mirror of
https://github.com/Dolibarr/dolibarr.git
synced 2026-03-14 06:16:54 +01:00
2e02df9002
External users (fk_soc set) were blocked from opening agenda events
because GETPOSTINT('socid') returns 0 when no socid param is in the URL
(ActionComm::getNomUrl() only generates ?id=XXXXX).
The condition 0 != $user->socid then triggers accessforbidden() for
every external user.
Fix: fall back to $user->socid when socid is not in the URL, consistent
with the pattern used in all other card pages (contracts, invoices,
orders, etc.).
The existing restrictedArea() check still validates that the event's
fk_soc matches the user's company, so security is preserved.
Fixes #37361
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>