From ed9db6c9ddf50de9255078b44539a55d29e69530 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 25 Feb 2023 16:36:48 +0100 Subject: [PATCH] Fix #yogosha15050 --- htdocs/user/card.php | 101 +++++++++++++++++++++++-------------------- 1 file changed, 54 insertions(+), 47 deletions(-) diff --git a/htdocs/user/card.php b/htdocs/user/card.php index 688ac6c28ac..08c2defd546 100644 --- a/htdocs/user/card.php +++ b/htdocs/user/card.php @@ -63,6 +63,9 @@ if (isModEnabled('stock')) { require_once DOL_DOCUMENT_ROOT.'/product/class/html.formproduct.class.php'; } +// Load translation files required by page +$langs->loadLangs(array('users', 'companies', 'ldap', 'admin', 'hrm', 'stocks', 'other')); + $id = GETPOST('id', 'int'); $action = GETPOST('action', 'aZ09'); $mode = GETPOST('mode', 'alpha'); @@ -77,42 +80,8 @@ $datestartvalidity = dol_mktime(0, 0, 0, GETPOST('datestartvaliditymonth', 'int' $dateendvalidity = dol_mktime(0, 0, 0, GETPOST('dateendvaliditymonth', 'int'), GETPOST('dateendvalidityday', 'int'), GETPOST('dateendvalidityyear', 'int')); $dateofbirth = dol_mktime(0, 0, 0, GETPOST('dateofbirthmonth', 'int'), GETPOST('dateofbirthday', 'int'), GETPOST('dateofbirthyear', 'int')); -// Define value to know what current user can do on users -$canadduser = (!empty($user->admin) || $user->hasRight("user", "user", "write")); -$canreaduser = (!empty($user->admin) || $user->hasRight("user", "user", "read")); -$canedituser = (!empty($user->admin) || $user->hasRight("user", "user", "write")); -$candisableuser = (!empty($user->admin) || $user->hasRight("user", "user", "delete")); -$canreadgroup = $canreaduser; -$caneditgroup = $canedituser; -if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS)) { - $canreadgroup = (!empty($user->admin) || $user->hasRight("user", "group_advance", "read")); - $caneditgroup = (!empty($user->admin) || $user->hasRight("user", "group_advance", "write")); -} - $childids = $user->getAllChildIds(1); // For later, test on salary visibility -// Define value to know what current user can do on properties of edited user -if ($id > 0) { - // $user is the current logged user, $id is the user we want to edit - $caneditfield = ((($user->id == $id) && $user->hasRight("user", "self", "write")) || (($user->id != $id) && $user->hasRight("user", "user", "write"))); - $caneditpassword = ((($user->id == $id) && $user->hasRight("user", "self", "password")) || (($user->id != $id) && $user->hasRight("user", "user", "password"))); -} - -// Security check -$socid = 0; -if ($user->socid > 0) { - $socid = $user->socid; -} -$feature2 = 'user'; -$result = restrictedArea($user, 'user', $id, 'user', $feature2); - -if ($user->id != $id && !$canreaduser) { - accessforbidden(); -} - -// Load translation files required by page -$langs->loadLangs(array('users', 'companies', 'ldap', 'admin', 'hrm', 'stocks', 'other')); - $object = new User($db); $extrafields = new ExtraFields($db); @@ -129,6 +98,38 @@ $error = 0; $acceptlocallinktomedia = (acceptLocalLinktoMedia() > 0 ? 1 : 0); +// Security check +$socid = 0; +if ($user->socid > 0) { + $socid = $user->socid; +} +$feature2 = 'user'; +$result = restrictedArea($user, 'user', $id, 'user', $feature2); + +// Define value to know what current user can do on users +$canadduser = (!empty($user->admin) || $user->hasRight("user", "user", "write")); +$canreaduser = (!empty($user->admin) || $user->hasRight("user", "user", "read")); +$canedituser = (!empty($user->admin) || $user->hasRight("user", "user", "write")); // edit other user +$candisableuser = (!empty($user->admin) || $user->hasRight("user", "user", "delete")); +$canreadgroup = $canreaduser; +$caneditgroup = $canedituser; +if (!empty($conf->global->MAIN_USE_ADVANCED_PERMS)) { + $canreadgroup = (!empty($user->admin) || $user->hasRight("user", "group_advance", "read")); + $caneditgroup = (!empty($user->admin) || $user->hasRight("user", "group_advance", "write")); +} + +if ($user->id != $id && !$canreaduser) { + accessforbidden(); +} + +// Define value to know what current user can do on properties of edited user +if ($id > 0) { + // $user is the current logged user, $id is the user we want to edit + $canedituser = (($user->id == $id) && $user->hasRight("user", "self", "write")); // can edit myself + $caneditfield = ((($user->id == $id) && $user->hasRight("user", "self", "write")) || (($user->id != $id) && $user->hasRight("user", "user", "write"))); + $caneditpassword = ((($user->id == $id) && $user->hasRight("user", "self", "password")) || (($user->id != $id) && $user->hasRight("user", "user", "password"))); +} + /** * Actions @@ -390,7 +391,7 @@ if (empty($reshook)) { } } - if ($action == 'update' && !$cancel) { + if ($action == 'update' && $canedituser) { require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; if ($caneditfield) { // Case we can edit all field @@ -430,8 +431,12 @@ if (empty($reshook)) { $object->national_registration_number = GETPOST("national_registration_number", 'alphanohtml'); } $object->gender = GETPOST("gender", 'aZ09'); - $object->pass = GETPOST("password", 'none'); // We can keep 'none' for password fields - $object->api_key = (GETPOST("api_key", 'alphanohtml')) ? GETPOST("api_key", 'alphanohtml') : $object->api_key; + if ($caneditpassword) { + $object->pass = GETPOST("password", 'none'); // We can keep 'none' for password fields + } + if ($caneditpassword || $user->hasRight("api", "apikey", "generate")) { + $object->api_key = (GETPOST("api_key", 'alphanohtml')) ? GETPOST("api_key", 'alphanohtml') : $object->api_key; + } if (!empty($user->admin)) { // admin flag can only be set/unset by an admin user. A test is also done later when forging sql request $object->admin = GETPOST("admin", "int"); } @@ -2074,7 +2079,7 @@ if ($action == 'create' || $action == 'adduserldap') { print "\n"; } } else { - print ''.$langs->trans("None").''; + print ''.$langs->trans("None").''; } print ""; @@ -2091,7 +2096,7 @@ if ($action == 'create' || $action == 'adduserldap') { /* * Card in edit mode */ - if ($action == 'edit' && ($canedituser || $caneditfield || $caneditpassword || ($user->id == $object->id))) { + if ($action == 'edit' && ($canedituser || $caneditpassword)) { print '
'; print ''; print ''; @@ -2417,12 +2422,14 @@ if ($action == 'create' || $action == 'adduserldap') { print "\n"; // API key - if (!empty($conf->api->enabled) && ($user->id == $id || $user->admin || $user->hasRight("api", "apikey", "generate"))) { + if (isModEnabled('api')) { print ''.$langs->trans("ApiKey").''; print ''; - print ''; - if (!empty($conf->use_javascript_ajax)) { - print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); + if ($caneditpassword || $user->hasRight("api", "apikey", "generate")) { + print ''; + if (!empty($conf->use_javascript_ajax)) { + print ' '.img_picto($langs->trans('Generate'), 'refresh', 'id="generate_api_key" class="linkobject"'); + } } print ''; } @@ -2879,10 +2886,10 @@ if ($action == 'create' || $action == 'adduserldap') { } } -if (!empty($conf->api->enabled)) { - // Add button to autosuggest a key - include_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; - print dolJSToSetRandomPassword('password', 'generate_password', 0); +// Add button to autosuggest a key +include_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; +print dolJSToSetRandomPassword('password', 'generate_password', 0); +if (isModEnabled('api')) { print dolJSToSetRandomPassword('api_key', 'generate_api_key', 1); }