diff --git a/htdocs/api/class/api_objectlinks.class.php b/htdocs/api/class/api_objectlinks.class.php index af800363222..4d08434cd8b 100644 --- a/htdocs/api/class/api_objectlinks.class.php +++ b/htdocs/api/class/api_objectlinks.class.php @@ -1,6 +1,7 @@ +/* Copyright (C) 2025 Jon Bendtsen * Copyright (C) 2025 MDW + * Copyright (C) 2025 Frédéric France * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -155,10 +156,10 @@ class ObjectLinks extends DolibarrApi if ($this->objectlink->targettype == 'subscription') { $tgttype = 'adherent'; } - if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $srctype, 'write')) { throw new RestException(403, 'denied access to create the objectlinks sourcetype='.$this->objectlink->sourcetype); } - if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $tgttype, 'write')) { throw new RestException(403, 'denied access to create the objectlinks targettype='.$this->objectlink->targettype); } @@ -207,10 +208,10 @@ class ObjectLinks extends DolibarrApi if ($this->objectlink->targettype == 'subscription') { $tgttype = 'adherent'; } - if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire')) { + if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'read')) { throw new RestException(403, 'denied access to the objectlinks sourcetype'); } - if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire')) { + if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'read')) { throw new RestException(403, 'denied access to the objectlinks targettype'); } } else { @@ -273,10 +274,10 @@ class ObjectLinks extends DolibarrApi if ($this->objectlink->targettype == 'subscription') { $tgttype = 'adherent'; } - if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $srctype, 'write')) { throw new RestException(403, 'denied access to get the objectlinks sourcetype='.$this->objectlink->sourcetype); } - if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $tgttype, 'write')) { throw new RestException(403, 'denied access to get the objectlinks targettype='.$this->objectlink->targettype); } @@ -337,10 +338,10 @@ class ObjectLinks extends DolibarrApi if ($this->objectlink->targettype == 'subscription') { $tgttype = 'adherent'; } - if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $srctype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $srctype, 'write')) { throw new RestException(403, 'denied access to delete the objectlinks sourcetype='.$this->objectlink->sourcetype); } - if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer')) { + if (!DolibarrApiAccess::$user->hasRight((string) $tgttype, 'creer') && !DolibarrApiAccess::$user->hasRight((string) $tgttype, 'write')) { throw new RestException(403, 'denied access to delete the objectlinks targettype='.$this->objectlink->targettype); } @@ -391,10 +392,10 @@ class ObjectLinks extends DolibarrApi if ($this->objectlink->targettype == 'subscription') { $tgttype = 'adherent'; } - if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire')) { + if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'read')) { throw new RestException(403, 'denied access to the objectlinks sourcetype'); } - if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire')) { + if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'read')) { throw new RestException(403, 'denied access to the objectlinks targettype'); } } else {