vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix #35103 require confirm='yes' before deleting in confirm_delete (#38687)

Browse source 
The shared confirm_delete branch at htdocs/core/actions_addupdatedelete.inc.php:468
fired on action=confirm_delete with permission, but never checked the
$confirm value. Every other confirm_* branch in the same file checks
$confirm == 'yes'. As a result, a card.php using the standard
$form->formconfirm() flow without the ajax handler would delete the
object when the user clicks 'No' on the confirmation dialog.

Align with the rest of the file by requiring $confirm == 'yes'.

Signed-off-by: Dolicraft <contact@dolicraft.com>
Co-authored-by: Dolicraft <contact@dolicraft.com>
This commit is contained in:
w3houde 2026-06-11 09:31:41 +02:00 committed by GitHub
parent bc3c96401e
commit 3424914d8b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/core/actions_addupdatedelete.inc.php
View file

@ -465,7 +465,7 @@ if ($action == "update_extras" && GETPOSTINT('id') > 0 && !empty($permissiontoed
}
// Action to delete
if ($action == 'confirm_delete' && !empty($permissiontodelete)) {
if ($action == 'confirm_delete' && $confirm == 'yes' && !empty($permissiontodelete)) {
if (!($object->id > 0)) {
dol_print_error(null, 'Error, object must be fetched before being deleted');
exit;