\n";
}
diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index da14436f749..d160967c9a0 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -451,7 +451,7 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand
if ($feature == 'project') $feature='projet';
if ($feature == 'task') $feature='projet_task';
- $check = array('adherent','banque','don','user','usergroup','product','produit','service','produit|service','categorie','resource'); // Test on entity only (Objects with no link to company)
+ $check = array('adherent','banque','don','user','usergroup','product','produit','service','produit|service','categorie','resource','expensereport','holiday'); // Test on entity only (Objects with no link to company)
$checksoc = array('societe'); // Test for societe object
$checkother = array('contact','agenda'); // Test on entity and link to third party. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet','project'); // Test for project object
diff --git a/htdocs/holiday/card.php b/htdocs/holiday/card.php
index 9bc181f66d9..1c92e558c41 100644
--- a/htdocs/holiday/card.php
+++ b/htdocs/holiday/card.php
@@ -45,7 +45,8 @@ $ref=GETPOST('ref', 'alpha');
$fuserid = (GETPOST('fuserid', 'int')?GETPOST('fuserid', 'int'):$user->id);
// Protection if external user
-if ($user->societe_id > 0) accessforbidden();
+if ($user->societe_id) $socid=$user->societe_id;
+$result = restrictedArea($user, 'holiday', $id, 'holiday');
$now=dol_now();
diff --git a/htdocs/holiday/document.php b/htdocs/holiday/document.php
index be948280eaf..942b6cb98fb 100644
--- a/htdocs/holiday/document.php
+++ b/htdocs/holiday/document.php
@@ -144,7 +144,7 @@ if ($object->id)
print '