From 5f5074b048c9da86c43a5c51d8c5570102fed87c Mon Sep 17 00:00:00 2001 From: Florent Poinsaut <1256948+FlorentPoinsaut@users.noreply.github.com> Date: Sat, 13 Jul 2024 17:28:25 +0200 Subject: [PATCH] FIX #30362 Fix an user with user->rights->projet->lire can see task time from other user on all project (#30363) --- htdocs/projet/tasks/time.php | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/htdocs/projet/tasks/time.php b/htdocs/projet/tasks/time.php index b65dce3385e..f970de8ea0f 100644 --- a/htdocs/projet/tasks/time.php +++ b/htdocs/projet/tasks/time.php @@ -4,11 +4,12 @@ * Copyright (C) 2010-2012 Regis Houssin * Copyright (C) 2011 Juanjo Menent * Copyright (C) 2018 Ferran Marcet - * Copyright (C) 2018 Frédéric France - * Copyright (C) 2019-2021 Christophe Battarel - * Copyright (C) 2023 Gauthier VERDOL + * Copyright (C) 2018 Frédéric France + * Copyright (C) 2019-2021 Christophe Battarel + * Copyright (C) 2023 Gauthier VERDOL * Copyright (C) 2024 MDW * Copyright (C) 2024 Vincent de Grandpré + * Copyright (C) 2024 Solution Libre SAS * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -1599,6 +1600,11 @@ if (($id > 0 || !empty($ref)) || $projectidforalltimes > 0 || $allprojectforuser $sql .= $hookmanager->resPrint; $sql .= " WHERE elementtype = 'task'"; $sql .= " AND p.entity IN (".getEntity('project').")"; + if (!$user->hasRight('projet', 'all', 'lire')) { + // Get list of project id allowed to user (in a string list separated by comma) + $projectsListId = $projectstatic->getProjectsAuthorizedForUser($user, 0, 1); + $sql .= " AND p.rowid IN (".$db->sanitize($projectsListId).")"; // public and assigned to, or restricted to company for external users + } if (empty($projectidforalltimes) && empty($allprojectforuser)) { // Limit on one task $sql .= " AND t.fk_element =".((int) $object->id);