lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #yogosha5673

Browse Source
This commit is contained in:
Laurent Destailleur 2021-03-19 13:25:58 +01:00
parent 5a4ffc18b9
commit aef2f1713e
3 changed files with 22 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
htdocs/admin/mails_senderprofile_list.php
View File

@ -76,14 +76,6 @@ if (!$sortorder) {
$sortorder = "ASC"; $sortorder = "ASC";
} }
// Security check
$socid = 0;
if ($user->socid > 0) { // Protection if external user
//$socid = $user->socid;
accessforbidden();
}
//$result = restrictedArea($user, 'mymodule', $id, '');
// Initialize array of search criterias // Initialize array of search criterias
$search_all = GETPOST("search_all", 'alpha'); $search_all = GETPOST("search_all", 'alpha');
$search = array(); $search = array();
@ -133,6 +125,19 @@ if ($id > 0) {
$object->fetch($id); $object->fetch($id);
} }
// Security check
$socid = 0;
if ($user->socid > 0) { // Protection if external user
//$socid = $user->socid;
accessforbidden();
}
// A non admin user can see profiles but limited to its own user
if (!$user->admin) {
if ($object->private != $user->id) {
accessforbidden();
}
}
/* /*
* Actions * Actions
@ -261,6 +266,10 @@ foreach ($search as $key => $val) {
if ($search_all) { if ($search_all) {
$sql .= natural_search(array_keys($fieldstosearchall), $search_all); $sql .= natural_search(array_keys($fieldstosearchall), $search_all);
} }
// If non admin, restrict list to itself
if (empty($user->admin)) {
$sql .= " AND private = ".((int) $user->id);
}
//$sql.= dolSqlDateFilter("t.field", $search_xxxday, $search_xxxmonth, $search_xxxyear); //$sql.= dolSqlDateFilter("t.field", $search_xxxday, $search_xxxmonth, $search_xxxyear);
// Add where from extra fields // Add where from extra fields
include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php'; include DOL_DOCUMENT_ROOT.'/core/tpl/extrafields_list_search_sql.tpl.php';
@ -315,13 +324,6 @@ if (is_numeric($nbtotalofrecords) && ($limit > $nbtotalofrecords || empty($limit
$num = $db->num_rows($resql); $num = $db->num_rows($resql);
} }
// Direct jump if only one record found
if ($num == 1 && !empty($conf->global->MAIN_SEARCH_DIRECT_OPEN_IF_ONLY_ONE) && $search_all && !$page) {
$obj = $db->fetch_object($resql);
$id = $obj->rowid;
header("Location: ".DOL_URL_ROOT.'/monmodule/emailsenderprofile_card.php?id='.$id);
exit;
}
// Output page // Output page
// -------------------------------------------------------------------- // --------------------------------------------------------------------

8
htdocs/admin/mails_ticket.php
View File

@ -32,10 +32,6 @@ $langs->loadLangs(array('companies', 'products', 'admin', 'mails', 'other', 'err
$action = GETPOST('action', 'aZ09'); $action = GETPOST('action', 'aZ09');
if (!$user->admin) {
accessforbidden();
}
$usersignature = $user->signature; $usersignature = $user->signature;
// For action = test or send, we ensure that content is not html, even for signature, because this we want a test with NO html. // For action = test or send, we ensure that content is not html, even for signature, because this we want a test with NO html.
if ($action == 'test' || $action == 'send') { if ($action == 'test' || $action == 'send') {
@ -53,6 +49,10 @@ $substitutionarrayfortest = array(
); );
complete_substitutions_array($substitutionarrayfortest, $langs); complete_substitutions_array($substitutionarrayfortest, $langs);
// Security check
if (!$user->admin) {
accessforbidden();
}
/* /*

2
htdocs/core/class/emailsenderprofile.class.php
View File

@ -54,7 +54,7 @@ class EmailSenderProfile extends CommonObject
/** /**
* @var string String with name of icon for emailsenderprofile * @var string String with name of icon for emailsenderprofile
*/ */
public $picto = 'emailsenderprofile@monmodule'; public $picto = 'emailsenderprofile';
const STATUS_DISABLED = 0; const STATUS_DISABLED = 0;