diff --git a/htdocs/salaries/card.php b/htdocs/salaries/card.php index f83f879cf8e..6d30ae73e3d 100755 --- a/htdocs/salaries/card.php +++ b/htdocs/salaries/card.php @@ -72,28 +72,24 @@ $childids = $user->getAllChildIds(1); // fetch optionals attributes and labels $extrafields->fetch_name_optionals_label($object->table_element); -if (($id > 0) || $ref) { - $object->fetch($id, $ref); - - // Check current user can read this leave request - $canread = 0; - if (!empty($user->rights->salaries->readall)) { - $canread = 1; - } - if (!empty($user->rights->salaries->read) && in_array($object->fk_user, $childids)) { - $canread = 1; - } - if (!$canread) { - accessforbidden(); - } -} - // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context $hookmanager->initHooks(array('salarycard', 'globalcard')); $object = new Salary($db); if ($id > 0 || !empty($ref)) { $object->fetch($id, $ref); + + // Check current user can read this salary + $canread = 0; + if (!empty($user->rights->salaries->readall)) { + $canread = 1; + } + if (!empty($user->rights->salaries->read) && $object->fk_user > 0 && in_array($object->fk_user, $childids)) { + $canread = 1; + } + if (!$canread) { + accessforbidden(); + } } // Security check