lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX user without permission can set ticket subject

Browse Source
This commit is contained in:
Laurent Destailleur 2021-09-19 00:56:10 +02:00
parent 052511d081
commit facd6abec3
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/ticket/card.php
View File

@ -492,7 +492,7 @@ if (empty($reshook)) {
}
}
if ($action == 'setsubject') {
if ($action == 'setsubject' && $user->rights->ticket->write) {
if ($object->fetch(GETPOST('id', 'int'))) {
if ($action == 'setsubject') {
$object->subject = GETPOST('subject', 'alphanohtml');