diff --git a/htdocs/expensereport/class/expensereport.class.php b/htdocs/expensereport/class/expensereport.class.php index 2dddac4dbab..bb543642733 100644 --- a/htdocs/expensereport/class/expensereport.class.php +++ b/htdocs/expensereport/class/expensereport.class.php @@ -970,7 +970,7 @@ class ExpenseReport extends CommonObject { // phpcs:enable global $conf; - + $this->lines=array(); $sql = ' SELECT de.rowid, de.comments, de.qty, de.value_unit, de.date, de.rang,'; @@ -2274,7 +2274,7 @@ class ExpenseReport extends CommonObject public function load_state_board() { // phpcs:enable - global $conf; + global $conf, $user; $this->nb=array(); @@ -2282,6 +2282,12 @@ class ExpenseReport extends CommonObject $sql.= " FROM ".MAIN_DB_PREFIX."expensereport as ex"; $sql.= " WHERE ex.fk_statut > 0"; $sql.= " AND ex.entity IN (".getEntity('expensereport').")"; + if(!$user->rights->expensereport->readall) + { + $userchildids = $user->getAllChildIds(1); + $sql.= " AND (ex.fk_user_author IN (".join(',', $userchildids).")"; + $sql.= " OR ex.fk_user_validator IN (".join(',', $userchildids)."))"; + } $resql=$this->db->query($sql); if ($resql) { @@ -2316,15 +2322,17 @@ class ExpenseReport extends CommonObject $now=dol_now(); - $userchildids = $user->getAllChildIds(1); - $sql = "SELECT ex.rowid, ex.date_valid"; $sql.= " FROM ".MAIN_DB_PREFIX."expensereport as ex"; if ($option == 'toapprove') $sql.= " WHERE ex.fk_statut = 2"; else $sql.= " WHERE ex.fk_statut = 5"; $sql.= " AND ex.entity IN (".getEntity('expensereport').")"; - $sql.= " AND (ex.fk_user_author IN (".join(',', $userchildids).")"; - $sql.= " OR ex.fk_user_validator IN (".join(',', $userchildids)."))"; + if(!$user->rights->expensereport->readall) + { + $userchildids = $user->getAllChildIds(1); + $sql.= " AND (ex.fk_user_author IN (".join(',', $userchildids).")"; + $sql.= " OR ex.fk_user_validator IN (".join(',', $userchildids)."))"; + } $resql=$this->db->query($sql); if ($resql) diff --git a/htdocs/holiday/class/holiday.class.php b/htdocs/holiday/class/holiday.class.php index 25f1d9675bb..1d818d33c1f 100644 --- a/htdocs/holiday/class/holiday.class.php +++ b/htdocs/holiday/class/holiday.class.php @@ -2182,12 +2182,20 @@ class Holiday extends CommonObject public function load_state_board() { // phpcs:enable + global $user; + $this->nb=array(); $sql = "SELECT count(h.rowid) as nb"; $sql.= " FROM ".MAIN_DB_PREFIX."holiday as h"; $sql.= " WHERE h.statut > 1"; $sql.= " AND h.entity IN (".getEntity('holiday').")"; + if(!$user->rights->expensereport->read_all) + { + $userchildids = $user->getAllChildIds(1); + $sql.= " AND (h.fk_user IN (".join(',', $userchildids).")"; + $sql.= " OR h.fk_validator IN (".join(',', $userchildids)."))"; + } $resql=$this->db->query($sql); if ($resql) { @@ -2221,14 +2229,16 @@ class Holiday extends CommonObject $now=dol_now(); - $userchildids = $user->getAllChildIds(1); - $sql = "SELECT h.rowid, h.date_debut"; $sql.= " FROM ".MAIN_DB_PREFIX."holiday as h"; $sql.= " WHERE h.statut = 2"; $sql.= " AND h.entity IN (".getEntity('holiday').")"; - $sql.= " AND (h.fk_user IN (".join(',', $userchildids).")"; - $sql.= " OR h.fk_validator IN (".join(',', $userchildids)."))"; + if(!$user->rights->expensereport->read_all) + { + $userchildids = $user->getAllChildIds(1); + $sql.= " AND (h.fk_user IN (".join(',', $userchildids).")"; + $sql.= " OR h.fk_validator IN (".join(',', $userchildids)."))"; + } $resql=$this->db->query($sql); if ($resql)