']; $sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];
$fullpath_original_file = $check_access['original_file']; // $fullpath_original_file is now a full path name $fullpath_original_file = $check_access['original_file']; // $fullpath_original_file is now a full path name