lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX Vulnerability: Idor leading to lock admin users.

Browse Source
This commit is contained in:
Laurent Destailleur 2021-03-22 13:56:19 +01:00
parent 7b01133493
commit e79284ea29
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/user/card.php
View File

@ -89,7 +89,7 @@ if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS)) {
// Define value to know what current user can do on properties of edited user // Define value to know what current user can do on properties of edited user
if ($id) { if ($id) {
// $user est le user qui edite, $id est l'id de l'utilisateur edite // $user is the current logged user, $id is the user we want to edit
$caneditfield = ((($user->id == $id) && $user->rights->user->self->creer) $caneditfield = ((($user->id == $id) && $user->rights->user->self->creer)
|| (($user->id != $id) && $user->rights->user->user->creer)); || (($user->id != $id) && $user->rights->user->user->creer));
$caneditpassword = ((($user->id == $id) && $user->rights->user->self->password) $caneditpassword = ((($user->id == $id) && $user->rights->user->self->password)
@ -122,6 +122,7 @@ $socialnetworks = getArrayOfSocialNetworks();
// Initialize technical object to manage hooks. Note that conf->hooks_modules contains array // Initialize technical object to manage hooks. Note that conf->hooks_modules contains array
$hookmanager->initHooks(array('usercard', 'globalcard')); $hookmanager->initHooks(array('usercard', 'globalcard'));
$error = 0;
/** /**
@ -136,13 +137,19 @@ if ($reshook < 0) {
if (empty($reshook)) { if (empty($reshook)) {
if ($action == 'confirm_disable' && $confirm == "yes" && $candisableuser) { if ($action == 'confirm_disable' && $confirm == "yes" && $candisableuser) {
if ($id <> $user->id) { if ($id <> $user->id) { // A user can't disable itself
$object->fetch($id); $object->fetch($id);
if ($object->admin && empty($user->admin)) {
// If user to delete is an admin user and if logged user is not admin, we deny the operation.
$error++;
setEventMessages($langs->trans("OnlyAdminUsersCanDisableAdminUsers"), null, 'errors');
} else {
$object->setstatus(0); $object->setstatus(0);
header("Location: ".$_SERVER['PHP_SELF'].'?id='.$id); header("Location: ".$_SERVER['PHP_SELF'].'?id='.$id);
exit; exit;
} }
} }
}
if ($action == 'confirm_enable' && $confirm == "yes" && $candisableuser) { if ($action == 'confirm_enable' && $confirm == "yes" && $candisableuser) {
$error = 0; $error = 0;