lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX check is moved to restrictedArea() function

Browse Source
This commit is contained in:
Regis Houssin 2019-01-16 19:25:19 +01:00
parent c4b9bdd569
commit ffeeb782b0
8 changed files with 9 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/user/agenda_extsites.php
View File

@ -57,10 +57,7 @@ $object->getrights();
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// If user is not user that read and no permission to read other users, we stop

5
htdocs/user/clicktodial.php
View File

@ -35,10 +35,7 @@ $id=GETPOST('id','int');
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context

7
htdocs/user/document.php
View File

@ -66,10 +66,9 @@ if ($id)
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
if (!$canreaduser) {
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();
// Get parameters

5
htdocs/user/info.php
View File

@ -43,10 +43,7 @@ if ($id > 0 || ! empty($ref))
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// If user is not user that read and no permission to read other users, we stop

2
htdocs/user/ldap.php
View File

@ -37,7 +37,7 @@ $contextpage=GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'userldap';
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) $feature2=''; // A user can always read its own card
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
$object = new User($db);

2
htdocs/user/note.php
View File

@ -45,7 +45,7 @@ if (($object->id != $user->id) && (! $user->rights->user->user->lire)) accessfor
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) $feature2=''; // A user can always read its own card
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context

6
htdocs/user/param_ihm.php
View File

@ -48,11 +48,7 @@ if ($id)
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
$canreaduser=1;
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();

5
htdocs/user/perms.php
View File

@ -58,11 +58,6 @@ if (! empty($conf->global->MAIN_USE_ADVANCED_PERMS))
$socid=0;
if (isset($user->societe_id) && $user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id && (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || $user->rights->user->self_advance->readperms)) // A user can always read its own card if not advanced perms enabled, or if he has advanced perms
{
$feature2='';
$canreaduser=1;
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();