Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2026-02-07 16:41:48 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #yogosha5832 - Missin test on permission for /index routes on APIs

Browse Source
This commit is contained in:
Laurent Destailleur
2021-04-08 19:05:28 +02:00
parent 6c84b858ee
commit 667481acd5
18 changed files with 81 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/commande/class/api_orders.class.php
View File

@@ -158,6 +158,10 @@ class Orders extends DolibarrApi
{
global $db, $conf;
if (!DolibarrApiAccess::$user->rights->commande->lire) {
throw new RestException(401);
}
$obj_ret = array();
// case of external user, $thirdparty_ids param is ignored and replaced by user's socid