lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #20435 from marc-dll/13.0_FIX_medias_access_multicompany

Browse Source 
FIX: permit access to medias when logged in a different entity
This commit is contained in:
Laurent Destailleur 2022-03-23 15:37:20 +01:00 committed by GitHub
commit c44cfb0885
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/viewimage.php
View File

@ -186,6 +186,13 @@ $refname = basename(dirname($original_file)."/");
// Security check // Security check
if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1); if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1);
// When logged in a different entity, medias cannot be accessed because $conf->$module->multidir_output
// is not set on the requested entity, but they are public documents, so reset entity
if ($modulepart === 'medias' && $entity != $conf->entity) {
$conf->entity = $entity;
$conf->setValues($db);
}
$check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname); $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname);
$accessallowed = $check_access['accessallowed']; $accessallowed = $check_access['accessallowed'];
$sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals']; $sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];