From f544219d922c6249aac9f3e13908adb5d25fb370 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 22 Feb 2022 16:44:17 +0100 Subject: [PATCH] FIX permission to download files of expense report with readall. --- htdocs/core/lib/files.lib.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php index c70ea041e0a..d1364598c07 100644 --- a/htdocs/core/lib/files.lib.php +++ b/htdocs/core/lib/files.lib.php @@ -2424,10 +2424,10 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity, } $original_file = $conf->fournisseur->facture->dir_output.'/'.$original_file; } elseif (($modulepart == 'holiday') && !empty($conf->holiday->dir_output)) { - if ($fuser->rights->holiday->{$read} || preg_match('/^specimen/i', $original_file)) { + if ($fuser->rights->holiday->{$read} || !empty($fuser->rights->holiday->readall) || preg_match('/^specimen/i', $original_file)) { $accessallowed = 1; // If we known $id of holiday, call checkUserAccessToObject to check permission on properties and hierarchy of leave request - if ($refname && !preg_match('/^specimen/i', $original_file)) { + if ($refname && empty($fuser->rights->holiday->readall) && !preg_match('/^specimen/i', $original_file)) { include_once DOL_DOCUMENT_ROOT.'/holiday/class/holiday.class.php'; $tmpholiday = new Holiday($db); $tmpholiday->fetch('', $refname); @@ -2436,10 +2436,10 @@ function dol_check_secure_access_document($modulepart, $original_file, $entity, } $original_file = $conf->holiday->dir_output.'/'.$original_file; } elseif (($modulepart == 'expensereport') && !empty($conf->expensereport->dir_output)) { - if ($fuser->rights->expensereport->{$lire} || preg_match('/^specimen/i', $original_file)) { + if ($fuser->rights->expensereport->{$lire} || !empty($fuser->rights->expensereport->readall) || preg_match('/^specimen/i', $original_file)) { $accessallowed = 1; // If we known $id of expensereport, call checkUserAccessToObject to check permission on properties and hierarchy of expense report - if ($refname && !preg_match('/^specimen/i', $original_file)) { + if ($refname && empty($fuser->rights->expensereport->readall) && !preg_match('/^specimen/i', $original_file)) { include_once DOL_DOCUMENT_ROOT.'/expensereport/class/expensereport.class.php'; $tmpexpensereport = new ExpenseReport($db); $tmpexpensereport->fetch('', $refname);