From 01296323d8d669c7585dccf7808a4c5a0405875f Mon Sep 17 00:00:00 2001
From: yannis <yannishoareau26@gmail.com>
Date: Wed, 25 Jun 2025 15:08:29 +0200
Subject: [PATCH] feat: enabling all perms will not enable unallowed global
 perms

---
 htdocs/user/api_token/card.php | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/htdocs/user/api_token/card.php b/htdocs/user/api_token/card.php
index dcf3664332b..4648b170bc3 100644
--- a/htdocs/user/api_token/card.php
+++ b/htdocs/user/api_token/card.php
@@ -104,7 +104,7 @@ if (empty($reshook)) {
 	if (in_array($action, array('addrights', 'delrights'))) {
 		$rigthsarray = [];
 
-		if ($rights != '') {
+		if (!empty($rights)) {
 			$sql = "SELECT module, perms, subperms";
 			$sql .= " FROM ".$db->prefix()."rights_def";
 			$sql .= " WHERE id = ".((int) $rights);
@@ -146,13 +146,24 @@ if (empty($reshook)) {
 			while ($obj = $db->fetch_object($resql)) {
 				$rigthsarray []= $obj->id;
 			}
-		} elseif ($module != '') {
+		} elseif (!empty($module)) {
 			$sql = "SELECT id";
 			$sql .= " FROM ".MAIN_DB_PREFIX."rights_def";
 			$sql .= " WHERE entity IN (".$db->sanitize($token->entity, 0, 0, 0, 0).")";
 			if ($module != 'allmodules') {
 				$sql .= " AND (module='".$db->escape($module)."')";
 			}
+			// To enable only all perms in a module that a user has to avoid better perms in token
+			$sql .= " AND id IN (";
+			$sql .= " SELECT ur.fk_id";
+			$sql .= " FROM llx_user_rights as ur";
+			$sql .= " WHERE ur.entity = ".$token->entity;
+			$sql .= " AND ur.fk_user = ".$id;
+			$sql .= " UNION";
+			$sql .= " SELECT gr.fk_id";
+			$sql .= " FROM llx_usergroup_rights as gr";
+			$sql .= " WHERE EXISTS(SELECT gu.rowid FROM llx_usergroup_user as gu WHERE gu.fk_user = ".$id;
+			$sql .= " AND gu.fk_usergroup = gr.fk_usergroup))";
 			$resql = $db->query($sql);
 			while ($obj = $db->fetch_object($resql)) {
 				$rigthsarray []= $obj->id;
@@ -160,7 +171,12 @@ if (empty($reshook)) {
 		}
 	}
 	if ($action == 'addrights' && $caneditperms && $confirm == 'yes') {
-		$tokenrigthsarray = explode(',', $token->rights);
+		$tokenrigthsarray = [];
+
+		if (!empty($token->rights)) {
+			$tokenrigthsarray = explode(',', $token->rights);
+		}
+
 		if (isset($rigthsarray)) {
 			$tokenrigthsarray = array_merge($tokenrigthsarray, $rigthsarray);
 		} else {