lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix perms on API user

Browse Source
This commit is contained in:
Laurent Destailleur 2021-05-17 16:16:45 +02:00
parent cb9db6e3a8
commit c54e010126
1 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
htdocs/user/class/api_users.class.php
View File

@ -71,7 +71,7 @@ class Users extends DolibarrApi
$obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->user->lire && !DolibarrApiAccess::$user->admin) {
if (!DolibarrApiAccess::$user->rights->user->user->lire && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, "You are not allowed to read list of users");
}
@ -142,7 +142,7 @@ class Users extends DolibarrApi
*/
public function get($id, $includepermissions = 0)
{
if (!DolibarrApiAccess::$user->rights->user->user->lire && !DolibarrApiAccess::$user->admin) {
if (!DolibarrApiAccess::$user->rights->user->user->lire && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401);
}
@ -177,7 +177,11 @@ class Users extends DolibarrApi
*/
public function getInfo()
{
$apiUser = DolibarrApiAccess::$user;
if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, 'Not allowed');
}
$apiUser = DolibarrApiAccess::$user;
$result = $this->useraccount->fetch($apiUser->id);
if (!$result) {
@ -208,7 +212,7 @@ class Users extends DolibarrApi
public function post($request_data = null)
{
// check user authorization
if(! DolibarrApiAccess::$user->rights->user->creer && !DolibarrApiAccess::$user->admin) {
if (empty(DolibarrApiAccess::$user->rights->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, "User creation not allowed");
}
// check mandatory fields
@ -242,7 +246,7 @@ class Users extends DolibarrApi
*/
public function put($id, $request_data = null)
{
if (!DolibarrApiAccess::$user->rights->user->user->creer && !DolibarrApiAccess::$user->admin) {
if (empty(DolibarrApiAccess::$user->rights->user->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401);
}
@ -299,7 +303,7 @@ class Users extends DolibarrApi
{
$obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->user->lire && !DolibarrApiAccess::$user->admin) {
if (empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401);
}
@ -334,7 +338,7 @@ class Users extends DolibarrApi
global $conf;
if (!DolibarrApiAccess::$user->rights->user->user->supprimer && !DolibarrApiAccess::$user->admin) {
if (empty(DolibarrApiAccess::$user->rights->user->user->creer) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401);
}
$result = $this->useraccount->fetch($id);
@ -389,9 +393,10 @@ class Users extends DolibarrApi
$obj_ret = array();
if (!DolibarrApiAccess::$user->rights->user->group_advance->read && !DolibarrApiAccess::$user->admin) {
throw new RestException(401, "You are not allowed to read list of groups");
}
if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) ||
!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->group_advance->read) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, "You are not allowed to read groups");
}
// case of external user, $societe param is ignored and replaced by user's socid
//$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe;
@ -463,7 +468,8 @@ class Users extends DolibarrApi
{
global $db, $conf;
if (!DolibarrApiAccess::$user->rights->user->group_advance->read && !DolibarrApiAccess::$user->admin) {
if ((empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->user->lire) && empty(DolibarrApiAccess::$user->admin)) ||
!empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty(DolibarrApiAccess::$user->rights->user->group_advance->read) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401, "You are not allowed to read groups");
}
@ -486,7 +492,7 @@ class Users extends DolibarrApi
*/
public function delete($id)
{
if (!DolibarrApiAccess::$user->rights->user->user->supprimer && !DolibarrApiAccess::$user->admin) {
if (empty(DolibarrApiAccess::$user->rights->user->user->supprimer) && empty(DolibarrApiAccess::$user->admin)) {
throw new RestException(401);
}
$result = $this->useraccount->fetch($id);