FIX When salary module is not enabled, bad permission check on user list

Dolibarr · May 22, 2023 · 42bebf3 · 42bebf3
1 parent 55ca2ab
commit 42bebf3
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/htdocs/user/card.php b/htdocs/user/card.php
@@ -97,6 +97,9 @@
 
 $acceptlocallinktomedia = (acceptLocalLinktoMedia() > 0 ? 1 : 0);
 
+if ($id > 0) {
+	$res = $object->fetch($id, '', '', 1);
+}
 
 // Security check
 $socid = 0;

diff --git a/htdocs/user/hierarchy.php b/htdocs/user/hierarchy.php
@@ -70,7 +70,7 @@
 $canadduser = (!empty($user->admin) || $user->hasRight("user", "user", "write"));
 
 // Permission to list
-if ($contextpage == 'employeelist' && $search_employee == 1) {
+if (isModEnabled('salaries') && $contextpage == 'employeelist' && $search_employee == 1) {
 	if (!$user->hasRight("salaries", "read")) {
 		accessforbidden();
 	}

diff --git a/htdocs/user/list.php b/htdocs/user/list.php
@@ -203,7 +203,7 @@
 $error = 0;
 
 // Permission to list
-if ($contextpage == 'employeelist' && $search_employee == 1) {
+if (isModEnabled('salaries') && $contextpage == 'employeelist' && $search_employee == 1) {
 	if (!$user->hasRight("salaries", "read")) {
 		accessforbidden();
 	}
@@ -478,7 +478,7 @@
 if ($search_warehouse > 0) {
 	$sql .= " AND u.fk_warehouse = ".((int) $search_warehouse);
 }
-if ($contextpage == 'employeelist' && !$user->hasRight("salaries", "readall")) {
+if (isModEnabled('salaries') && $contextpage == 'employeelist' && !$user->hasRight("salaries", "readall")) {
 	$sql .= " AND u.rowid IN (".$db->sanitize(join(',', $childids)).")";
 }
 // Add where from extra fields