From af0000d568ca1cb552c3eece2d91a3e99a1402b9 Mon Sep 17 00:00:00 2001
From: Vincent Dieltiens <v.dieltiens@jdc-airports.com>
Date: Tue, 15 Feb 2022 09:51:28 +0100
Subject: [PATCH] Fixes expensereport downloads

---
 htdocs/core/lib/security.lib.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index 4a20fbf96f2..ccdfa261fc8 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -892,8 +892,10 @@ function checkUserAccessToObject($user, array $featuresarray, $object = 0, $tabl
 			}
 			if ($feature == 'expensereport') {
 				$useridtocheck = $object->fk_user_author;
-				if (!in_array($useridtocheck, $childids)) {
-					return false;
+				if (!$user->rights->expensereport->readall) {
+					if (!in_array($useridtocheck, $childids)) {
+						return false;
+					}
 				}
 			}
 		}