lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: bad restricted view of company

Browse Source
This commit is contained in:
Regis Houssin 2011-01-30 13:00:02 +00:00
parent 3ed533fc7e
commit be18f46b4a
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
htdocs/societe/lien.php
View File

@ -1,6 +1,7 @@
<?php <?php
/* Copyright (C) 2001-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2001-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2010 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2010 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005-2011 Regis Houssin <regis@dolibarr.fr>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -33,7 +34,7 @@ $langs->load("suppliers");
$langs->load("banks"); $langs->load("banks");
// Security check // Security check
$socid = isset($_GET["socid"])?$_GET["socid"]:''; $socid = GETPOST("socid");
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user, 'societe','',''); $result = restrictedArea($user, 'societe','','');
@ -167,7 +168,6 @@ if($_GET["socid"])
{ {
if ($user->rights->societe->creer) if ($user->rights->societe->creer)
{ {
$page=$_GET["page"]; $page=$_GET["page"];
if ($page == -1) { $page = 0 ; } if ($page == -1) { $page = 0 ; }
@ -185,13 +185,13 @@ if($_GET["socid"])
$sql = "SELECT s.rowid as socid, s.nom, s.ville, s.prefix_comm, s.client, s.fournisseur,"; $sql = "SELECT s.rowid as socid, s.nom, s.ville, s.prefix_comm, s.client, s.fournisseur,";
$sql.= " te.code, te.libelle"; $sql.= " te.code, te.libelle";
$sql.= " FROM ".MAIN_DB_PREFIX."societe as s,"; $sql.= " FROM ".MAIN_DB_PREFIX."societe as s";
$sql.= " ".MAIN_DB_PREFIX."c_typent as te"; $sql.= ", ".MAIN_DB_PREFIX."c_typent as te";
if (! $user->rights->societe->client->voir) $sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
$sql.= " WHERE s.fk_typent = te.id"; $sql.= " WHERE s.fk_typent = te.id";
if (dol_strlen(trim($_GET["search_nom"]))) $sql.= " AND s.entity = ".$conf->entity;
{ if (! $user->rights->societe->client->voir) $sql.= " AND s.rowid = sc.fk_soc AND sc.fk_user = " .$user->id;
$sql .= " AND s.nom LIKE '%".$_GET["search_nom"]."%'"; if (dol_strlen(trim($_GET["search_nom"]))) $sql.= " AND s.nom LIKE '%".$_GET["search_nom"]."%'";
}
$sql.= $db->order("s.nom","ASC"); $sql.= $db->order("s.nom","ASC");
$sql.= $db->plimit($conf->liste_limit+1, $offset); $sql.= $db->plimit($conf->liste_limit+1, $offset);