Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix permission on delete token

Browse Source
This commit is contained in:
Laurent Destailleur 2024-08-31 19:26:46 +02:00
parent 827c3daa03
commit 815352e8f9
9 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/core/modules/oauth/generic_oauthcallback.php
View File

@ -156,7 +156,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken($genericstring);
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

3
htdocs/core/modules/oauth/github_oauthcallback.php
View File

@ -107,7 +107,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken('GitHub');
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

3
htdocs/core/modules/oauth/google_oauthcallback.php
View File

@ -144,7 +144,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken('Google');
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

3
htdocs/core/modules/oauth/microsoft2_oauthcallback.php
View File

@ -130,7 +130,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken($genericstring);
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

3
htdocs/core/modules/oauth/microsoft_oauthcallback.php
View File

@ -130,7 +130,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken($genericstring);
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

4
htdocs/core/modules/oauth/stripelive_oauthcallback.php
View File

@ -110,8 +110,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken('StripeLive');
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

4
htdocs/core/modules/oauth/stripetest_oauthcallback.php
View File

@ -110,8 +110,8 @@ if (!getDolGlobalString($keyforparamsecret)) {
* Actions
*/
if ($action == 'delete') {
if ($action == 'delete' && (!empty($user->admin) || $user->id == GETPOSTINT('userid'))) {
$storage->userid = GETPOSTINT('userid');
$storage->clearToken('StripeTest');
setEventMessages($langs->trans('TokenDeleted'), null, 'mesgs');

5
htdocs/includes/OAuth/Common/Storage/DoliStorage.php
View File

@ -65,6 +65,8 @@ class DoliStorage implements TokenStorageInterface
public $date_creation;
public $date_modification;
public $userid; // ID of user for user specific OAuth entries
/**
* @param DoliDB $db Database handler
@ -226,6 +228,9 @@ class DoliStorage implements TokenStorageInterface
$sql = "DELETE FROM ".MAIN_DB_PREFIX."oauth_token";
$sql .= " WHERE service = '".$this->db->escape($servicepluskeyforprovider)."'";
$sql .= " AND entity IN (".getEntity('oauth_token').")";
if (!empty($this->userid)) {
$sql .= " AND fk_user = ".((int) $this->userid);
}
$resql = $this->db->query($sql);
//}

1
test/phpunit/CodingPhpTest.php
View File

@ -653,6 +653,7 @@ class CodingPhpTest extends CommonClassTest
&& !preg_match('/\$permto/', $val[0])
&& !preg_match('/\$usercan/', $val[0])
&& !preg_match('/\$canedit/', $val[0])
&& !preg_match('/\$user->admin/', $val[0])
&& !preg_match('/already done/i', $val[0])
&& !preg_match('/not required/i', $val[0])) {
$ok = false;