From 1730aa56675b31cfede895fdae55b673d887fb8f Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 14 Aug 2026 16:25:46 +0200 Subject: [PATCH] Fix AISLE-2026-0340-0086 Authorization bypass in clonetasks: private destination project check is inverted - reported by Pavel Kohout --- htdocs/core/actions_massactions.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/actions_massactions.inc.php b/htdocs/core/actions_massactions.inc.php index 797b2c77fd4..684698af331 100644 --- a/htdocs/core/actions_massactions.inc.php +++ b/htdocs/core/actions_massactions.inc.php @@ -1946,7 +1946,7 @@ if (!$error && ($massaction == 'clonetasks' || ($action == 'clonetasks' && $conf if (empty($newproject->public)) { $tmps = $newproject->getProjectsAuthorizedForUser($user, 0, 1, 0, '(fk_statut:=:1)'); // We check only open project (cloning on closed is not allowed) $tmparray = explode(',', $tmps); - if (!in_array($newproject->id, $tmparray)) { + if (in_array($newproject->id, $tmparray)) { $iscontactofnewproject = 1; } }