From ffeeb782b0b655d79766c460cafe7c11366ab0e0 Mon Sep 17 00:00:00 2001
From: Regis Houssin <regis.houssin@inodbox.com>
Date: Wed, 16 Jan 2019 19:25:19 +0100
Subject: [PATCH] FIX check is moved to restrictedArea() function

---
 htdocs/user/agenda_extsites.php | 5 +----
 htdocs/user/clicktodial.php     | 5 +----
 htdocs/user/document.php        | 7 +++----
 htdocs/user/info.php            | 5 +----
 htdocs/user/ldap.php            | 2 +-
 htdocs/user/note.php            | 2 +-
 htdocs/user/param_ihm.php       | 6 +-----
 htdocs/user/perms.php           | 5 -----
 8 files changed, 9 insertions(+), 28 deletions(-)

diff --git a/htdocs/user/agenda_extsites.php b/htdocs/user/agenda_extsites.php
index 2d94711aae8..541cf455a03 100644
--- a/htdocs/user/agenda_extsites.php
+++ b/htdocs/user/agenda_extsites.php
@@ -57,10 +57,7 @@ $object->getrights();
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id)	// A user can always read its own card
-{
-	$feature2='';
-}
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 
 // If user is not user that read and no permission to read other users, we stop
diff --git a/htdocs/user/clicktodial.php b/htdocs/user/clicktodial.php
index a6c43e2dc62..ce5491f5e20 100644
--- a/htdocs/user/clicktodial.php
+++ b/htdocs/user/clicktodial.php
@@ -35,10 +35,7 @@ $id=GETPOST('id','int');
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id)	// A user can always read its own card
-{
-	$feature2='';
-}
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
diff --git a/htdocs/user/document.php b/htdocs/user/document.php
index 2c41c1bf922..fd30172135d 100644
--- a/htdocs/user/document.php
+++ b/htdocs/user/document.php
@@ -66,10 +66,9 @@ if ($id)
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2='user';
-if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
-if (!$canreaduser) {
-	$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
-}
+
+$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
+
 if ($user->id <> $id && ! $canreaduser) accessforbidden();
 
 // Get parameters
diff --git a/htdocs/user/info.php b/htdocs/user/info.php
index 3cecf94543b..c1db0455628 100644
--- a/htdocs/user/info.php
+++ b/htdocs/user/info.php
@@ -43,10 +43,7 @@ if ($id > 0 || ! empty($ref))
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id)	// A user can always read its own card
-{
-	$feature2='';
-}
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 
 // If user is not user that read and no permission to read other users, we stop
diff --git a/htdocs/user/ldap.php b/htdocs/user/ldap.php
index 6b8d0b2502e..dcd47e5283f 100644
--- a/htdocs/user/ldap.php
+++ b/htdocs/user/ldap.php
@@ -37,7 +37,7 @@ $contextpage=GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'userldap';
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id) $feature2=''; // A user can always read its own card
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 
 $object = new User($db);
diff --git a/htdocs/user/note.php b/htdocs/user/note.php
index 87a6785615e..7ca91200734 100644
--- a/htdocs/user/note.php
+++ b/htdocs/user/note.php
@@ -45,7 +45,7 @@ if (($object->id != $user->id) && (! $user->rights->user->user->lire)) accessfor
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id) $feature2=''; // A user can always read its own card
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 
 // Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
diff --git a/htdocs/user/param_ihm.php b/htdocs/user/param_ihm.php
index 9e1ef7b9444..0d9e81b95e6 100644
--- a/htdocs/user/param_ihm.php
+++ b/htdocs/user/param_ihm.php
@@ -48,11 +48,7 @@ if ($id)
 $socid=0;
 if ($user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id)	// A user can always read its own card
-{
-    $feature2='';
-    $canreaduser=1;
-}
+
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 if ($user->id <> $id && ! $canreaduser) accessforbidden();
 
diff --git a/htdocs/user/perms.php b/htdocs/user/perms.php
index 574aa44f89d..c1b2e6da717 100644
--- a/htdocs/user/perms.php
+++ b/htdocs/user/perms.php
@@ -58,11 +58,6 @@ if (! empty($conf->global->MAIN_USE_ADVANCED_PERMS))
 $socid=0;
 if (isset($user->societe_id) && $user->societe_id > 0) $socid = $user->societe_id;
 $feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
-if ($user->id == $id && (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || $user->rights->user->self_advance->readperms))	// A user can always read its own card if not advanced perms enabled, or if he has advanced perms
-{
-	$feature2='';
-	$canreaduser=1;
-}
 
 $result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
 if ($user->id <> $id && ! $canreaduser) accessforbidden();