vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch '24.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse source
This commit is contained in:
Laurent Destailleur 2026-08-14 20:09:12 +02:00
commit 78a9b01b38
4 changed files with 34 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
htdocs/adherents/class/api_members.class.php
View file

@ -380,6 +380,14 @@ class Members extends DolibarrApi
$member = new Adherent($this->db);
foreach ($request_data as $field => $value) {
if (in_array($field, array('pass', 'pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
// This properties can't be set/modified with API without permission user->user->creer
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without permission user->user->create");
}
if ($field === 'caller') {
// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
$member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
@ -423,7 +431,17 @@ class Members extends DolibarrApi
throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
}
$sav_user_id = $member->user_id;
foreach ($request_data as $field => $value) {
if (in_array($field, array('pass', 'pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
// This properties can't be set/modified with API without permission user->user->creer
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without the permission user->user->create");
}
if ($field == 'id') {
continue;
}
@ -464,7 +482,9 @@ class Members extends DolibarrApi
// If there is no error, update() returns the number of affected rows
// so if the update is a no op, the return value is zero.
if ($member->update(DolibarrApiAccess::$user) >= 0) {
$nosyncuser = 0;
$nosyncpassword = 1; // Disable password sync. Management of password must be done using the user API only.
if ($member->update(DolibarrApiAccess::$user, 0, $nosyncuser, $nosyncpassword) >= 0) {
return $this->get($id);
} else {
throw new RestException(500, 'Error when updating member: '.$member->error);
@ -565,6 +585,9 @@ class Members extends DolibarrApi
unset($object->fk_delivery_address);
unset($object->shipping_method_id);
unset($object->pass);
unset($object->pass_crypted);
unset($object->total_ht);
unset($object->total_ttc);
unset($object->total_tva);

2
htdocs/core/actions_massactions.inc.php
View file

@ -1946,7 +1946,7 @@ if (!$error && ($massaction == 'clonetasks' || ($action == 'clonetasks' && $conf
if (empty($newproject->public)) {
$tmps = $newproject->getProjectsAuthorizedForUser($user, 0, 1, 0, '(fk_statut:=:1)'); // We check only open project (cloning on closed is not allowed)
$tmparray = explode(',', $tmps);
if (!in_array($newproject->id, $tmparray)) {
if (in_array($newproject->id, $tmparray)) {
$iscontactofnewproject = 1;
}
}

2
htdocs/core/lib/ticket.lib.php
View file

@ -218,7 +218,7 @@ function showDirectPublicLink($object)
$email = CMailFile::getValidAddress($object->origin_email, 2);
$url = '';
if ($email) {
$url = getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', dol_buildpath('/public/ticket/', 3)).'view.php?track_id='.$object->track_id.'&email='.$email;
$url = getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', dol_buildpath('/public/ticket/', 3)).'view.php?track_id='.urlencode($object->track_id).'&email='.urlencode($email);
}
$out = '';

8
htdocs/user/bank.php
View file

@ -99,6 +99,14 @@ if (!$bankid) {
$account->fetch(0, '', $id);
} else {
$account->fetch($bankid);
if ($account->id > 0) {
if ((int) $account->userid !== (int) $object->id) {
accessforbidden();
}
if ((int) $account->entity !== (int) $conf->entity) {
accessforbidden();
}
}
}
if (empty($account->userid)) {
$account->userid = $object->id;