vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX reception/note.php and contact.php: wrong object passed to restrictedArea causing random access denied (#38604)

Browse source 
Co-authored-by: Zakaria Boushaba <z.boushaba@vold.africa>
This commit is contained in:
Zakaria Boushaba 2026-06-09 00:43:48 +01:00 committed by GitHub
parent c549b38e56
commit 5ffdb271dc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
htdocs/reception/contact.php
View file

@ -83,11 +83,11 @@ if ($user->socid > 0) {
// TODO Test on reception module on only
$result = -1;
if ($origin == 'reception') {
$result = restrictedArea($user, $origin, $object->id);
if (isModEnabled("reception") || $origin == 'reception' || empty($origin)) {
$result = restrictedArea($user, 'reception', $object->id);
} else {
if ($origin == 'supplierorder' || $origin == 'order_supplier') {
$result = restrictedArea($user, 'fournisseur', $object, 'commande_fournisseur', 'commande');
$result = restrictedArea($user, 'fournisseur', $object->origin_id, 'commande_fournisseur', 'commande');
} elseif (!$user->hasRight($origin, 'lire') && !$user->hasRight($origin, 'read')) {
accessforbidden();
}

6
htdocs/reception/note.php
View file

@ -97,11 +97,11 @@ if (isModEnabled("reception")) {
$permissionnote = $user->hasRight('reception', 'creer'); // Used by the include of actions_setnotes.inc.php
// TODO Test on reception module on only
if ($origin == 'reception') {
$result = restrictedArea($user, $origin, $object->id);
if (isModEnabled("reception") || $origin == 'reception' || empty($origin)) {
$result = restrictedArea($user, 'reception', $object->id);
} else {
if ($origin == 'supplierorder' || $origin == 'order_supplier') {
$result = restrictedArea($user, 'fournisseur', $object, 'commande_fournisseur', 'commande');
$result = restrictedArea($user, 'fournisseur', $object->origin_id, 'commande_fournisseur', 'commande');
} elseif (!$user->hasRight($origin, 'lire') && !$user->hasRight($origin, 'read')) {
accessforbidden();
}