From 1f217c564c779ca46e2cc06e4ffc59e03211894f Mon Sep 17 00:00:00 2001 From: minimexat Date: Mon, 13 Jul 2026 16:13:51 +0200 Subject: [PATCH] FIX: enforce document upload access checks (#39125) * FIX: enforce document upload access checks * Update ChangeLog for version 24.0.0 --------- Co-authored-by: f-hoedl Co-authored-by: Laurent Destailleur --- htdocs/api/class/api_documents.class.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/htdocs/api/class/api_documents.class.php b/htdocs/api/class/api_documents.class.php index 7192376b44c..fdb736a3b42 100644 --- a/htdocs/api/class/api_documents.class.php +++ b/htdocs/api/class/api_documents.class.php @@ -1124,6 +1124,9 @@ class Documents extends DolibarrApi $relativefile = $tmpreldir.dol_sanitizeFileName((string) $object->ref); } $tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, $ref, 'write'); + if (empty($tmp['accessallowed'])) { + throw new RestException(403, 'Access not allowed to upload file into this directory'); + } $upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir /*} else { if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) { @@ -1147,6 +1150,9 @@ class Documents extends DolibarrApi if ($modulepart != 'ecm') { $relativefile = $subdir; $tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, '', 'write'); + if (empty($tmp['accessallowed'])) { + throw new RestException(403, 'Access not allowed to upload file into this directory'); + } $upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir } else { if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) {