Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-06 01:28:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX event for restricted user was restricted if company null

Browse Source
This commit is contained in:
Alexis Algoud
2015-05-21 11:49:10 +02:00
parent 439b416daf
commit bc672c2c23
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/core/lib/security.lib.php
View File

@@ -446,15 +446,15 @@ function restrictedArea($user, $features, $objectid=0, $dbtablename='', $feature
else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir)) else if (! empty($conf->societe->enabled) && ($user->rights->societe->lire && ! $user->rights->societe->client->voir))
{ {
if (empty($dbt_keyfield)) dol_print_error('','Param dbt_keyfield is required but not defined'); if (empty($dbt_keyfield)) dol_print_error('','Param dbt_keyfield is required but not defined');
$sql = "SELECT sc.fk_soc";
$sql = "SELECT dbt.id";
$sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt"; $sql.= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
$sql.= ", ".MAIN_DB_PREFIX."societe as s"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe as s ON (dbt.".$dbt_keyfield." = s.rowid)";
$sql.= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc"; $sql.= " LEFT JOIN ".MAIN_DB_PREFIX."societe_commerciaux as sc ON (sc.fk_soc = dbt.".$dbt_keyfield.")";
$sql.= " WHERE dbt.".$dbt_select." = ".$objectid; $sql.= " WHERE dbt.".$dbt_select." = ".$objectid;
$sql.= " AND sc.fk_soc = dbt.".$dbt_keyfield; $sql.= " AND ((s.entity IN (".getEntity($sharedelement, 1).")";
$sql.= " AND dbt.".$dbt_keyfield." = s.rowid"; $sql.= " AND sc.fk_user = ".$user->id." ) OR dbt.fk_soc IS NULL)";
$sql.= " AND s.entity IN (".getEntity($sharedelement, 1).")";
$sql.= " AND sc.fk_user = ".$user->id;
} }
// If multicompany and internal users with all permissions, check user is in correct entity // If multicompany and internal users with all permissions, check user is in correct entity
else if (! empty($conf->multicompany->enabled)) else if (! empty($conf->multicompany->enabled))