diff --git a/htdocs/core/ajax/objectonoff.php b/htdocs/core/ajax/objectonoff.php
index 6b06cccd50c..987a59ec3fb 100644
--- a/htdocs/core/ajax/objectonoff.php
+++ b/htdocs/core/ajax/objectonoff.php
@@ -15,8 +15,9 @@
  */
 
 /**
- *       \file       htdocs/core/ajax/productonoff.php
- *       \brief      File to set tosell and tobuy for product
+ *       \file       htdocs/core/ajax/objectonoff.php
+ *       \brief      File to set status for an object
+ *       			 This Ajax service is called when option MAIN_DIRECT_STATUS_UPDATE is set.
  */
 
 if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL', '1'); // Disables token renewal
@@ -36,6 +37,13 @@ $field=GETPOST('field', 'alpha');
 $element=GETPOST('element', 'alpha');
 
 $object = new GenericObject($db);
+
+// Security check
+if (! empty($user->societe_id))
+	$socid = $user->societe_id;
+
+
+
 /*
  * View
  */
@@ -44,6 +52,20 @@ top_httphead();
 
 print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";
 
+if ($element == 'societe' && in_array($field, array('status')))
+{
+	$result = restrictedArea($user, 'societe', $id);
+}
+elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch')))
+{
+	$result = restrictedArea($user, 'produit|service', $id, 'product&product', '', '', 'rowid');
+}
+else
+{
+	accessforbidden("Bad value for combination of parameters element/field.", 0, 0, 1);
+	exit;
+}
+
 // Registering new values
 if (($action == 'set') && ! empty($id))
     $object->setValueFrom($field, $value, $element, $id);
diff --git a/htdocs/core/ajax/security.php b/htdocs/core/ajax/security.php
index 9e7dea2ef95..faaddd31b23 100644
--- a/htdocs/core/ajax/security.php
+++ b/htdocs/core/ajax/security.php
@@ -17,7 +17,7 @@
 
 /**
  *       \file       htdocs/core/ajax/security.php
- *       \brief      This ajax component is used to generated has keys for security purposes
+ *       \brief      This ajax component is used to generated hash keys for security purposes
  *                   like key to use into URL to protect them.
  */
 
diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php
index a96e63a4f43..43f4723d695 100644
--- a/htdocs/core/lib/ajax.lib.php
+++ b/htdocs/core/lib/ajax.lib.php
@@ -538,11 +538,12 @@ function ajax_constantonoff($code, $input = array(), $entity = null, $revertonof
 }
 
 /**
- *  On/off button for object
+ *  On/off button to change status of an object
+ *  This is called when MAIN_DIRECT_STATUS_UPDATE is set and it use tha ajax service objectonoff.php
  *
  *  @param  Object  $object     Object to set
  *  @param  string  $code       Name of constant : status or status_buy for product by example
- *  @param  string  $field      Name of database field : tosell or tobuy for product by example
+ *  @param  string  $field      Name of database field : 'tosell' or 'tobuy' for product by example
  *  @param  string  $text_on    Text if on
  *  @param  string  $text_off   Text if off
  *  @param  array   $input      Array of type->list of CSS element to switch. Example: array('disabled'=>array(0=>'cssid'))