vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix GHSA-vpmc-jjmw-vhww

Browse source
This commit is contained in:
Laurent Destailleur 2026-03-26 02:55:18 +01:00
parent 082c0ad43e
commit e719cd3fe6
1 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
htdocs/core/ajax/updateextrafield.php
View file

@ -37,16 +37,9 @@ if (!defined('NOREQUIREAJAX')) {
if (!defined('NOREQUIRESOC')) {
define('NOREQUIRESOC', '1');
}
if (!defined('NOCSRFCHECK')) {
define('NOCSRFCHECK', '1');
}
if (!defined('NOREQUIREHTML')) {
define('NOREQUIREHTML', '1');
}
// Load Dolibarr environment
include '../../main.inc.php';
/**
* @var Conf $conf
* @var DoliDB $db
@ -56,7 +49,7 @@ include '../../main.inc.php';
* @var User $user
*/
$objectType = GETPOST('objectType', 'aZ09');
$objectType = GETPOST('objectType', 'aZ09'); // modulepart
$objectId = GETPOST('objectId', 'aZ09');
$field = GETPOST('field', 'aZ09');
$value = GETPOST('value', 'alpha');
@ -70,11 +63,24 @@ if (is_numeric($objectId)) {
$objectId = 0;
}
$object = fetchObjectByElement($objectId, $objectType, $element_ref);
if (empty($object->element)) {
httponly_accessforbidden('Failed to get object with fetchObjectByElement(id=' . $objectId . ', objecttype=' . $objectType . ')');
}
$module = $object->module;
$element = $object->element;
// Security check
if (!$user->hasRight($module, $object->element, 'write') && !$user->hasRight($module, 'write')) {
accessforbidden();
$usesublevelpermission = ($module != $element ? $element : '');
if ($usesublevelpermission && !$user->hasRight($module, $element, 'write') && !$user->hasRight($module, 'write')) { // There is no permission on object defined, we will check permission on module directly
$usesublevelpermission = '';
}
// print $object->id.' - '.$object->module.' - '.$object->element.' - '.$object->table_element.' - '.$usesublevelpermission."\n";
restrictedArea($user, $object->module, $object, $object->table_element, $usesublevelpermission);
/*
* View