Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge pull request #10341 from hregis/8.0_bug

Browse Source 
FIX security broken with Multicompany
This commit is contained in:
Laurent Destailleur
2019-01-26 14:28:13 +01:00
committed by GitHub
parent b4400b95db d5b66eeffb
commit fd192f10c4
10 changed files with 13 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
htdocs/core/lib/security.lib.php
View File

@@ -252,6 +252,7 @@ function restrictedArea($user, $features, $objectid=0, $tableandshare='', $featu
$tmpreadok=1;
foreach($feature2 as $subfeature)
{
if ($subfeature == 'user' && $user->id == $objectid) continue; // A user can always read its own card
if (! empty($subfeature) && empty($user->rights->$feature->$subfeature->lire) && empty($user->rights->$feature->$subfeature->read)) { $tmpreadok=0; }
else if (empty($subfeature) && empty($user->rights->$feature->lire) && empty($user->rights->$feature->read)) { $tmpreadok=0; }
else { $tmpreadok=1; break; } // Break is to bypass second test if the first is ok

5
htdocs/user/agenda_extsites.php
View File

@@ -57,10 +57,7 @@ $object->getrights();
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// If user is not user that read and no permission to read other users, we stop

5
htdocs/user/card.php
View File

@@ -85,11 +85,8 @@ if ($id)
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
if (! $canreaduser) {
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();

5
htdocs/user/clicktodial.php
View File

@@ -35,10 +35,7 @@ $id=GETPOST('id','int');
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context

7
htdocs/user/document.php
View File

@@ -66,10 +66,9 @@ if ($id)
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2='user';
if ($user->id == $id) { $feature2=''; $canreaduser=1; } // A user can always read its own card
if (!$canreaduser) {
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();
// Get parameters

5
htdocs/user/info.php
View File

@@ -43,10 +43,7 @@ if ($id > 0 || ! empty($ref))
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// If user is not user that read and no permission to read other users, we stop

2
htdocs/user/ldap.php
View File

@@ -37,7 +37,7 @@ $contextpage=GETPOST('contextpage','aZ')?GETPOST('contextpage','aZ'):'userldap';
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) $feature2=''; // A user can always read its own card
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
$object = new User($db);

2
htdocs/user/note.php
View File

@@ -45,7 +45,7 @@ if (($object->id != $user->id) && (! $user->rights->user->user->lire)) accessfor
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) $feature2=''; // A user can always read its own card
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context

6
htdocs/user/param_ihm.php
View File

@@ -49,11 +49,7 @@ if ($id)
$socid=0;
if ($user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id) // A user can always read its own card
{
$feature2='';
$canreaduser=1;
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);
if ($user->id <> $id && ! $canreaduser) accessforbidden();

5
htdocs/user/perms.php
View File

@@ -58,10 +58,9 @@ if (! empty($conf->global->MAIN_USE_ADVANCED_PERMS))
$socid=0;
if (isset($user->societe_id) && $user->societe_id > 0) $socid = $user->societe_id;
$feature2 = (($socid && $user->rights->user->self->creer)?'':'user');
if ($user->id == $id && (empty($conf->global->MAIN_USE_ADVANCED_PERMS) || $user->rights->user->self_advance->readperms)) // A user can always read its own card if not advanced perms enabled, or if he has advanced perms
if ($user->id == $id && (! empty($conf->global->MAIN_USE_ADVANCED_PERMS) && empty($user->rights->user->self_advance->readperms))) // A user can always read its own card if not advanced perms enabled, or if he has advanced perms
{
$feature2='';
$canreaduser=1;
accessforbidden();
}
$result = restrictedArea($user, 'user', $id, 'user&user', $feature2);