From b6be42e10376bcc55f66c1d9ed146b2de32f6c09 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 18 Feb 2020 12:40:50 +0100
Subject: [PATCH] FIX List of viewed projects too large in task widget

---
 htdocs/core/boxes/box_task.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/boxes/box_task.php b/htdocs/core/boxes/box_task.php
index 2ae0ede3c21..ed267493e97 100644
--- a/htdocs/core/boxes/box_task.php
+++ b/htdocs/core/boxes/box_task.php
@@ -86,6 +86,7 @@ class box_task extends ModeleBoxes
 		$form = new Form($this->db);
         $cookie_name = 'boxfilter_task';
         $boxcontent = '';
+        $socid = $user->socid;
 
         $textHead = $langs->trans("CurentlyOpenedTasks");
 
@@ -97,7 +98,6 @@ class box_task extends ModeleBoxes
             $filterValue = $_COOKIE[$cookie_name];
         }
 
-
         if ($filterValue == 'im_task_contact') {
             $textHead .= ' : '.$langs->trans("WhichIamLinkedTo");
         }
@@ -143,6 +143,10 @@ class box_task extends ModeleBoxes
             );
 
 
+            // Get list of project id allowed to user (in a string list separated by coma)
+            $projectsListId = '';
+            if (!$user->rights->projet->all->lire) $projectsListId = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1, $socid);
+
             $sql = "SELECT pt.rowid, pt.ref, pt.fk_projet, pt.fk_task_parent, pt.datec, pt.dateo, pt.datee, pt.datev, pt.label, pt.description, pt.duration_effective, pt.planned_workload, pt.progress";
 			$sql .= ", p.rowid project_id, p.ref project_ref, p.title project_title";
 
@@ -163,7 +167,7 @@ class box_task extends ModeleBoxes
 			$sql .= " AND p.fk_statut = ".Project::STATUS_VALIDATED;
 			$sql .= " AND (pt.progress < 100 OR pt.progress IS NULL ) "; // 100% is done and not displayed
             $sql .= " AND p.usage_task = 1 ";
-
+            if (!$user->rights->projet->all->lire) $sql .= " AND p.rowid IN (".$projectsListId.")"; // public and assigned to, or restricted to company for external users
 
 			$sql .= " ORDER BY pt.datee ASC, pt.dateo ASC";
 			$sql .= $this->db->plimit($max, 0);