vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX: enforce document upload access checks (#39125)

Browse source 
* FIX: enforce document upload access checks

* Update ChangeLog for version 24.0.0

---------

Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
This commit is contained in:
minimexat 2026-07-13 16:13:51 +02:00 committed by GitHub
parent 6f0bc87209
commit 1f217c564c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
htdocs/api/class/api_documents.class.php
View file

@ -1124,6 +1124,9 @@ class Documents extends DolibarrApi
$relativefile = $tmpreldir.dol_sanitizeFileName((string) $object->ref);
}
$tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, $ref, 'write');
if (empty($tmp['accessallowed'])) {
throw new RestException(403, 'Access not allowed to upload file into this directory');
}
$upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir
/*} else {
if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) {
@ -1147,6 +1150,9 @@ class Documents extends DolibarrApi
if ($modulepart != 'ecm') {
$relativefile = $subdir;
$tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, '', 'write');
if (empty($tmp['accessallowed'])) {
throw new RestException(403, 'Access not allowed to upload file into this directory');
}
$upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir
} else {
if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) {