From 5ffdb271dc8b8ac35e57d8adbc28ae8d5ff0d0d9 Mon Sep 17 00:00:00 2001 From: Zakaria Boushaba <48571684+Boushabazakaria@users.noreply.github.com> Date: Tue, 9 Jun 2026 00:43:48 +0100 Subject: [PATCH] FIX reception/note.php and contact.php: wrong object passed to restrictedArea causing random access denied (#38604) Co-authored-by: Zakaria Boushaba --- htdocs/reception/contact.php | 6 +++--- htdocs/reception/note.php | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/htdocs/reception/contact.php b/htdocs/reception/contact.php index b6036509429..d2b778d0264 100644 --- a/htdocs/reception/contact.php +++ b/htdocs/reception/contact.php @@ -83,11 +83,11 @@ if ($user->socid > 0) { // TODO Test on reception module on only $result = -1; -if ($origin == 'reception') { - $result = restrictedArea($user, $origin, $object->id); +if (isModEnabled("reception") || $origin == 'reception' || empty($origin)) { + $result = restrictedArea($user, 'reception', $object->id); } else { if ($origin == 'supplierorder' || $origin == 'order_supplier') { - $result = restrictedArea($user, 'fournisseur', $object, 'commande_fournisseur', 'commande'); + $result = restrictedArea($user, 'fournisseur', $object->origin_id, 'commande_fournisseur', 'commande'); } elseif (!$user->hasRight($origin, 'lire') && !$user->hasRight($origin, 'read')) { accessforbidden(); } diff --git a/htdocs/reception/note.php b/htdocs/reception/note.php index 28eaf661adf..c0ca7df6f24 100644 --- a/htdocs/reception/note.php +++ b/htdocs/reception/note.php @@ -97,11 +97,11 @@ if (isModEnabled("reception")) { $permissionnote = $user->hasRight('reception', 'creer'); // Used by the include of actions_setnotes.inc.php // TODO Test on reception module on only -if ($origin == 'reception') { - $result = restrictedArea($user, $origin, $object->id); +if (isModEnabled("reception") || $origin == 'reception' || empty($origin)) { + $result = restrictedArea($user, 'reception', $object->id); } else { if ($origin == 'supplierorder' || $origin == 'order_supplier') { - $result = restrictedArea($user, 'fournisseur', $object, 'commande_fournisseur', 'commande'); + $result = restrictedArea($user, 'fournisseur', $object->origin_id, 'commande_fournisseur', 'commande'); } elseif (!$user->hasRight($origin, 'lire') && !$user->hasRight($origin, 'read')) { accessforbidden(); }