vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Restrict some field in api create/update of member for secure purpose -

Browse source 
reported by vulncheck
This commit is contained in:
Laurent Destailleur 2026-08-14 20:00:37 +02:00
parent 52d83c89d6
commit fbf476cc5d
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
htdocs/adherents/class/api_members.class.php
View file

@ -384,6 +384,10 @@ class Members extends DolibarrApi
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
// This properties can't be set/modified with API without permission user->user->creer
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without permission user->user->create");
}
if ($field === 'caller') {
// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
$member->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
@ -427,11 +431,17 @@ class Members extends DolibarrApi
throw new RestException(403, 'Access not allowed for login '.DolibarrApiAccess::$user->login);
}
$sav_user_id = $member->user_id;
foreach ($request_data as $field => $value) {
if (in_array($field, array('pass', 'pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
if (in_array($field, array('user_id') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'creer'))) {
// This properties can't be set/modified with API without permission user->user->creer
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs without the permission user->user->create");
}
if ($field == 'id') {
continue;
}
@ -472,7 +482,9 @@ class Members extends DolibarrApi
// If there is no error, update() returns the number of affected rows
// so if the update is a no op, the return value is zero.
if ($member->update(DolibarrApiAccess::$user) >= 0) {
$nosyncuser = 0;
$nosyncpassword = 1; // Disable password sync. Management of password must be done using the user API only.
if ($member->update(DolibarrApiAccess::$user, 0, $nosyncuser, $nosyncpassword) >= 0) {
return $this->get($id);
} else {
throw new RestException(500, 'Error when updating member: '.$member->error);