lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #13094

Browse Source
This commit is contained in:
Laurent Destailleur 2020-02-12 17:28:18 +01:00
parent cc6313cdf3
commit e74df397eb
2 changed files with 44 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/core/lib/security.lib.php
View File

@ -311,6 +311,9 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
{ {
foreach ($feature2 as $subfeature) foreach ($feature2 as $subfeature)
{ {
if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->creer) continue; // User can edit its own card
if ($subfeature == 'user' && $user->id == $objectid && $user->rights->user->self->password) continue; // User can edit its own password
if (empty($user->rights->$feature->$subfeature->creer) if (empty($user->rights->$feature->$subfeature->creer)
&& empty($user->rights->$feature->$subfeature->write) && empty($user->rights->$feature->$subfeature->write)
&& empty($user->rights->$feature->$subfeature->create)) { && empty($user->rights->$feature->$subfeature->create)) {

57
htdocs/user/card.php
View File

@ -40,6 +40,7 @@ require_once DOL_DOCUMENT_ROOT.'/user/class/user.class.php';
require_once DOL_DOCUMENT_ROOT.'/user/class/usergroup.class.php'; require_once DOL_DOCUMENT_ROOT.'/user/class/usergroup.class.php';
require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php'; require_once DOL_DOCUMENT_ROOT.'/contact/class/contact.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/company.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/images.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/images.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/usergroups.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/usergroups.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/extrafields.class.php';
@ -85,8 +86,7 @@ if ($id)
$socid = 0; $socid = 0;
if ($user->socid > 0) $socid = $user->socid; if ($user->socid > 0) $socid = $user->socid;
$feature2 = 'user'; $feature2 = 'user';
$result = restrictedArea($user, 'user', $id, 'user', $feature2);
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && !$canreaduser) accessforbidden(); if ($user->id <> $id && !$canreaduser) accessforbidden();
@ -567,12 +567,14 @@ if (empty($reshook)) {
$object->fetch($id); $object->fetch($id);
$object->oldcopy = clone $object; if (GETPOST("password", "none")) { // If pass is empty, we do not change it.
$object->oldcopy = clone $object;
$ret = $object->setPassword($user, GETPOST("password")); $ret = $object->setPassword($user, GETPOST("password", "none"));
if ($ret < 0) if ($ret < 0)
{ {
setEventMessages($object->error, $object->errors, 'errors'); setEventMessages($object->error, $object->errors, 'errors');
}
} }
} }
} }
@ -1551,7 +1553,7 @@ else
else else
{ {
if ($user->admin) $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("Crypted").': '.$object->pass_indatabase_crypted; if ($user->admin) $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("Crypted").': '.$object->pass_indatabase_crypted;
else $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').$langs->trans("Hidden"); else $valuetoshow .= ($valuetoshow ? (' '.$langs->trans("or").' ') : '').'<span class="opacitymedium">'.$langs->trans("Hidden").'</span>';
} }
} }
@ -2307,7 +2309,11 @@ else
print '<tr><td>'.$langs->trans("Gender").'</td>'; print '<tr><td>'.$langs->trans("Gender").'</td>';
print '<td>'; print '<td>';
$arraygender = array('man'=>$langs->trans("Genderman"), 'woman'=>$langs->trans("Genderwoman")); $arraygender = array('man'=>$langs->trans("Genderman"), 'woman'=>$langs->trans("Genderwoman"));
print $form->selectarray('gender', $arraygender, GETPOST('gender') ?GETPOST('gender') : $object->gender, 1); if ($caneditfield) {
print $form->selectarray('gender', $arraygender, GETPOSTISSET('gender') ?GETPOST('gender') : $object->gender, 1);
} else {
print $arraygender[$object->gender];
}
print '</td></tr>'; print '</td></tr>';
// Employee // Employee
@ -2387,31 +2393,50 @@ else
// Address // Address
print '<tr><td class="tdtop titlefield">'.$form->editfieldkey('Address', 'address', '', $object, 0).'</td>'; print '<tr><td class="tdtop titlefield">'.$form->editfieldkey('Address', 'address', '', $object, 0).'</td>';
print '<td><textarea name="address" id="address" class="quatrevingtpercent" rows="3" wrap="soft">'; print '<td>';
if ($caneditfield) print '<textarea name="address" id="address" class="quatrevingtpercent" rows="3" wrap="soft">';
print $object->address; print $object->address;
print '</textarea></td></tr>'; if ($caneditfield) print '</textarea>';
print '</td></tr>';
// Zip // Zip
print '<tr><td>'.$form->editfieldkey('Zip', 'zipcode', '', $object, 0).'</td><td>'; print '<tr><td>'.$form->editfieldkey('Zip', 'zipcode', '', $object, 0).'</td><td>';
print $formcompany->select_ziptown($object->zip, 'zipcode', array('town', 'selectcountry_id', 'state_id'), 6); if ($caneditfield) {
print $formcompany->select_ziptown($object->zip, 'zipcode', array('town', 'selectcountry_id', 'state_id'), 6);
} else {
print $object->zip;
}
print '</td></tr>'; print '</td></tr>';
// Town // Town
print '<tr><td>'.$form->editfieldkey('Town', 'town', '', $object, 0).'</td><td>'; print '<tr><td>'.$form->editfieldkey('Town', 'town', '', $object, 0).'</td><td>';
print $formcompany->select_ziptown($object->town, 'town', array('zipcode', 'selectcountry_id', 'state_id')); if ($caneditfield) {
print $formcompany->select_ziptown($object->town, 'town', array('zipcode', 'selectcountry_id', 'state_id'));
} else {
print $object->town;
}
print '</td></tr>'; print '</td></tr>';
// Country // Country
print '<tr><td>'.$form->editfieldkey('Country', 'selectcounty_id', '', $object, 0).'</td><td>'; print '<tr><td>'.$form->editfieldkey('Country', 'selectcounty_id', '', $object, 0).'</td><td>';
print $form->select_country((GETPOST('country_id') != '' ?GETPOST('country_id') : $object->country_id), 'country_id'); if ($caneditfield) {
if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionarySetup"), 1); print $form->select_country((GETPOST('country_id') != '' ?GETPOST('country_id') : $object->country_id), 'country_id');
if ($user->admin) print info_admin($langs->trans("YouCanChangeValuesForThisListFromDictionarySetup"), 1);
} else {
$countrylabel = getCountry($object->country_id, '0');
print $countrylabel;
}
print '</td></tr>'; print '</td></tr>';
// State // State
if (empty($conf->global->USER_DISABLE_STATE)) if (empty($conf->global->USER_DISABLE_STATE))
{ {
print '<tr><td class="tdoverflow">'.$form->editfieldkey('State', 'state_id', '', $object, 0).'</td><td>'; print '<tr><td class="tdoverflow">'.$form->editfieldkey('State', 'state_id', '', $object, 0).'</td><td>';
print $formcompany->select_state($object->state_id, $object->country_code, 'state_id'); if ($caneditfield) {
print $formcompany->select_state($object->state_id, $object->country_code, 'state_id');
} else {
print $object->state_label;
}
print '</td></tr>'; print '</td></tr>';
} }