FIX create invoice from order using API and multi-entity (#35654)

* FIX create invoice from order using API and multi-entity

* FIX API not allow to access order in other entity on creating invoice from order

* Update api_invoices.class.php

---------

Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>

htdocs/compta/facture/class/api_invoices.class.php

@@ -315,6 +315,7 @@ class Invoices extends DolibarrApi
 	  * @return int
 	  * @throws RestException 400
 	  * @throws RestException 401
+	  * @throws RestException 403		Access not allowed for login
 	  * @throws RestException 404
 	  * @throws RestException 405
 	  */
@@ -332,6 +333,9 @@ class Invoices extends DolibarrApi
 		if (empty($orderid)) {
 			throw new RestException(400, 'Order ID is mandatory');
 		}
+		if (!DolibarrApi::_checkAccessToResource('commande', $orderid)) {
+			throw new RestException(403, 'Access not allowed on order for login '.DolibarrApiAccess::$user->login);
+		}
 
 		$order = new Commande($this->db);
 		$result = $order->fetch($orderid);