From c85d0e840725a3c1a2f49b3e97766469c3cb02b6 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 18 Aug 2026 12:45:00 +0200 Subject: [PATCH] Fix add guard on salary field permission when module salary is - reported by vulncheck --- htdocs/user/class/api_users.class.php | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/htdocs/user/class/api_users.class.php b/htdocs/user/class/api_users.class.php index 78b6e02d943..34f638424f7 100644 --- a/htdocs/user/class/api_users.class.php +++ b/htdocs/user/class/api_users.class.php @@ -373,7 +373,7 @@ class Users extends DolibarrApi //assign field values foreach ($request_data as $field => $value) { - if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) { + if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key', 'openid'))) { // This properties can't be set/modified with API throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs"); } @@ -384,6 +384,14 @@ class Users extends DolibarrApi } } */ + $canreadsalary = ((isModEnabled('salaries') && DolibarrApiAccess::$user->hasRight('salaries', 'read')) || !isModEnabled('salaries')); + if (!$canreadsalary) { + if (in_array($field, array('salary', 'salaryextra', 'thm', 'tjm'))) { + // This properties can't be set/modified with API + throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs with permission on salaries"); + } + } + if ($field === 'caller') { // Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller $this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09'); @@ -455,10 +463,19 @@ class Users extends DolibarrApi } foreach ($request_data as $field => $value) { - if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) { + if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key', 'openid'))) { // This properties can't be set/modified with API throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs"); } + + $canreadsalary = ((isModEnabled('salaries') && DolibarrApiAccess::$user->hasRight('salaries', 'read')) || !isModEnabled('salaries')); + if (!$canreadsalary) { + if (in_array($field, array('salary', 'salaryextra', 'thm', 'tjm'))) { + // This properties can't be set/modified with API + throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs with permission on salaries"); + } + } + if ($field == 'id') { continue; }