vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix report by Bhuvaneswaran R, Security Engineer. Bad permission test on

Browse source 
delete links
This commit is contained in:
Laurent Destailleur 2026-06-22 02:29:53 +02:00
parent 65a0d0e36e
commit 05268dca37
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
htdocs/api/class/api_objectlinks.class.php
View file

@ -219,10 +219,10 @@ class ObjectLinks extends DolibarrApi
if ($this->objectlink->targettype == 'conferenceorboothattendee') {
$tgttype = 'projet';
}
if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'read')) {
if (!DolibarrApiAccess::$user->hasRight(((string) $srctype), 'creer') && !DolibarrApiAccess::$user->hasRight(((string) $srctype), 'write')) {
throw new RestException(403, 'denied access to the objectlinks sourcetype');
}
if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'lire') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'read')) {
if (!DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'creer') && !DolibarrApiAccess::$user->hasRight(((string) $tgttype), 'write')) {
throw new RestException(403, 'denied access to the objectlinks targettype');
}
} else {