From 4cf305ebb958eeffa921aad7c94de179b764f7e7 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 16 Aug 2026 06:29:55 +0200 Subject: [PATCH] Fix prevent edit by external users - reported by VulnCheck --- htdocs/societe/class/api_thirdparties.class.php | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/htdocs/societe/class/api_thirdparties.class.php b/htdocs/societe/class/api_thirdparties.class.php index 27dd0ecab87..b73131b2871 100644 --- a/htdocs/societe/class/api_thirdparties.class.php +++ b/htdocs/societe/class/api_thirdparties.class.php @@ -2401,6 +2401,10 @@ class Thirdparties extends DolibarrApi throw new RestException(403); } + if (!DolibarrApi::_checkAccessToResource('societe', $id)) { + throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login); + } + $sql = "SELECT rowid, fk_user_creat, date_creation FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'"; $result = $this->db->query($sql); @@ -2499,6 +2503,10 @@ class Thirdparties extends DolibarrApi throw new RestException(403); } + if (!DolibarrApi::_checkAccessToResource('societe', $id)) { + throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login); + } + $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'"; $result = $this->db->query($sql); @@ -2563,6 +2571,10 @@ class Thirdparties extends DolibarrApi throw new RestException(403); } + if (!DolibarrApi::_checkAccessToResource('societe', $id)) { + throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login); + } + $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."societe_account WHERE fk_soc = ".((int) $id)." AND site = '".$this->db->escape($site)."'"; $result = $this->db->query($sql);