lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '4.0' of git@github.com:Dolibarr/dolibarr.git into 5.0

Browse Source
This commit is contained in:
Laurent Destailleur 2017-03-10 12:23:09 +01:00
commit fbb80b54df
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
htdocs/core/lib/files.lib.php
View File

@ -1886,17 +1886,32 @@ function dol_check_secure_access_document($modulepart,$original_file,$entity,$fu
// Define $accessallowed // Define $accessallowed
if (preg_match('/^([a-z]+)_user_temp$/i',$modulepart,$reg)) if (preg_match('/^([a-z]+)_user_temp$/i',$modulepart,$reg))
{ {
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1; if (empty($conf->{$reg[1]}->dir_temp)) // modulepart not supported
{
dol_print_error('','Error call dol_check_secure_access_document with not supported value for modulepart parameter ('.$modulepart.')');
exit;
}
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1;
$original_file=$conf->{$reg[1]}->dir_temp.'/'.$fuser->id.'/'.$original_file; $original_file=$conf->{$reg[1]}->dir_temp.'/'.$fuser->id.'/'.$original_file;
} }
else if (preg_match('/^([a-z]+)_temp$/i',$modulepart,$reg)) else if (preg_match('/^([a-z]+)_temp$/i',$modulepart,$reg))
{ {
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1; if (empty($conf->{$reg[1]}->dir_temp)) // modulepart not supported
{
dol_print_error('','Error call dol_check_secure_access_document with not supported value for modulepart parameter ('.$modulepart.')');
exit;
}
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1;
$original_file=$conf->{$reg[1]}->dir_temp.'/'.$original_file; $original_file=$conf->{$reg[1]}->dir_temp.'/'.$original_file;
} }
else if (preg_match('/^([a-z]+)_user$/i',$modulepart,$reg)) else if (preg_match('/^([a-z]+)_user$/i',$modulepart,$reg))
{ {
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1; if (empty($conf->{$reg[1]}->dir_output)) // modulepart not supported
{
dol_print_error('','Error call dol_check_secure_access_document with not supported value for modulepart parameter ('.$modulepart.')');
exit;
}
if ($fuser->rights->{$reg[1]}->lire || $fuser->rights->{$reg[1]}->read || ($fuser->rights->{$reg[1]}->download)) $accessallowed=1;
$original_file=$conf->{$reg[1]}->dir_output.'/'.$fuser->id.'/'.$original_file; $original_file=$conf->{$reg[1]}->dir_output.'/'.$fuser->id.'/'.$original_file;
} }
else else