diff --git a/htdocs/document.php b/htdocs/document.php index d4a91010466..6c8c7c59c7f 100644 --- a/htdocs/document.php +++ b/htdocs/document.php @@ -54,7 +54,7 @@ $action=GETPOST('action','alpha'); $original_file=GETPOST('file','alpha'); // Do not use urldecode here ($_GET are already decoded by PHP). $modulepart=GETPOST('modulepart','alpha'); $urlsource=GETPOST('urlsource','alpha'); -$entity=GETPOST('entity','int'); +$entity=GETPOST('entity')?GETPOST('entity','int'):$conf->entity; // Security check if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart'); @@ -440,6 +440,7 @@ if ($modulepart) } } + // Basic protection (against external users only) if ($user->societe_id > 0) {