vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX: Require delete permission for email templates API (#39134)

Browse source 
Co-authored-by: f-hoedl <hoefla14@htl-kaindorf.ac.at>
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
This commit is contained in:
minimexat 2026-07-13 14:59:15 +02:00 committed by GitHub
parent bd9e8a55e8
commit c95e337c40
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ChangeLog
View file

@ -177,7 +177,6 @@ For developers:
NEW: Use another hash algorithm v2 based on sha256/hmac for immutable logs (#37725)
NEW: Replace MyObject MyModule occurrences (#38370)
NEW: ModuleBuilder - Allow selecting which optional tabs (contact, note, document, agenda) are generated for an object (#38570)
FIX: ModuleBuilder - Generated list page derives the email trackid from the object name instead of the leftover 'xxxx' placeholder (#32460)
NEW: add hooks in reception card (#37214)
NEW: add new hook in BonPrelevement::EnregDestinataireSEPA() function (#37419)
NEW: Add hook selectForFormsListUrl in Form::selectForForms (#37447)

8
htdocs/api/class/api_emailtemplates.class.php
View file

@ -87,9 +87,9 @@ class EmailTemplates extends DolibarrApi
*/
public function deleteById($id)
{
$allowaccess = $this->_checkAccessRights('lire');
$allowaccess = $this->_checkAccessRights('supprimer');
if (!$allowaccess) {
throw new RestException(403, 'denied read access to email templates');
throw new RestException(403, 'denied delete access to email templates');
}
$result = $this->email_template->apifetch($id, '');
@ -125,9 +125,9 @@ class EmailTemplates extends DolibarrApi
*/
public function deleteByLabel($label)
{
$allowaccess = $this->_checkAccessRights('lire');
$allowaccess = $this->_checkAccessRights('supprimer');
if (!$allowaccess) {
throw new RestException(403, 'denied read access to email templates');
throw new RestException(403, 'denied delete access to email templates');
}
$result = $this->email_template->apifetch(0, $label);