vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix AISLE-2026-0340-0086 Authorization bypass in clonetasks: private

Browse source 
destination project check is inverted - reported by Pavel Kohout
This commit is contained in:
Laurent Destailleur 2026-08-14 16:25:46 +02:00
parent 340a08734b
commit 1730aa5667
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/core/actions_massactions.inc.php
View file

@ -1946,7 +1946,7 @@ if (!$error && ($massaction == 'clonetasks' || ($action == 'clonetasks' && $conf
if (empty($newproject->public)) {
$tmps = $newproject->getProjectsAuthorizedForUser($user, 0, 1, 0, '(fk_statut:=:1)'); // We check only open project (cloning on closed is not allowed)
$tmparray = explode(',', $tmps);
if (!in_array($newproject->id, $tmparray)) {
if (in_array($newproject->id, $tmparray)) {
$iscontactofnewproject = 1;
}
}