From a9bdefa3587bb05b6b94523ebc91e1260db48f5c Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Thu, 9 Dec 2021 11:12:40 +0100 Subject: [PATCH] FIX select too large into addrights (pb of missing parenthesis) --- htdocs/user/class/user.class.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/user/class/user.class.php b/htdocs/user/class/user.class.php index 09bb34ddef3..be1db952aa0 100644 --- a/htdocs/user/class/user.class.php +++ b/htdocs/user/class/user.class.php @@ -738,7 +738,7 @@ class User extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."rights_def"; $sql .= " WHERE entity = ".((int) $entity); if (!empty($whereforadd) && $whereforadd != 'allmodules') { - $sql .= " AND ".$whereforadd; + $sql .= " AND (".$whereforadd.")"; // Note: parenthesis are important because whereforadd can contains OR. Also note that $whereforadd is already sanitized } $result = $this->db->query($sql); @@ -864,7 +864,7 @@ class User extends CommonObject $sql .= " FROM ".MAIN_DB_PREFIX."rights_def"; $sql .= " WHERE entity = ".((int) $entity); if (!empty($wherefordel) && $wherefordel != 'allmodules') { - $sql .= " AND ".$wherefordel; + $sql .= " AND (".$wherefordel.")"; // Note: parenthesis are important because wherefordel can contains OR. Also note that $wherefordel is already sanitized } // avoid admin can remove his own important rights