diff --git a/htdocs/core/ajax/saveinplace.php b/htdocs/core/ajax/saveinplace.php index eb04379a778..4c46ab43e23 100644 --- a/htdocs/core/ajax/saveinplace.php +++ b/htdocs/core/ajax/saveinplace.php @@ -94,10 +94,21 @@ if (! empty($field) && ! empty($element) && ! empty($table_element) && ! empty($ } else $newelement = $element; - if (! empty($user->rights->$newelement->creer) || ! empty($user->rights->$newelement->create) || ! empty($user->rights->$newelement->write) - || (isset($subelement) && (! empty($user->rights->$newelement->$subelement->creer) || ! empty($user->rights->$newelement->$subelement->write))) - || ($element == 'payment' && $user->rights->facture->paiement) - || ($element == 'payment_supplier' && $user->rights->fournisseur->facture->creer)) + $_POST['action']='update'; // Hack so restrictarea can test permission on write too + $feature = $newelement; + $object_id = $fk_element; + if ($feature == 'expedition' || $feature == 'shipping') + { + $feature = 'commande'; + $object_id = 0; + } + if ($feature == 'shipping') $feature = 'commande'; + //var_dump(GETPOST('action','aZ09')); + //var_dump($newelement.'-'.$subelement."-".$feature."-".$object_id); + $check_access = restrictedArea($user, $feature, $object_id, '', $subelement); + //var_dump($user->rights); + + if ($check_access) { // Clean parameters $newvalue = trim($value); diff --git a/htdocs/expedition/card.php b/htdocs/expedition/card.php index 81b6ed455a7..15caab8a1ee 100644 --- a/htdocs/expedition/card.php +++ b/htdocs/expedition/card.php @@ -127,7 +127,7 @@ if (empty($reshook)) include DOL_DOCUMENT_ROOT.'/core/actions_dellink.inc.php'; // Must be include, not include_once - // Set incoterm + // Reopen if ($action == 'reopen' && $user->rights->expedition->creer) { $object->fetch($id); @@ -503,8 +503,8 @@ if (empty($reshook)) } } - // Action update description of emailing - else if ($action == 'settrackingnumber' || $action == 'settrackingurl' + // Action update + else if ($action == 'settracking_number' || $action == 'settracking_url' || $action == 'settrueWeight' || $action == 'settrueWidth' || $action == 'settrueHeight' @@ -513,8 +513,8 @@ if (empty($reshook)) { $error=0; - if ($action == 'settrackingnumber') $object->tracking_number = trim(GETPOST('trackingnumber','alpha')); - if ($action == 'settrackingurl') $object->tracking_url = trim(GETPOST('trackingurl','int')); + if ($action == 'settracking_number') $object->tracking_number = trim(GETPOST('tracking_number','alpha')); + if ($action == 'settracking_url') $object->tracking_url = trim(GETPOST('tracking_url','int')); if ($action == 'settrueWeight') { $object->trueWeight = trim(GETPOST('trueWeight','int')); $object->weight_units = GETPOST('weight_units','int'); @@ -1692,8 +1692,8 @@ else if ($id || $ref) print ''; // Tracking Number - print '