diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php index a4299e925df..c8c2c5cdc2b 100644 --- a/htdocs/core/lib/security.lib.php +++ b/htdocs/core/lib/security.lib.php @@ -620,8 +620,8 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand } } } elseif (in_array($feature, $checksoc)) { // We check feature = checksoc - if ($user->socid > 0) { - // If external user: Check permission for external users + // If external user: Check permission for external users + if ($user->socid > 0 && empty($conf->global->MAIN_EXTERNAL_USERS_CAN_SEE_SUBSIDIARY_COMPANIES)) { if ($user->socid <> $objectid) { return false; } diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php index e0131a420fb..d69a602c900 100644 --- a/htdocs/societe/card.php +++ b/htdocs/societe/card.php @@ -80,7 +80,7 @@ $backtopage = GETPOST('backtopage', 'alpha'); $confirm = GETPOST('confirm', 'alpha'); $socid = GETPOST('socid', 'int') ?GETPOST('socid', 'int') : GETPOST('id', 'int'); -if ($user->socid) { +if ($user->socid && empty($conf->global->MAIN_EXTERNAL_USERS_CAN_SEE_SUBSIDIARY_COMPANIES)) { $socid = $user->socid; } if (empty($socid) && $action == 'view') {