Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix permission for salaries module

Browse Source
This commit is contained in:
lmarcouiller 2021-09-08 15:36:51 +02:00
parent 0b68da4e9e
commit a5e670291e
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/security.lib.php
View File

@ -611,7 +611,7 @@ function checkUserAccessToObject($user, array $featuresarray, $objectid = 0, $ta
$feature = 'projet_task';
}
$check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salary', 'website'); // Test on entity only (Objects with no link to company)
$check = array('adherent', 'banque', 'bom', 'don', 'mrp', 'user', 'usergroup', 'payment', 'payment_supplier', 'product', 'produit', 'service', 'produit|service', 'categorie', 'resource', 'expensereport', 'holiday', 'salaries', 'website'); // Test on entity only (Objects with no link to company)
$checksoc = array('societe'); // Test for societe object
$checkother = array('contact', 'agenda'); // Test on entity + link to third party on field $dbt_keyfield. Allowed if link is empty (Ex: contacts...).
$checkproject = array('projet', 'project'); // Test for project object

18
htdocs/salaries/card.php
View File

@ -67,9 +67,27 @@ $fk_user = GETPOSTINT('userid');
$object = new Salary($db);
$extrafields = new ExtraFields($db);
$childids = $user->getAllChildIds(1);
// fetch optionals attributes and labels
$extrafields->fetch_name_optionals_label($object->table_element);
if (($id > 0) || $ref) {
$object->fetch($id, $ref);
// Check current user can read this leave request
$canread = 0;
if (!empty($user->rights->salaries->readall)) {
$canread = 1;
}
if (!empty($user->rights->salaries->read) && in_array($object->fk_user, $childids)) {
$canread = 1;
}
if (!$canread) {
accessforbidden();
}
}
// Initialize technical object to manage hooks of page. Note that conf->hooks_modules contains array of hook context
$hookmanager->initHooks(array('salarycard', 'globalcard'));