vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix prevent edit by external users - reported by VulnCheck

Browse source
This commit is contained in:
Laurent Destailleur 2026-08-16 06:29:55 +02:00
parent 08527d0e76
commit 4cf305ebb9
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
htdocs/societe/class/api_thirdparties.class.php
View file

@ -2401,6 +2401,10 @@ class Thirdparties extends DolibarrApi
throw new RestException(403);
}
if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
}
$sql = "SELECT rowid, fk_user_creat, date_creation FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'";
$result = $this->db->query($sql);
@ -2499,6 +2503,10 @@ class Thirdparties extends DolibarrApi
throw new RestException(403);
}
if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
}
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'";
$result = $this->db->query($sql);
@ -2563,6 +2571,10 @@ class Thirdparties extends DolibarrApi
throw new RestException(403);
}
if (!DolibarrApi::_checkAccessToResource('societe', $id)) {
throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
}
$sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'";
$result = $this->db->query($sql);