From 7cb3e6f78090a1c8b5c74a80f1efcf9199f9b35c Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 18 Apr 2012 01:01:46 +0200 Subject: [PATCH] Fix: Restore broken feature --- htdocs/document.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/htdocs/document.php b/htdocs/document.php index d4a91010466..6c8c7c59c7f 100644 --- a/htdocs/document.php +++ b/htdocs/document.php @@ -54,7 +54,7 @@ $action=GETPOST('action','alpha'); $original_file=GETPOST('file','alpha'); // Do not use urldecode here ($_GET are already decoded by PHP). $modulepart=GETPOST('modulepart','alpha'); $urlsource=GETPOST('urlsource','alpha'); -$entity=GETPOST('entity','int'); +$entity=GETPOST('entity')?GETPOST('entity','int'):$conf->entity; // Security check if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart'); @@ -440,6 +440,7 @@ if ($modulepart) } } + // Basic protection (against external users only) if ($user->societe_id > 0) {