Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix duplicate id

Browse Source
This commit is contained in:
Laurent Destailleur
2020-08-17 20:06:01 +02:00
parent e891250fb3 c63d54631c
commit bd65e5612f
9 changed files with 67 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
htdocs/core/lib/security.lib.php
View File

@@ -1,6 +1,7 @@
<?php
/* Copyright (C) 2008-2011 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2008-2017 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2020 Ferran Marcet <fmarcet@2byte.es>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -537,8 +538,18 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand
$sql .= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
}
} elseif (in_array($feature, $checkproject))
{
if ($feature == 'agenda')// Also check owner or attendee for users without allactions->read
{
if ($objectid > 0 && empty($user->rights->agenda->allactions->read)) {
require_once DOL_DOCUMENT_ROOT . '/comm/action/class/actioncomm.class.php';
$action = new ActionComm($db);
$action->fetch($objectid);
if ($action->authorid != $user->id && $action->userownerid != $user->id && !(array_key_exists($user->id, $action->userassigned))) {
return false;
}
}
}
} elseif (in_array($feature, $checkproject)) {
if (!empty($conf->projet->enabled) && empty($user->rights->projet->all->lire))
{
include_once DOL_DOCUMENT_ROOT.'/projet/class/project.class.php';
@@ -552,8 +563,7 @@ function checkUserAccessToObject($user, $featuresarray, $objectid = 0, $tableand
$sql .= " WHERE dbt.".$dbt_select." IN (".$objectid.")";
$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
}
} elseif (in_array($feature, $checktask))
{
} elseif (in_array($feature, $checktask)) {
if (!empty($conf->projet->enabled) && empty($user->rights->projet->all->lire))
{
$task = new Task($db);