lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #19452 from bomuux/patch-3

Browse Source 
FIX contact/note.php always restricted for external users
This commit is contained in:
Laurent Destailleur 2021-11-30 12:21:34 +01:00 committed by GitHub
commit f43fb18287
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/contact/note.php
View File

@ -34,18 +34,22 @@ $action = GETPOST('action', 'aZ09');
// Load translation files required by the page
$langs->load("companies");
// Security check
$id = GETPOST('id', 'int');
if ($user->socid) {
$id = $user->socid;
}
$result = restrictedArea($user, 'contact', $id, 'socpeople&societe');
$object = new Contact($db);
if ($id > 0) {
$object->fetch($id);
}
// Security check
if ($user->socid > 0) {
if ($object->fk_soc > 0 && $object->fk_soc != $user->socid) {
accessforbidden();
}
}
$result = restrictedArea($user, 'contact', $id, 'socpeople&societe');
$permissionnote = $user->rights->societe->creer; // Used by the include of actions_setnotes.inc.php
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context