[Dolibarr-bugtrack] [Bug #1833] user permissions in contact/note.php not working

[Doliforge]

Is this email not displaying correctly? update email preferences.

Dolibarr ERP & CRM » Bugs » bug #1833

user permissions in contact/note.php not working

Latest modifications

braito (braito)

2015-02-17 18:05 (Europe/Madrid)

I Find the problem
In this area (third Party Costumer) the permmissions are: $result = restrictedArea($user, 'contact', $id, 'socpeople&societe');
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/list.php#L40
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/card.php#L74

but in note is this:
$result = restrictedArea($user, 'societe', $id, '&societe');
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/note.php#L39

Just a paste from here:
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/societe/note.php

I'm going to corrected in github

Answer now

Snapshot

Details
Submitted by:	braito (braito)		Submitted on:	2015-02-10 10:12
Last Modified On:	2015-02-17 13:18
Summary:	user permissions in contact/note.php not working
Description:	If you try to add a note to a contact (thirdparty contact) you are not able to access to that module.
Step to reproduce bug:
Detected in version:	3.6.0		Category:	Module: Thirdparties
Severity:	3		OS Type/Version:
PHP version:			Database type and version:
Status
Status:	Need more info		Assigned to:	None
Resolution:	Works for me

Comments

braito 2015-02-17 18:05

I Find the problem
In this area (third Party Costumer) the permmissions are: $result = restrictedArea($user, 'contact', $id, 'socpeople&societe');
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/list.php#L40
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/card.php#L74

but in note is this:
$result = restrictedArea($user, 'societe', $id, '&societe');
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/contact/note.php#L39

Just a paste from here:
https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/societe/note.php

I'm going to corrected in github

braito 2015-02-17 13:18

Hello again.

I change:
if ($user->societe_id) $id=$user->societe_id;
$result = restrictedArea($user, 'societe', $id, '&societe');
For this:
if ($user->societe_id > 0)
accessforbidden();

And works.

braito 2015-02-17 13:05

Hi Marcos.

I tried to reproduce the problem in the demo page and it works.
But, in my own 3.7 doesn't.
I'm using a database created in 3.5; and the problem could be that the permissions in the migration were lost.
I'm using a admin account, and i'm still having the same error: Access denied. In the user's page where I've to allow the different access it is everything on.

Marcos García 2015-02-16 23:33

There is not enough information to qualify this bug. This is
often missing information:
- What action fail (which screen, menu or button) ?
- What is the error message/behaviour or no way to reproduce the
problem with informations provided ?
- How can we reproduce problem.

So the bug is classified as "Works For Me".

 Direct link to the artifact  |  Update your email preferences